PART IGENERAL

Citation and commencement

1.—(1) These Regulations may be cited as the Telecommunications (Data Protection and Privacy) Regulations 1999.

(2) These Regulations shall come into force–

(a)for the purposes of regulation 3(2), on 16th August 1999;

(b)for all other purposes, on 1st March 2000.

Interpretation

2.—(1) In these Regulations–

“the Act of 1984” means the Telecommunications Act 1984(3);

“bill” includes an invoice, account, statement or other instrument of the like character and “billing” shall be construed accordingly;

“corporate subscriber” means a subscriber who is not an individual, that is to say a subscriber who is–

“the Data Protection Commissioner” and “the Commissioner” both mean the Commissioner appointed under section 6 of the Data Protection Act 1998(5);

“the Directive” means Directive 97/66/EC of the European Parliament and of the Council of the European Union(6);

“the Director” means the Director General of Telecommunications appointed under section 1 of the Act of 1984;

“individual” means a living individual and includes an unincorporated body of such individuals;

“public telecommunications network” means any transmission system, and any associated switching equipment and other resources, which (in either case)–

“relevant telecommunications network”, in relation to a telecommunications service provider, means a public telecommunications network which is used by that service provider for the provision of publicly available telecommunications services;

“relevant telecommunications service provider” means–

“subscriber” means a person who is a party to a contract with a telecommunications service provider for the supply of publicly available telecommunications services;

“telecommunications network provider” means a person who provides a public telecommunications network (whether or not he is also a telecommunications service provider);

“telecommunications service provider” means a person who provides publicly available telecommunications services (whether or not he is also a telecommunications network provider);

“telecommunications services” means services the provision of which consists, in whole or in part, of the transmission and routing of signals on telecommunications networks, not being services by way of radio or television broadcasting;

“user” means an individual using a publicly available telecommunications service (whether or not he is a subscriber).

(2) Section 1 of the Data Protection Act 1998 (basic interpretative provisions) shall have effect for the purposes of these Regulations as it has effect for the purposes of that Act.

(3) Subject to paragraphs (1) and (2) and except where the context otherwise requires, expressions used in these Regulations which are also used in the Directive have the same meanings in these Regulations as they have in the Directive.

(4) In a case in which signals are conveyed to telecommunications equipment used by a subscriber wholly or partly otherwise than by line, any reference in these Regulations to a line shall be construed as including a reference to what, in that case, functionally corresponds to a line and “connected”, in relation to a line, shall be construed accordingly.

Revocation and amendment of provisions and modification of contracts

3.—(1) The Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998(7) are hereby revoked.

(2) Until the coming into force of paragraph (1) on 1st March 2000 and the revocation thereby of the said Regulations of 1998, those Regulations shall have effect subject to the amendment set out in Part I of Schedule 1.

(3) The amendments set out in Part II of Schedule 1 shall have effect.

(4) To the extent that any term in a contract between–

(a)a subscriber to, and the provider of, publicly available telecommunications services, or

(b)such a provider and a telecommunications network provider,

would be inconsistent with a requirement of these Regulations, that term shall be void.

Requirements of Regulations

4.  Notwithstanding that the requirements of these Regulations are requirements imposed by law, where a person is required to provide, or ensure the provision of, a facility he may make a reasonable charge in respect thereof save insofar as is otherwise provided in regulations 11(2) and (3), 12(2) and (3), 18(1), 19(1) and 31.

Consents, notices, notifications and requests for purposes of Regulations

5.—(1) Except where the context otherwise requires, a consent, notice or notification for the purposes of these Regulations may be in general or more limited terms and may be subject to conditions.

(2) A consent, notice, notification or request for the purposes of these Regulations may (without prejudice to any other method of transmission) be sent by post.

PART IITRAFFIC AND BILLING DATA

Limitation on processing certain traffic data

6.—(1) This regulation relates to data which–

(a)are in respect of traffic handled by a telecommunications network provider or a telecommunications service provider;

(b)are processed to secure the connection of a call and held by the provider concerned; and

(c)constitute personal data whereof the data subject is a subscriber to, or user of, any publicly available telecommunications service or, in the case of a corporate subscriber, would constitute such personal data if that subscriber were an individual.

(2) Upon the termination of the call in question, save as provided in regulations 7(2) and 8(2), such data as are mentioned in paragraph (1) shall be erased or shall be so dealt with that they cease to be such data as are mentioned in paragraph (1)(c).

Limitation on processing certain billing data

7.—(1) This regulation relates to the processing of any such data as are mentioned in Schedule 2 and are held by a telecommunications network provider or a telecommunications service provider for purposes connected with the payment of sums falling to be paid–

(a)by a subscriber, or

(b)by way of interconnection charges.

(2) Such data as are mentioned in paragraph (1) of that regulation, such data as are mentioned in paragraph (1) of this regulation may, and may only, be processed for the purposes there mentioned until the expiry of the period during which legal proceedings may be brought in respect of the payments due, or alleged to be due, or where such proceedings are brought within that period, until those proceedings are finally determined and, for the purposes hereof, the proceedings shall not be taken to be finally determined–

(a)until the end of the ordinary time for an appeal by either party, if no appeal proceedings are brought within that time, or

(b)if any such proceedings are so brought, until the conclusion of the appeal proceedings.

(3) References in paragraph (2) to appeal proceedings include references to an application for leave to appeal.

Processing of billing data for certain marketing purposes by a telecommunications service provider

8.—(1) This regulation relates to the processing of such data as are mentioned in Schedule 2 which–

(a)are held by a telecommunications service provider, and

(b)constitute personal data whereof the data subject is a subscriber to that service or, in the case of a corporate subscriber, would constitute such data if that subscriber were an individual.

