SI 2024/1049 - The Internet Domain Registry (Prescribed Practices and Prescribed Requirements) Regulations 2024

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

STATUTORY INSTRUMENTS 2024 No. 1049 ELECTRONIC COMMUNICATIONS The Internet Domain Registry (Prescribed Practices and Prescribed Requirements) Regulations 2024 Made - - - - 17th October 2024 Laid before Parliament 22nd October 2024 Coming into force - - 12th November 2024 The Secretary of State makes these Regulations in exercise of the powers conferred by sections 124O(3) and 402(3)(a) of the Communications Act 2003(1).

In accordance with section 124O(6) of that Act, the Secretary of State has consulted such persons as the Secretary of State considers appropriate.

Citation, commencement and extent

1.—(1) These Regulations may be cited as the Internet Domain Registry (Prescribed Practices and Prescribed Requirements) Regulations 2024 and come into force on 12th November 2024.

(2) These Regulations extend to England and Wales, Scotland and Northern Ireland.

Prescribed practices that are unfair or involve the misuse of internet domain names

2.—(1) The practices in paragraph (2) are prescribed for the purposes of section 124O(3)(a) of the Communications Act 2003 (prescribed practices that are unfair or involve the misuse of internet domain names).

(2) The failure by a qualifying internet domain registry(2) to—

(a) require, for example through its terms and conditions of use, that any person registering or seeking to register an internet domain name with the registry must not use or intend to use that internet domain name, for an activity listed in paragraph (3), and

(b) take steps to prevent or stop an internet domain name that is registered with that registry being used for an activity listed in paragraph (3) where the registry knows that it is being used for that activity or is intended to be used for that activity.

(1) 2003 c. 21. Section 124O was inserted by section 19 of the Digital Economy Act 2010 (c. 24). Subsection (3)(a) refers to “prescribed practices” and subsection (3)(b) refers to “prescribed requirements”. Subsection (5) provides that “prescribed” in subsection (3) means prescribed by regulations made by the Secretary of State.

(2) “Qualifying internet domain registry” is defined in section 124O(7) of the Communications Act 2003 (c. 21).Document Generated: 2024-11-12

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

(3) The activities referred to in paragraph (2) are—

(a) intentionally causing the installation or execution of malware on a device, without authorisation;

(b) redirecting a user of the internet, without that user’s knowledge, to a fraudulent site or service;

(c) obtaining information from a person for use for a purpose to which that person has not consented;

(d) sending email for the purposes of sub-paragraphs (a)-(c);

(e) any activity that would constitute an offence under—

(i)section 1 of the Protection of Children Act 1978(3) (indecent photographs of children),

(ii)article 3 of the Protection of Children (Northern Ireland) Order 1978(4) (indecent photographs of children), or

(iii)section 52 of the Civic Government (Scotland) Act 1982(5) (indecent photographs etc. of children).

(4) In paragraph (3)(a)— “malware” means software, whether self-operating or capable of being operated by a remote controller, which is capable of—

(a) disrupting a device’s operations,

(b) obtaining information, or

(c) gaining access to private computer systems; “without authorisation” means that the person causing the installation or execution of the malware—

(a) is not a person who has responsibility for the device and is entitled to determine whether the installation or execution should be done, and

(b) does not have consent to the installation or execution from any such person.

Prescribed requirements for arrangements for dealing with complaints

3.—(1) The requirements in paragraph (4) are prescribed for the purposes of section 124O(3)(b) of the Communications Act 2003 (prescribed requirements) in relation to arrangements made by a qualifying internet domain registry for dealing with complaints that fall within paragraph (2).

(2) A complaint falls within this paragraph if it is a complaint about cybersquatting and concerns—

(a) a trade mark that the complainant owns or has permission from the owner to use, which is registered or recognised anywhere in the world, and

(b) an internet domain name registered with the registry under whose arrangements the complainant is making their complaint.

(3) 1978 c. 37. Section 1 was amended by Schedule 2 to the Extradition Act 1989 (c. 33), section 84(1) and (2) of, and Schedule 11 to, the Criminal Justice and Public Order Act 1994 (c. 33), and paragraph 24 of Schedule 6 to the Sexual Offences Act 2003 (c. 42).

