Communications policy

Regulatory and institutional structure

Summarise the regulatory framework for the communications sector. Do any foreign ownership restrictions apply to communications services?

Communications law and regulation in the UK is principally founded on the Communications Act 2003 (the Act). This legislation implemented a number of EU laws aimed at harmonising, simplifying and increasing the usability of telecoms regimes across all European Union member states. The Act also grants authority to the Office of Communications (Ofcom), the UK’s national regulatory authority for communications.

The role of Ofcom is to set and enforce regulatory rules in all sectors for which it is responsible and, along with the Competition and Markets Authority (CMA) (see question 28), to promote fair competition across the industry by enforcing competition laws.

As part of Ofcom’s regulatory principles, Ofcom must take the least intrusive approach to intervention and will only do so where the intervention would be evidence-based, proportionate, consistent and transparent.

Although Ofcom is accountable to Parliament, the Department for Culture, Media and Sport is the UK government department with overall responsibility for developing the telecoms regulatory framework within the UK. Ofcom is restricted to acting within the powers conferred on it by Parliament.

The proposed Ofcom 2019/2020 Annual Plan focuses on supporting investment in infrastructure (moving towards universal availability of high quality and secure communication networks), maintaining high quality broadcast content for audiences, protecting consumers from harmful pricing practices, and reviewing their approach to the potential regulation of harmful online content.

Although there are currently no restrictions on foreign ownership of telecoms services within the UK, the current UK government pledged to introduce new rules on foreign control for the telecoms industry as part of its election manifesto in May 2017.

If the UK leaves the EU without a deal in place, parts of the UK electronic communications regulatory framework would no longer be appropriate without corrections. For example, the requirement to notify matters to the European Commission would not be applicable because the UK would cease to be a member of the EU. On 13 September 2018, the UK government published guidance for the telecoms industry, which stated that, under the EU Withdrawal Act 2018, it would correct references within the UK’s regulatory framework to EU bodies, processes and legislation, to ensure that the regulatory framework remains operable come exit-day. At the time of writing, the draft Electronic Communications (Amendment etc) (EU Exit) Regulations 2019 had been laid before the UK Parliament and the Broadcasting (Amendment) (EU Exit) Regulations 2019 had been made but were not in force. Both of these statutory instruments would amend certain deficiencies within the Communications Act 2003.

Authorisation/licensing regime

Describe the authorisation or licensing regime.

The general authorisation regime under the Act does not make a distinction between fixed, mobile and satellite networks and services. All electronic communications networks (ECNs), electronic communication services (ECSs) and associated facilities (AFs) fall under the scope of the Act, irrespective of the means of transmission. Moreover, under the general authorisation regime, there is no requirement for specific licensing of ECNs, ECSs and AFs.

The broad definition of ECN to include any transmission system for the conveyance of signals between a transmitter, a medium and a receiver, by use of electrical, magnetic or electromagnetic energy, is in line with the EU’s overarching principle of technology neutrality. Equally widely defined, an ECS is a service that has as its principal feature the conveyance of signals by means of an ECN, excluding content services (the provision of material such as information or entertainment). Under the Act, an AF is a facility, element or service that is, or may be, used to enable the provision of an ECN or ECS or other services on that network or service, or supports the provision of such services.

ECNs or ECSs are able to provide networks or services to the public without the need for prior authorisation from Ofcom where they have complied with the General Conditions of Entitlement (the General Conditions). A revised version of the General Conditions came into force on 01 October 2018. In more limited circumstances, the ECNs or ECSs may also need to comply with specific conditions. The General Conditions apply to ECNs irrespective of whether a provider owns or rents some or all of the network in question. The ECS will generally be the entity with a direct contractual relationship with the end user, or the reseller or other intermediary in the case of a wholesale provider. Ofcom provides further guidelines on which organisations will fall within these categories.

