GIBRALTAR REGULATORY AUTHORITY ANNUAL REPORT GRA 2020/2021 GIBRALTAR REGULATORY AUTHORITY

www.gra.gi

Table of Contents

CHIEF EXECUTIVE OFFICER’S STATEMENT...... 5

ELECTRONIC COMMUNICATIONS...... 9 Introduction...... 10 International Participation...... 10 Regulatory Matters...... 13

RADIO COMMUNICATIONS...... 21 Introduction...... 22 International Coordination and Participation...... 22 Regulatory Matters...... 23

INFORMATION RIGHTS...... 27 Introduction...... 28 International Participation...... 28 Regulatory Matters...... 31

BROADCASTING...... 43 Introduction...... 44 International Participation...... 44 Regulatory Matters...... 45

POSTAL SERVICES...... 47 Introduction...... 48 Regulatory Matters...... 48

HIGHER EDUCATION REGULATION...... 55 Introduction...... 56 Regulatory Matters...... 56

CYBER SECURITY COMPLIANCE...... 59 Introduction...... 60 International Participation...... 60 Regulatory Matters...... 60

3 4 CEO STATEMENT

5 Introduction Electronic and, consequently, the local Communications electronic communications sector has shown further signs of The Electronic Communications improvement and innovation. This Annual Report of the Division regulates, supervises, Gibraltar Regulatory Authority and enforces compliance In December 2020, Her Majesty’s (“the GRA”) is prepared in with conditions and specific Government of Gibraltar (the accordance with section 19(1) obligations imposed upon “Government”) implemented a of the Gibraltar Regulatory providers of electronic new legislative package which Authority Act 2000 (“the Act”) communications networks and/ included amendments to the and covers the period 1st April or services. It engages with Communications Act 2006 and 2020 to 31st March 2021. electronic communications its subsidiary legislation. The providers and ensures they Division is currently familiarising meet the regulatory and legal itself with the changes and will consult with the communications Gibraltar Regulatory standards while continuously assessing the levels of industry as required. Authority Act 2000 competition in the electronic The Division will continue In accordance with section 3 of communications market. supervising and monitoring the Act, the GRA Board consists During this reporting period, the electronic communications of the GRA’s Chief Executive the electronic communications markets in accordance with its Officer and the Deputy Chief sector found itself at the centre functions and objectives and Executive Officer, and three of a world-wide pandemic which improve its regulatory oversight appointed members, namely Mr had a tremendous global impact to the benefit of consumers. Anthony Provasoli, Mr Kieran on the public and businesses Power and Mr Francis Lopez. alike. With many people working The Chief Executive Officer is the from home due to the lockdown Radio Communications Chairman of the GRA. restrictions, the demand for communications services during The Spectrum and Operations non-peak periods increased with Division deals with all matters Organisation and Staffing little warning. relating to the electro-magnetic spectrum, radiocommunications, The GRA has a total staff of The rise in demand for satellite and international twenty-seven and is divided into communications services posed coordination, as well as internal Divisions, each with their own challenges of an unprecedented ICT and facilities management. It structure and responsibilities. The nature. The Division could do is responsible for administering work carried out by the Divisions little to relieve these difficulties, the regulatory provision of is briefly summarised below. however, they reached out the satellite services industry to local providers and gave and represents the Gibraltar- them an opportunity to raise based operator SES Satellites any concerns or issues they COVID-19 (Gibraltar) Limited (“SES-G”) encountered throughout this at international meetings and The COVID-19 pandemic affected period. forums and ensures compliance the way the GRA operated with the International Despite the disruption, the throughout the year 2020/2021. Telecommunication Union local telecommunications With lockdown restrictions Radio Regulations and all other market continues to grow. imposed both locally and abroad, international obligations. End-users are enjoying a hosting live workshops, travelling large range of electronic abroad for conferences, and As part of its remit under Part communications services holding face-to-face meetings, VI of the Communications Act from several providers and at were not possible. Nevertheless, 2006, the GRA is responsible a variety of price points which the GRA managed to adapt, and for the management and range from high value, multi- the Divisions have addressed control of the electro-magnetic service bundles, to premium how they each dealt with the spectrum. Amongst its duties, ultra-high-speed offerings. disruption of COVID-19 under the Division carries out regular The effects of competition are their respective sections. site inspections of sites known now being felt more than ever to emit radio waves, with a view

