A Principal Reference for Rules Governing the Export of Encryption Can Be Found in the

England & Wales: Cybersecurity Laws and Regulations 2022

ICLG - Cybersecurity Laws and Regulations - England & Wales Affiliate covers mutual issues in cybersecurity laws and regulations, including cybercrime, applicative laws, preventing attacks, specific sectors, corporate governance, litigation, insurance, and investigatory and law powers.

Published: 03/11/2021

Hot off the press

Chapter Content Gratuitous Access

1. 1. Cybercrime
2. 2. Cybersecurity Laws
3. 3. Preventing Attacks
4. four. Specific Sectors
5. 5. Corporate Governance
6. half-dozen. Litigation
7. 7. Insurance
8. 8. Investigatory and Police Powers

1. Cybercrime

ane.1        Would any of the following activities constitute a criminal or administrative offence in your jurisdiction? If so, please provide details of the offence, the maximum penalties available, and any examples of prosecutions in your jurisdiction:

Hacking (i.east. unauthorised access)

Yes.  Under the Estimator Misuse Act 1990, it is an offence to cause a computer to perform any office with the intent to secure unauthorised admission to any program or data held in a estimator (or enable such access to be secured).  On indictment, the maximum penalty is ii years' imprisonment.  If a person commits this offence with the intent to commit or facilitate a more serious "further offence" (e.g. theft via the diversion of funds), the maximum penalisation is five years' imprisonment.  In 2019, a director of a CCTV provider and her employee were sentenced to 14 months' and 5 months' imprisonment (respectively) after they accessed CCTV footage of the mail service-mortem of footballer Emiliano Sala.  In 2019, a disgruntled old IT contractor at Jet2 was sentenced to 10 months' imprisonment afterward he deleted user accounts and accessed the email account of the Jet2 CEO in a revenge attack.

The offence tin can likewise ascend alongside the criminal offences in the Data Protection Human action 2018, to the extent the offence involves causing a estimator to perform a role with the intention of securing unauthorised admission to information.  For case, in a prosecution brought past the Information Commissioner's Role (ICO) in January 2022 under the Information Protection Act 2022 and the Estimator Misuse Act 1990, an employee for RAC was sentenced to viii months' imprisonment and field of study to a £25,000 confiscation gild following the unauthorised access and transfer of customer personal data to a third-political party accident claims direction business firm.

Under the Investigatory Powers Act 2022 (IPA 2016), information technology is an offence to intercept intentionally (within the UK) a communication in the course of its transmission past means of a public or private telecommunications system without lawful authority.  The offence is punishable on a summary conviction (with a fine) and on conviction on indictment (with up to ii years' imprisonment or a fine, or both).

Deprival-of-service attacks

Yes.  Under the Computer Misuse Human action 1990, it is an offence to do any unauthorised act in relation to a reckoner that a person knows to be unauthorised, with the intent of impairing the operation of any computer, preventing or hindering admission to any program or the data held in any computer, impairing the operation of whatever programme or the reliability of any data, or enabling whatsoever of the above.  On indictment, the maximum punishment is 10 years' imprisonment.  In 2022 and 2019, two individuals were each sentenced to sixteen months in youth offender institutions for separate denial-of-service attacks confronting various websites targeting websites of law enforcement and a number of companies including Amazon, Netflix and NatWest.

Phishing

Yep.  Come across the respond in respect of hacking.

Under the Fraud Act 2006, phishing could also plant fraud by faux representation if (for instance) an electronic mail was sent falsely representing that information technology was sent by a legitimate firm.  On indictment, the maximum penalty is 10 years' imprisonment.  In 2021, a text scammer was found guilty of fraud by faux representation afterward sending bulk text messages to members of the public seeking to deceive recipients into providing personal financial information.  The messages included SMS messages claiming to be from the UK HMRC offering grants in relation to the COVID-19 pandemic.

Infection of It systems with malware (including ransomware, spyware, worms, trojans and viruses)

Yep.  Come across the respond in respect of deprival-of-service attacks.

Distribution, sale or offering for sale of hardware, software or other tools used to commit cybercrime

Yes.  Nether the Figurer Misuse Act 1990, it is an offence to make, adapt, supply or offer to supply any article intending it to be used to commit, or that may be probable to be used to commit, an offence nether section ane (see the reply in respect of hacking) or section 3 (see the respond in respect of denial-of-service attacks) of the Act.  On indictment, the maximum penalisation is two years' imprisonment.

Nether the Fraud Act 2006, it is an offence to make or supply articles for apply in the course of, or in connection with fraud, provided the individual either: (i) has cognition that the article is designed or adapted for utilise in the course of or in connexion with fraud; or (ii) intends the article to exist used to commit or help in the commission of fraud.  On indictment, the maximum penalty is ten years' imprisonment.

In 2019, an private was sentenced to ix years' imprisonment after he created website scripts designed to look similar the websites of upwardly to 53 Uk-based companies to assistance criminals defraud victims out of approximately £41.half dozen million.  He too supplied the criminals with software that disguised their phishing sites from beingness identified by spider web browsers.

Possession or use of hardware, software or other tools used to commit cybercrime

Yes.  Encounter the response relating to the distribution, sale or offering for sale of hardware, software or other tools used to commit cybercrime higher up.