(2) Such data as are mentioned in paragraph (1) of that regulation, such data as are mentioned in paragraph (1) of this regulation may be processed by the telecommunications service provider concerned for the purposes of marketing telecommunications services which he provides if, but only if, the subscriber concerned has given his consent.

Further provisions relating to the processing of traffic and billing data

9.—(1) This regulation relates to the processing by either a telecommunications network provider or a telecommunications service provider (“the relevant person”) of data to which regulation 6, 7 or 8 relates.

(2) The processing of such data as are mentioned in paragraph (1) shall, without prejudice to any other restriction contained in this Part, be restricted to what is necessary for the purposes of such an activity as is mentioned in paragraph (3) or for the purposes of regulation 6(2) and (unless the relevant person is an individual and the processing is carried out by him personally) processing for such purposes shall only be carried out by a person–

(a)acting under the authority of the relevant person, and

(b)whose activities under that authority include such an activity as is mentioned in paragraph (3).

(3) The activities referred to in paragraph (2) are activities relating to–

(a)the management of billing or traffic;

(b)customer enquiries;

(c)the prevention or detection of fraud, and

(d)the marketing of any telecommunications services provided by the relevant person.

Savings relating to the settling of disputes

10.  Nothing in this Part shall preclude the furnishing of billing or traffic data to a person who is a competent authority for the purposes of any provision relating to the settling of disputes (by way of legal proceedings or otherwise) which is contained in, or made by virtue of, any enactment.

PART IIICALLING OR CONNECTED LINE IDENTIFICATION

Prevention of calling line identification—outgoing calls

11.—(1) This regulation relates to outgoing calls on a line.

(2) The relevant telecommunications service provider shall ensure that a user originating a call has, subject to regulations 13 and 14, as respects that call, a simple means to prevent, without charge, presentation of the identity of the calling line on the connected line.

(3) The relevant telecommunications service provider shall ensure that a subscriber has, subject to regulations 13 and 14, as respects his line and all calls originating therefrom, a simple means to prevent, without charge, presentation of the identity of his line on any connected line.

Prevention of calling or connected line identification—incoming calls

12.—(1) This regulation relates to incoming calls on a line.

(2) Where presentation on the connected line of the identity of the calling line is available, the relevant telecommunications service provider shall ensure that the called subscriber has a simple means to prevent, without charge for reasonable use of the facility, presentation of the identity of a calling line on the connected line.

(3) Where presentation on the calling line of the identity of the connected line is available, the relevant telecommunications service provider shall ensure that a called subscriber has a simple means to prevent, without charge, presentation of the identity of the connected line on any calling line.

(4) Where presentation on the connected line of the identity of the calling line, before the establishment of a call, is available, the relevant telecommunications service provider shall ensure that the called subscriber has, as respects all or particular calls in the case of which such presentation has been prevented as mentioned in regulation 11(2) or (3), a simple means to reject the calls in question.

(5) In this regulation “called subscriber” means the subscriber whose line is the called line (whether or not it is also the connected line).

999 or 112 calls

13.—(1) This regulation relates to calls to the emergency services made using either the national emergency call number 999 or the single European emergency call number 112 (“999 or 112 calls”).

(2) In order to facilitate responses to such calls–

(a)all 999 or 112 calls shall be excluded from the calls referred to in regulation 11, and

(b)in relation to 999 or 112 calls, no person shall be entitled to prevent the presentation on the connected line of the identity of the calling line.

Tracing of malicious or nuisance calls

14.—(1) This regulation shall apply where the relevant telecommunications service provider has been notified by a subscriber that he requests the tracing of malicious or nuisance calls received on his line.

(2) Until such time as action in pursuance of such a request has ceased, the relevant telecommunications service provider or the provider of a relevant telecommunications network, where the subscriber has made application in that behalf, may–

(a)in relation to calls in relation to which the subscriber’s line is the called line, and

(b)so far as it appears to the provider in question necessary or expedient for the purposes of such action,

override anything done to prevent the presentation of the identity of the calling line.

(3) Any term of a contract for the provision of telecommunications services which relates to such prevention shall have effect subject to the provisions of paragraph (2).

(4) In relation to such calls as are mentioned in paragraph (2)(a), nothing in these Regulations shall preclude the relevant telecommunications service provider, or a provider of a relevant telecommunications network, from holding and making available to a person with a legitimate interest therein, data containing the identification of a calling subscriber which were obtained while paragraph (2) applied.

Facilities for calling or connected line identification to be publicised

15.  A telecommunications service provider who offers facilities for calling or connected line identification shall take all reasonable steps to publicise that he does so and of the effect of this Part in relation thereto.

Supplementary provisions

16.—(1) Any other telecommunications service provider and any telecommunications network provider shall comply with any reasonable requests made by a relevant telecommunications service provider for the purposes of regulation 11, 12 or 14.

(2) Where a subscriber has two or more lines, regulations 11 and 12 shall, in his case, have effect separately as respects each line as if that line were his only line.

PART IVDIRECTORIES OF SUBSCRIBERS

Application and interpretation of Part IV

17.—(1) This Part shall apply in relation to a directory of subscribers to publicly available telecommunications services, whether in printed form or in electronic form–

(a)which is made available to the public or a section of the public, or

(b)information from which is provided by a directory enquiry service.

(2) In this Part any reference to a directory is a reference to such a directory as is mentioned in paragraph (1), “production” in relation to a directory means its publication or preparation and cognate expressions shall be construed accordingly.