6 of ensuring they operate within Consequently, organisations Broadcasting recognised safe guidelines. The within the EU are required to Division is also responsible for implement measures before The role and duties that govern the management and allocation data is transferred to Gibraltar, the Broadcasting Division are of frequencies, which extends to thereby affecting the flow of contained in the Broadcasting those used by mobile operators data between the jurisdictions. Act 2012. The Division’s for the provision of mobile voice main responsibilities are to and data services. The 2020/2021 period has been grant and enforce licences to an important year for the Division, broadcasters, regulate matters Due to difficulties posed by in particular, because of the work on broadcasting standards, issue the pandemic, the scheduled undertaken as a result of the Codes of Practice and encourage Satellite Coordination Meeting UK’s exit from the EU. Due to the the promotion of media literacy. did not take place this year, changes in the law, the Division however, a virtual meeting was invested a significant amount The Division does not only license held between the Division, of its resources in responding and regulate Gibraltar-based Ofcom and SES-G in June 2020 to to incoming enquiries, raising broadcasters, but also provides discuss the Annual Development public awareness, and providing guidance to consumers and Plan update for the SES-G guidance to help organisations other users of the broadcasting satellite filings. The updated plan ensure compliance with the services in Gibraltar. was reviewed and approved by Gibraltar and EU GDPR. The Division continued to the Division prior to discussions deliver its Media Literacy with Ofcom. In response to the change in regime, the Division published Awareness Campaign despite Brexit-related guidance and the disruption caused by the held dedicated Brexit-related COVID-19 pandemic, which Information Rights workshops in the second half put the campaign on hold of 2020. The information and temporarily. The latter part of The Information Rights Division guidance notes were published 2020 saw the resumption of the regulates data protection on the GRA’s website and social campaign where the event was and will regulate freedom of media platforms. held virtually for all students information when the relevant aged 14-15. legislation is commenced. In addition, the Division introduced the use of short Despite the difficulties associated The Data Protection Act 2004 videos in its communications with video conferencing, the and the Gibraltar General Data and engagement strategy. The campaign was successful, and Protection Regulation (“Gibraltar use of video is expected to help the feedback received was GDPR”), which came into force attract greater attention to the extremely positive. on 1st January 2021, provide guidance published by the a comprehensive and modern Division. As in previous years, framework for data protection the Division has continued to in Gibraltar. The legislation Postal Services respond to public concerns and provides a set of principles that has enhanced its awareness- The Postal Services Division organisations, public bodies, raising initiatives to provide the of the GRA has responsibility and businesses must adhere support and guidance required for regulating the postal to, as well as a series of rights by organisations and individuals services sector in Gibraltar in for citizens over their personal alike. Amongst other things, accordance with the Post Office information. workshops for Data Protection Act 1961 and the Postal Services Following the end of the Officers, quarterly e-newsletters, (Authorisation) Regulations Brexit transition period on 1st public awareness events and the 2012. ongoing “Control Your Privacy” January 2021, the European The GRA’s statutory objective is campaign, which aims to raise Union General Data Protection to promote development and awareness of the risks to privacy Regulation 2016/679 (“the enhance competition within the from digital technology and EU GDPR”) ceased to apply in local postal services sector, whilst promote its responsible use, Gibraltar. Gibraltar’s exit from securing the provision of an have continued. the EU means the jurisdiction is efficient universal postal service now considered a “third country” at an affordable price for all for the purposes of the EU GDPR.

7 users in Gibraltar. This is done by Commission and the Gibraltar entities under the act and facilitating market entry through Authority for Standards in Higher providing guidance to operators a system of authorisations and Education. of essential services or Digital licences, the result of which is a Service Providers and drawing fully liberalised postal services During this reporting year, the up Codes of Practice. market. University Advisory Board, that provides advice and support to During this reporting year, the The Division also issues the CEO of the GRA in respect CYBERUK conference, which is guidance and recommendations to his responsibilities, met the UK Government’s flagship to all postal service providers twice, virtually, together with cyber security event and was to ensure compliance with the senior representatives from the scheduled to be hosted in requirements of the act, whilst University. A further meeting is Cardiff by the National Cyber simultaneously ensuring the scheduled to take place later in Security Centre, was postponed rights of users are upheld. 2021. due to the pandemic. The event was rescheduled to take place The COVID-19 pandemic virtually on 11th and 12th May produced an unprecedented Cyber Security 2021. They will provide a series crisis that caused a dramatic of top-level keynotes, interactive economic impact in the postal Compliance panel discussions and solution- services industry. Nevertheless, In 2018, the Civil Contingencies based case studies. This event is it provided an opportunity for attended by those with overall the postal services industry to Act 2007 was amended to include the requirements responsibility for cyber security innovate and develop new ideas, in public office. There will also be strategies, and business plans. of Directive 2016/1148 on the security of network and a strong industry presence from Both consumers and businesses across the UK and worldwide. alike became more dependent information systems across the on postal service providers EU (“the NIS Directive”). The throughout this period, NIS Directive was required to especially in their delivery of improve national cybersecurity Revenue and Expenditure medical supplies and other capabilities of essential services During the 2020/21 financial essential goods. throughout the EU, to build cooperation and promote a year, the total collected was culture of risk management £1,719,368.15 which was paid and incident reporting among into the Consolidated Fund. Higher Education Member States. This compares to expenditure Regulation (calculated on a cash basis), The Cyber Security Compliance for all of the GRA’s divisions of The Higher Education Regulation Division was setup to enable £2,271,933.08. Division was setup to enable the the GRA to comply with its GRA to comply with Part 11 of responsibilities under the the University of Gibraltar Act amended Civil Contingencies 2015. The act commenced on Act 2007. Under part 7 of the 2nd July 2015 and gave powers act, the GRA was designated to the Minister for Education to as the competent authority for designate a quality assurance the security of network and authority to be known as the information systems in respect Gibraltar Authority for Standards of operators of essential services in Higher Education and to also and Digital Service Providers. designate a regulatory authority to be known as the Gibraltar Additionally, the GRA was Higher Education Commission. designated by the act as the single point of contact for On 31st May 2018, the University Gibraltar. of Gibraltar (Regulation and Accountability) Regulations The Division is mainly responsible 2018 were commenced, and for regulating, supervising, and the GRA was designated as both enforcing compliance with the the Gibraltar Higher Education requirements placed on certain

