Telecommunications (Security) Act 2021

(105Z18) (1) Where the Secretary of State determines that there are reasonable grounds for believing that a public communications provider is contravening, or has contravened— (a) a requirement imposed by a designated vendor direction, or (b) a requirement under section 105Z7, the Secretary of State may give the provider a notification under this section. (2) A notification under this section is one which— (a) sets out the Secretary of State’s determination; (b) specifies the requirement and contravention in respect of which the determination is made; (c) specifies the period during which the provider has an opportunity to make representations; (d) specifies the steps that the Secretary of State thinks should be taken by the provider in order to— (i) comply with the requirement; (ii) remedy the consequences of the contravention; (e) specifies the penalty which the Secretary of State is minded to impose. (3) A notification under this section may be given in respect of more than one contravention. (4) If a notification under this section relates to more than one contravention, a separate penalty may be specified under subsection (2)(e) in respect of each contravention. (5) If a notification under this section is given in respect of a continuing contravention, it may be given in respect of any period during which the contravention has continued. (6) If a notification under this section relates to a continuing contravention, no more than one penalty may be specified under subsection (2)(e) in respect of the period of contravention specified in the notification. (7) Notwithstanding subsection (6), in relation to a continuing contravention, a penalty may be specified in respect of each day on which the contravention continues after— (a) the giving of a confirmation decision under section 105Z20 which requires immediate action in respect of that contravention (see section 105Z20(6)(a)); or (b) the expiry of any period specified in the confirmation decision for complying with the requirement being contravened. (8) Where a notification under this section has been given to a public communications provider in respect of a contravention of a requirement, the Secretary of State may give a further notification in respect of the same contravention of that requirement if, and only if— (a) the contravention is one occurring after the time of the giving of the earlier notification; (b) the contravention is a continuing contravention and the subsequent notification is in respect of so much of a period as falls after a period to which the earlier notification relates; or (c) the earlier notification has been withdrawn without a penalty having been imposed in respect of the notified contravention. (105Z19) (1) The amount of a penalty that may be specified in a notification under section 105Z18 is such amount as the Secretary of State determines to be— (a) appropriate; and (b) proportionate to the contravention in respect of which it is imposed. (2) The amount may not exceed 10 per cent of the turnover of the public communications provider’s relevant business for the relevant period, subject to subsection (3). (3) In the case of a penalty specified under section 105Z18(7), the amount may not exceed £100,000 per day. (4) Where the notification relates to a contravention of a requirement under section 105Z7— (a) subsection (2) has effect as if the maximum amount specified were £10 million; and (b) subsection (3) has effect as if the maximum amount specified were £50,000 per day. (5) The Secretary of State may by regulations amend this section so as to substitute a different maximum penalty for the maximum penalty for the time being specified in subsection (3) or (4)(a) or (b). (6) No regulations are to be made containing provision authorised by subsection (5) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House. (7) For the purposes of this section— (a) the turnover of a person’s relevant business for a period is to be calculated in accordance with such rules as may be set out in an order under section 97(3)(a); and (b) what is to be treated as the network, service, facility or business by reference to which the calculation of that turnover falls to be made is to be determined in accordance with such provision as may be made by an order under section 97(3)(a). (8) In this section— - “relevant business”, in relation to a person, means (subject to the provisions of an order under section 97(3)(a)) so much of any