Entities using radio spectrum, such as mobile network operators or satellite service providers, will require the grant of a licence from Ofcom under the Wireless Telegraphy Act 2006 (the WTA). Each grant will detail the specific frequency, use, fees and duration of the licence. Some services, such as receive-only earth stations, may not fall within the scope of the WTA licence condition, but still require Ofcom to authorise any such use under a scheme of recognised spectrum access. Operators of set-top boxes that convert signals for viewing will also need an operating licence under the Broadcasting Act 1996. The use of certain frequencies in the radio spectrum for short-range devices, such as alarms and radio frequency identification equipment, is exempt from the need to obtain licences.

Ofcom’s approach to spectrum award is to allow the market as much flexibility in how the spectrum is used without assigning it to a particular technology or application. While spectrum licences are most commonly awarded via auction, Ofcom is able to design these in such a way as to ensure that there is the greatest possible competition within the market. The UK’s 4G spectrum was auctioned by Ofcom in 2013, with a further 4G and 5G spectrum auction in April 2018.

There are currently 17 General Conditions in force, the majority of which must be complied with by all ECNs and ECSs. The remainder apply in more limited circumstances, such as for public pay telephones. The most recent iteration of the General Conditions was published on the Ofcom website on 01 October 2018. Under the Act, Ofcom has the power to amend or revoke any of the General Conditions as appropriate.

In the smaller number of cases where an ECN or ECS is subject to specific conditions, Ofcom will notify that provider of the fact that those conditions are to be imposed. A summary of the main types of specific condition is given below.

Universal service conditions

The basis for this condition is to ensure that everyone within the UK is afforded basic access to telephony. In the UK, the designated service providers are KCOM in the Hull area and BT for the rest of the UK. See question 6 for more detail.

Access-related conditions

To ensure end-to-end connectivity for end users through the interconnection of different networks, Ofcom may impose specific conditions relating to access on ECNs.

Privileged supplier conditions

Where a supplier has special or exclusive rights in relation to the provision of any non-communications service (services other than ECNs or ECSs) then Ofcom must ensure that the privileged supplier complies with specific accounting requirements under the Act.

Significant market power conditions

An operator will have significant market power (SMP) if it is in such a position to act independently of its competitors and consumers or end users. See question 4 for more detail.

Licence duration

Licences issued by Ofcom under the WTA have varying durations depending on the type of licence granted. The mobile 3G licences granted in 2000 were subject to a fixed term of 20 years. Following the WTA (Directions to Ofcom) Order 2010, and subsequent consultation by Ofcom, mobile licences will continue for an indefinite period but be subject to annual renewal fees. ECNs and ECSs provided under the general authorisation regime are not subject to licensing requirements and, therefore, there is no set licence duration applicable to the provision of ECNs and ECSs.

Modification of licences

Although ECNs and ECSs will not be subject to any direct licence modification, under the Act Ofcom may impose changes to the General Conditions or specific conditions from time to time. The Act requires that Ofcom publish a notice, outlining the proposed changes and justifying its reasons for these, providing a period for proposals from those providers affected of not less than one month. Variations to SMP conditions are subject to additional requirements, including consultation with the European Commission and the EU independent advisory body for telecoms regulations, the Body of European Regulators in Electronic Communications (BEREC). Licences under the WTA may be varied by Ofcom providing written notice to the licence holder or publishing a general notice to all holder of a class of licence.


As a result of the passing of the Digital Economy Act 2017, Ofcom is entirely funded through industry fees and charges. Communications service providers (with a revenue of more than £5 million) must pay a fee based on 0.1160 per cent of relevant turnover for the year ending 31 December 2016. Operators that have code powers under the Electronic Communications Code (conferring benefits such as not having to apply for a street works licence to install certain equipment) will also have to pay an annual fee to Ofcom. The charge for 2018/2019 was £1,000. Operators also have to pay a one-off charge of £10,000 for Ofcom’s cost of dealing with the application for code powers.