Identity theft or identity fraud (eastward.g. in connectedness with access devices)

Yep.  Under the Fraud Human action 2006, information technology is an offence to dishonestly make a false representation, knowing that the representation was or may be untrue or misleading, with the intent of making a gain for yourself or some other or causing a loss or risk of loss to some other (i.e. fraud past false representation).  On indictment, the maximum penalty is 10 years' imprisonment.  In 2019, an individual was convicted of offences nether the Fraud Human action 2006 and Calculator Misuse Act 1990 (later on accessing a barrister colleague'south electronic mail account to copy his practising certificate in order to produce a faked copy in his own name before going on to practise every bit a barrister working on eighteen cases) and was sentenced to a total of 2 years' and 3 months' imprisonment.  In 2021, an individual was sentenced to two years' imprisonment after being bedevilled of fraud by imitation representation and unauthorised reckoner admission with intent, after using compromised national lottery login details in an endeavour to access user accounts to obtain business relationship holders' bank details.

Electronic theft (eastward.thou. breach of confidence by a current or erstwhile employee, or criminal copyright infringement)

Yes.  This may constitute an offence under the Computer Misuse Act 1990 (such as hacking) as well every bit a financial crime, such as theft (under the Theft Human action 1990).  A breach of confidence or misuse of individual data is actionable as a mutual police force tort, simply not as a law-breaking in itself.  In 2020, a self-employed It support specialist was sentenced to 20 months' imprisonment for offences under the Computer Misuse Act 1990 and the Theft Act 1990 after he stole over £31,000 in cryptocurrency from a client.

Unsolicited penetration testing (i.due east. the exploitation of an IT system without the permission of its owner to determine its vulnerabilities and weak points)

Yes.  See "Hacking (i.east. unauthorised admission)" to a higher place.

Any other activity that adversely affects or threatens the security, confidentiality, integrity or availability of any IT system, infrastructure, communications network, device or data

Please encounter above.  In addition, certain terrorism offences may arise in relation to cybersecurity.  For example, under the Terrorism Act 2000, it is an offence to take any action designed to seriously interfere with or seriously disrupt an electronic system if this is designed to influence the authorities or intimidate the public or a section of the public, or for the purpose of advancing a political, religious, racial or ideological cause.

The Data Protection Human activity 2022 also creates the offence of knowingly, recklessly or without the consent of the controller, obtaining (and retaining), disclosing or procuring personal data.  It is as well an offence to sell or offer to sell such personal information.  These offences are punishable on confidence to a fine.

ane.ii        Practice any of the to a higher place-mentioned offences accept extraterritorial application?

Yes.  For certain offences under the Computer Misuse Act 1990 (such every bit hacking, phishing or denial-of-service attacks), the offence will be committed where there is a "significant link to the domestic jurisdiction".  This includes the person committing the offence being in the United kingdom of great britain and northern ireland, the target calculator being in the UK or a United kingdom of great britain and northern ireland national committing the offence while outside the UK (provided in the latter instance that the deed was even so an offence in the state where it took place).

The Data Protection Human activity 2022 applies to whatever processing of personal data relating to an individual in the UK by a controller or processor that is non established in the Great britain, but that offers goods or services, or monitors the behaviour of these individuals in the UK.  The offences nether the Data Protection Act 2022 can therefore be committed by a legal or natural person outside the UK if they procedure personal data relating to individuals within the UK in order to target those individuals.

1.3        Are there any factors that might mitigate any penalization or otherwise plant an exception to whatsoever of the higher up-mentioned offences (eastward.g. where the offence involves "ethical hacking", with no intent to crusade harm or make a fiscal gain)?

There is an exemption for certain offences nether the Computer Misuse Human action 1990 (such as hacking, phishing or denial-of-service attacks) in respect of an enforcement officer acting in accordance with legislation to facilitate inspection, search or seizure without a person's consent.  There are no general defences under the Computer Misuse Human activity 1990.  However, Crown Prosecutors volition consider a number of public interest factors before charging an individual with an offence.

In relation to the offence under the Data Protection Deed 2022 outlined above, it is a defence if the person tin can demonstrate that obtaining, disclosing, procuring or retaining data without the controller'southward consent was necessary for the purposes of preventing or detecting crime, required or authorised by law or order, or justified in the public interest.  There are other defences available relating to the person'due south reasonable belief or special purpose (e.g. if they acted in the reasonable belief they had a legal right, or had the controller's consent, or acted for a special purpose).

2. Cybersecurity Laws

ii.ane Applicative Police: Please cite any Applicative Laws in your jurisdiction applicable to cybersecurity, including laws applicable to the monitoring, detection, prevention, mitigation and management of Incidents. This may include, for example, data protection and e-privacy laws, intellectual property laws, confidentiality laws, information security laws, and import/export controls, among others.

England and Wales does not have a comprehensive cybersecurity police force; instead, the legal framework for cybersecurity is dispersed across a number of different laws:

• The Data Protection Human activity 2022 – applies, alongside the EU General Data Protection Regulation, as information technology forms part of the laws of England and Wales, Scotland and Northern Republic of ireland by virtue of the European Union (Withdrawal) Act 2018 (UK GDPR), to Incidents to the extent that they involve Personal Data.  The Information Protection Human activity 2022 also sets out information protection requirements for national security and clearing every bit well as other domestic areas of police force.
• The Communications Human activity 2003 – includes cybersecurity obligations that utilise in the telecommunications sector to public electronic communications network providers and public electronic communications service providers.
• The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) – includes security obligations in respect of personal data that apply to public electronic communications service providers.
• The Network and Information Systems Regulations 2022 (NIS Regulations) – impose obligations on operators of essential services (OES) and relevant digital service providers (RDSPs).  OES are organisations that operate services accounted disquisitional to the economy and wider society such as water, transport, energy, healthcare and digital infrastructure.  RDSPs are anyone who provides online marketplaces, online search engines or cloud computing services and, is a medium or large-sized business with its caput office, or a nominated representative in the UK.  The NIS Regulations crave OES and RDSPs to have sufficient security systems in place to prevent the data they hold or the services they provide being compromised and to report certain Incidents to a competent authority.  The ICO is the competent authority for RDSPs.  Run into question 2.two beneath for more information well-nigh OES.
• The Regulation of Investigatory Powers Act 2000 (RIPA) – governs certain investigative powers of law enforcement, such as surveillance and interception of communications data.
• The IPA 2022 – amends the RIPA, provides for additional investigative powers, and creates criminal offences of the unlawful interception of communications, subject to limited exceptions for legitimate business organization purposes.
• The Computer Misuse Act 1990 – sets out various cybercrime offences, though does not define what is meant by a "reckoner" (encounter the answers to question 1.i above), which may be prosecuted in conjunction with offences under the Theft Human activity 1968, Theft Act 1978, Criminal Police force Act 1977, Proceeds of Crime Human action 2002, or the Fraud Act 2006.
• Official Secrets Act 1989 – may apply in respect of servants of the Crown or Uk government contractors, and creates offences in relation to disclosure (or failure to secure) certain information that may be damaging to the UK's interests.
• Governance obligations, which can direct or indirectly chronicle to cybersecurity, apply to public companies under the Companies Act 2006, the Disclosure Guidance and Transparency Rules and the Listing Rules in the Financial Behave Authorization (FCA) Handbook and the risk direction and control provisions in the UK Corporate Governance Code.
• Copyright infringement, including unauthorised copying of documents and the cyber piracy of films, music, e-books, is an offence under the Copyright Designs and Patents Act 1988.  To the extent an individual seeks to sell counterfeit goods online, the Merchandise Marks Act 1994 and Forgery and Counterfeiting Act 1981 may also apply alongside the Fraud Human activity 2006 and Proceeds of Crime Act 2002.
• The Malicious Communications Act 1988 – sets out criminal offences in relation to malicious and offensive communications, including if the intention is to cause distress or anxiety, or to convey a threat or information that is simulated (and was known or believed to have been false past the sender).
• Various common police doctrines may likewise utilize in respect of ceremonious actions (see question v.i below).

2.2 Disquisitional or essential infrastructure and services: Are in that location whatever cybersecurity requirements under Applicable Laws (in addition to those outlined above) applicable specifically to critical infrastructure, operators of essential services, or similar, in your jurisdiction?

• Telecommunications sector – cybersecurity requirements under the Communications Human activity 2003 require providers of public electronic communications networks and public electronic communications services to, amidst other things, maintain the security and integrity of those networks and services, including by taking measures to prevent or minimise the bear upon of Incidents on end users and on the interconnection of networks.
• OES/RSDPs – the NIS Regulations came into force in the United kingdom on 10 May 2018, and impose certain security duties, on any OES and RSDPs, including a duty to notify Incidents to the relevant competent authority.  The NIS Regulations require OES and RDSPs to place and take appropriate and proportionate measures to manage the risks posed, including to prevent and minimise the impact of incidents and to ensure service continuity.  The NIS Regulations identify sector-based competent authorities (for operators of essential services operating in sectors roofing free energy, ship, wellness, drinking water supply and distribution and digital infrastructure) and the ICO is the competent authority for RDSPs.  The National Cyber Security Center (NCSC) is the Great britain's unmarried point of contact for Incident reporting.  The NCSC does not take a regulatory office only it undertakes the role of the Computer Security Incident Response Squad responding to Incidents that arise as a result of a cyber-assault and that accept been notified to it.  The NIS Regulations introduce a range of penalties that can be imposed by the relevant competent authority.  These range from £ane 1000000 for whatever contravention of the NIS Regulations, which the relevant say-so determines could not cause an Incident, upward to £17 million for a textile contravention of the NIS Regulations, which the relevant authority determines has caused, or could cause, an Incident resulting in immediate threat to life or pregnant adverse impact on the UK economy.
• Financial services sector – The Senior Management Arrangements Systems and Controls (SYSC) part of the FCA Handbook (see the answer to question 3.two below) applies to financial services infrastructure providers who are regulated by the FCA – these organisations will be operators of essential services for the purposes of the NIS Regulations (see above).

2.3 Security measures: Are organisations required under Applicable Laws to take measures to monitor, detect, prevent or mitigate Incidents? If so, please describe what measures are required to be taken.

Under the Data Protection Human action 2022 (and the U.k. GDPR), if an organisation processes personal data – information relating to a living private who tin can exist identified straight or indirectly from that information – it volition be required to implement appropriate technical and organisational measures to ensure a level of security of that personal information appropriate to the risk, including the risk of accidental or unlawful disclosure of, or access to, that personal information.  The UK GDPR explicitly identifies, as part of these measures, ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services, and the power to restore the availability and access to personal data in a timely fashion in the outcome of an Incident.

Nether the Data Protection Act 2022 and UK GDPR, controllers (i.e. the natural or legal persons that determine how and why personal information is processed) are also required to document any personal information breaches, and (depending on the circumstances) report sure personal data breaches to the ICO or individuals whose personal data is afflicted (see questions ii.four and 2.v beneath).  Where an organization reports a personal information breach to the ICO, it must describe the measures taken or proposed to exist taken to address the personal information alienation including measures to mitigate possible adverse effects.

The NIS Regulations besides require operators of essential services and digital service providers to have appropriate and proportionate technical and organisational risk management measures, including to prevent and minimise the touch of Incidents.

Under the PECR, a public electronic communications service provider must take appropriate technical and organisational measures to safeguard the security of its service and maintain a record of all Incidents involving a personal data breach in an inventory or log.  This must incorporate the facts surrounding the breach, the effects of the alienation and the remedial activeness taken by the service provider.