8 ELECTRONIC COMMUNICATIONS

9 10 ELECTRONIC COMMUNICATIONS consumer arange cannow select continues to flourish. The local telecommunications market of the pandemic, the local thepressuresNotwithstanding addressing these. challenges andcoped well when some providers faced certain on, As canberead further encountering lockdown. during concerns orissuestheywere to raise any the opportunity to localproviders to give them reached out but nevertheless little to relieve these difficulties, nature. The Divisioncould do challenges ofanunprecedented posed communications services The increase indemandfor withlittlewarning.next sky-rocketed from oneday to the non-peakperiods during services the demandfor communications from home, working majority and businesses alike. With the onthepublic global impact which hashadatremendous of aworld-wide pandemic foundsector itselfat thecentre communicationsthe electronic period, thisreporting During arecompetitive met. services that consumer demandsfor the Division seeks to ensure a rapidly evolving oneand communications is sector electronic communications. The asregardsthe GRA electronic things, of the general functions setsout, amongother Act”) Communications 2006(“the Act (“providers”).or services The communications and/ networks upon providers ofelectronic specific obligations imposed compliance withconditions and andenforcingsupervising, is taskedwithregulating, Division”)Division (“the The Communications Electronic Introduction Participation International regulatory practices during these during practices regulatory pandemic and how to enhance team member centred on the the webinars attended by a on current matters. Oneof improve its understanding year withaviewto further webinars thereporting during The Divisionattended various these at somepoint in2021. 2020buthopestoearly revisit with providers in that started the regular informal meetings Division decidedto postpone because ofthepandemic, the Unfortunately,data collection. and theimproved of efficiency code ofpractice,voluntary providers onsigning upto a continued negotiations with its socialmediapublications, included thedevelopment of ingeneral. services These communicationsof electronic with the public and consumers effectiveness ofitsinteractions develop inorder to improve the areas ofitsoperations itshould resources to investigate which The Divisiondedicated its period. this reporting increasing once againduring with overall broadband speeds of improving theirofferings, innovateto andfind further ways interaction haspushedproviders demand for increased social offerings. Competition andthe broadbandspeed symmetrical bundles to premium ultra-high- from highvalue multi-service ofprice points,variety ranging providersauthorised andat a from anumberof services communicationsof electronic The Division hastakensteps Regulations 2006. Rights) andUsers’(Universal Service 2006 andtheCommunications Data Regulations andPrivacy) the Communications (Personal and Licensing) Regulations2006, Communications (Authorisation (Access) Regulations 2006,the 2006, the Communications to theCommunications Act which includedamendments a newlegislative package the Government published On 24thDecember 2020, Commission. published by theEuropean including any relevant initiatives developments inthesector shall bemonitoring any key theGRA framework, regulatory the provisions oftheEuropean to Gibraltar isnolongersubject Gibraltar have theEUand left note that, althoughtheUKand to isimportant Code (“EECC”). It CommunicationsElectronic Investments intheEuropean Competition,Market, and Governance ofthe Telecoms on Communications (“IIC”) The of of theInternationalInstitute Chapterhosted by theItalian also attended anonlinewebinar Two membersoftheDivision thoseviews.evidence to support despite thelackofany scientific on socialmediaplatforms, to thepandemic, spreading of 5Gtechnology anditslinks centred around thedangers focused onthefakenews stories health misinformation and attended awebinar on5Gand Another Divisionmember communications services. onelectronic their dependency and how thisgreatly increased entire populations to stay home worldwide lockdowns forcing inrelation to the particularly on thecommunications sector, ofCOVID-19 discussed theimpact challenging times. The speakers ELECTRONIC COMMUNICATIONS 11 Cullen Cullen International Seminar on the Cost Average Weighted Legacy for of Capital Infrastructure, Telecoms 21st October 2020

The telecoms regulator of India of regulator telecoms The revamp the need to also stressed include to protections consumer protection transparency, billing privacy, and data personal of it is important all, “above stating, awareness consumer create to about the and education they can so regulatory provisions of the services themselves avail manner”. possible best the in undoubtedly was COVID-19 example as a great highlighted regulation, industry, of how can governments and national their achieve to together work objectives. challenges the Considering proved event the of the year, having and successful innovative 58 from 190 delegates attracted 31 from who heard countries speakers. One Division member attended One Division member attended the online seminar in which Commission’s the European observations on the significant National in discrepancies (“NRA”) Regulatory Authority’s as WACC of the estimates part of their market analysis was discussed. notifications Commission European The in addition to that, discovered being a lack of consistency there some Member States, across using different were NRAs in points different methods at lack of harmonisation The time. and such methodological likely to were inconsistencies incentives distort investment in and hinder investment electronic communications networks. the seminar provided The ii. together and the opportunity and the together breakouts group small for their share to regulators for learnings. and personal thoughts In and infrastructure respect to technology to ensuring access the regulator’s and information, in workingrole with industry in supporting the most vulnerable was and disadvantaged what to addition in discussed structural and technological the pandemic had trends It concluded was accelerated. that ensure to it is essential that while services affordable remain service to incentives providing modernise and to providers while extend their coverage, on quality and price. focusing of view, point a European From gigabit a towards goal BEREC’s society use included the neutral wireless and mobile, fixed, of networks in order technology as competition stimulate to all infrastructure the basis for promote to investments, issuing guidelines sharing by on regulatory of assessment to contribute to investment build-outfaster and enable of deployment efficient and infrastructure broadband mobile networks. In of consumer terms discussions centred protection, trust and consumer around should that the safeguards achieve to be implemented certainty marketplace. within the Critical communication also and transparency were essential as highlighted good of maintaining elements Itbusiness practices. also was industry that plays recognised in leading the way a key role achieving consumer towards working while also confidence to with regulators together of obtain regulatory clearance policyany or administrative process. International International Regulators Forum of the IIC, Ottawa, of the IIC, Ottawa, Forum October 2020