Ofcom has the power under the WTA to set fees in relation to wireless telegraphy licences, other than for those awarded by auction. Under the WTA, Ofcom is able to prescribe ‘Administered Incentive Pricing’, allowing for fees to be set at above administrative costs so as to encourage efficient use of the spectrum. Ofcom must set out the fees through published regulations. Ofcom is able to either update existing regulations or publish new ones. Since the Wireless Telegraphy (Licence Charges) Regulations 2011, Ofcom has taken the former approach of prescribing new fees by means of updates. The latest changes were made in 2016. Ofcom held consultations on proposed Annual Licence Fees for mobile network operators of 900MHz and 1800MHz frequency bands, which closed on 3 August 2018 and for UK Broadband’s 3.4GHz and 3.6GHz spectrum, which closed on 11 February 2019. See Ofcom’s website for more details.

Television and radio

Ofcom also charges licence fees for the radio and television sectors. The percentage of annual turnover payable varies according to the turnover of the operator. Further details can be found on Ofcom’s website.

Public Wi-Fi

The Investigatory Powers Act 2016 (IPA) applies to public Wi-Fi providers, which may result in them being required to retain and disclose communications data to authorities.

Flexibility in spectrum use

Do spectrum licences generally specify the permitted use or is permitted use (fully or partly) unrestricted? Is licensed spectrum tradable or assignable?

In its 2014 Spectrum Management Strategy statement, Ofcom highlighted the importance of providing as much flexibility as possible in spectrum licence conditions to liberalise the rights of the licensee, allowing that user to re-purpose the use of its spectrum without needing to seek a licence variation. Subject to certain boundaries (such as interference risks), licensees are afforded the ability to determine how that licence should be used without referral to Ofcom. Defining interference parameters remains an important tool for allowing licence owners to understand how they can use their own network and the possible interference levels they may experience. In its 2014 statement, Ofcom indicated that the process of liberalising certain classes of mobile and business radio services was already complete.

Spectrum trading

Spectrum trading is allowed in the UK, with the prior consent of Ofcom only required for the trading of mobile licences. The laws governing such trading are: the WTA, the Wireless Telegraphy (Spectrum Trading) Regulations 2012 (the Trading Regulations) and the Wireless Telegraphy (Mobile Spectrum Trading) Regulations 2011 (the Mobile Trading Regulations). The parties to the transfer must notify Ofcom with certain information about the trade before Ofcom can then publish a notice setting out information on the trade and basic details about the licence. For mobile transfers, Ofcom must consent to the transfer, possibly giving further directions to the parties. Ofcom is consulting on an update to the Mobile Trading Regulations to include 700MHz and 3.6-3.8GHz bands in preparation for the future rollout of 5G mobile connectivity. The consultation closed on 12 March 2019. Certain types of partial transfers are also permissible under the Mobile Trading Regulations, although these may be restricted to limit the number of available licences in the band.

Ex-ante regulatory obligations

Which communications markets and segments are subject to ex-ante regulation? What remedies may be imposed?

Ofcom has powers to impose ex-ante regulations on markets where that market is found not to display effective competition. The range of markets that the EU believes should be subject to ex-ante regulation has been reduced over the years to just four:

  • wholesale call termination on individual public telephone;
  • wholesale voice call termination on individual mobile networks;
  • wholesale local access provided at a fixed location or wholesale central access provided at a fixed location for mass-market products; and
  • wholesale high-quality access provided at a fixed location.

Jurisdictions may, however, extend the number of markets. As discussed in question 2, under these ex-ante regulatory powers, Ofcom may impose certain SMP conditions on a communications provider where that provider is deemed to have SMP such that it is able to dominate a market. In 2002, the European Commission published guidance on how national regulators should approach imposing SMP conditions on a provider. Following a consultation by the European Commission in June 2017, revised draft guidelines were published by the European Commission in February 2018 to reflect the changes to EU competition law generally as well as changes to the telecoms sector. The European Commission launched a consultation on 15 February 2019 (which closes on 10 May 2019) to review the relevant markets in the electronic communications sector, to take into account major market and technological developments (such as the deployments of 5G networks, internet-based applications and services, the convergence between different types of networks and services and the development of Next Generation Access Networks and Services). The results of the consultation are expected to inform a new recommendation on relevant markets that will be adopted by 21 December 2020. At the time of writing, it is unclear whether the UK will adopt the recommendations on relevant markets because of uncertainty in relation to the outcome of the Brexit process.

