# The Internet Domain Registry (Prescribed Practices and Prescribed Requirements) Regulations 2024, Regulation 2: Prescribed practices that are unfair or involve the misuse of internet domain names


(1) The practices in paragraph (2) are prescribed for the purposes of section 124O(3)(a) of the Communications Act 2003 (prescribed practices that are unfair or involve the misuse of internet domain names).
(2) The failure by a qualifying internet domain registry to—
(a) require, for example through its terms and conditions of use, that any person registering or seeking to register an internet domain name with the registry must not use or intend to use that internet domain name, for an activity listed in paragraph (3), and
(b) take steps to prevent or stop an internet domain name that is registered with that registry being used for an activity listed in paragraph (3) where the registry knows that it is being used for that activity or is intended to be used for that activity.
(3) The activities referred to in paragraph (2) are—
(a) intentionally causing the installation or execution of malware on a device, without authorisation;
(b) redirecting a user of the internet, without that user’s knowledge, to a fraudulent site or service;
(c) obtaining information from a person for use for a purpose to which that person has not consented;
(d) sending email for the purposes of sub-paragraphs (a)-(c);
(e) any activity that would constitute an offence under—
(i) section 1 of the Protection of Children Act 1978 (indecent photographs of children),
(ii) article 3 of the Protection of Children (Northern Ireland) Order 1978 (indecent photographs of children), or
(iii) section 52 of the Civic Government (Scotland) Act 1982 (indecent photographs etc. of children).
(4) In paragraph (3)(a)—
“malware” means software, whether self-operating or capable of being operated by a remote controller, which is capable of—
(a) disrupting a device’s operations,
(b) obtaining information, or
(c) gaining access to private computer systems;
“without authorisation” means that the person causing the installation or execution of the malware—
(a) is not a person who has responsibility for the device and is entitled to determine whether the installation or execution should be done, and
(b) does not have consent to the installation or execution from any such person.

---
Source: https://www.legislation.gov.uk/uksi/2024/1049/regulation/2 (the official version)
Page: https://openlegislation.uk/internet-domain-registry-prescribed-practices-and-prescribed-requirements-regulations-2024/regulation-2
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.