business carried on by the person as consists in any one or more of the following— the provision of a public electronic communications network; the provision of a public electronic communications service; the making available of facilities that are associated facilities by reference to such a network or service; - “relevant period”, in relation to a contravention by a person of a requirement imposed by a designated vendor direction, means— except in a case falling within paragraph (b) or (c), the period of one year ending with the 31st March next before the time when notification of the contravention was given under section 105Z18; in the case of a person who at that time has been carrying on that business for a period of less than a year, the period, ending with that time, during which the person has been carrying it on; and in the case of a person who at that time has ceased to carry on that business, the period of one year ending with the time when the person ceased to carry it on. (105Z20) (1) This section applies where— (a) a public communications provider has been given a notification under section 105Z18; (b) the Secretary of State has allowed the provider an opportunity to make representations about the matters notified; and (c) the period allowed for the making of representations has expired. (2) The Secretary of State may— (a) give the provider a decision (“a confirmation decision”) confirming the imposition of requirements on the provider in accordance with the notification under section 105Z18; or (b) inform the provider that no further action will be taken. (3) The Secretary of State may not give the provider a confirmation decision unless, after considering any representations, the Secretary of State is satisfied that the provider has, in one or more of the ways specified in the notification under section 105Z18, contravened— (a) a requirement imposed by a designated vendor direction, or (b) a requirement imposed under section 105Z7, specified in the notification under section 105Z18. (4) A confirmation decision must be given to the provider without delay. (5) A confirmation decision must include reasons for the decision. (6) A confirmation decision may— (a) require immediate action by the provider— (i) to comply with the requirement specified in the notification under section 105Z18, and (ii) to remedy the consequences of the contravention, or (b) specify a period within which the provider must comply with that requirement and remedy those consequences, and may specify the steps to be taken by the provider in order to comply with that requirement or remedy those consequences. (7) A confirmation decision may require the provider to pay— (a) the penalty specified in the notification under section 105Z18, or (b) such lesser penalty as the Secretary of State considers appropriate in the light of— (i) any representations made by the provider, and (ii) any steps taken by the provider to comply with the requirement specified in the notification under section 105Z18 or to remedy the consequences of the contravention, and may specify the period within which the penalty is to be paid. (8) It is the duty of the provider to comply with any requirement imposed by a confirmation decision. (9) The Secretary of State may enforce the provider’s duty in civil proceedings— (a) for an injunction; (b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or (c) for any other appropriate remedy or relief. (105Z21) (1) This section applies where a sum is payable to the Secretary of State as a penalty under section 105Z20. (2) In England and Wales, the penalty is recoverable as if it were payable under an order of the county court. (3) In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland. (4) In Northern Ireland, the penalty is recoverable as if it were payable under an order of a county court in Northern Ireland. (5) Where action is taken under this section for the recovery of a sum payable as a penalty under section 105Z20, the penalty is— (a) in relation to England and Wales, to be treated for the purposes of section 98 of the Courts Act 2003 (register of judgments and orders etc) as if it were a judgment entered in the county court; (b) in relation to Northern Ireland, to be treated for the purposes of Article 116 of the Judgments Enforcement (Northern Ireland) Order 1981 (S.I. 1981/226 (N.I. 6)) (register of judgments) as if it were a judgment in respect of which an application has been accepted under Article 22 or 23(1) of that Order.

