
2024 No. 1049
ELECTRONIC COMMUNICATIONS
The Internet Domain Registry (Prescribed Practices and Prescribed Requirements) Regulations 2024
Made 17th October 2024
Laid before Parliament 22nd October 2024
Coming into force 12th November 2024
The Secretary of State makes these Regulations in exercise of the powers conferred by sections 124O(3) and 402(3)(a) of the Communications Act 2003.In accordance with section 124O(6) of that Act, the Secretary of State has consulted such persons as the Secretary of State considers appropriate.
Citation, commencement and extent
1 

(1) These Regulations may be cited as the Internet Domain Registry (Prescribed Practices and Prescribed Requirements) Regulations 2024 and come into force on 12th November 2024.
(2) These Regulations extend to England and Wales, Scotland and Northern Ireland.
Prescribed practices that are unfair or involve the misuse of internet domain names
2 

(1) The practices in paragraph (2) are prescribed for the purposes of section 124O(3)(a) of the Communications Act 2003 (prescribed practices that are unfair or involve the misuse of internet domain names).
(2) The failure by a qualifying internet domain registry to—
(a) require, for example through its terms and conditions of use, that any person registering or seeking to register an internet domain name with the registry must not use or intend to use that internet domain name, for an activity listed in paragraph (3), and
(b) take steps to prevent or stop an internet domain name that is registered with that registry being used for an activity listed in paragraph (3) where the registry knows that it is being used for that activity or is intended to be used for that activity.
(3) The activities referred to in paragraph (2) are—
(a) intentionally causing the installation or execution of malware on a device, without authorisation;
(b) redirecting a user of the internet, without that user’s knowledge, to a fraudulent site or service;
(c) obtaining information from a person for use for a purpose to which that person has not consented;
(d) sending email for the purposes of sub-paragraphs (a)-(c);
(e) any activity that would constitute an offence under—
(i) section 1 of the Protection of Children Act 1978 (indecent photographs of children),
(ii) article 3 of the Protection of Children (Northern Ireland) Order 1978 (indecent photographs of children), or
(iii) section 52 of the Civic Government (Scotland) Act 1982 (indecent photographs etc. of children).
(4) In paragraph (3)(a)—
 “malware” means software, whether self-operating or capable of being operated by a remote controller, which is capable of—
(a) disrupting a device’s operations,
(b) obtaining information, or
(c) gaining access to private computer systems;
 “without authorisation” means that the person causing the installation or execution of the malware—
(a) is not a person who has responsibility for the device and is entitled to determine whether the installation or execution should be done, and
(b) does not have consent to the installation or execution from any such person.
Prescribed requirements for arrangements for dealing with complaints
3 

(1) The requirements in paragraph (4) are prescribed for the purposes of section 124O(3)(b) of the Communications Act 2003 (prescribed requirements) in relation to arrangements made by a qualifying internet domain registry for dealing with complaints that fall within paragraph (2).
(2) A complaint falls within this paragraph if it is a complaint about cybersquatting and concerns—
(a) a trade mark that the complainant owns or has permission from the owner to use, which is registered or recognised anywhere in the world, and
(b) an internet domain name registered with the registry under whose arrangements the complainant is making their complaint.
(3) In this regulation—
 “bad faith”, in relation to cybersquatting, includes registering an internet domain name primarily for the purpose of—
(a) selling, renting out or otherwise transferring the internet domain name, at a profit, to a person who owns, or has permission from the owner to use, the trade mark, or to the competitor of such a person;
(b) preventing a person who owns, or has permission from the owner to use, the trade mark from reflecting the trade mark in an internet domain name, where this is part of a pattern of such conduct;
(c) disrupting the business of a competitor;
(d) attracting, for commercial gain, users of the internet to a website or other online location, by creating a likelihood of confusion with the trade mark;
 “cybersquatting” means the registration of an internet domain name that is identical or similar to a trade mark by a person who—
(a) does not own, or have a legitimate interest in, that trade mark, and
(b) registers that internet domain name in bad faith.
(4) The requirements referred to in paragraph (1) are that the arrangements must—
(a) if there is a charge for dealing with a complaint, only make provision for a charge that is proportionate to the cost of providing those arrangements, whether to the registry or any third party used by the registry to provide any part of those arrangements;
(b) provide for a decision on a complaint—
(i) to be taken within a reasonable period of the receipt of the complaint by the registry;
(ii) for the complainant to be notified of the decision within a reasonable period of the decision having been taken;
(iii) where the decision is made in the complainant’s favour, provide for appropriate action to be taken by the registry within a reasonable period of the decision having been made and for the notification to be provided under paragraph (ii) to set out what action will be taken by the registry and within what time period;
(c) be publicly available and in language that is easily understood by an ordinary reader;
(d) not prevent any person from bringing proceedings in a court or tribunal;
(e) take into account the need to be—
(i) equitable to both parties to the complaint, and
(ii) proportionate.
Jones of Whitchurch
Parliamentary Under Secretary of State
Department for Science, Innovation and Technology
17th October 2024