We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byDarlene Feemster
Modified over 2 years ago
© JANET(UK) 2011 Running a Public Communications Service Andrew Cormack Chief Regulatory Adviser, Janet
© JANET(UK) 2011 What is a public comms. service? “public electronic communications service” means any electronic communications service that is provided so as to be available for use by members of the public; (Communications Act 2003, s.151) E.g. Open library terminal, open/commercial wifi hotspot, hotel, cybercafe, housing estate, business park,... NB: Most BCE doesn’t involve public traffic NB: Janet is not a public network service
© JANET(UK) 2011 Which laws are different? The following have additional rules for public services –EC Telecomms Directives (security & privacy) –UK Interception Law –UK/EU Data Retention –UK Copyright Infringement – maybe Future developments likely at EC and UK level
© JANET(UK) 2011 Responsibilities for the service Must comply with Ofcom guidance on security –Documented risk management process (e.g. ISO27001) –Take appropriate measures to deliver security Must report “significant” security breaches to Ofcom, e.g. –100K users disconnected for 12 hours, or –Failure reported to Government department or in the media
© JANET(UK) 2011 Responsibilities for privacy Must design service/systems to protect privacy Must report all privacy breaches to ICO –Consequences and mitigation action taken –And to user if PD or privacy “adversely affected” Traffic/flow data only used for prescribed purposes –Transmission; Billing and traffic management; Customer enquiries; Fraud prevention/detection; Other legal duties Not research –Must delete/anonymise as soon as no longer needed Unlawful interception by operator is a criminal offence
© JANET(UK) 2011 Responsibilities for users Must (if notified by Home Office) retain data about use –Time, duration, type, source, destination of communication –Can agree by contract who does this Best if done by the organisation that authenticates users Various other responsibilities being discussed –Dealing with copyright infringements (Digital Economy Act) –Dealing with infected user equipment –Network Neutrality (restrictions on traffic management)
© JANET(UK) 2011 How far do these extend? Which networks/equipment –Probably anything that might carry public traffic –Good idea to separate those Which organisations are responsible? –Service: Organisation, Janet and ISP –Privacy: Organisation, Janet and ISP –Users: Organisation or ISP
© JANET(UK) 2011 Don’t Forget: State Aid law Using public funds to distort a commercial market –Illegal: fine plus repayment with interest Public Internet access is a commercial market –State Aid law likely to apply Possible approaches (see Janet guidance) –Library terminal: provide “supported Internet access” –Wifi Hotspot: open tender, including use of backhaul –Hotel/cybercafe: charge market rate to trading subsidiary –Broadband gaps: BIS authorisation for individual projects
© JANET(UK) 2011 Policies etc. Janet Policies protect Janet reputation/operation –Need SecPol and AUP whenever Janet addresses used Access control, Manage security threats, Enforce AUP, etc. –Otherwise use Policy of ISP whose addresses are used –Always need disconnection right to protect service to others Other IP address issues –RIPE/WHOIS contact data => body with User responsibilities Copyright enforcement responsibility likely to follow this –Beware of IP address “authorisation” Internal services, licensed content, firewalls, etc.
© JANET(UK) 2011 To run a public network service... It/you must (+ bullets apply to Janet backhaul too) +Be designed according to Ofcom security principles +Report significant (availability) breaches to Ofcom +Report all privacy breaches to ICO +Only use traffic data for prescribed purposes –Only use interception (if at all) with great care –Be prepared to retain information about users –Be prepared to deal with copyright infringement reports +Deal with State Aid issues Probably want to separate this from your R&E service
© JANET(UK) 2011 Discussion Themes How to segregate? Authentication: when/where/how? ISP access Institutional Risk Assessment & Responsibilities Pricing Models Community Support
© JANET(UK) 2011 Questions?
Copyright JNT Association JANET Briefing, 20 th Jan, Digital Economy Act 2010 Andrew Cormack Chief Regulatory Adviser, JANET(UK)
Information Management in Telco: A Legal Perspective Sheila Tormey Barlow Lyde & Gilbert LLP Ronan Lupton Barrister at Law 17 September 2009.
Information Management in Retail: A Legal Perspective Chris Hill Barlow Lyde & Gilbert LLP 17 September 2009.
DATA PROTECTION AND RUNNING A COMPLIANT PUB WATCH SCHEME Nigel Connor Head of Legal –JD Wetherspoon PLC.
Data Protection Paul Veysey & Bethan Walsh. Introduction Data Protection is about protecting people by responsibly managing their data in ways they expect.
Understanding Privacy An Overview of our Responsibilities.
CMG Events 2016 Cybersecurity Briefing 24 February 2016 John Magee William Fry.
Online infringement of copyright - the Digital Economy Act June 2010 Robin Fry.
Information Management in FSS: A Legal Perspective Paul Hinton Ian Mason Barlow Lyde & Gilbert LLP 17 September 2009.