(3) Such a request as is mentioned in paragraph (3) of regulation 18 or paragraph (2) of regulation 19 shall be treated for the purposes of the regulation in question as having no application in relation to an edition of a directory which was first produced before the request was received by the producer of the directory; and, for the purposes hereof, an edition of a directory which is revised after it was first produced shall be treated as a new edition.

Entries relating to individuals

18.—(1) This regulation applies in relation to a directory which includes entries which relate to subscribers who are individuals, and any person who produces such a directory shall, without charge to any such subscriber, ensure that it complies with this regulation.

(2) Except to the extent, if any, to which the subscriber in question has consented otherwise, such a directory shall not contain any personal data whereof the data subject is a subscriber who is an individual other than data which are necessary to identify him and the number allocated to him.

(3) Without prejudice to paragraph (2), where a subscriber who is an individual has so requested the producer of such a directory then, in his case–

(a)no entry relating to a number specified in the request shall be included in that directory;

(b)no entry therein shall contain a reference which reveals his sex; and

(c)no such entry shall contain such part of his address as is so specified.

(4) Where, in connection with the production of a directory, information relating to a particular subscriber is supplied to the producer thereof by some other person–

(a)where the other person has in his possession such a request by that subscriber as is mentioned in paragraph (3) (to whomsoever made) or a copy or record of such a request, he shall, without undue delay, transmit a copy of that request or a copy of that record to the producer of the directory, and

(b)subject to receipt by the producer of the directory of a copy of a request or of a record thereof so transmitted, the request in question shall be treated for the purposes of paragraph (3) as if it had been made to that producer.

Entries relating to corporate subscribers

19.—(1) This regulation applies in relation to a directory which includes entries which relate to corporate subscribers and any person who produces such a directory shall, without charge to any such subscriber, ensure that it complies with this regulation.

(2) Where a corporate subscriber has so requested the producer of such a directory, then, in its case, no entry relating to a number specified in the request shall be included in that directory.

(3) Paragraph (4) of regulation 18 shall have effect for the purposes of this regulation as if any reference therein to paragraph (3) of that regulation were a reference to paragraph (2) of this regulation.

Supplementary provisions relating to directory enquiry services

20.  Where a person directs an enquiry relating to a particular subscriber to a directory enquiry service but there is either no entry relating to that subscriber, or no entry relating to his number, in a directory used by that service, nothing in this Part shall be taken to preclude the person in question being told the reason, or possible reason, why there is no such entry, in particular, that, in pursuance of a request made by the subscriber for the purposes of regulation 18(3), regulation 18(3)(a) applies or, in the case of a corporate subscriber, in pursuance of a request made by it for the purposes of regulation 19(2), that provision applies.

PART VUSE OF TELECOMMUNICATIONS SERVICES FOR DIRECT MARKETING PURPOSES

Application and interpretation of Part V

21.—(1) This Part shall apply in relation to the use of publicly available telecommunications services for direct marketing purposes.

(2) Any reference in this Part to direct marketing is a reference to the communication of any advertising or marketing material on a particular line.

(3) In this Part, “caller” means a person using publicly available telecommunications services for direct marketing purposes, except that where such services are so used at the instigation of some other person “caller” means that other person.

(4) In regulations 26(3) and 27(5) and (6), “directory of subscribers” means a directory of subscribers to publicly available telecommunications services, whether in printed form or in electronic form, which is made available to the public or a section of the public and, in relation to such a directory, “producer” means the person by whom the directory is published or prepared.

Use of automated calling systems for direct marketing purposes—communications on lines of individual or corporate subscribers

22.—(1) This regulation applies in relation to the use of publicly available telecommunications services by means of an automated calling system (that is to say, a system which, when activated, operates to make calls without human intervention) for the communication of material for direct marketing purposes, whether the called line is that of a subscriber who is an individual or that of a corporate subscriber.

(2) A person shall not use, or instigate the use of, publicly available telecommunications services, and a subscriber to such services shall not permit his line to be used, as mentioned in paragraph (1), except where the called line is that of a subscriber who has previously notified the caller that for the time being he consents to such communications as are there mentioned being sent by, or at the instigation of, the caller in question on that line.

Use of fax for direct marketing purposes—unsolicited communications on lines of individual or corporate subscribers

23.—(1) This regulation applies in relation to the use of publicly available telecommunications services for the unsolicited communication of material, for direct marketing purposes, by means of facsimile transmission, whether the called line is that of a subscriber who is an individual or that of a corporate subscriber; and, in a case in which an automated calling system within the meaning of regulation 22(1) is used, the provisions of this regulation and those of regulation 22 are without prejudice to each other.

(2) A person shall not use, or instigate the use of, publicly available telecommunications services, and a subscriber to such services shall not permit his line to be used, as mentioned in paragraph (1) where–

(a)the called line is that of a subscriber who has previously notified the caller (notwithstanding, in the case of a subscriber who is an individual, that he enjoys the benefit of regulation 24) that such unsolicited communications as are so mentioned should not be sent on that line, or

(b)the number allocated to a subscriber in respect of the called line is one listed in the record kept under paragraph (4).

(3) For the purposes of paragraphs (1) and (2), the communication of material as mentioned in paragraph (1) shall not be treated as unsolicited where the called line is that of a subscriber who has notified the caller that he does not for the time being object to such communications as are so mentioned being sent by, or at the instigation of, the caller in question on that line.