2.4 Reporting to authorities: Are organisations required nether Applicable Laws, or otherwise expected by a regulatory or other authorisation, to report information related to Incidents or potential Incidents (including cyber threat data, such equally malware signatures, network vulnerabilities and other technical characteristics identifying a cyber-attack or attack methodology) to a regulatory or other say-so in your jurisdiction? If and so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; (b) the regulatory or other authority to which the information is required to be reported; (c) the nature and telescopic of information that is required to be reported; and (d) whether any defences or exemptions exist by which the arrangement might prevent publication of that information.

The Data Protection Act 2022 and United kingdom GDPR

Under the Information Protection Human activity 2022 and the UK GDPR, a controller will be required to notify an Incident involving personal data to the ICO without undue delay and, where feasible, inside 72 hours later on becoming aware of it, unless it is unlikely to result in risks to individuals.  This notification must include: (a) a clarification of the nature of the Incident; (b) the name and contact details of the organisation'southward information protection officer or contact point; (c) the likely consequences of the Incident; and (d) the measures taken, or proposed to be taken, to address the Incident and mitigate possible adverse effects.

Under the Data Protection Act 2018, the ICO is not permitted to publicise any information that has been disclosed to it (eastward.g. through notification of an Incident) if that information relates to an identified or identifiable individual or business organization and is non already in the public domain.  Even so, this restriction on publication will non apply in certain cases, such as if the ICO determines that publication is in the public interest.  The ICO's practise is non to publicise data breach notification information unless it has taken public enforcement activity in relation to the breach, or publication is necessary in the public involvement (eastward.g. to allay public concern).

The NIS Regulations

The NIS Regulations also crave OES and RDSPs to report Incidents to the relevant competent say-so without undue delay.  The relevant authority may inform the public where public awareness is needed either to prevent or resolve the Incident, or where this would otherwise be in the public interest, only the system will be consulted before disclosure to the public is made to preserve confidentiality and commercial interests.

The NCSC publishes a weekly threat report on its website, with content drawn from contempo open up source reporting, which details cyber threat information, known network and software vulnerabilities and other information organisations and individuals may find useful.  However, in that location is no obligation for organisations to report threat information to the NCSC to compile these reports.

The Communications Human action 2003

The Communications Human action 2003 requires public electronic communications network providers to notify Ofcom of any alienation of security that has a significant impact on the network's functioning.  It likewise requires public electronic communications service providers to notify Ofcom of any alienation of security that has a significant touch on the operation of the service.

PECR

The PECR requires a public electronic communications service provider to notify the ICO of a data alienation within 24 hours of becoming aware of the "essential facts" of the breach.  The notification must include: (a) the service provider'southward proper name and contact details; (b) the appointment and time of the breach (or an estimate) and the appointment and time of detection; (c) information about the nature of the breach; and (d) the nature and content of the personal data concerned and the security measures applied to it.

The FCA and PRA Handbooks

An organisation regulated past the FCA are also required to notify the FCA of whatever significant failure in its systems and controls under Chapter 15.3 of the Supervision Manual of the FCA and PRA Handbooks, which may include Incidents that involve data loss.  Similarly, the FCA expects payment service providers to comply with European Banking Authority guidelines on major Incident reporting under which those providers are expected to report major operational or security Incidents to the competent authority within four hours from the moment the Incident was first detected, with intermediate updates and a concluding written report delivered within ii weeks after business is deemed to have returned to normal.

2.5 Reporting to affected individuals or tertiary parties: Are organisations required nether Applicable Laws, or otherwise expected by a regulatory or other dominance, to written report data related to Incidents or potential Incidents to any affected individuals? If so, delight provide details of: (a) the circumstance in which this reporting obligation is triggered; and (b) the nature and scope of data that is required to be reported.

Under the Data Protection Act 2022 and the UK GDPR, a controller will be required to notify affected individuals of an Incident without undue delay if the Incident involves personal data and is likely to result in a loftier risk to the rights and freedoms of those individuals.  This notification must include: (a) a description of the nature of the Incident; (b) contact details where more information can be institute; (c) the likely consequences of the Incident; and (d) the measures taken, or proposed to be taken, by the system to address the Incident and mitigate possible adverse furnishings.

Nether the PECR, a public electronic communications service provider must notify its affected subscribers or users of an Incident without unnecessary delay if that Incident is likely to adversely affect their personal data or privacy.  The service provider should provide a summary of the Incident, including the estimated engagement of the breach, the nature and content of personal information afflicted, the likely issue on the private, any measures taken to address the Incident and information as to how the private can mitigate any possible adverse touch.  No notification is required if the service provider can demonstrate to the ICO's satisfaction that the personal data that has been breached was encrypted or was rendered unintelligible by similar security measures.

two.half dozen Responsible potency(ies): Delight provide details of the regulator(southward) or potency(ies) responsible for the above-mentioned requirements.

• The ICO is the relevant regulator under information protection laws, including the Data Protection Deed 2018, the Uk GDPR and the PECR, too as the competent authorisation for RDSPs nether the NIS Regulations ((Hyperlink)
• Ofcom is the relevant regulator under the Communications Human activity 2003 ((Hyperlink)
• The FCA is the relevant regulator under the FCA Handbook ((Hyperlink) The PRA is also responsible for the regulation and supervision of financial services firms.
• Sector-based competent authorities are the relevant regulators in Schedule 1 to the NIS Regulations ((Hyperlink)

ii.7 Penalties: What are the penalties for not complying with the in a higher place-mentioned requirements?