IS BIG DATA GIVING YOU A BIG HEADACHE? Risk Reduction - Transactional, International and Liability Issues Oregon State Bar Corporate Counsel Section Fall.
Data protection—training materials [Name and details of speaker]
New EU General Data Protection Regulation Conference 2016 Managing a Data Breach Prevention-Detection-Mitigation By Gerard Joyce Dun Laoghaire Feb 24 th.
1 Session 3 – Information Security Policies. 2 General - background How to establish security requirements –Risk assessments –Legal, statutory requirements.
PRIVACY, SECURITY & ID THEFT PREVENTION - TIPS FOR THE VIGILANT BUSINESS - SMALL BUSINESS & ECONOMIC DEVELOPMENT FORUM October 21, WITH THANKS TO.
Session 7 Compliance failure policy. 1 Contents Part 1: COLP and COFA duties Part 2: What do we have to comply with and why does it matter? Part 3: Compliance.
The Gathering Cloud computing - Legal considerations David Goodbrand, Partner 28 February 2013 Aberdeen Edinburgh Glasgow.
ICT Legislation Copyright, Designs and Patents Act (1988); Computer Misuse Act (1990); Health and Safety at Work Act (1974); EU Health and Safety.
COMPUTER CRIME AND TYPES OF CRIME Prepared by: NURUL FATIHAH BT ANAS.
Kevin Sharp Customer Engagement Manager Janet, Public Access & The Cloud.
1 Information Governance (For Dental Practices) Norman Pottinger Information Governance Manager NHS Suffolk.
The role of the Office of the Privacy Commissioner in telecommunications Andrew Solomon Director, Policy.
Data Security Breach Code of Practice. Data Security Concerns Exponential growth in personal data holdings Increased outsourcing 3 rd countries cloud.
Information Commissioner’s Office: data protection Judith Jones Senior Policy Officer Strategic Liaison – public security 16 November 2011.
FAQs about the new regulatory framework Lucy Rhodes
Ioannis Iglezakis Directive on privacy and electronic communications.
Data Protection for Church of Scotland Congregations.
© Boardworks Ltd of 10 Data Protection and the Digital Economy Act.
Nov/Dec 2003ElectraNet BSP-2 Workshop (khb) 1 EU Telecoms Regulatory Status Governing Legislation Package 2002 Directive 2002/19/EC Access to, and interconnection.
EMERGING TOPICS IN DATA, APPLICATION AND INFRASTRUCTURE PROTECTION Taher Elgamal ITU
Objectives Legislation: Understand that implementation of legislation will impact on procedures within an organisation. Describe.
Ecommerce Applications 2007/8 E-Commerce Applications UK e-Commerce Regulations.
Designing Smart Cities Conference University of Strathclyde, Glasgow 31 st March 2015 “Regulating Smart Cities: Policing & Privacy” Paul Mackie Chief Executive.
Tina Kraigher and Milena Podjed-Fabjančič 18 April 2010 Processing of Telephone Traffic Data of Employees ( a Case Study )
General Awareness Training Security Awareness Module 2 What is a Security Incident? How Vulnerable am I?
The Law of Information General Purpose Packages. Why Do We Need Laws? Flow of information A wide area network such as the Internet allows users to access.
Computer Legislation The need for computer laws Go to Contents.
DIRECT WORKS FORUM 10 June 2008 Andy Ballard. COMMON LAW MANSLAUGHTER Effectively – Death by gross negligence Test – (a) was a (common law) duty of care.
An overview of the Data Protection Act Legal framework The Data Protection Act 1998 came into force in March 2001, replacing the Data Protection.
Net Neutrality, What Else? Wim Nauwelaerts Partner Hunton & Williams.
CHANGES WE CAN EXPECT TO COPYRIGHT LAW NHSS Event, 24/10/11.
TERENA Networking Conference 2005©The JNT Association, 2005 Network Performance Measurement: Privacy and Legal Issues Andrew Cormack, UKERNA
Copyright JNT Association Striking a Balance: Privacy and Legal Issues in Network Management Andrew Cormack Chief Regulatory Adviser, UKERNA
Network security policy: best practices Ref: document ID
1 Red Flag Rules: What they are? & What you need to do Employee Training for Identity Theft : “RED FLAG RULES” February 2010.
Preventing Infringement of Intellectual Property (IP) Rights in the Workplace Awareness raising to prevent infringement within [business name] September.
How to be an effective COLP Peter Scott Consulting
14 May 2014 Information Security, Information Governance and the Law – Confidence in Compliance © Contact Leonardo for reuse
Every employer must ensure, as far as is reasonable practicable, the health, safety and welfare of all his employees More specifically, employers must.
Preventing Infringement of Intellectual Property (IP) Rights in the Workplace Awareness raising to how to prevent infringement within [business name] September.
© 2017 SlidePlayer.com Inc. All rights reserved.