(4) For the purposes of this regulation–

(a)the Director shall maintain and keep up-to-date, in printed form or in electronic form, a record of the numbers allocated to subscribers, in respect of particular lines, who have notified him (notwithstanding, in the case of individuals, that they enjoy the benefit of regulation 24) that they do not for the time being wish to receive such communications as are mentioned in paragraph (1) on the lines in question, and he shall remove a number from the record where he has reason to believe that it has ceased to be allocated to the subscriber by whom he was so notified, and

(b)on the request of–

(i)a person wishing to send, or instigate the sending of, such communications, or

(ii)a subscriber wishing to permit the use of his line for the sending of such communications,

for information derived from that record, the Director shall, unless it is not reasonably practicable so to do, on the payment to him of such fee as is applicable and is, subject to paragraph (5), required by him, make the information requested available to that person or that subscriber.

(5) For the purposes of paragraph (4)(b) the Director may require different fees–

(a)for making available information derived from the record in different forms or manners, or

(b)for making available information derived from the whole or from different parts of the record,

but the fees required by him shall be ones in relation to which the Secretary of State has notified the Director that he is satisfied that they are designed to secure, as nearly as may be and taking one year with another, that the aggregate fees received, or reasonably expected to be received, equal the costs incurred, or reasonably expected to be incurred, by the Director, in discharging his duties under paragraph (4).

(6) The functions of the Director under paragraph (4), other than the function of determining the fees to be required for the purposes of sub-paragraph (b) thereof, may be discharged on his behalf by some other person in pursuance of arrangements in that behalf made by the Director with that other person.

Use of fax for direct marketing purposes—communications on lines of subscribers who are individuals

24.—(1) This regulation applies in relation to the use of publicly available telecommunications services for the communication of material, for direct marketing purposes, by means of facsimile transmission where the called line is that of a subscriber who is an individual; and–

(a)the provisions of this regulation and those of regulation 23 are without prejudice to each other, and

(b)in a case in which an automated calling system within the meaning of regulation 22(1) is used, the provisions of this regulation and those of regulation 22 are without prejudice to each other.

(2) A person shall not use, or instigate the use of, publicly available telecommunications services, and a subscriber to such services shall not permit his line to be used, as mentioned in paragraph (1), except where the called line is that of a subscriber who has previously notified the caller that he consents for the time being to such communications as are there mentioned being sent by, or at the instigation of, the caller in question on that line.

Unsolicited calls for direct marketing purposes on lines of subscribers who are individuals

25.—(1) This regulation applies in relation to the use of publicly available telecommunications services for the purposes of making unsolicited calls, for direct marketing purposes, otherwise than in a case in which the material communicated is communicated by means of facsimile transmission, where the called line is that of a subscriber who is an individual; and, in a case in which an automated calling system within the meaning of regulation 22(1) is used, the provisions of this regulation and those of regulation 22 are without prejudice to each other.

(2) A person shall not use, or instigate the use of, publicly available telecommunications services, and a subscriber to such services shall not permit his line to be used, as mentioned in paragraph (1) where–

(a)the called line is that of a subscriber who has previously notified the caller that such unsolicited calls as are there mentioned should not for the time being be made on that line, or

(b)the number allocated to a subscriber in respect of the called line is one listed in the record kept under paragraph (4).

(3) For the purposes of paragraphs (1) and (2), a call on a subscriber’s line shall not be treated as an unsolicited call if that subscriber has notified the caller that he does not object to calls being made by, or at the instigation of, the caller in question for direct marketing purposes on that line.

(4) For the purposes of this regulation–

(a)the Director shall maintain and keep up-to-date, in printed form or in electronic form, a record of the numbers allocated to subscribers who are individuals, in respect of particular lines, who have notified him that they do not for the time being wish to receive unsolicited calls made for direct marketing purposes on the lines in question, and he shall remove a number from the record where he has reason to believe that it has ceased to be allocated to the subscriber by whom he was so notified, and

(b)on the request of–

(i)a person wishing to make, or instigate the making of, such calls, or

(ii)a subscriber wishing to permit the use of his line for the making of such calls,

for information derived from that record, the Director shall, unless it is not reasonably practicable so to do, on the payment to him of such fee as is applicable and is, subject to paragraph (5), required by him, make the information requested available to that person or that subscriber.

(5) For the purposes of paragraph (4)(b) the Director may require different fees–

(a)for making available information derived from the record in different forms or manners, or

(b)for making available information derived from the whole or from different parts of the record,

but the fees required by him shall be ones in relation to which the Secretary of State has notified the Director that he is satisfied that they are designed to secure, as nearly as may be and taking one year with another, that the aggregate fees received, or reasonably expected to be received, equal the costs incurred, or reasonably expected to be incurred, by the Director in discharging his duties under paragraph (4).

(6) The functions of the Director under paragraph (4), other than the function of determining the fees to be required for the purposes of sub-paragraph (b) thereof, may be discharged on his behalf by some other person in pursuance of arrangements in that behalf made by the Director with that other person.

Notifications for the purposes of regulation 23(4)(a) or 25(4)(a)

26.—(1) Where any such person as is mentioned in paragraph (3) has in his possession such a notification as is mentioned in regulation 23(4)(a) or regulation 25(4)(a) (to whomsoever it is addressed) or a copy or record of such a notification–

(a)he shall, without undue delay, transmit a copy of that notification or a copy of that record to the Director, and

(b)subject to receipt by the Director of a copy of a notification or of a record thereof so transmitted, the notification in question shall be treated for the purposes of regulation 23(4)(a) or, as the case may be, regulation 25(4)(a) as if it had been given to the Director.

(2) Where the Director has made arrangements in pursuance of paragraph (6) of regulation 23 or, as the case may be, paragraph (6) of regulation 25 for the discharge of functions under paragraph (4) of the regulation in question by some other person on his behalf, paragraph (1) of this regulation shall have effect, in relation to such a notification as is mentioned in paragraph (4)(a) of the regulation in question, as if for the reference to the Director in sub-paragraph (a) and the first reference to him in sub-paragraph (b) there were substituted references to that other person.