• The Data Protection Human activity 2022 and the Britain GDPR – failure to report an Incident involving a personal data breach tin incur a fine of up to the higher of ii% of total almanac worldwide turnover or £8.vii million (other infringements of the UK GDPR can incur fines of upward to the higher of 4% of total annual worldwide turnover or £17.five million).
• The PECR – failure past a public electronic communications service provider to notify an Incident involving a personal data alienation to the ICO can incur a £1,000 stock-still fine.  A failure by a public electronic communications service provider to take appropriate technical and organisational measures to safeguard the security of their service tin incur a fine of up to £500,000 from the ICO.
• The NIS Regulations – failure to comply with the NIS Regulations by RDSPs, depending on the blazon of contravention, can incur a monetary penalty of up to £17 million (for material contraventions that could or have caused an incident that results in a threat to life or significant adverse economical impact to the UK).
• The IPA 2016 creates ceremonious liability for unlawful interception and provides a ceremonious sanctions regime under which the Investigatory Powers Commissioner tin can event a penalty notice of up to £50,000 (where the person has non committed the criminal offence).

2.viii Enforcement: Please cite whatever specific examples of enforcement action taken in cases of non-compliance with the higher up-mentioned requirements.

In July 2019, in the kickoff fine to be announced by the ICO under the UK GDPR, the ICO announced an intention to issue a fine of £183.39 million to British Airways, following an Incident in September 2018.  This fine was later on revised to £20 1000000 in Oct 2020, to reverberate certain mitigating factors (including the remedial measures taken past British Airways in response to the Incident, British Airways' cooperation with the ICO, the lack of aggravating factors, and the touch of the COVID-19 pandemic).  The Incident in office involved the unauthorised access of British Airway's IT systems (via the compromised credentials of a user within a 3rd-political party supplier, specifically a remote-access account that was not field of study to multi-factor authentication) and the diversion of user traffic to the British Airways website to a fraudulent site.  Through this simulated site, customer details were harvested past the attackers.  Personal data of approximately 429,000 customers was compromised in this Incident, which is believed to have begun in June 2018.  In the detailed penalty notice published in October 2016, the ICO indicates that the fine was imposed due to a failure to ensure appropriate data security, and a failure to use and implement appropriate technical and organisational security measures.

Also, in July 2019, the ICO announced an intention to fine Marriott International £99.ii meg, following a data alienation affecting Marriott subsidiary Starwood'southward guest reservation database.  This fine was later revised to £xviii.4 million in October 2022 to reflect sure mitigating factors (including Marriott's steps to mitigate the effects of the Incident, cooperation with the ICO, and the impact of the COVID-19 pandemic on Marriott).  A diversity of personal data (including guest proper name and identifier, gender, date of nascence, contact details, passport data, credit carte data, and loyalty plan information) independent in approximately 339 million guest records globally were exposed by the Incident, of which 7 1000000 related to Great britain residents.  It is believed the relevant vulnerability began in 2022 (prior to Marriott'due south acquisition), but was not discovered until 2022 (past which time Marriott had acquired Starwood).  The Incident involved the installation of a "web shell" on the Starwood network, which allowed the implementation of remote-access Trojan malware to enable remote assistants of the system.  The ICO constitute that Marriott failed to undertake sufficient due diligence when it bought the Starwood hotels group in 2016, and should have done more to secure its systems.  In the detailed penalty find published in October 2020, the ICO identifies four principal failures: (i) insufficient monitoring of privileged accounts; (ii) insufficient monitoring of databases; (3) insufficient control of critical systems; and (iv) insufficient encryption.

In November 2020, the ICO issued a fine of £one.25 meg to Ticketmaster U.k. Express following a data alienation involving an attack on a tertiary-party-hosted chat-bot on its online payment page.  The Incident allowed the harvesting of customer financial information and affected 9.4 million customers in the EEA, including 1.5 meg located in the UK (which was a member of the EEA at the time of the Incident).  In the detailed penalization notice, the ICO identifies failures to assess the risks of using a chat-bot on a payment page, implement appropriate security measures to negate such risks, and identify the source of suggested fraudulent action promptly, despite warnings.

3. Preventing Attacks

3.one        Are organisations permitted to utilise whatever of the following measures to protect their Information technology systems in your jurisdiction  (including to detect and deflect Incidents on their Information technology systems)?

Beacons (i.e. imperceptible, remotely hosted graphics inserted into content to trigger a contact with a remote server that will reveal the IP address of a computer that is viewing such content)

There are no specific laws prohibiting the use of web beacons in the U.k..  Even so, where employ of a spider web beacon involves processing personal data, the organisation's use of the spider web buoy must be in accordance with the requirements of the PECR and information protection laws.

Honeypots (i.e. digital traps designed to trick cyber threat actors into taking action against a synthetic network, thereby allowing an organization to detect and counteract attempts to attack its network without causing whatsoever damage to the organisation'southward real network or data)

There are no specific laws prohibiting the utilize of honeypots in the UK.

Sinkholes (i.e. measures to re-directly malicious traffic abroad from an organization's own IP addresses and servers, commonly used to preclude DDoS attacks)

There are no specific laws prohibiting the apply of sinkholes in the U.k..

3.ii        Are organisations permitted to monitor or intercept electronic communications on their networks (east.g. electronic mail and internet usage of employees) in order to preclude or mitigate the bear upon of cyber-attacks?

Monitoring of employees, e.thousand. monitoring apply of email and net access, involves processing of personal data and so the Data Protection Act 2022 and the UK GDPR utilize.  The ICO's Employment Practices Code (the Lawmaking) contains guidance on monitoring employees at work.  Though the Code was produced under previous legislation, the ICO has confirmed that it considers the information useful (the ICO is also currently conducting a public consultation on its guidance for employment practices).  The Code states that employees have an expectation of privacy, and then monitoring should be justified, proportionate, secured and that organisations should undertake an bear upon assessment and ensure that the employees are notified that monitoring will accept place.  A failure to comply with the Code will not automatically issue in a breach of the UK GDPR or the Data Protection Act 2018.  However, an organisation should be able to justify any departure from the Code, and the ICO tin take this into business relationship when considering enforcement action.