Urgent enforcement directions

21

• (1) The Communications Act 2003 is amended as follows.

• (2) After section 105Z21 insert—

(105Z22) (1) The Secretary of State may give a direction under this section (“an urgent enforcement direction”) to a person if the Secretary of State determines that— (a) there are reasonable grounds for believing that the person is contravening, or has contravened— (i) a requirement imposed by a designated vendor direction; or (ii) a requirement not to disclose imposed under section 105Z25; (b) there are reasonable grounds for suspecting that the case is an urgent case; and (c) the urgency of the case makes it appropriate for the Secretary of State to take action under this section. (2) A case is an urgent case for the purposes of this section if the contravention has resulted in, or creates an immediate risk of— (a) a serious threat to national security; or (b) significant harm to the security of a public electronic communications network, a public electronic communications service or a facility that is an associated facility by reference to such a network or service. (3) An urgent enforcement direction must— (a) specify the requirement and contravention in respect of which it is given; (b) require the person to take such steps falling within subsection (4) as are specified in the direction; (c) specify a period within which those steps must be taken; and (d) specify the Secretary of State’s reasons for giving the direction. (4) The steps falling within this subsection are the steps that the Secretary of State has determined are appropriate— (a) for complying with the requirement; or (b) for remedying the consequences of the contravention. (5) The requirement in subsection (3)(d) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the direction would be contrary to the interests of national security. (105Z23) (1) As soon as reasonably practicable after giving an urgent enforcement direction, the Secretary of State must— (a) confirm the direction; or (b) revoke the direction (see section 105Z24). (2) The Secretary of State may confirm an urgent enforcement direction with or without modifications. (3) The Secretary of State may confirm an urgent enforcement direction only if the Secretary of State has determined that— (a) the person is contravening, or has contravened— (i) a requirement imposed by a designated vendor direction; or (ii) a requirement not to disclose imposed under section 105Z25; (b) the contravention has resulted in, or creates an immediate risk of, a threat or harm described in section 105Z22(2)(a) or (b); and (c) it is appropriate to confirm the urgent enforcement direction, with any modifications, to prevent, reduce or remove that threat or harm or immediate risk. (4) Before confirming an urgent enforcement direction, the Secretary of State must— (a) give notice to the person to whom the direction was given that the Secretary of State proposes to confirm the direction; and (b) give the person— (i) an opportunity of making representations about the grounds on which it was given and its effect; and (ii) an opportunity of proposing steps to remedy the situation. (5) The notice under subsection (4)(a) must— (a) state that the Secretary of State proposes to confirm the direction; (b) specify any proposed modifications of the direction; (c) specify the Secretary of State’s reasons for confirming the direction and for any modifications; and (d) specify a reasonable period for making representations. (6) The requirement in subsection (5)(c) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security. (7) As soon as reasonably practicable after determining whether to confirm the direction, the Secretary of State must by notice inform the person to whom it was given of the determination. (105Z24) (1) A person who is given an urgent enforcement direction must comply with it, whether or not it has been confirmed (unless it is revoked). (2) The duty is enforceable in civil proceedings by the Secretary of State— (a) for an injunction; (b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or (c) for any other appropriate remedy or relief.

• (3) In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—

• “urgent enforcement direction” has the meaning given by section 105Z22.