SMP conditions may only be imposed on a communications provider where the relevant market has been properly identified and reviewed by Ofcom, and, where necessary, a consultation with the European Commission and BEREC has been undertaken. Under the EU framework, Ofcom must review these markets, along with any other markets it deems necessary, every three years. The current position is as follows:

  • wholesale broadband access (WBA) markets - Ofcom consulted in 2017 and its preliminary conclusion was that BT retained SMP in a small proportion of the WBA market;
  • business connectivity markets - on 02 November 2018 Ofcom published a draft consultation following its latest review of the business connectivity market and is expected to publish a final statement in Spring 2019;
  • mobile call termination markets - Ofcom published a statement in March 2018 with network access and charge control obligations imposed on mobile operators;
  • narrowband markets (a review of the products and services underpinning the delivery of retail fixed telephony services in the UK) - Ofcom published a statement in November 2017 applying SMP conditions to BT and KCOM in Hull; and
  • physical infrastructure market - Ofcom has set out proposals to give companies unrestricted access to Openreach’s network of underground ‘ducts’ and telegraph poles.

On 6 February 2019, Ofcom imposed reporting directions across all markets in which KCOM is regulated (the wholesale local access market, the business connectivity markets, the narrowband markets and the wholesale broadband access market).

In the event of the UK leaving the EU without a deal, Ofcom’s decision making in relation to SMP markets and related conditions will no longer be subject to the oversight of the European Commission.

Structural or functional separation

Is there a legal basis for requiring structural or functional separation between an operator’s network and service activities? Has structural or functional separation been introduced or is it being contemplated?

In 2005, BT gave binding undertakings to Ofcom under the Enterprise Act 2002 (the EA) under which it agreed to implement a ‘functional separation’ of its network division - Openreach - from the rest of the BT group. Organisational boundaries and information barriers comprised the basis of this functional separation, with Openreach obliged to deliver products providing access to the ‘first mile’ infrastructure to all communications providers on a non-discriminatory basis.

The status and operation of Openreach was reviewed in 2016 with Ofcom considering proposals, including retaining functional separation with increased independence of Openreach’s governance, along with stricter access and quality requirements for Openreach (following a number of criticisms levelled at BT for abuse of their Openreach monopoly, underinvesting in the UK’s broadband infrastructure and charging high prices with correlating poor customer service). Following Ofcom’s announcement of its intention to file a formal notification to the European Commission to commence the separation process, in March 2017, BT Group agreed to implement a legal separation of Openreach from the BT group. On 31 October 2018, Ofcom published a notice confirming that BT was released from its Enterprise Act undertakings given in respect of Openreach.

Universal service obligations and financing

Outline any universal service obligations. How is provision of these services financed?

As mentioned in question 2, under the Universal Service Order (SI 1904/2003) (USO) BT and KCOM must comply with conditions aimed at ensuring the provision of universal service. The obligations include: special tariff schemes for low-income customers, reasonable geographic access to public call boxes, a connection to the fixed network (including functional internet access), as well as the provision of a text relay service for customers with hearing impairment. There is no universal service funding and the costs to fulfil the obligation are borne by BT and KCOM on the basis that the revenue generated by supplying the services exceeds the costs of providing them.

The Digital Economy Act 2017 established a USO for a legally binding minimum level of broadband service with a connection of at least 10Mbps and upload speeds of at least 1Mpbs by giving each household and business a new legal right to demand an affordable broadband connection up to a reasonable cost threshold. With the Broadband Delivery UK (BDUK) programme (as referred to in question 11) expected to bring fixed-line superfast broadband to 97 per cent of the UK by 2020, the USO will be geared towards achieving the final 3 per cent. While a 30Mbps USO was dropped, despite being voted through the House of Lords, a new mechanism was nonetheless introduced that will allow the UK government, once 75 per cent of households have upgraded to a ‘superfast broadband’ service, to raise the USO’s minimum speed beyond 10Mbps. With regard to funding this new obligation, a final public consultation will be needed to decide the exact specification and funding mechanism to be employed. The Electronic Communications (Universal Service) (Broadband) Regulations 2018, which came into force on 4 December 2018, set out the process Ofcom will use to designate the persons it considers as universal service providers and to whom broadband conditions are to be applicable.