The event covered three core core three covered event The namely discussion themes, consumer infrastructure, and content protection keynote with regulation, panel speeches and moderated suit to discussions delivered all time zones. from regulators with workshops Interactive the by opening presentations and Competition Australian and the Commission Consumer Regulators Body of European Electronic Communications for the from “Learnings (“BEREC”) on also provided were Pandemic” Due to the travel restrictions the travel Due to COVID-19, about by brought the International Regulators online by hosted was Forum Radio-Television the Canadian and Telecommunications based in Ottawa. Commission One member of the Division fifty regulators joined over share the globe to around from and and experiences insights new ideas on policyexchange and regulation. i. The Division will continue will continue Division The its supervisory as well role the electronic as monitor markets within communications enhance to its functions, in order annually its regulatory oversight of consumers. advantage the to to familiarisethe with itself to made and has amendments ensure to initial preparations day-to- its changes to any that activities from day resulting carried are these amendments, and without out seamlessly The delay. or interruption assess to continue will Division change the amendments how in which it carriesits out the way functions in and responsibilities the future. 12 ELECTRONIC COMMUNICATIONS taly Chapter iii. report. annual accounting separation be appliedto theanalysis ofthe WACC parameters whichcould for abetter understanding ofthe Division withusefulinformation some ofthe drawbacks of withonly benefits ofFTTH which provide almost allthe (“FTTN”), as Fibre-to-the-Node less expensive solutions such compete withotherfarcheaper example, hasinvariably had to for (“FTTH”), Fibre-to-the-Home latest andgreatest services. provide consumers withthe seemingly prohibitive costs to developments driven by the had resulted inunexpected ultrafast broadband services how consumer demandfor provision. Speakersdiscussed set by theEECC co-investment incentives andregulatory market on somecrucialissuesrelated to The webinar debate shedlight share investment risk. seekers to reduce costs and between investors andaccess- the cooperative arrangements concerns of themainaspects competition safeguards. One whilst maintaining effective networks, high-capacity very of the deployment andtake-up facilitatedirectly andincentivise several newprovisions aimedto highlighted Theyframework. of theEuropean regulatory new independent objective promotion having become a on theEECC’s investment The speakersmostlyfocused attended theonlinewebinar. Two membersoftheDivision

IIC I 2021 EECC, 26thFebruary and Investments inthe Markets –Competition of TelecomsGovernance Webinar: The iv. posts. The misinformation was with1.6millionsharedtheories interested in5Gconspiracy public groups on social media realised there were over 200 campaign intheUKand the misinformationtracking Researchers intheBBCbegan on Twitter andInstagram. millions offollowers online misinformationsharing to their in socialmediawithcelebrities continued to gainpopularity aroundtheories 5G and COVID-19 how described conspiracy thediscussion,speakers During out intheHague2018. that no 5G tests had been carried death of297birds. was The fact resultedNetherlands inthe also claimsthat a5Gtest inthe those areas. 2018,there In were tocaused harm peoplelivingin out of5Gmastsaround theUK believed that therecent roll the spread ofCOVID-19. People around 5Gbeganin2019,before theories theconspiracy the UK, the virusto 5Gtechnology. In misinformation campaign linking COVID-19 spread, sodida was highlightedIt that as evidence. despite the lackofany scientific on socialmediaplatforms, pandemic, spreading online technology anditslinksto the surrounding thedangersof5G focused onthefakenews stories by one Division member and The IICwebinar was attended critical. investment incentives remains competition safeguards and of thebalance between investment andtheeffectiveness systems,legacy illustrating how

IIC: 5GandH Them, 27thMay 2020 How to Communicate COVID-19: The Facts and Misinformation Amid ealth v. adoption oftheECC. in fullimplementation and speeds, and thepossibledelays and minimumbroadband regarding vulnerable customers obligations specifically service congestion issues, universal consumer protection, traffic regarding 5G technology, misinformation andfakenews under thepandemic, namely they are allcurrently facing pressing telecoms issues their views on the more Each regulator provided authority.regulatory the Commissioners of the Irish Germany andchaired by oneof from Italy, Sweden, UK and was composed ofregulators attended the webinar. The panel One memberoftheDivision mobile phonetechnology. control ofthepopulation using give theGovernment greater pandemic isahoax,devisedto and otherssuggestingthe 5Gto COVID-19 online linking were the false stories circulating contributing to these attacks The motivating factors Netherlands. in the UK and 30 mastsin the Europe, with 90 masts targeted a regular occurrence within attacks on masts were becoming the COVID-19 lockdown, arson world consequences. During misinformation on5Ghadreal of 2020whenthesharing April the real problem beganinearly However, speakersstated that over 150different countries. been translated andshared in tracked outsidetheUKand had

IIC: Regula May 2020 A European View, 12th Lessons for theFuture: Times ofPandemic and tion in ELECTRONIC COMMUNICATIONS 13 Practice Practice Reports (“ASR”) Reports (“ASR”) V A