Designated vendor directions: further provision

Requirement not to disclose

22

After section 105Z24 of the Communications Act 2003 insert—

(105Z25) (1) The Secretary of State may require a public communications provider which has been given a designated vendor direction or a designated vendor who has been sent a copy under section 105Z4 not to disclose to any other person the contents of— (a) the designated vendor direction, or (b) a part of the designated vendor direction specified by the Secretary of State, without the permission of the Secretary of State. (2) The Secretary of State may require a designated vendor not to disclose to any other person the contents of— (a) the designation notice, or (b) a part of the designation notice specified by the Secretary of State, without the permission of the Secretary of State. (3) The Secretary of State may require a public communications provider which has been given a notification under section 105Z18 (notification of contravention of designated vendor direction etc) not to disclose to any other person the existence or contents of— (a) the notification, or (b) a part of the notification specified by the Secretary of State, without the permission of the Secretary of State. (4) The Secretary of State may require a public communications provider which has been given a confirmation decision under section 105Z20 (enforcement of notification under section 105Z18) not to disclose to any other person the existence or contents of— (a) the confirmation decision, or (b) a part of the confirmation decision specified by the Secretary of State, without the permission of the Secretary of State. (5) The Secretary of State may require a person who has been given an urgent enforcement direction not to disclose to any other person the existence or contents of— (a) the urgent enforcement direction, or (b) a part of the urgent enforcement direction specified by the Secretary of State, without the permission of the Secretary of State. (6) The Secretary of State may require a person who has been given a notice under section 105Z23(4)(a) or (7) (notices relating to confirmation of an urgent enforcement direction) not to disclose to any other person the existence or contents of— (a) the notice, or (b) a part of the notice specified by the Secretary of State, without the permission of the Secretary of State. (7) The Secretary of State may not impose a requirement on a person under subsection (1), (2), (3), (4), (5) or (6) unless the condition in subsection (8) is satisfied. (8) The condition in this subsection is that the Secretary of State considers that it would be contrary to the interests of national security for— (a) the contents of the designated vendor direction or the part specified under subsection (1), (b) the contents of the designation notice or the part specified under subsection (2), (c) the existence or contents of the notification under section 105Z18 or the part specified under subsection (3), (d) the existence or contents of the confirmation decision under section 105Z20 or the part specified under subsection (4), (e) the existence or contents of the urgent enforcement direction or the part specified under subsection (5), or (f) the existence or contents of the notice under section 105Z23(4)(a) or (7) or the part specified under subsection (6), (as the case may be) to be disclosed, except as permitted by the Secretary of State. (9) If the condition in subsection (10) is satisfied, the Secretary of State may require a person consulted under section 105Z3(1), 105Z5(4), 105Z9(1) or 105Z10(4) not to disclose to any other person— (a) the existence of the consultation and any information disclosed to the person in the consultation, or (b) the existence of a part of the consultation specified by the Secretary of State and any information disclosed to the person in that part of the consultation, without the permission of the Secretary of State. (10) The condition in this subsection is that the Secretary of State considers that it would be contrary to the interests of national security for the matters described in subsection (9)(a) or (as the case may be) subsection (9)(b) to be disclosed, except as permitted by the Secretary of State. (11) Where a person is subject to a requirement under this section not to disclose a matter, disclosure of that matter by an employee of the person or a person engaged in the person’s business is to be regarded as a disclosure by the person, unless the person can show that the person took all reasonable steps to prevent such a disclosure. (105Z26) (1) Sections 105Z18, 105Z19(1) to (3), 105Z20 and 105Z21 apply in relation to a contravention by a person of a requirement not to disclose imposed under section 105Z25 as they apply in relation to a contravention by a public communications provider of a requirement imposed by a designated vendor direction, subject to subsections (2) to (6). (2) Section 105Z18 (as applied by this section) has effect as if, in subsection (2)(d), for sub-paragraphs (i) and (ii) there were substituted— (i) bring the contravention to an end; (ii) limit the consequences of the contravention; (3) Section 105Z19 (as applied by this section) has effect as if— (a) in subsection (2), the maximum penalty specified were £10 million; (b) in subsection (3), the maximum penalty specified were £50,000 per day. (4) The Secretary of State may by regulations amend subsection (3) so as to substitute a different amount for the amount for the time being specified in subsection (3)(a) or (b). (5) No regulations are to be made containing provision authorised by subsection (4) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House. (6) Section 105Z20 (as applied by this section) has effect as if— (a) in subsection (6)— (i) in paragraph (a), for sub-paragraphs (i) and (ii) there were substituted— (i) to bring the contravention to an end, and (ii) to limit the consequences of the contravention, (ii) in paragraph (b), for “comply with that requirement and remedy” there were substituted “bring that contravention to an end and limit”; (iii) in the words following paragraph (b), for “comply with that requirement or remedy” there were substituted “bring that contravention to an end or limit”; (b) in subsection (7)(b)(ii), for the words from “comply” to “remedy” there were substituted “bring the contravention to an end or to limit”.