Nether the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000, an organisation may lawfully monitor and tape communications without consent to: (a) ascertain compliance with regulatory practices or procedures relevant to the business; (b) ascertain or demonstrate standards that ought to be achieved by employees using the telecommunication system; (c) prevent or detect crime; (d) investigate or detect unauthorised use of the telecommunication system (such as detecting a potential Incident); and (eastward) ensure the effective operation of the telecommunications system.

Information technology is non an offence to intercept communications under the IPA 2022 if the person has lawful authority and has the correct to control the system (for example, an employer in relation to a private communications system) or has consent of such person to deport out the interception (for example, is authorised IT personnel interim on the employer's instructions).  The IPA 2022 is supplemented by the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, which allows for the lawful interception, monitoring and recording of communications by businesses in express circumstances.  These regulations require the business organisation to demonstrate a permitted purpose of interception (equally outlined in the regulations), which includes investigating or detecting unauthorised employ of the system or any other telecommunications arrangement.  The system controller must accept fabricated all reasonable efforts to inform individuals who use the organization that their communications may be intercepted.

The Human being Rights Act 1998 and, in detail, the correct to respect for private and family life, home and correspondence, must too be considered and counterbalanced confronting obligations on the organisation to implement appropriate security measures in respect of potential Incidents.

three.3        Does your jurisdiction restrict the import or export of technology (e.one thousand. encryption software and hardware) designed to prevent or mitigate the touch on of cyber-attacks?

In that location are no specific restrictions on the import or export of commercial technology designed to prevent or mitigate the impact of cyber-attacks.

Nonetheless, export authorisations may be required for the export of certain engineering science that can exist used for both civil and military machine purposes nether the Council Regulation (EC) No 428/2009 of 5 May 2009 (equally retained and amended pursuant to the European Matrimony (Withdrawal) Act 2018).  This could, amidst other things, include information security systems, equipment and components that comprise or utilize encryption and decryption engineering science.

4. Specific Sectors

4.1        Does marketplace exercise with respect to data security vary across different business organisation sectors in your jurisdiction? Please include details of any common deviations from the strict legal requirements under Applicable Laws.

Certain sectors, such every bit financial services and telecommunications, are more incentivised to avert the cost and reputational bear upon of Incidents.  In some organisations, cybersecurity exercise is driven not only past compliance with Applicable Laws but also the desire to promote adept "cyber hygiene" culture.  For example, although there is no legal requirement to train employees in cyber risks, many organisations practise and may carry out simulations (such as phishing simulations and "war games") as a thing of good practise.

Public sector organisations (such as the National Wellness Service) and government authorities are subject area to additional reporting guidelines issued by the central government, in addition to disclosure obligations under Applicable Laws.

4.2        Excluding requirements outlined at 2.2 in relation to the operation of essential services and critical infrastructure, are in that location any specific legal requirements in relation to cybersecurity applicable to organisations in specific sectors (e.g. financial services or telecommunications)?

Under SYSC 3.ii.6R, regulated financial services organisations are required to take reasonable care to plant and maintain effective systems and controls to comply with regulatory requirements and standards and to counter take chances that the organisation may be used to further financial crime.  Further, under SYSC 3.1.1R, the organisation is required to maintain adequate policies and procedures to ensure compliance with those obligations and countering those risks.  These requirements extend to cybersecurity problems.  For example, the FCA has previously fined Tesco Depository financial institution (£16.four million) and 3 HSBC firms (£three meg) for failure to have adequate systems and controls in place to protect customer confidential information and manage financial criminal offence risk.

In the telecommunications sector, public electronic communications network providers and public electronic communications service providers must take advisable technical and organisational measures to manage risks to the security of the networks and services, including to minimise the impact of Incidents.  Public electronic communications network providers must too have all appropriate steps to protect, so far as possible, the availability of that provider's network.

5. Corporate Governance

5.1        In what circumstances, if any, might a failure by a company (whether listed or individual) to forestall, mitigate, manage or respond to an Incident amount to a alienation of directors' or officers' duties in your jurisdiction?

A failure to prevent, mitigate, manage or respond to an Incident may be a breach of directors' duties if, for case, the failure resulted from a lack of skill, intendance and diligence on the office of the relevant director.  Directors are required, nether the Companies Act 2006, to promote the success of the company for the do good of its members equally a whole and do reasonable skill, care and diligence in performing their role.  It is up to the lath of directors of each company to ensure that the board has the relevant competence and integrity to practice these duties in view of the risk to the visitor as a whole, including the hazard of Incidents.

five.ii        Are companies (whether listed or private) required nether Applicable Laws to: (a) designate a CISO (or equivalent); (b) establish a written Incident response plan or policy; (c) deport periodic cyber run a risk assessments, including for 3rd party vendors; and (d) perform penetration tests or vulnerability assessments?

No, there are no specific requirements in this respect.  Notwithstanding, listed companies are required, under the United kingdom Corporate Governance Code, to set certain committees with responsibility for specific areas, such as audit.  Financial services companies may also exist required to have a risk committee.  These committees may, as role of their functions, conduct risk assessments that cover cyber chance.  The United kingdom of great britain and northern ireland Corporate Governance Code emphasises the board'due south responsibility to make up one's mind and assess the master risks facing the company.  This responsibility extends to a robust assessment of the visitor'due south emerging risks, which would comprehend cyber gamble.