(3) The persons referred to in paragraph (1) are–

(a)a telecommunications service provider;

(b)the producer of a directory of subscribers; and

(c)where, in connection with the production of such a directory, information relating to a particular subscriber is supplied to the producer thereof by some other person, that other person.

Supplementary provisions

27.—(1) Where publicly available telecommunications services are used for the communication of material for direct marketing purposes–

(a)in a case in which an automated calling system within the meaning of regulation 22(1) is used or the material is communicated by means of facsimile transmission, the caller shall ensure that the material communicated includes the particulars mentioned in paragraph (2)(a) and (b) below;

(b)otherwise than as mentioned in sub-paragraph (a), the caller shall ensure that the material communicated includes the particulars mentioned in paragraph (2)(a) below and, if the recipient of the call so requests, those mentioned in paragraph (2)(b) below.

(2) The particulars referred to in paragraph (1) are–

(a)the name of the caller;

(b)either the address of the caller or a freephone telephone number on which he can be reached.

(3) Where a person by whom numbers are allocated to subscribers is requested by or on behalf of the Director, for the purposes of his functions under regulation 23(4) or 25(4), to furnish information as to when a particular number ceases to be allocated to a particular subscriber, that person shall comply with the request.

(4) A caller shall not be held to have contravened regulation 23 or regulation 25 by reason of the making, or instigating the making, of a call and a subscriber shall not be held to have contravened regulation 23 or regulation 25 by permitting his line to be used for the making of a call, by reason only that the number of the called line is one listed in the record kept under paragraph (4) of the regulation in question, if that number was not so listed at any time within the 28 days preceding that on which the call is made.

(5) Subject to paragraph (6), the producer of a directory of subscribers shall ensure that it contains a statement drawing attention to the provisions of regulations 22, 23, 24, and 25.

(6) Nothing in paragraph (5) shall apply in relation to a directory of subscribers which is comprised in an edition first published before the coming into force of these Regulations; and, for the purposes hereof, an edition of a directory which is revised after it was first published shall be treated as a new edition.

PART VIMISCELLANEOUS PROVISIONS

Security of telecommunications services

28.—(1) Subject to paragraph (2), a telecommunications service provider shall take technical and organisational measures which are appropriate to secure the security of the service he provides.

(2) If necessary, the measures required by paragraph (1) shall be taken by a telecommunications service provider in conjunction with the provider of the relevant telecommunications network who shall comply with any reasonable requests made by the service provider for the purposes hereof.

(3) Where, notwithstanding the taking of measures required hereby, there is a significant risk to the security of the relevant telecommunications network, the telecommunications service provider shall inform the subscribers concerned of–

(a)that risk;

(b)any measures appropriate to afford safeguards against that risk which they themselves might take, and

(c)the costs involved in the taking of such measures.

(4) For the purposes of this regulation, measures shall only be taken to be appropriate if, having regard to–

(a)the state of technological development, and

(b)the cost of implementing the measures,

they are proportionate to the risks against which they would afford safeguards.

(5) For the purposes of this regulation the security of a public telecommunications service or network shall not be taken to be at risk by reason of the intentional disclosure, or possibility of such disclosure, of any matter falling within subsection (1)(a) or (b) of section 45 of the Act of 1984(8) by a telecommunications service or network provider in a case or circumstances in which he would not be guilty of an offence under that section which, for the purposes of this paragraph, shall have effect as if–

(a)the reference in subsection (1) thereof to a person engaged in the running of a public telecommunications system were a reference to such a provider;

(b)for the words “that system”, in both places where they occur in subsection (1)(a) and (b) thereof, there were substituted the words “a public telecommunications system”; and

(c)the reference in subsection (1)(a) thereof to a message were a reference to a communication.

Right to bills which are not itemised

29.  At the request of the subscriber concerned, a telecommunications service provider shall only submit to him bills which are not itemised.

Itemised billing and privacy

30.—(1) The Secretary of State and the Director shall each have a duty, when exercising any function assigned to him by a provision of the Act of 1984 specified in paragraph (2), to have regard to the need to reconcile the rights of subscribers receiving itemised bills with the rights to privacy of calling users and called subscribers, for example by ensuring that sufficient alternative means for the making of calls or methods of paying therefor are available to such users and subscribers.

(2) For the purposes of paragraph (1), the specified provisions of the Act of 1984 are sections 7, 8, 12, 13, 15, 16, 17, 18, 47, 48, 49, and 50.

Termination of unwanted automatic call forwarding

31.  Where calls originally directed to another line are being automatically forwarded to a subscriber’s line as a result of action taken by a third party and the subscriber so requests the relevant telecommunications service provider (“the subscriber’s provider”), that provider shall ensure, without charge, that such forwarding ceases without any avoidable delay, and any other telecommunications service provider and any telecommunications network provider shall comply with any reasonable requests made by the subscriber’s provider for the purposes of this regulation.

National security

32.—(1) Nothing in any of the provisions of these Regulations shall require a telecommunications service or network provider to do, or refrain from doing, anything (including the processing of data) if exemption from the requirement in question is required for the purpose of safeguarding national security.

(2) Subject to paragraph (4), a certificate signed by a Minister of the Crown certifying that exemption from any requirement of these Regulations is or at any time was required for the purpose of safeguarding national security shall be conclusive evidence of that fact.

(3) A certificate under paragraph (2) may identify the circumstances in which it applies by means of a general description and may be expressed to have prospective effect.

