European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations, 2011

• Jurisdiction: Ireland
• Citation: IR SI 336/2011

CONTENTS

Regulation

1. Citation

2. Interpretation

3. Services to which these Regulations apply

4. Security of processing

5. Confidentiality of communications

6. Traffic data

7. Itemised billing

8. Presentation and restriction of calling and connected line identification

9. Location data other than traffic data

10. Exceptions

11. Automatic call forwarding

12. Directories of subscribers

13. Unsolicited communications

14. National Directory Database

15. Technical features and standardisation

16. Internal procedures where the scope of rights and obligations are restricted and damages for contravention of Regulations

17. Commissioner’s powers of enforcement

18. Power to require information

19. Powers of authorised officers

20. Service of notices

21. Appeals to Circuit Court

22. Circumstances in which a person need not comply with an enforcement or information notice

23. Evidence in legal proceedings

24. Hearing of proceedings in private

25. Offences by officers of bodies corporate

26. Prosecution of offences

27. Penalties

28. Power to include requirements under these Regulations in codes of practice under the Act of 1988

29. Directions

30. Enforcement of Regulations by the Regulator

31. Application to the High Court

32. Appeals

33. Co-operation between Commissioner and Regulator

34. Transitional arrangements

35. Revocations

S.I. No. 336 of 2011

EUROPEAN COMMUNITIES (ELECTRONIC COMMUNICATIONS NETWORKS AND SERVICES) (PRIVACY AND ELECTRONIC COMMUNICATIONS) REGULATIONS 2011

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 5th July, 2011.

I, PAT RABBITTE, Minister for Communications, Energy and Natural Resources, in exercise of the powers conferred on me by section 3 of the European Communities Act 1972 (No. 27 of 1972) and for the purpose of giving effect to Directive 2002/58/EC of the European Parliament and of the Council of 12 July 20021 as amended by Directive 2006/24/EC of the European Parliament and of the Council of 15 March 20062 and Directive 2009/136/EC of the European Parliament and of the Council of 25 November 20093 , hereby make the following regulations:

Citation

1. These Regulations may be cited as the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011.

Interpretation

2. (1) For the purpose of these Regulations the definitions set out in Regulation 2(1) of the Framework Regulations apply.

(2) In these Regulations—

“Act of 1983” means Postal and Telecommunications Services Act 1983 (No. 24 of 1983);

“Act of 1988” means Data Protection Act 1988 (No. 25 of 1988);

“Act of 1993” means Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993 (No. 10 of 1993);

“Act of 2002” means Communications Regulation Act 2002 (No. 20 of 2002);

“Act of 2003” means Data Protection (Amendment) Act 2003 (No. 6 of 2003);

“Act of 2011” means Communications (Retention of Data) Act 2011 (No. 3 of 2011);

“automated calling machine” means an automatic calling machine or system which, when activated, operates to make calls without human intervention;

“blocking”, in relation to data, means so marking the data that it is not possible to process it for purposes in relation to which it is marked;

“Commissioner” means Data Protection Commissioner;

“communication” means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service, but does not include any information conveyed as part of a broadcasting service to the public over the electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information;

“consent” by a user or subscriber means a data subject’s consent in accordance with the Data Protection Acts and these Regulations;

“data” means automated data and manual data;

“data controller” means a person who either alone or with others controls the contents and use of personal data;

“Data Protection Acts” means Data Protection Acts 1988 and 2003;

“Data Protection Directive” means Directive 95/46/EC of the European Parliament and of the Council of 24 October 19954 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

“Directive on privacy and electronic communications” means Directive 2002/58/EC of the European Parliament and of the Council of 12 July 20021 as amended by Directive 2006/24/EC of the European Parliament and of the Council of 15 March 20062 and Directive 2009/136/EC of the European Parliament and of the Council of 25 November 20093;

“directory” means a directory of subscribers in printed or electronic form—

(a) that is available to members of the public, or

(b) information from which is available to members of the public by way of a directory enquiry service;

“EEA Agreement” means the Agreement on the European Economic Area signed at Oporto on 2 May 1992 as adjusted by the Protocol signed at Brussels on 17 March 1993;

“electronic mail” means any text, voice, sound or image message including an SMS message sent over a public communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient;

“enactment” means a statute or an instrument made under, or power conferred by, statute;

“enforcement notice” means a notice served under Regulation 17(4);

“European Economic Area” has the meaning assigned to it by the EEA agreement;

“Framework Regulations” means European Communities (Electronic Communications Networks and Services) (Framework) Regulations 2011 ( S.I. No. 333 of 2011 );

“information notice” means a notice served under Regulation 18(1);

“interconnection” means the physical and logical linking of public communications networks used by the same or a different undertaking in order to allow the users of one undertaking to communicate with users of the same or another undertaking, or to access services provided by another undertaking. Services may be provided by the parties involved or other parties who have access to the network. Interconnection is a specific type of access implemented between the public network operators;

“location data” means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service;

“National Directory Database” means the record of all subscribers of publicly available telephone services in the State, including those with fixed, personal or mobile numbers, who have not refused to be included in that record, kept in accordance with Regulation 19(4) of the Universal Service Regulations and these Regulations;

“operator” means a person designated by the Regulator under Regulation 7(1) of the Universal Service Regulations to provide a universal service (within the meaning of those Regulations) in respect of directory services referred to in Regulation 4 of those Regulations;

“personal data” means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller;

“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service in the European Union;

“processing”, of or in relation to information or data, means performing any operation or set of operations on the information or data, whether or not by automatic means, including—

(a) obtaining, recording or keeping the information or data,

(b) collecting, organising, storing, altering or adapting the information or data,

(c) retrieving, consulting or using the information or data,

(d) disclosing the information or data by transmitting, disseminating or otherwise making it available, or,

(e) aligning, combining, blocking, erasing or destroying the information or data,

and cognate words shall be construed accordingly;

“Regulations of 2003” means European Communities (Electronic Communications Networks and Services) (Data Protection and Privacy) Regulations 2003 ( S.I. No. 535 of 2003 );

“traffic data” means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof;

“unsolicited call” means a call that is not requested by the called party;

“unsolicited communication” means a communication that is not requested by the contacted party;

“user” means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;

“value added service” means any service which requires the processing of traffic data or location data other than traffic data beyond what is necessary for the transmission of a communication or the billing thereof.

(3) A word or expression that is used in these Regulations and that is also used in the Data Protection Directive, the Directive on privacy and electronic communications or in the Framework Regulations has, unless the context otherwise requires, the same meaning in these Regulations that it has in those Directives or in those Regulations.

(4) In these Regulations a reference to an enactment or Regulations shall be construed as a reference to the enactment or Regulations as amended by any subsequent enactment or Regulations, including these Regulations.

(5)(a) A reference in any...