Appeal Judgment to the Privy the to Judgment Appeal final basis, on that and, Council the from obtained was leave Court in December Appeal of the Privy to appeal 2019 to Council. hearing has been set down The 6th and 7th October 2021. for Duringreportinglast the period, Gibtelecom has been designated has been designated Gibtelecom market significant as having (“SMP”)power in various electroniccommunications and is consequently markets, subject of obligations to separation, accounting and non- accounting cost discrimination amongst others. requires One of its obligations annually Gibtelecom that ASR, which is submit an audited the Division to by then revised ascertaininformation valuable various Gibtelecom’s on ASR includes The businesses. electronicthe of breakdown a markets in communications is dominant, which Gibtelecom and includes accounting attribution documents, and methodology documents regulatory financial statements. the submission deadline for The ASR was 2019 of the audited 30th September 2020 as per obligations. Gibtelecom’s from upon request However, to the GRA agreed Gibtelecom, 2019 ASR the unaudited accept such time as Gibtelecom until submit an audited to ready was version. receive to GRA is yet The 2019 ASR. audited Gibtelecom’s iii. of oluntary Code ii. Separation ccounting Decision in Respect of Gibtelecom to Access Centre Data G

permits in place so that this this so that permitsin place be to found was happen, could and bureaucratic, cumbersome unnecessarycausing delays. which issues one of many is This and lockdowns the from resulted need the highlighted which one swift intervention. for the issues being Despite a took panel the encountered, view on the lockdown positive as both industryexperience had been given and regulators an opportunity a learn from to one which worst-cast scenario, had but simulated, had many at actuallynever experienced, Systems, this scale. least not to and cybersecurity, policies, had perceptions accepted the been challenged and now sector data had measurable and reflect upon in review to future other for prepare to order challenges. In the 2019/2020 annual report, that the Division informed the Court of Appeal following been had that Judgement in April 2019, handed down the GRA it ruled that had where required powers the relevant grant to Gibtelecom compel to its data to access GibFibre the GRA considering was centre, the to appealing the matter seek to in order Privy Council of law. clarification on this point proceed to GRA resolved The with the appeal of the Court of Regulatory Matters i. GRA to Appeal ibFibre IIC: ‘Regulation in Times of Pandemic – The The – of Pandemic Spike’ Cybersecurity

The increased burden on burden increased The networks and communications service was internet providers with length, at discussed also networksmost encountering because downtime no or little of internet of the huge increase particularlytraffic, during the maintain In to order daytime. specialised these networks, to required were employees their homes and carryleave but the out their duties on-site, of getting the necessaryprocess The speakers discussed the speakers discussed the The impacton pandemic the of sector, the communications particularly the to in relation most of forcing lockdowns to populations their respective this greatly home and how stay dependencytheir increased electronicon communications services. Cybersecurity during encountered breaches highlighted lockdown the criminals had exploited how of online users underprepared and learning platforms. work they had been In some cases, as their cybersecuritytargeted either inadequate were measures or non-existent noted and it was direct likely due as a this was that need of their immediate result working continue or learning to home with little warning from these for prepare or time to changes. The webinar included webinar The speakers from presentations everyfrom of the corner world. communications vi. The webinar proved to be to proved webinar The and provided very interesting into insight an effective perspectivethe EU of the industrycommunications during times. these exceptional 14 ELECTRONIC COMMUNICATIONS 5. Summary oftheCode; and 5. Summary the providers. To achieve this entering into any contracts with toto receive andexpect upon theysign up of service the type make informed choices about is essential that customers can forcedriving ofthe VCOP, andit Transparency istheprimary are promoting andselling. they andservices the products sufficient understandingof trained andthat theyhave that itsstaffare adequately in questionwillhave to ensure terms oftraining,In theprovider onitoring compliance with 6. ight to exit thecontract 4. etailed information on 3. nformation provided to 2. 1. Training; in the VCOP are: the VCOP. The setout principles setoutin under theprinciples providers receive theinformation fromand broadband services relevant fixed/mobile telephony all customers whopurchase the to time. The VCOP ensures that issues that may from arise time speeds and how to resolve bundles andtariffs, broadband contracts, terms andconditions, is notlimited to, information on Such information includes, but markets. telephony and broadband offeredof products inthe make more informed choices to consumers and helpthem information and transparency of the VCOP isto provide more practices. The mainobjective toits principles their business providers to consider andapply toolregulatory for authorised asaself- (“VCOP”) of practice codeand broadband voluntary establishedatelephonythe GRA without penalty; without penalty; Authorised Provider websites; customers; the Code. M R D I principles. VCOP and comply withits have agreed to sign upto the pleased to note that GibFibre measureregulatory andis on this self- with industry The Division has been working specific conditions. thecontract under time during contract without penalty, at any any customer to exit their speeds, providers shall allow case ofbroadband access line level required. thespecific In to broadband the expected issue andrestore theservice mustaimtoturn resolve the theirprovidercontact whoin speeds. These customers should orslowinterrupted service they generally encounter an deteriorated broadband service, When customers experience a made available. offers ordiscounts shallalsobe and prices. Information onany with theircorresponding tariffs andthelike,packages, along products, bundles, services, information onallrelevant include, butnotbelimited to, website. This information shall provided ontheprovider’s orservice product particular additional information ona are madeaware that there is ensure that theircustomers Furthermore, theproviders must provider. by therelevant authorised or beenupgraded/downgraded haschangedinany wayservice existing customers, where their any contract or, inthecaseof customers before theyenter into are providedservices to potential on telephony andbroadband informationand meaningful that, accurate, up-to-date, that theiremployees ensure use theirbestendeavours so principle, theproviders must iv. new customers inGibraltar is now availablepackage to all minimum residential broadband new customers. This said, the was no longer available to took note that thispackage but still ona16Mbpspackage Gibtelecom customers whoare that there are many existing The Division acknowledged publication was 16Mbps. access, whichat thetimeof speed forinternet functional minimum broadband download was this period the during One item that was considered designations proposed. the Division’s position on the GibFibre, whobroadly accepted Gibtelecom, u-mee and comments from three operators, The Divisionreceived Division’s proposals. comments ofthe inrespect to provide an opportunity and allowed interested parties published on10thJuly2020 consultation C05/20was Gibtelecom. As such,public current designated provider, changes whichmay affectthe Obligations to evaluate any review oftheUniversal Service a conducted 2020,theGRA In to consumers. presently availableand services representative oftheproducts andarethe localmarket also technologies used within keeping withthedeveloping that any obligations are in out anannualexercise to ensure To thisend, theDivisioncarries affordable price. reasonable request andat an are available to end-userson social andeconomic inclusion, whichareservices, essential to communicationsbasic electronic Obligations isto guarantee that The aimoftheUniversal Service