Number allocation and portability

Describe the number allocation scheme and number portability regime in your jurisdiction.

Under European law, end users have a right to keep their original telephone number when switching communications provider. In accordance with its powers under the Act, Ofcom has laid out the conditions for number portability under General Condition B3. Under this condition, an end user’s original service provider must provide them with a Porting Authorisation Code in the shortest possible time when requested. The end user may then pass this code to a new provider and the porting must then take place within one business day.

Ofcom has, however, outlined its preferred view that number portability should, in fact, be ‘gaining-provider led’. Under this approach, the transfer of a number would be controlled by the new provider, with the consumer only needing to contact this party. Ofcom believes that this would allow for easier and quicker transferring of numbers. Ofcom started a consultation on the mobile switching process (including number portability) in 2016/2017 and in December 2017 published the decision to reform the process for switching mobile provider. In January 2019, further guidance was published relating to requests for switching multi-SIM contracts and accounts. See the Ofcom website for more details.

Customer terms and conditions

Are customer terms and conditions in the communications sector subject to specific rules?

Part C of the General Conditions impose consumer protection conditions. Condition C1 imposes minimum information provision requirements in consumer contracts, including a maximum initial duration of two years and conditions for termination. One of the matters to be disclosed includes details of prices and tariffs, which is further extrapolated under Condition C2. Under this Condition all ECN operators must make available, clear and up-to-date information on their prices and tariffs, as well as on their standard terms and conditions of access to, and use of, publicly available telephone services.

Condition C4 and the Act further require that dispute resolution mechanisms provided by the communications provider or otherwise are accessible to their domestic and small business customers (ie, businesses with 10 or fewer employees). The two dispute resolutions schemes approved by Ofcom for this purpose are the Ombudsman Services and the Communication and Internet Services Adjudication Scheme.

Net neutrality

Are there limits on an internet service provider’s freedom to control or prioritise the type or source of data that it delivers? Are there any other specific regulations or guidelines on net neutrality?

The 2015 EU Roaming and Open Internet Access Regulation (the 2015 Regulation) (implemented in the UK by the Open Internet Access (EU Regulation) Regulations 2016 - necessary for the purposes of designating Ofcom as the UK national regulatory authority) prohibits discrimination, interference or paid prioritisation affecting end-user access. It includes transparency rules requiring internet access services to publish information on any traffic management measure that could affect end users (in terms of quality, privacy and data protection), as well as information on fair use policies, actual speeds, data caps and download limits (among others). It further requires Ofcom to monitor and enforce the rules. Ofcom published its first report on compliance in June 2017, finding no major causes for concern but highlighting some areas in need of better ISP compliance. See the Ofcom website for more details.

The UK government has published a draft Open Internet Access (Amendment etc) (EU Exit) Regulations 2018 (draft SI) to address issues arising from the UK exiting the EU. The draft SI provides for amendments such as removing references to ‘national regulatory authority’, ‘common rules’ and requirements for Ofcom to follow requirements set by the European Commission and BEREC. Again, it is unclear whether the UK would adopt similar requirements post-Brexit.

Platform regulation

Is there specific legislation or regulation in place, and have there been any enforcement initiatives relating to digital platforms?

While there is, at present, no legislation or regulation specifically governing digital platforms in the UK, general authorisation provisions under the Act will apply. Ofcom’s remit covers the following platforms: digital terrestrial television, digital audio broadcasting (DAB), radio and video-on-demand (VOD) services. Any other digital platforms are subsequently only subject to general competition law and sector-specific regulations.