(4) Any person directly affected by the issuing of a certificate under paragraph (2) may appeal to the Tribunal against the certificate.

(5) If on an appeal under paragraph (4), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may allow the appeal and quash the certificate.

(6) Where in any proceedings under or by virtue of these Regulations it is claimed by a telecommunications service or network provider that a certificate under paragraph (2) which identifies the circumstances in which it applies by means of a general description applies in the circumstances in question, any other party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply in those circumstances and, subject to any determination under paragraph (7), the certificate shall be conclusively presumed so to apply.

(7) On any appeal under paragraph (6), the Tribunal may determine that the certificate does not so apply.

(8) In this regulation “the Tribunal” means the Data Protection Tribunal referred to in section 6 of the Data Protection Act 1998 and–

(a)subsections (8), (9), (10) and (12) of section 28 of that Act and Schedule 6 thereto shall apply for the purposes of, and in connection with, this regulation as if any references therein to sub-section (2), (4) or (6) of the said section 28 were, respectively, references to paragraph (2), (4) or (6) of this regulation and

(b)section 58 of that Act shall so apply as if the reference therein to the functions of the Tribunal under that Act included a reference to the functions of the Tribunal under paragraphs (4) to (7) of this regulation.

Legal requirements, law enforcement etc

33.  Nothing in any of the provisions of these Regulations shall require a telecommunications service or network provider to do, or refrain from doing, anything (including the processing of data)–

(a)if compliance with the requirement in question–

(i)would be inconsistent with any requirement imposed by or under any enactment, by any rule of law or by the order of a court, or

(ii)would be likely to prejudice the prevention or detection of crime or the apprehension or prosecution of offenders; or

(b)if exemption from the requirement in question–

(i)is required for the purposes of, or in connection with, any legal proceedings (including prospective legal proceedings),

(ii)is necessary for the purposes of obtaining legal advice, or

(iii)is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

Transitory and transitional provisions

34.  The provisions in Schedule 3 shall have effect.

PART VIICOMPENSATION AND ENFORCEMENT

Compensation for failure to comply with requirements of Regulations

35.—(1) A person who suffers damage by reason of any contravention of any of the requirements of these Regulations by any other person shall be entitled to compensation from the other person for that damage.

(2) In proceedings brought against a person by virtue of this regulation it shall be a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.

Enforcement—extension of Part V of the Data Protection Act 1998

36.—(1) The provisions of Part V of the Data Protection Act 1998 and of Schedules 6 and 9 thereto are hereby extended for the purposes of these Regulations and, for those purposes, shall have effect subject to the omissions and other modifications set out in Schedule 4.

(2) In regulations 37 and 38, “enforcement functions” means the functions of the Data Protection Commissioner under the provisions referred to in paragraph (1) as extended thereby.

(3) The provisions of this regulation and those of regulation 35 are without prejudice to each other.

Request that Commissioner exercise his enforcement functions

37.  Where it is alleged that there has been contravention of any of the requirements of these Regulations either the Director or a person aggrieved by the alleged contravention may request the Commissioner to exercise his enforcement functions in respect of that contravention, but those functions shall be exercisable by him whether or not he has been so requested.

Technical advice to Commissioner

38.  The Director shall comply with any reasonable request made by the Commissioner, in connection with his enforcement functions, for advice on technical and similar matters relating to telecommunications.

Regulation 3(2) and (3)

SCHEDULE 1AMENDMENTS

PART IAMENDMENT OF THE TELECOMMUNICATIONS (DATA PROTECTION AND PRIVACY) (DIRECT MARKETING) REGULATIONS 1998

At the end of regulation 10 of the Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998(9) (notifications for purposes of regulation 7(4)(a) or 9(4)(a) thereof) there shall be added the two following paragraphs:–

“(5) Where the number, in respect of a particular line, allocated to a subscriber who is an individual was, immediately before 1st May 1999, included in the list of numbers mentioned in paragraph (6), then, for the purposes of regulation 9(4)(a), that subscriber shall, as respects that line, be deemed to have notified the Director as mentioned therein, and that notification may be withdrawn by him as though it were a notification actually given.

(6) The list referred to in paragraph (5) is the list kept before 1st May 1999 by the Direct Marketing Association (UK) Ltd for the purposes of the extra-statutory scheme then operated by it which was known as “the Telephone Preference Scheme.”.”

PART IIINCIDENTAL AND CONSEQUENTIAL AMENDMENTS

The Telecommunications Act 1984

1.  In section 1(6) of the Act of 1984(10) (payment out of money provided by Parliament) for the words following “by any of his staff” there shall be substituted the following words–

• “in consequence of the provisions of–

  (a)

  this Act;

  (b)

  the Telecommunications (Open Network Provision) (Voice Telephony) Regulations 1998; or

  (c)

  the Telecommunications (Data Protection and Privacy) Regulations 1999.”.

2.  At the end of section 7(5)(a) of the Act of 1984 (power to license systems) there shall be added the words “or by regulation 30 of the Telecommunications (Data Protection and Privacy) Regulations 1999.”.

The Data Protection Act 1998

3.  In section 11 of the Data Protection Act 1998 (right to prevent processing for purposes of direct marketing), after subsection (2) there shall be inserted the following subsection–

“(2A) This section shall not apply in relation to the processing of such data as are mentioned in paragraph (1) of regulation 8 of the Telecommunications (Data Protection and Privacy) Regulations 1999 (processing of telecommunications billing data for certain marketing purposes) for the purposes mentioned in paragraph (2) of that regulation.”.