(4) S.I. 1978/1047 (N.I. 17). Article 3 was amended by section 84(8) and (10) of the Criminal Justice and Public Order Act 1994, paragraph 8 of Schedule 1 to S.I. 2003/1247 (N.I. 13) and article 42(1) and (4) of S.I. 2008/1769 (N.I. 2). There are other amendments not relevant to these Regulations.

(5) 1982 c. 45. Section 52 was amended by section 84(5) and (6) of the Criminal Justice and Public Order Act 1994, section 16(1) and (2) of the Protection of Children and Prevention of Sexual Offences (Scotland) Act 2005 (asp 9), section 41(1)(a) of, and paragraph 13 of Schedule 7 to, the Criminal Justice and Licensing (Scotland) Act 2010 (asp 13), and section 214(4), (5) and

(6) of the Online Safety Act 2023 (c. 50). There are other amendments not relevant to these Regulations.

2Document Generated: 2024-11-12

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

(3) In this regulation— “bad faith”, in relation to cybersquatting, includes registering an internet domain name primarily for the purpose of—

(a) selling, renting out or otherwise transferring the internet domain name, at a profit, to a person who owns, or has permission from the owner to use, the trade mark, or to the competitor of such a person;

(b) preventing a person who owns, or has permission from the owner to use, the trade mark from reflecting the trade mark in an internet domain name, where this is part of a pattern of such conduct;

(c) disrupting the business of a competitor;

(d) attracting, for commercial gain, users of the internet to a website or other online location, by creating a likelihood of confusion with the trade mark; “cybersquatting” means the registration of an internet domain name that is identical or similar to a trade mark by a person who—

(a) does not own, or have a legitimate interest in, that trade mark, and

(b) registers that internet domain name in bad faith.

(4) The requirements referred to in paragraph (1) are that the arrangements must—

(a) if there is a charge for dealing with a complaint, only make provision for a charge that is proportionate to the cost of providing those arrangements, whether to the registry or any third party used by the registry to provide any part of those arrangements;

(b) provide for a decision on a complaint—

(i)to be taken within a reasonable period of the receipt of the complaint by the registry;

(ii)for the complainant to be notified of the decision within a reasonable period of the decision having been taken;

(iii)where the decision is made in the complainant’s favour, provide for appropriate action to be taken by the registry within a reasonable period of the decision having been made and for the notification to be provided under paragraph (ii) to set out what action will be taken by the registry and within what time period;

(c) be publicly available and in language that is easily understood by an ordinary reader;

(d) not prevent any person from bringing proceedings in a court or tribunal;

(e) take into account the need to be—

(i)equitable to both parties to the complaint, and

(ii)proportionate.

Jones of Whitchurch Parliamentary Under Secretary of State Department for Science, Innovation and 17th October 2024 Technology 3Document Generated: 2024-11-12

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

EXPLANATORY NOTE (This note is not part of the Regulations) These Regulations set out the prescribed practices and prescribed requirements relating to the consideration of whether there is a relevant failure in relation to a qualifying internet domain registry for the purposes of section 124O of the Communications Act 2003 (c. 21) (“the 2003 Act”) (notification of failure in relation to internet domain registry). “Qualifying internet domain registry” is defined in section 124O(7).

Section 124O of the 2003 Act sets out that the Secretary of State must provide a notification to a qualifying internet domain registry if the Secretary of State is satisfied that a serious relevant failure in relation to that registry is taking place or has taken place and the Secretary of State wishes to exercise the powers under section 124P (appointment of manager of internet domain registry) or 124R (functions of manager etc).

Section 124O(3) sets out the circumstances in which there is a relevant failure in relation to a qualifying internet domain registry. For the purposes of subsection (3), these Regulations prescribe the—

(a) practices that are unfair or involve the misuse of internet domain names (regulation 2), and

(b) requirements for the arrangements made by the registry for dealing with complaints in connection with internet domain names (regulation 3).

Section 124O(4) sets out when a relevant failure is serious.

These Regulations ensure that the UK remains compliant with paragraph 1(a) of Article 18:28 of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership,

which is available at: https://www.mfat.govt.nz/assets/Trade-agreements/TPP/Text-ENGLISH/18.- Intellectual-Property-Chapter.pdf. A copy of this can be requested from the Department for Science, Innovation and Technology, 100 Parliament Street, London, SW1A 2BQ.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary sector or community bodies is foreseen.

4