Member

368: After Clause 132, insert the following new Clause— “Consumer cloud-based service provider access restrictions: lost or stolen devices(1) A provider of consumer cloud-based services referred to in subsection (7)(a) that are accessed from a device must, upon receiving verified notification from a relevant person that a device has been lost or stolen, take reasonable and timely steps aimed at preventing any person who is not the device owner from accessing the provider’s consumer cloud-based services from that device, in order to discourage, where possible, the resale of devices obtained unlawfully.(2) In subsection (1) “relevant person” means— (a) a consumer who is the device owner,(b) a person that is a legitimate seller of the device, or(c) a relevant authority.(3) The provider must, so far as it is technically possible for the provider to do so in accordance with the technical standards referred to in subsection (7)(a), block access to the provider’s consumer cloud-based services from the device identified in the relevant verified notification.(4) The provider must inform, as soon as practically possible, the National Crime Agency and the police service in the area in which the theft or loss of the device was first reported.(5) Providers must, subject to appropriate safeguards, establish a process for relevant persons to appeal or reverse a block on a device in cases of error, fraud, or device recovery.(6) A provider shall not be liable for any loss or damage suffered in consequence of any action taken under this section.(7) The Secretary of State must by regulations make provision for—(a) the technical standards required to enforce the steps outlined in subsections (1) and (3),(b) the categories of consumer cloud-based services in relation to which providers will be required to take the steps outlined in subsections (1) and (3),(c) the implementation timeline for providers, and(d) sanctions for non-compliance.(8) In this section—“consumer” has the meaning given by section 2(3) of the Consumer Rights Act 2015;“consumer cloud-based service” means a digital service which—(a) is a cloud computing service (as defined in the Network and Information Systems Regulations 2018 (S.I. 2018/506)),(b) is supplied directly to consumers in the United Kingdom, and(c) is used by those consumers solely for personal use.“device” means a mobile telephone device with an IMEI number;“device owner” means—(a) a person that—(i) is a consumer in the United Kingdom,(ii) has purchased a device through a contract or transfer of ownership of the device, or(b) a legal person that can demonstrate legitimate ownership through supply chain documentation.“legitimate seller” means—(a) a manufacturer or trader of the device,(b) an online marketplace provider or legal person that sells the device, or(c) a trader operating on an online marketplace provided they can trace the origin of the device.“provider” means a person who enters into a contract directly with a consumer in the United Kingdom for the provision of consumer cloud-based services;“verified notification” means a written notification that a device has been lost or stolen, which includes all of the following information—(a) details of the relevant device that has been lost or stolen, including its IMEI number,(b) evidence demonstrating that the person who has submitted the notification is a relevant person, such as proof of purchase or supply chain documentation, and(c) any other information that the provider reasonably requires in order for it to comply with its obligations under this section.”