Section 67Regulations about reports to the NCA

(1) The Secretary of State must make regulations in connection with the reports that are to be made to the NCA (including by non-UK providers) as required by section 66.

(2) The regulations may make provision about—

• (a)
  the information to be included in the reports,
• (b)
  the format of the reports,
• (c)
  the manner in which the reports must be sent to the NCA,
• (d)
  the time frames for sending the reports to the NCA (including provision about cases of particular urgency),
• (e)
  the records that providers must keep in relation to the reports, or the details that providers must retain as evidence that they have made the reports, and
• (f)
  such other matters relating to the reports as the Secretary of State considers appropriate.

(3) The regulations may also—

• (a)
  require providers to retain, for a specified period, data of a specified description associated with a report, and
• (b)
  impose restrictions or requirements in relation to the retention of such data (including how the data is to be secured or stored or who may access the data).

(4) The power to require the retention of data associated with a report includes power to require the retention of—

• (a)
  content generated, uploaded or shared by any user mentioned in the report (or metadata relating to such content), and
• (b)
  user data relating to any such person (or metadata relating to such data).

“User data” here has the meaning given by section 231.

(5) Before making regulations under this section, the Secretary of State must consult—

• (a)
  the NCA,
• (b)
  OFCOM, and
• (c)
  such other persons as the Secretary of State considers appropriate.