OpenLegislation

The Network and Information Systems (EU Exit) (Amendment) Regulations 2021

S.I. 2021/1461 · Made 15 December 2021

Original text. legislation.gov.uk does not revise statutory instruments, so later amendments are not shown here. Changes made to it are listed under each provision when known.

Exiting The European Union

Electronic Communications

Made 15th December 2021

Coming into force 12th January 2022

The Secretary of State makes these Regulations in exercise of the powers conferred by section 8(1) and (5) of, and paragraph 21 of Schedule 7 to, the European Union (Withdrawal) Act 2018f1.

In accordance with paragraph 1(1) of Schedule 7 to that Act, a draft of this instrument has been laid before Parliament and approved by a resolution of each House of Parliament.

Annotations to the whole text

Footnotes

f1

2018 c. 16. Section 8 was amended by section 27 of the European Union (Withdrawal Agreement) Act 2020 (c. 1). Paragraph 21 of Schedule 7 was amended by the same Act, Schedule 5, paragraph 53.

Contents

  1. 1Citation and commencement
  2. 2Extent and application
  3. 3Amendment of the Network and Information Systems Regulations 2018
  4. 4Amendment of Commission Implementing Regulation (EU) 2018/151
  5. Signature
  6. Explanatory note

1Citation and commencement

These Regulations may be cited as the Network and Information Systems (EU Exit) (Amendment) Regulations 2021 and come into force twenty-eight days after the day on which they are made.

2Extent and application

(1)

These Regulations extend to England and Wales, Scotland and Northern Ireland.

(2)

These Regulations apply to—

(a)

the United Kingdom, including its internal waters;

(b)

the territorial sea adjacent to the United Kingdomf1; and

(c)

the sea (including the seabed and subsoil) in any area designated under section 1(7) of the Continental Shelf Act 1964f2.

3Amendment of the Network and Information Systems Regulations 2018

(1)

Regulation 12 of the Network and Information Systems Regulations 2018f1 (relevant digital service providers) is amended as follows.

(2)

For paragraph (7)(b) substitute—

“(b)

have regard to any relevant guidance published by the Information Commissioner.”.

4Amendment of Commission Implementing Regulation (EU) 2018/151

(1)

Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact is amended as followsf1.

(2)

In Article 2(5) for the words from “Pursuant to” to the end of the paragraph substitute “United Kingdom, European and internationally accepted standards and specifications relevant to the security of network and information systems may also be used.”.

(3)

In Article 3(3) for “Member States of the EU” substitute “areas of the United Kingdom”.

(4)

Omit Article 4.

Signature

Julia Lopez

Minister of State

Department for Digital, Culture, Media and Sport

15th December 2021

Explanatory note

(This note is not part of the Regulations)

These Regulations are made in exercise of the powers conferred by section 8(1) and (5) of, and paragraph 21 of Schedule 7 to, the European Union (Withdrawal) Act 2018 (c. 16) in order to address failures of retained EU law to operate effectively and other deficiencies (in particular under section 8(2)(d)) arising from the withdrawal of the United Kingdom from the European Union.

These Regulations amend both the retained EU law version of Commission Implementing Regulation (EU) 2018/151 and the Network and Information Systems Regulations 2018 (S.I. 2018/506) (which relate to securing network and information systems) by amending and removing certain criteria for managing and reporting cyber risks that apply to digital service providers where those criteria are no longer appropriate now that the United Kingdom has left the European Union. In particular, thresholds for reporting cyber incidents that were set by reference to the impact of the incident on the European Union’s population have been removed and these thresholds will instead be set in guidance.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sectors is foreseen.