The complex nature of digital platforms and the difficulties in understanding their competitive effects has led the UK government and CMA to take a flexible and case-by-case approach to policing digital platforms.

The UK, along with a number of other member states, advised in an open letter dated 4 April 2016, that while the Commission is right to emphasise the importance of the issue of digital platforms and collect evidence to inform and define the role of such platforms within the Digital Single Market Strategy, care should be taken to avoid excessive regulation that could end up harming rather than furthering the initiative.

On 1 March 2018, the European Commission issued a Recommendation regarding measures to tackle illegal content online. On 26 April 2018 the Commission proposed an EU Regulation of fairness and transparency in online platform trading. These legislative instruments aim to address unfair contractual clauses in platform-to-business relationships, and make progress with procedural aspects and principles on removal of illegal content. The proposed regulation will apply to providers of online intermediation services and online search engines.

As part of the report published on 13 March 2019 by the Digital Competition Expert Panel, led by Jason Furman, ‘Unlocking digital competition’ (the Furman Report), the panel recommended that a new code of conduct should be established for companies designated as having ‘strategic market status’ on acceptable norms of competitive conduct on how they should act with respect to smaller firms and consumers. Further details on the report can be found in question 30.

Next-Generation-Access (NGA) networks

Are there specific regulatory obligations applicable to NGA networks? Is there a government financial scheme to promote basic broadband or NGA broadband penetration?

There is currently no legislation or regulation covering NGA networks in the UK. Indeed, Ofcom has stated its role is not to provide operators with incentives to make particular investments, but rather to attempt to ensure that the incentives for efficient investment are not distorted as a result of disproportionate regulation.

Pursuant to the undertakings entered into between BT and Ofcom in 2002, BT must allow its competitors access to its virtual unbundled local access points to foster competition over the supply of superfast broadband services to consumers. BT is also required to allow other providers the option of investing in NGA by giving access to its ducts and poles and other physical infrastructures. On 20 April 2017, Ofcom published a consultation on opening up BT’s infrastructure to improve access to Openreach’s underground ducts and poles for competing providers of fibre broadband.

There is a general EU prohibition restricting the UK government’s ability to invest directly in broadband infrastructure in the UK. However, the UK government is, through BDUK, supporting investment in: the provision of superfast broadband coverage to 95 per cent of the UK (achieved by December 2017); the provision of access to basic broadband (2Mbps) for all; and the stimulation of private investment in full fibre connections by 2021. The UK government announced, in November 2017, that local bodies could apply for funding for investment in fibre networks, the Local Full Fibre Network challenge fund. In August 2018, the third and final allocation of funding, worth £95 million, was opened up to bidding. At the time of writing, the UK government had confirmed nine winning bidders who cumulatively had secured £53 million of the total available.

Ofcom plays a key role in facilitating both investment and competition in superfast broadband. March 2017 saw Ofcom announcing plans to cut the wholesale price that Openreach can charge telecoms companies for its superfast broadband service to allow cheaper prices to be passed on to consumers and promote further competition and thus investment and development. The rules also include stricter requirements on Openreach to repair faults and install new broadband lines more quickly.

The Body of European Regulators for Electronic Communications (BEREC) released a draft report, dated 6 December 2018, concerning access to physical infrastructure in the context of market analyses, citing that physical infrastructure (such as ducts and poles) represent a significant proportion of the investment in NGA networks. The report emphasises the benefits of measures that are aimed at facilitating greater use of existing physical infrastructure that can reduce the civil engineering works required to deploy new networks, significantly lowering costs. In time, this may see regulatory change around access to physical infrastructure supporting NGA networks.

Data protection

Is there a specific data protection regime applicable to the communications sector?

The General Data Protection Regulation (GDPR) governs data protection in the UK with effect from 25 May 2018. The GDPR generally imposes more stringent compliance obligations on both data controllers and data processors, alongside more onerous information requirements, to ensure that the personal data of data subjects is afforded an adequate level of protection. The scope of the regulation is also expanded and may, therefore, affect telecoms providers located outside the EU.