Designa Service ProviderService tion ofUniversal ELECTRONIC COMMUNICATIONS 15 Gibtelecom must provide a a provide must Gibtelecom GibFibre. to line leased wholesale Gibtelecom 2019, In August to the Appeal of Notice filed a CourtSupreme in respect of The Determination. the GRA’s appeal to leave for application 2019, 12 November on heard was intervened also GibFibre where party. as an interested handed was judgement The 14th February on down the Supreme 2020, in which Gibtelecom Court granted appeal the permission to and that, Determination GRA’s subject that the condition to “de than other nothing unless belonging equipment minimis” in the be required GibFibre to provide to in order centre data the wholesale leased line to be the Determination GibFibre, stayed. Gibtelecom the hearing, At the appeal should that argued of re-hearing way by proceed review of way than by rather new with the aim of introducing GRAthe before not evidence when it made its Determination. Management Conference A Case hearing for set down (“CMC”) was the courton 14 July 2020 where directionsmade respectin to of the management the future courtThe the that noted appeal. and of review way hearing by was Gibtelecom not open to it was informally matter that raise to or application an without and parties the to notice proper and the court. Nevertheless, the partycourt any that confirmed further adduce who wished to apply under to was evidence Courtthe Supreme Rules in the usual manner. were applications two a result, As 2020. on 3 and 4 November heard for Gibtelecom by application An evidence adduce permission to the hearingat of the appeal Access Access dispute between GibFibre and GibFibre between Gibtelecom

measur aff pr pr dir and services. universal location; location; services; directories; can also require the GRA to GRAthe to also require can providers or more one designate of provision the guarantee to services. Different the universal to can be designated providers of elements different provide it is service. Usually, universal who operator the incumbent such provide to is designated services, although alternative to also decide may providers various universal implement servicesto able be may they and costs. reduced it at provide C05/20 Consultation Public all to extendedinvitation an undertakings any provide to part services. of the universal the GRA not receive did However, any from of interest expressions provider. all the considering After the Division issued above, on C07/20 Decision Notice 14th September 2020 which as Gibtelecom designated for ServiceUniversal Provider a further ending on 30th year September 2021. minimum set of Universal The Service provided Obligations include the Gibtelecom by following: Last year it was reported it was the that Last year GRA had issued a Determination that in July 2019 stating • • disabledusers; es for for oftariffs ordability v. • afixed at ofaccess ovision • oftelephone ovision • ectory enquiry services and • public pay telephones; • public pay The Universal Service Universal The Regulations The Division, therefore, invited invited Division, therefore, The submit a written to Gibtelecom in respect of such application To cover. funding under separate been have no applications date the Division. by received Furthermore, Regulation 11(2) Regulation Furthermore, made application “An states, sub-regulation (1) to pursuant such by shall be accompanied supporting as may information the by be required reasonably make enable it to to GRA in order a preliminary as determination a with compliance whether to service universal may obligation an unfair financial represent on the designated burden provider”. Regulation 11(1) states, “Where Regulation 11(1) states, service universal a designated funding receive seeks to provider with of complying the net cost for servicea universal he obligation, application shall submit a written such funding”. GRA the for to In response to the consultation, the consultation, In to response various made Gibtelecom the to in relation comments setting up of a Universal and the sharing Service Fund of Universal of the burden GRA The Service Obligation’s. the to Gibtelecom referred (Universal Communications Rights) Service and User’s in Regulations 2006 and, 11(1) Regulation to particular, and (2). Consequently, the Division was Division was the Consequently, minimum the that of the view should rate data broadband 16Mbps be set at to continue for sufficient as this is still websites browse to consumers delay, without significant files and stream large download without high quality content major disruptions. the 75Mbps download packagedownload the 75Mbps by Gibtelecom. offered 16 ELECTRONIC COMMUNICATIONS vi. Appeal. date has of been set by the Court At thetimeofwriting, nohearing suitable for remote hearing. felt thatcourt the appeal was not onthebasisthatadjourned the appealwas party, the three-day following submissionsfrom each 2021,however,29th January was set down for the 27th to The appealremote hearing the appeal. interim pending the outcome of Gibtelecom’s Data Centre in the would nothave access to Determination. As such,GibFibre than the GRA’swent further on thebasisthat theirproposal rejected GibFibre’s application to rely upon. also The court andGibFibreGRA may wish responsive evidence whichthe evidence together withany allowed Gibtelecom to adduce where theSupreme Court 2021, down on27thJanuary The judgement was handed access. GibFibre withtherequested requiring Gibtelecom to provide “de minimis”) andfor anorder the stay (i.e. themeaningof for clarificationofthe of terms and anapplication by GibFibre or underlying issues which or mayunderlying may beindicative ofemerging provider isengaging in which consumer complaints each to highlight thenumber of alsoserves basis.to-month It onamonth- take-up and service trends, end-user preferences the Divisionaninsight onmarket communications sector, giving in the local markets service assessments ofthevarious by out localproviders to carry on thestatistical data submitted The Divisioncontinues to rely