The Telecommunications (Open Network Provision) (Voice Telephony) Regulations 1998

4.  In regulation 2(1) of the Telecommunications (Open Network Provision) (Voice Telephony) Regulations 1998(11) (interpretation), for the definitions of “Data Protection Registrar” and of “relevant data protection legislation” there shall be substituted, respectively, the following definitions–

““Data Protection Commissioner” means the Commissioner appointed under section 6 of the Data Protection Act 1998;”;

““relevant data protection legislation” means the Data Protection Act 1998, the instruments from time to time in force thereunder and the Telecommunications (Data Protection and Privacy) Regulations 1999;”.

5.  In regulation 10 of the said Regulations (directory services—systemless providers), both in paragraph (8)(a) and in paragraph (9), for the words “Data Protection Registrar” there shall be substituted the words “Data Protection Commissioner” and at the end of the said regulation there shall be added the following paragraph–

“(10) For the purposes of paragraphs (8)(a) and (9) above, anything done before the commencement of section 6(1) of the Data Protection Act 1998 by the Data Protection Registrar appointed under section 3 of the Data Protection Act 1984 shall be treated as if it had been done by the Data Protection Commissioner.”.

6.  In regulation 21(6)(b)(iii) of the said Regulations (conditions of access and use and essential requirements), for the words “imposed only in accordance” there shall be substituted the word “compatible”.

Regulations 7(1) and 8(1)

SCHEDULE 2DATA REFERRED TO IN REGULATIONS 7 AND 8

1.  The data referred to in regulations 7(1) and 8(1) are data which constitute personal data whereof the data subject is a subscriber to, or user of, any publicly available telecommunications service or, in the case of a corporate subscriber, would constitute such data if that subscriber were an individual, and which comprise information in respect of all or any of the following matters, namely–

(a)the number or other identification of the subscriber’s station;

(b)the subscriber’s address and the type of the station;

(c)the total number of units of use by reference to which the sum payable in respect of an accounting period is calculated;

(d)the type, starting time and duration of calls and the volume of data transmissions in respect of which sums are payable by the subscriber and the numbers or other identification of the stations to which they were made;

(e)the date of the provision of any service not falling within sub-paragraph (d); and

(f)other matters concerning payments including, in particular, advance payments, payments by instalments, reminders and disconnections.

2.  The reference in paragraph 1(c) to an accounting period is, in relation to sums of any description payable to a telecommunications network provider or a telecommunications service provider, a reference to a period in respect of which the relevant person normally sends out bills for sums of that description payable to him.

Regulation 34

SCHEDULE 3TRANSITORY AND TRANSITIONAL PROVISIONS

Provisions relating to regulation 8

1.—(1) For the purposes of this paragraph, such data as are mentioned in paragraph (1) of regulation 8 are eligible data at any time if, and to the extent that, they are at that time subject to processing which was already under way immediately before 1st March 2000 being processing by a telecommunications service provider for the purposes of marketing telecommunications services provided by him (“the existing processing”).

(2) This paragraph shall apply where the telecommunications service provider concerned has given a subscriber written notice of the existing processing and of the effect of this paragraph (“a notified subscriber”).

(3) Subject as hereinafter provided, for the purposes of regulation 8(2) in relation to the continued processing of eligible data which constitute personal data whereof the data subject is a notified subscriber, or, in the case of a notified corporate subscriber, would constitute such data if that subscriber were an individual, the notified subscriber shall be deemed to have given his consent.

(4) If, within 2 months of a notified subscriber having been given the notice referred to in sub-paragraph (2), he expresses his dissent by written notice given to the telecommunications service provider concerned, then, in the case of that subscriber, the provider concerned shall cease, as soon as is reasonably practicable, the continued processing of eligible data in pursuance of sub-paragraph (3).

(5) Without prejudice to sub-paragraph (4), where a notified subscriber is deemed to have given his consent for the purposes of regulation 7(2), that consent may be withdrawn by him as though it were a consent actually given.

Provision relating to Part IV

2.  Part IV shall not apply in relation to such a directory as is mentioned in regulation 17(1) which is comprised in an edition first published before 1st March 2000.

Provisions relating to Part V

3.—(1) Where, immediately before 1st March 2000, the number, in respect of a particular line, allocated to a subscriber who is an individual, was listed in the record kept under regulation 9(4)(a) of the Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998(12) by reason only of regulation 10(5) of those Regulations(13), then, for the purposes of regulation 25(4)(a) of these Regulations, that subscriber shall, as respects that line, be deemed to have notified the Director as mentioned in the said regulation 25(4)(a), and that notification may be withdrawn by him as though it were a notification actually given.

(2) The reference in regulation 27(4) to the record kept under paragraph (4) of the regulation in question, that is to say regulation 23 or 25, shall be construed, in relation to a time before 1st March 2000, as a reference to the record kept under paragraph (4) of the corresponding regulation of the Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998, that is to say regulation 7 or 9 thereof.

(3) The provisions of this paragraph are without prejudice to those of section 17(2) of the Interpretation Act 1978(14).

Provisions relating to enforcement etc

4.—(1) This paragraph shall apply in relation to enforcement notices under section 10 of the Data Protection Act 1984 as applied by regulation 13(1) of the Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998; and nothing in paragraph 7 of Schedule 14 to the Data Protection Act 1998 shall apply in relation to such notices.

(2) If, immediately before 1st March 2000–

(a)such an enforcement notice has effect, and

(b)either the time for appealing against the notice has expired or any appeal has been determined,

then the notice shall have effect for the purposes of sections 41 and 47 of the Data Protection Act 1998 as if it were an enforcement notice under section 40 thereof as extended by regulation 36(1) of these Regulations.