Power of Secretary of State to require information etc

23

After section 105Z26 of the Communications Act 2003 insert—

(105Z27) (1) The Secretary of State may require a person falling within subsection (2) to provide the Secretary of State with such information as the Secretary of State may reasonably require for the purpose of exercising the Secretary of State’s functions under sections 105Z1 to 105Z26. (2) The persons falling within this subsection are— (a) a person who is or has been a public communications provider; (b) a person not falling within paragraph (a) who appears to the Secretary of State to have information relevant to the exercise of the Secretary of State’s functions under sections 105Z1 to 105Z26. (3) The Secretary of State may require a person falling within subsection (2)— (a) to produce, generate or obtain information for the purpose of providing it under subsection (1); (b) to collect or retain information that the person would not otherwise collect or retain for the purpose of providing it under subsection (1); (c) to process, collate or analyse any information held by the person (including information the person has been required to collect or retain) for the purpose of producing or generating information to be provided under subsection (1). (4) The information that may be required under subsection (1) includes, in particular, information about— (a) the use, or proposed use, of goods, services or facilities supplied, provided or made available by a particular person or a particular description of person; (b) goods, services or facilities proposed to be supplied, provided or made available by a particular person or a particular description of person; (c) goods, services or facilities proposed to be supplied, provided or made available by a person who has not, or has not recently, supplied, provided or made available for use in the United Kingdom— (i) goods, services or facilities of that description; or (ii) any goods, services or facilities; (d) the manner in which a public electronic communications network or a public electronic communications service is, or is proposed to be, provided or facilities that are associated facilities by reference to such a network or service are, or are proposed to be, made available; (e) future developments of such a network or service or such associated facilities. (5) The Secretary of State may require a person to provide information under this section at such times or in such circumstances as may be specified by the Secretary of State. (6) A person must comply with a requirement imposed under this section in such manner and within such reasonable period as may be specified by the Secretary of State. (7) The powers in this section are subject to the limitations in section 105Z28. (8) A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility. (105Z28) (1) This section limits the purposes for which, and manner in which, requirements may be imposed under section 105Z27. (2) The Secretary of State is not to require a person to provide information under section 105Z27 except by a notice served on the person that— (a) describes the required information; and (b) sets out the Secretary of State’s reasons for requiring it. (3) The Secretary of State is not to impose a requirement on a person under section 105Z27(3) except by a notice served on the person that sets out the requirement and the Secretary of State’s reasons for imposing it. (4) The requirements in subsections (2)(b) and (3) do not apply if or to the extent that the Secretary of State considers that setting out reasons in the notice would be contrary to the interests of national security. (5) The Secretary of State is not to require the provision of information under section 105Z27 except where the making of a demand for the information is proportionate to the use to which the information is to be put in the carrying out of the Secretary of State’s functions. (6) The Secretary of State is not to impose a requirement on a person under section 105Z27(3) except where the imposition of the requirement is proportionate to the use to which the information required to be produced, generated, obtained, collected or retained (including information required to be produced or generated by processing, collating or analysing) is to be put in the carrying out of the Secretary of State’s functions. (7) A requirement to provide information under section 105Z27 does not require a person to disclose information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings. (105Z29) (1) Sections 105Z18, 105Z19(1) to (3), 105Z20 and 105Z21 apply in relation to a contravention by a person of a requirement under section 105Z27 as they apply in relation to a contravention by a public communications provider of a requirement imposed by a designated vendor direction, subject to subsection (2). (2) Section 105Z19 (as applied by this section) has effect as if— (a) in subsection (2), the maximum penalty specified were £10 million; (b) in subsection (3), the maximum penalty specified were £50,000 per day. (3) The Secretary of State may by regulations amend subsection (2) so as to substitute a different amount for the amount for the time being specified in subsection (2)(a) or (b). (4) No regulations are to be made containing provision authorised by subsection (3) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.

Further amendments

Further amendment concerning penalties

24

After section 139 of the Communications Act 2003 insert—

(139ZA) (1) This section applies where— (a) a person is given a notification under section 138 which specifies a proposed penalty; and (b) the condition in subsection (2) or (3) is met. (2) The condition in this subsection is that— (a) the proposed penalty is in respect of a contravention of a requirement to provide information under section 135; and (b) the demand for the information contains a statement that OFCOM consider the information to be necessary for the purpose of— (i) carrying out any of their functions under sections 105L to 105Z; (ii) preparing a report under section 105Z12. (3) The condition in this subsection is that the proposed penalty is in respect of a contravention of a requirement imposed under subsection (3C) of section 135. (4) Section 139 applies in relation to the proposed penalty as if— (a) in subsection (4B), the maximum penalty specified were £50,000 per day; (b) in subsection (5), the maximum penalty specified were £10 million. (5) The Secretary of State may by regulations amend this section so as to make different provision as to the maximum penalty applying under section 139(4B) or (5). (6) No regulations are to be made containing provision authorised by subsection (5) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.

Further consequential amendments

25

• (1) The Communications Act 2003 is amended as follows.

• (2) In section 38 (fixing of charges) in subsection (6) (list of functions by reference to which charges are to be fixed) omit paragraph (ec).