Data Gathering urel Statistical Quarterly obile Infrastructure vii. OVID-19 and its impact and itsimpact OVID-19 viii. currently addressing these. responses andtheDivisionis once againprovided parties infrastructure sharing. Interested set of measures on mobile which itproposed anamended issued on24thAugust 2020in Public Consultation C06/20was way to proceed. Accordingly, set ormeasures was thebest consultation withanalternative decided that publishing a second measures required areview and felt that theoriginally proposed responses itreceived, theDivision Considering someofthe parties. responses from interested February 2020, inwhichitinvited Consultation C02/20on24th The Divisionpublished general. As aresult, keeping the Gibraltar andtheworld in an unprecedented timefor COVID-19 hasbrought about to theirregular operations. to minimisedisruptions efforts and doingsoefficiently, making of the dataaccuracy collected to find ways to improve the work closelywithproviders The Divisionwillcontinue to therequiredcollecting data. and minimiseerrors when to providers to ensure accuracy guidance again suppliedfurther fairness, theDivisionhasonce the highestlevel and ofaccuracy order In to maintaincollection. five years ofstatistical data theprevious during observed developments whichhave been instances ofsignificant market the Divisionhaspublished period, thisreporting During require intervention. regulatory

M C Sharing on Providers disruptions to flow theirnormal both providers experienced no more timeat home. Again, result ofcustomers spending bandwidth consumption asa expressed anincrease in GibFibre andu-meealso this period. telephony increased throughout for mobilevoice services of OTT is interesting to note that theuse the lockdown.during However, it most oftheirtimeat home customers hadbeenspending to the Division, given that cameasnosurprise network demands placed ontheir Gibtelecom andtheincreased of the challenges mentioned by greatest extentpossible. Some up to date on matters to the had been protected and kept disruption andthat customers workflow encountered minimal thatlearn Gibtelecom’s business The Divisionwas pleasedto provided usefulinformation. who allcooperated fullyand u-mee, GibFibre andGibtelecom wereResponses received from could assist theminany way. coping and whethertheGRA customers andcompanies were matter how inorder to ascertain any relevant information onthe the different providers to share Accordingly, theDivisionasked first few months ofthepandemic. were encountering the during issues they had encountered or determine ifthere were any the localproviders inorder to Division corresponded with circumstances, in May 2020 the light ofsuchexceptionalIn thepandemic.during we live, andcommunicate work, we allhadto adaptto theway businesses, andindividuals, as families, vital role insupporting year, many have sectors played a thelast During more important. across Gibraltar hasnever been going communications industry ELECTRONIC COMMUNICATIONS 17 26% in March 2020 to 24% in 24% to 2020 in March 26% despite is, that 2021, March their subscriber numbers also During slightly. increased having this reporting the local period, to continued has that provider the most significant experience residential in the fixed growth marketis GibFibre, broadband their market increased who have 2020 in March 39% from share 2021, thus 43% in March to the their position for cementing the as year consecutive second local the majority in shareholder market. broadband residential fixed the shows 2 Figure market broadband business as of March in Gibraltar shares the major to 2021. In contrast shifts can be observed that in the market, broadband residential broadband equivalent the has business market for in changes less far experienced during period the market share the market Overall, under review. one hundred has gained over which new business customers, terms, in relative that, shows the market is still on an upward Gibtelecom’s Despite trend. decreased having market share 83% in the previous from slightly 81% in March reporting to year to continues 2021, Gibtelecom business the fixed dominate market in Gibraltar. broadband Network’s U-mee and Sapphire effectively have market shares around the same at remained S

C M Disputes; Disputes; COVID-19; the following topics: the following x. 2021, the total of March As tatistics and Trends broadband of number from subscribers increased 21,839. 2020 to 19,523 in March of the 1 is an illustration Figure broadband residential fixed as in Gibraltar market shares years, In 2021. of March recent this market has demonstrated changes the most significant of availability increased to due broadband priced competitively packages and bundles resulting number of in a substantial purchase subscribers opting to services alternative from providers. increase a marginal Despite in its subscriber numbers, residential fixed Gibtelecom’s has market share broadband from reduce to continued 33% in 2020 to 35% in March u-mee 2021. Similarly, March a slight has also experienced residential in its fixed decrease from market share, broadband • and onsumer Complaints • on5Gand isinformation • Scam Calls; • 5G; and security. password Wi-Fi • oadband Provider; oadband Provider; S