Nevertheless, if a company processes personal data, the UK GDPR also imposes an obligation on that company to take appropriate technical and organisational measures (to secure the data) in lodge to demonstrate compliance with U.k. GDPR standards.  Depending on the nature and context of the information processing, it may be an appropriate technical and organisational measure to behave periodic cyber-take chances assessments and perform penetration or vulnerability assessments.  For example the ICO'south online guidance on security contains a (non-binding) checklist for companies to assess compliance.  At the time of writing, this ICO checklist recommends organisations to: (i) regularly review their data security policies and measures; and (ii) acquit regular testing and reviews of their security measures to ensure they remain effective.

5.3        Are companies (whether listed or private) subject to any specific disclosure requirements (other than those mentioned in department 2) in relation to cybersecurity risks or Incidents (due east.g. to listing regime, the market or otherwise in their annual reports)?

Nether the Disclosure Guidance and Transparency Rules set out in the FCA Handbook, listed companies are required to disclose an Incident if the Incident amounts to inside information that may impact the company's share price.  For example, theft of business-critical intellectual property is likely to be cost-sensitive information.

There are other full general annual written report requirements that do not explicitly reference cybersecurity merely may encourage the reporting of Incidents (depending on the nature of the Incident).  For example, every bit per the Companies Act 2006, the purpose of the strategic report is intended to inform shareholders and help them assess how directors have performed their duty to promote the success of the visitor (which may include their response to a major Incident).

The United kingdom of great britain and northern ireland Corporate Governance Lawmaking (applicable to premium listed companies) also requires that the lath conducts a robust cess of the company'south emerging and principal risks, and provides a description of its principal risks and an explanation of how such risks are being managed in its annual written report.  Though cybersecurity is not explicitly referenced, an Incident may be relevant to the annual study if it represents a principal risk to the company.

6. Litigation

6.one        Please provide details of any civil or other individual actions that may exist brought in relation to any Incident and the elements of that action that would demand to be met.

There are a number of potential ceremonious actions that may be brought in relation to whatever Incident, for example:

• Breach of confidence.  Where at that place is unauthorised disclosure or use of data and: (i) the data itself had a necessary quality of conviction virtually it; (ii) that information was imparted in circumstances importing an obligation of conviction; and (three) at that place was an unauthorised apply of that information to the detriment of the party communicating it.
• Breach of contract.  This could accept any form, including a alienation of a commercial contract or breach of an employee's terms and conditions of employment.  For case, if a party has contractually agreed or warranted that information technology complies with an ISO standard, a failure to do and so will exist a breach of contract.
• Breach of trust.  A person who owes a fiduciary duty to some other may non place him or herself in a situation where they have a personal involvement that may conflict with the interest of the person to whom the fiduciary duty is owed.  If an Incident is caused by an employee or a director, a breach of trust/fiduciary duty may be claimed.  Quack assistance may be claimed where at that place is a fiduciary relationship and dishonest assistance has been given past a third political party to the breach of trust.
• Causing loss by unlawful means.  A defendant will be liable for causing loss by unlawful ways where they intentionally cause loss to the claimant past unlawfully interfering in the liberty of a tertiary political party to bargain with the claimant.
• Compensation for breach of the Data Protection Act 2022 (and U.k. GDPR).  Individuals who suffer "material or non-fabric harm" past reason of any contravention, by a data controller, of any requirements of the Data Protection Human action 2022 (including the U.k. GDPR) are entitled to compensation for that harm.  "Not-textile impairment" includes distress.  This does not require the claimant to bear witness pecuniary loss.
• Conspiracy.  The economical tort of conspiracy requires there to be two or more than perpetrators who are legal persons who conspire to practise an unlawful deed, or to a lawful deed but by unlawful means.
• Conversion.  The tort of conversion may cover unauthorised interference with personal information and other property.
• Cant.  At that place are 4 elements: (i) the defendant makes a false representation to the claimant; (ii) the defendant knows that the representation is false or is reckless as to whether it is true of fake; (iii) the accused intends that the claimant should act in reliance on it; and (iv) the claimant does human activity in reliance of the representation and suffers loss equally a consequence.
• Directors' duties.  See the answer to question 4.i to a higher place.
• Infringement of copyright and/or database rights.  Copyright is infringed when a person, without say-so, carries out an infringing act under the Copyright, Designs and Patents Act 1988, such equally copying the work or communicating the piece of work to the public.  Database rights are infringed if a person extracts or re-utilises all or a substantial office of a database without the owner's permission.
• Misuse of individual information.  Like to a breach of confidence, but removing the need for the claimant to institute a relationship of conviction.  The cause of action may be improve described as a right to informational privacy and to control broadcasting of information about i's individual life.
• Negligence may exist claimed where the defendant owed a duty of intendance to the claimant, breached that duty of care and that alienation caused the claimant to suffer a recoverable loss.
• Trespass is the intentional or negligent interference with personal appurtenances.  A deliberate endeavour through the internet unlawfully to manipulate data on a computer may corporeality to trespass to that figurer.

half-dozen.2        Please cite any specific examples of published civil or other private actions that have been brought in your jurisdiction in relation to Incidents.

The following are illustrations of cases that have been brought that can be said to relate to Incidents.

Breach of confidence and various economic torts

Ashton Investments Ltd v OJSC Russian Aluminium (Rusal) [2006] EWHC 2545 (Comm): there was a good arguable case justifying service out of the jurisdiction, in respect of claims for breach of confidence, unlawful interference with business concern, and conspiracy where a figurer server in London had allegedly been improperly accessed from Russian federation and confidential information and privileged information had been viewed and downloaded.

Contract

Bristol Groundschool Ltd v Intelligent Information Capture Ltd [2014] EWHC 2145 (Ch): a contract relating to the development of figurer-based airplane pilot training materials was a "relational" contract containing an unsaid duty of good faith.  One party had behaved in a commercially unacceptable manner in accessing the other party's computer and downloading information, but its acquit was not repudiatory.