• (3) In section 402 (power of Secretary of State to make orders and regulations) in subsection (2) (orders and regulations subject to negative procedure)—

• (a) omit the “or” before paragraph (c);

• (b) after paragraph (c) insert

or (d) any regulations that are required, by any provision of this Act, to be laid before Parliament and approved in draft,

.

Final

Financial provision

26

There is to be paid out of money provided by Parliament any increase attributable to this Act in the sums payable under any other Act out of money so provided.

Extent

27

This Act extends to England and Wales, Scotland and Northern Ireland.

Commencement

28

• (1) The following provisions come into force on the day on which this Act is passed—

• (a) sections 1 and 2, so far as they confer power to make regulations;

• (b) section 3, so far as it confers power to issue codes of practice;

• (c) sections 14 to 23;

• (d) section 24, so far as it relates to section 18;

• (e) section 25(1) and (3);

• (f) section 26;

• (g) section 27;

• (h) this section;

• (i) section 29.

• (2) The following provisions come into force on such day as the Secretary of State may by regulations made by statutory instrument appoint—

• (a) sections 1 to 3 (so far as not already in force by virtue of subsection (1));

• (b) sections 4 to 13;

• (c) section 24 (so far as not already in force by virtue of subsection (1));

• (d) section 25(2).

• (3) Different days may be appointed for different purposes.

• (4) The Secretary of State may by regulations made by statutory instrument make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.

Short title

29

This Act may be cited as the Telecommunications (Security) Act 2021.

Duty to take security measures

Duty to take measures in response to security compromises

Codes of practice about security measures etc

Informing others of security compromises

General duty of OFCOM to ensure compliance with security duties

Powers of OFCOM to assess compliance with security duties

Powers of OFCOM to enforce compliance with security duties

Civil liability for contravention of security duties

Relationship between security duties and certain other duties etc

Statement of policy on ensuring compliance with security duties

Reporting on matters related to security

Powers to require and share information related to security

Appeals against security decisions of OFCOM

Reviews of sections 1 to 13

Designated vendor directions

Designation notices

Laying before Parliament

Monitoring of designated vendor directions

Monitoring directions: inspection notices

Power of Secretary of State to enforce compliance with designated vendor directions etc

Urgent enforcement directions

Requirement not to disclose

Power of Secretary of State to require information etc

Further amendment concerning penalties

Further consequential amendments

Financial provision

Extent

Commencement

Short title

Editorial notes

[^key-0b758168d03271bb286b0414fdacac2a]: S. 1 in force at Royal Assent for specified purposes, see s. 28(1)(a)

[^key-81275ed1d4cb3d80c7c8b7ac1c43bfa1]: S. 2 in force at Royal Assent for specified purposes, see s. 28(1)(a)

[^key-263036c797f14b9b75ebd1f28f61ccff]: S. 3 in force at Royal Assent for specified purposes, see s. 28(1)(b)

[^key-32796151acffc06de87c54533b8628aa]: S. 4 not in force at Royal Assent, see s. 28

[^key-2d3f7b7af859a4285c8eb7dc03f8920b]: S. 5 not in force at Royal Assent, see s. 28

[^key-fe3000c2f06de4f6f5d575969381864b]: S. 6 not in force at Royal Assent, see s. 28

[^key-d82a9d76b5180fab9c7c36bb2a70ead5]: S. 7 not in force at Royal Assent, see s. 28

[^key-db02a0a21e021539bed4528fe6bc436f]: S. 8 not in force at Royal Assent, see s. 28

[^key-f07b0aa4af22048c06d1129ccad3a76d]: S. 9 not in force at Royal Assent, see s. 28

[^key-98d3c72b3b310016f2d0ace0054b2a34]: S. 10 not in force at Royal Assent, see s. 28

[^key-880ed6c8ce2a853da3807e9399ae66b9]: S. 11 not in force at Royal Assent, see s. 28

[^key-f7bec472f2bf183a2938583c5f51774c]: S. 12 not in force at Royal Assent, see s. 28