The GDPR is supplemented by the Data Protection Act 2018 (DPA), which received Royal Assent on 23 May 2018 and came into force on 25 May 2018. The purpose of the DPA includes: incorporating elements of the GDPR into UK law, meaning that the UK and EU data protection regimes are aligned after Brexit (which may increase the likelihood of an adequacy decision from the Commission); exercising derogations to the GDPR in certain areas; clarifying the role of the Information Commissioner’s Office (ICO); and consolidating data protection enforcement, by increasing fines and introducing two new criminal offences.

The GDPR is complemented by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended) (the PEC Regulations). The PEC Regulations (which implement E-Privacy Directive (2002/58/EC)) provide for measures such as the safeguarding of security of a service by public ECSs; notice requirements, should there be any breaches of security; prohibitions on unsolicited or direct marketing communications; restrictions on the processing of user identity and location; and how long personal data may be held or held without modification.

In 2017, the European Commission published a draft of the E-Privacy Regulation to bring the provisions of the existing E-Privacy Directive in line with the GDPR and to take account of technology changes. Failure to comply with either of these Regulations could lead to fines being imposed on a business of the higher of 4 per cent of worldwide annual turnover or €20 million. If the E-Privacy Regulation has not come into effect prior to the UK’s departure from the EU, then it will not form part of UK law automatically by virtue of the Withdrawal Act. In this case, organisations may need to comply with dual regimes under UK and EU law to the extent that the E-Privacy Regulation differs from the PEC Regulations.

The IPA deals with data retention, interception and acquisition. Some of the key changes introduced by this legislation included: an extension of government powers to require telecoms operators to retain data about users including their web-browsing history; the potential for communications providers to be prevented from implementing end-to-end encryption of user data; and an expansion of the types of operators that will be affected by such investigatory powers to include by public and private telecoms operators. The UK government is legislating to bring elements of the IPA into force (the most recent update being on 4 February 2019) but the IPA is also being challenged in the courts and in November 2018 a human rights group won the right to a judicial review of Part 4 of the IPA, which gives government agencies powers to collect electronic communications and records without reason for suspicion.

Additionally, Ofcom offers guidance as to how communications providers should implement technical and organisational security measures to manage the security risks of public ECNs and ECSs. This guidance was updated in December 2017.


Is there specific legislation or regulation in place concerning cybersecurity or network security in your jurisdiction?

There is no single piece of legislation or regulation in place concerning cybersecurity or network security in the UK. It is instead covered by several pieces of legislation, such as the Act, PECR, GDPR and also the Network and Information Systems Regulations 2018 (NIS Regulations). The NIS Regulations impose cybersecurity and incident reporting obligations on two classes of operator in the UK: relevant digital service providers; and operators of essential services (provided they operate in certain sectors and meet threshold requirements).

The Act requires public ECN and ECS providers to take appropriate technical and organisational measure to manage the ECNs and ECSs, the focus of which is to minimise the impact of security breaches on end users and on the interconnections of public electronic communications networks. The Act also imposes a number of notification requirements on these providers. The PEC Regulations similarly impose obligations on public ECSs to ensure that personal data is handled appropriately and subject to appropriate security policies.

Under the GDPR (see question 12) data controllers and data processors have to ensure that appropriate technical and security measures are put in place when handling a data subject’s personal data.

Big data

Is there specific legislation or regulation in place, and have there been any enforcement initiatives in your jurisdiction, addressing the legal challenges raised by big data?

While general data protection legislation applies to big data, no particular UK legislation or regulation covers big data specifically. However, a number of inquiries have been conducted by UK bodies into benefits and challenges arising from the exponential growth in the use of big data (and its link to the Internet of Things). In November 2018, the UK government created the Centre for Data Ethics and Innovation which aims to assist the UK government with identifying and addressing areas where clearer guidelines or regulation in relation to data and data-related technologies are needed.