(3) Where such an enforcement notice has been served and, immediately before 1st March 2000–

(a)the time for appealing against the notice has not expired, or

(b)an appeal has not been determined,

any appeal shall be determined in accordance with the provisions of the Data Protection Act 1984 and, unless the notice is quashed on appeal, the notice shall have effect for the purposes of sections 41 and 47 of the Data Protection Act 1998 as if it were an enforcement notice under section 40 thereof as extended as aforesaid.

5.—(1) Part VII of these Regulations shall have effect as if any reference therein to these Regulations included a reference to the Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998.

(2) Sections 40, 41 and 43 of the Data Protection Act 1998, as extended by regulation 36(1) of these Regulations, shall have effect as if any reference therein to these Regulations included a reference to the Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998 and, accordingly, as if any reference therein to a relevant requirement included a reference to a requirement of the said Regulations of 1998.

(3) Schedule 9 to the said Act of 1998, as extended as aforesaid, shall have effect as if any reference therein to these Regulations (including a reference to “the 1999 Regulations”) included a reference to the Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998.

Regulation 36(1)

SCHEDULE 4MODIFICATIONS TO PART V OF THE DATA PROTECTION ACT 1998 AND SCHEDULES 6 AND 9 THERETO AS EXTENDED BY REGULATION 36

1.  In section 40–

(a)in subsection (1), for the words “data controller” there shall be substituted the word “person”, for the words “data protection principles” there shall be substituted the words “requirements of the Telecommunications (Data Protection and Privacy) Regulations 1999 (in this Part referred to as “the relevant requirements”)” and for the words “principle or principles” there shall be substituted the words “requirement or requirements”;

(b)in subsection (2), the words “or distress” shall be omitted;

(c)subsections (3), (4), (5), (9) and (10) shall be omitted; and

(d)in subsection (6)(a), for the words “data protection principle or principles” there shall be substituted the words “relevant requirement or requirements”.

2.  In section 41, for the words “data protection principle or principles”, in both places where they occur, there shall be substituted the words “relevant requirement or requirements”.

3.  Section 42 shall be omitted.

4.  In section 43–

(a)for subsections (1) and (2) there shall be substituted the following provisions–

“(1) If the Commissioner reasonably requires any information for the purpose of determining whether a person has complied or is complying with the relevant requirements, he may serve that person with a notice (in this Act referred to as “an information notice”) requiring him, within such time as is specified in the notice, to furnish the Commissioner, in such form as may be so specified, with such information relating to compliance with the relevant requirements as is so specified.

(2) An information notice must contain a statement that the Commissioner regards the specified information as relevant for the purpose of determining whether the person has complied, or is complying, with the relevant requirements and his reason for regarding it as relevant for that purpose.”;

(b)in subsection (6)(a), after the word “under” there shall be inserted the words “the Telecommunications (Data Protection and Privacy) Regulations 1999 or”;

(c)in subsection (6)(b), after the words “arising out of” there shall be inserted the words “the said Regulations or”; and

(d)subsection (10) shall be omitted.

5.  Sections 44, 45 and 46 shall be omitted.

6.  In section 47(1) and (2), for the words “an information notice or a special information notice”, in both places where they occur, there shall be substituted the words “or an information notice”.

7.  In section 48–

(a)in subsections (1) and (3), for the words “an information notice or a special information notice”, in both places where they occur, there shall be substituted the words “or an information notice”;

(b)in subsection (3) for the words “43(5) or 44(6)” there shall be substituted the words “or 43(5)”; and

(c)subsection (4) shall be omitted.

8.  In section 49, subsection (5) shall be omitted.

9.  In paragraph 4(1) of Schedule 6, for the words “(2) or (4)” there shall be substituted the words “or (2)”.

10.  In paragraph 1 of Schedule 9–

(a)for sub-paragraph (1)(a) there shall be substituted the following provision–

“(a)that a person has contravened or is contravening any of the requirements of the Telecommunications (Data Protection and Privacy) Regulations 1999 (in this Schedule referred to as “the 1999 Regulations”), or”, and

(b)sub-paragraph (2) shall be omitted.

11.  In paragraph 9 of Schedule 9–

(a)in sub-paragraph (1)(a), after the words “rights under” there shall be inserted the words “the 1999 Regulations or”, and

(b)in sub-paragraph (1)(b), after the words “arising out of” there shall be inserted the words “the 1999 Regulations or”.

Explanatory Note

(This note is not part of the Regulations)

These Regulations implement Directive 97/66/EC of the European Parliament and the Council concerning the processing of personal data and privacy in the telecommunications sector.

They revoke the Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998, which have already implemented part of the Directive.

Part II places restrictions upon the processing of data about telecommunications traffic and billing.

Part III provides for subscribers and users to be able to prevent the identity of the caller or, in certain circumstances, the line to which a call is connected from being identified to the other party to the call.

Part IV requires producers of directories to exclude subscribers or to omit details of subscribers' sex or address if so requested.

Part V repeats the provisions about direct marketing contained in the 1998 Regulations.

Part VI contains provisions about the security of telecommunications services, itemised billing and the termination of unwanted call-forwarding, and provisions overriding Parts II and III in the interests of law enforcement and national security.

Part VII provides for compensation and enforcement.

The Regulations come into force on 1st March 2000, the same day as related provisions of the Data Protection Act 1998. An interim amendment to the 1998 Regulations, giving legal effect to the Direct Marketing Association’s non-statutory list of subscribers who do not want to receive direct marketing calls, comes into force on 16th August 1999.

A regulatory impact assessment is available and can be obtained from Communications and Information Industries Directorate, Department of Trade and Industry, 151 Buckingham Palace Road, London, SW1W 9SS. Copies have been placed in the libraries of both Houses of Parliament.