[^key-3c95618b6f28b94263e187c504ea6e2c]: S. 13 not in force at Royal Assent, see s. 28

[^key-8120ae62dee20fd8f006029d56f2370a]: S. 14 in force at Royal Assent, see s. 28(1)(c)

[^key-18fcd9430e2ea1dce115b0957c813b12]: S. 15 in force at Royal Assent, see s. 28(1)(c)

[^key-4c41d0862a98f7853eb6b369176160b1]: S. 16 in force at Royal Assent, see s. 28(1)(c)

[^key-1621f2fb8bb28e9791537cb22444018e]: S. 17 in force at Royal Assent, see s. 28(1)(c)

[^key-93bbf4f50064359f5c1bc123a0fc6ef2]: S. 18 in force at Royal Assent, see s. 28(1)(c)

[^key-b59036e3661d6d945e98b5475da16aee]: S. 19 in force at Royal Assent, see s. 28(1)(c)

[^key-d54f5a2a4b9fbe4dbda2713350320c70]: S. 20 in force at Royal Assent, see s. 28(1)(c)

[^key-d3be080f91ff88e0ce4cefe215776042]: S. 21 in force at Royal Assent, see s. 28(1)(c)

[^key-fcb821ebdb66a9abd1226934c53d2376]: S. 22 in force at Royal Assent, see s. 28(1)(c)

[^key-59fc59b412d3f90ea94c012b495ff61d]: S. 23 in force at Royal Assent, see s. 28(1)(c)

[^key-54ff9fea58c6dd18108005f174272e71]: S. 24 in force at Royal Assent for specified purposes, see s. 28(1)(d)

[^key-dacacaabe9b65cd5272f7a4d9d465b23]: S. 25(1)(3) in force at Royal Assent, see s. 28(1)(e)

[^key-fce20e6a69a24bf8d76e714dcb171e42]: S. 26 in force at Royal Assent, see s. 28(1)(f)

[^key-e0033c43f0e0da70e6bf3417c43824b6]: S. 27 in force at Royal Assent, see s. 28(1)(g)

[^key-e69dc6999f3c7ac3e26991f7e6c605c2]: S. 28 in force at Royal Assent, see s. 28(1)(h)

[^key-6207794f79675e1dea73f05c2341e1bc]: S. 29 in force at Royal Assent, see s. 28(1)(i)

[^key-b9d960155d896e9ae1c723622a196f9e]: S. 1 in force at 1.10.2022 in so far as not already in force by S.I. 2022/931, reg. 2(a)

[^key-b4a381044d4d16e8144587c372f5f389]: S. 2 in force at 1.10.2022 in so far as not already in force by S.I. 2022/931, reg. 2(a)

[^key-288b822086d17b99d9fa138d2c7926df]: S. 3 in force at 1.10.2022 in so far as not already in force by S.I. 2022/931, reg. 2(a)

[^key-89c0a9b467222078a6b4e1626e97468c]: S. 4 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-ca5021911e4872528318dc12a8ef3f8d]: S. 5 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-fcf6aae2bc767fecc25cda2264bce519]: S. 6 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-7a759cf109a473a4167ebb35400fc176]: S. 7 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-19be6b5b1edafad5413cbcfc6a6f02fe]: S. 8 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-08a962f666a43b471e179b9bda31a230]: S. 9 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-87311e1f848ba18d71c2b7cb4a5bbcec]: S. 10 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-286601bc11ffdef44adb482e6eb4d8af]: S. 11 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-ea65ed8794f2097bbf06d2e0f0b34f60]: S. 12 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-14f1d098d5242aded8d2d57df662c8e9]: S. 13 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)

[^key-b4f68a92a6b74aadbc78e63b20f342af]: S. 24 in force at 1.10.2022 in so far as not already in force by S.I. 2022/931, reg. 2(c)

[^key-8ab7d3812b6eb7728846c44000d78d29]: S. 25(2) in force at 1.10.2022 by S.I. 2022/931, reg. 2(d)