Borderland Systems Ltd (t/a Voiceflex) v Frip Finishing Ltd [2014] EWHC 1907 (TCC): an internet telephony provider'due south customer whose calculator network had been hacked was not liable to pay the bill incurred by unauthorised tertiary parties.

Trespass

Arqiva Ltd & Ors v Everything Everywhere Ltd & Ors [2011] EWHC 1411 (TCC): obiter reference to Clerk & Lindsell on Torts (20^th Edition) at paragraphs xix-02 and 17-131.  At paragraph 19-02, the authors land the proposition that "one who has the right of entry upon another'due south land and acts in excess of his right or afterwards his correct has expired, is a trespasser".  At paragraphs 17–131, the authors refer to "Cyber-trespass" and say that "[w]hile the definition of corporeal personal property may normally be straightforward, questions may nevertheless arise in a number of borderline cases, in particular in respect of electronic technology.  For example, information technology is hard to meet why a deliberate try through the net unlawfully to dispense data on a estimator should not amount to trespass to that computer".

Compensation for alienation of the Information Protection Deed 2022 (and Great britain GDPR)

Wm Morrisons Supermarket PLC v Diverse Claimants [2020] UKSC 12: although determined nether previous legislation, in the first group litigation data breach case to come earlier the courts, Morrisons Supermarket was, following an entreatment, constitute non to be vicariously liable for a deliberate data breach carried out past a rogue employee, out of working hours and at home on a personal computer.  The ICO had, separately, ended an investigation into the data breach and found that Morrisons had discharged its own obligations as required under the Information Protection Act 1998 and mutual law.  At first instance, the court ended that Morrisons had no primary liability in respect of the breach, but there was nonetheless a sufficient connection (as the rogue employee accessed the data in question in the form of his employment) for Morrisons to have vicarious liability.  However, this position was overturned on entreatment to the Supreme Court.

half dozen.3        Is in that location any potential liability in tort (or equivalent legal theory) in relation to failure to prevent an Incident (e.chiliad. negligence)?

Please see the list in response to question five.1 in a higher place.

vii. Insurance

7.1        Are organisations permitted to take out insurance against Incidents in your jurisdiction?

Aye, organisations are permitted to take out insurance against Incidents.

7.ii        Are there whatever regulatory limitations to insurance coverage against specific types of loss, such every bit business interruption, system failures, cyber extortion or digital asset restoration? If and so, are there whatever legal limits placed on what the insurance policy can encompass?

No, there are no regulatory limitations.

8. Investigatory and Constabulary Powers

8.1        Delight provide details of any investigatory powers of law enforcement or other authorities nether Applicative Laws in your jurisdiction (e.grand. antiterrorism laws) that may exist relied upon to investigate an Incident.

Law enforcement authorities have diverse surveillance powers under United kingdom of great britain and northern ireland laws.  For example, the Police Act 1997 authorises covert entry into and interference with communications systems by the law, and like powers are available to the security services under the Security Service Deed 1989 and the Intelligence Services Act 1994.

Other powers of surveillance and interception of communications information are bailiwick to the IPA 2022 and RIPA.  For example, the IPA 2022 allows sure public authorities to issue targeted interception warrants, bulk interception warrants, targeted examination warrants, and mutual assistance warrants.  Targeted interception warrants can authorise any activeness by authorised public bodies for obtaining secondary data and can compel private bodies (including telecommunications operators) to assist public authorities in conducting intelligence-gathering activities.  Certain warrants nether the IPA 2022 require dual ministerial and judicial approval, or (in add-on), Prime Ministerial approval.

8.2        Are there any requirements nether Applicable Laws for organisations to implement backdoors in their Information technology systems for police enforcement authorities or to provide law enforcement authorities with encryption keys?

The RIPA, as amended by the IPA 2016, empowers public authorities to require disclosure of a decryption central to enable information technology to admission – i.e. put into an accessible form – encrypted electronic material in its possession (where it has obtained such information lawfully) or where information technology is likely to obtain such electronic information lawfully.  The relevant authorised public bodies tin can: (i) require disclosure of protected information in an intelligible class; (ii) require disclosure of the means to admission the protection data; (iii) require the ways of putting protected information into an intelligible course; and (iv) hogtie the person disclosing to secrecy (to prevent tipping-off).  The powers extend to electronic data, which without the decryption, cannot (or cannot readily) be accessed or placed into an intelligible grade.

Demands for an encryption fundamental under the RIPA (equally amended by the IPA 2016) are subject to judicial authorisation, or a warrant issued by the Secretarial assistant of State or gauge, or authorisations under the Police Deed 1997.  Authorised public bodies can also seek encryption fundamental demands via a targeted equipment interference warrant under the IPA 2016.

The IPA 2022 – every bit supplemented by the Investigatory Powers (Technical Adequacy) Regulations 2022 (SI 2018/353) – allows the Secretary of Land to place obligations on telecommunications operators (or postal operators) to install permanent interception capabilities through "technical adequacy notices" (TCN).  The purpose of a TCN is to ensure that when a warrant is served, or an authorisation or notice given, the company tin can give effect to it securely and quickly.

The International Comparative Legal Guides and the International Business Reports are published by: Global Legal Grouping

My U.S. based insurance agency specializes in providing insurance for firms with worldwide operations. The content on the Global Legal Grouping website has been a wealth of information in helping our clients to admission their worldwide products liability exposures in multiple jurisdictions. I recommend Global Legal Grouping to my clients who need counsel in this specialized area.
John Sadler, President - SADLER & Visitor INC., U.s.

landrumthisectoulto1993.blogspot.com

Source: https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/england-and-wales