Furthermore, the fallout from Cambridge Analytica harvesting data from Facebook on a large scale has turned the spotlight on big data collection and processing activities and, in November 2018, the ICO produced a report into this subject entitled ‘Investigation into the use of data analytics in political campaigns’.

In its Furman Report, the Digital Competition Expert Panel recognises the importance of data as a competitive tool in the UK’s digital market. Specifically, it has seen how digital markets can often tend towards concentration, with limited degrees of in-market competition, leading to significant barriers to entry because of the accumulation of data by incumbent firms. Some recommendations, therefore, seek to enable greater personal data mobility and systems with open standards. The Panel also encourages policies of data openness in granting access to non-personal or anonymised data to new market participants.

Data localisation

Are there any laws or regulations that require data to be stored locally in the jurisdiction?

There are no data localisation requirements in the UK. There are, however, rules in the GDPR that require personal data transferred outside the European Economic Area to be subject to ‘adequate protection’.

Key trends and expected changes

Summarise the key emerging trends and hot topics in communications regulation in your jurisdiction.


As noted in question 1, the Act, and much of the regulation surrounding the telecoms market, has its foundations in EU law. Following the UK’s decision to leave the EU on 23 June 2016 (Brexit), it is somewhat unclear how the regulatory system will operate after the UK leaves the EU. Although there is unlikely to be any immediate change to the relevant existing UK legislation, Ofcom will not be subject to EU oversight and the considerations that influence its regulation of the market will likely be more UK-centric as a result. Consequently, it is possible that a more divergent approach will be seen between the UK and the EU over time. For example, aspects such as the general conditions and specific conditions could be altered to better serve the interest of the UK public, rather than having a broader EU focus.

In March 2018, the EU Commission published a summary of the likely implications of Brexit on communications service providers. In summary:

  • communications service providers established in the UK would cease to benefit from the general authorisation regime in the EU-27 member states (and vice versa); and
  • fixed and mobile termination rate and roaming regulation would cease to apply to the UK and EU-27 relationship. As a result, call charges between the UK and EU-27 and roaming charges for visitors in either direction could increase.

Although the UK government has stated its commitment to certain areas of current and future EU legislation (such as the GDPR), the lack of certainty for many areas of the law means that any changes will have to be closely monitored in the future.

The European Electronic Communications Code (EECC) (Directive 2018/1972) came into force on 20 December 2018. This Directive will replace and reform existing directives (the Framework Directive (Directive 2002/21/EC), the Authorisation Directive (Directive 2002/20/EC), the Access Directive (Directive 2002/19/EC) and the Universal Service Directive (Directive 2002/22/EC), which were all transposed into UK law through national legislation (mainly the Communications Act 2003 and Wireless Telegraphy Act 2006) and incorporate them into a single document on 21 December 2020. The UK government indicated in its ‘no deal Brexit’ technical notice on telecoms that if the Code is adopted before exit day but with a transposition date post-exit it would be minded to implement the Code’s substantive provisions according to a similar timetable.

Spectrum changes

Spectrum allocation and bandwidth remains a major issue in the UK market both to manage existing capacity and coverage constraints and requirements, but also to prepare for 5G service roll out. Ofcom expects to start taking applications for an auction for the 700MHz and 3.6-3.8GHz spectrum bands in December 2019.

Ofcom Proposed Annual Plan 2019/20

The Ofcom Proposed Annual Plan for 2019/20 focuses on:

  • moving towards universality in broadband and mobile service;
  • promoting investment in fibre network infrastructure;
  • spectrum auctions (see above);
  • preparing for the launch of 5G mobile services;
  • building cyber-security capability and ensuring providers are managing security risks;
  • review of the BBC’s news and current affairs output; and
  • improving pricing for bundled mobile airtime and handset contracts.

There have also been important market reviews conducted by Ofcom that aim to assess and address competition issues in the fixed line and mobile markets (see question 4).

Following the legal separation of BT and Openreach agreed in March 2017, Ofcom is continuing to monitor progress and plans to publish a report on the overall outcomes in 2020/21.