C Choosing Br industry. W pandemic; • OVID-19 andthelocal • Speeds; and • Broadband • orking homeduring the from ix. Division makes good use The ocial Media of its various social media consumers ensure to platforms and the local community with the latest provided are of interest on topics information and during the period under these included the review, following: gathering statistics; • Data • Brexit; The Division was grateful to the to grateful Division was The and feedback their for providers to customers supportthe offered such a difficult time throughout out reach to and will not hesitate and support in local operators similar events if any the future occur. of serviceof customers some but relation in complaints had made broadband issues and/or Wi-Fi to that explained GibFibre speeds. investigated were all complaints they result time and as a the at and rectify identify able to were some Previously, areas. saturated been have may areas saturated but these were identify to hard rectify duringeasy to lockdown same the in customers as were area household and/or at their broadband connected to the same time. Furthermore, the Division also the Division Furthermore, and/or publishes information as a series or sequence guidance run over of slides or videos that which week of one the course on a particular issue focus topic, the at which is relevant or process Division has published The time. a series of social media slides on 18 ELECTRONIC COMMUNICATIONS (pay-as-you-go mobile type the total numberofpre-paid Figure 3isarepresentation of markets. in both the local broadband continues to develop itsposition year.current reporting GibFibre 12% inMarch 2020to 15%inthe share has again increased from other hand, GibFibre’s market 1% and3%respectively. Onthe to in2020. thesameperiod compared5,000 subscribers a gross decrease ofalmost 35,757 subscribers, representing 15,350 for agrand total of of post-paid was subscribers was 20,407andthetotal number mobilesubscribers of pre-paid March 2021, the total number inGibraltar.subscribers As of mobile contract mobileservices) andpost-paid (monthly services) Figure 5 represents the total phased out. arelower bandwidth packages become more competitive and asprices bandwidth products migratingsubscribers to higher following theworldwide trend of that Gibraltar is the fact 25Mbps. Figure 4 also reinforces ofunder a broadband package 100Mbps andonly12%were on download speedsbetween 25- with broadband packages purchasedof allsubscribers of 101Mbpsormore. 30% withdownload speeds packages (58%), purchasing broadband ofallsubscribers the majority with high bandwidthpackages, aresubscribers tending towards figures indicate collected that inGibraltar.packages The ofbroadbandthe distribution this inmind, Figure 4 shows more affordable offerings. With fibresymmetric broadband to from ultra-high speed1Gbps of broadband products, ranging now benefitfrom awidearray markets, Gibraltar’s subscribers and residential broadband inboththebusiness subscribers With operators competing for data, callminutes andSMS’s. which are bundled with inclusive priced post-paid mobileservices availability ofcompetitively possibly dueto theincreased than ever before,paid services upmore post- taking subscribers to highlight thepropensity of overGRA recent years, continues statistical data collated by the lockdown. Despite thisfact, out ofGibraltar theCovid during movement ofpeopleinto and from imposed on the restrictions this decrease may have resulted subscribers. We understandthat loss of around 6,000 pre-paid numbers resulting from a overall decrease insubscriber slightly from 2020,withthe increasedpaid subscribers However, the number of post- ELECTRONIC COMMUNICATIONS 19 Re

replacing the use of traditional traditional use of the replacing figures with these mobile calls, trend experiencinga downward This years. the last few over must of 3% however decrease of the in light be considered restrictions as a result imposed and pandemic Covid the of its likely impact on subscriber trends. usage habits and xi. During period the 2020/21 and with the provisions in accordance Collected venue amount the total of the Act, the GRA in respectcollected by was of General Authorisations £858,894. collected by amount total The the GRA in respect of Service £3,462. was Providers total the has brought This Service for Providers revenue for and General Authorisations £862,356. 2020/21 period to interact with their friends their with interact and we home, from Working family. also added suspect, have may of in the number an increase to It generated. call minutes fixed fixed that be noted should also service providers telephony significantly offering now are ever than cheaper call tariffs calls with some fixed before, meaning of charge, being free less mindful subscribers that are when making and frequent they were longer calls than doing previously. number total the 6 shows Figure generated of mobile call minutes is a slight There in Gibraltar. of 3% in the number of decrease the to compared when minutes is This reportingprevious year. which in line with global trends the use of mobile that show and OTT devices to applications the internet calls over make free are (Wi-Fi, etc) mobile data number of fixed call minutes call minutes fixed of number During operators. of all local this reporting the total period, call minutes of fixed number which is 13% by has increased trend contraryestablished the to reporting in previous identified steady a showed which years, call fixed decline in the amount collected by Statistics minutes. the past over that the GRAshow had call minutes years fixed five almost 50%, most by reduced the use of to likely attributable (OTT) services such Top” the “Over Skype Facetime, WhatsApp, as and other similar applications make free users to which allow online. calls voice and video in mind, with the above However, be due, of 13% may the increase lockdowns in part, the Covid to level national a on imposed and which has undoubtedly impacthad a significant on people with more usage trends unable to home, being stuck at 20 RADIO COMMUNICATIONS

21 22 RADIO COMMUNICATIONS mobile voice anddata services. operators for theprovision of toextend thoseusedby mobile of radio frequencies, which management and allocation is also responsible for the safe guidelines. The Division operate withintherecognised a viewto that ensuring they to emit radioknown waves, with out of regularsites inspections its duties, theDivisioncarries Amongst magnetic spectrum. and control of the electro- responsible for themanagement is theGRA Act”), 2006 (“the VI of the Communications Act ofitsremit under Part As part slots. orbital 13 distinct satellite whichare networks in with thecoordination ofthese to theITU. The Divisionassists administration for submission the filingis to theUK forwarded the required duediligence before satellite out and carries project The Divisionexamines eachnew other international obligations. Regulationsandall (“ITU”) Radio Telecommunication Union with theInternational forums andensures compliance at international meetingsand (Gibraltar) Limited (“SES-G”) based operator SESSatellites also represents theGibraltar- Furthermore, theDivision Outer Space Licences. Act together withtheissuingof terrestrial andsatellite services, Regulations, whichinclude Radio provisionthe regulatory ofthe responsible for administering management. The Divisionis andfacilities as well asinternal ICT and international coordination, radiocommunications, satellite spectrum, electro-magnetic with allmatters relating to the Division”)Division (“the deals andOperationsThe Spectrum Introduction services, Fixedservices, Satellite Service grouped into of two types Essentially, all filings can be set outby theITU. proceduresregulatory andrules would needto comply withthe associated with a new filing years. Any prospective satellites congested overit very the has subsequentlyorbit made satellite inthegeostationary of placingacommunications Regulations. The hugebenefits conformity withtheITURadio and economically shared in must berationally, efficiently, natural resource andtheslots bandsused alimited frequency slotsandtheassociatedorbital required. This therefore makes at asatellite withnotracking are keptfixed and pointed dish antennas ontheground Conveniently, thismeansthat position ontheEarth’s surface. continuously at thesame satellite would bepointing of theEarth. This meansthe the samespeedasrotation causes thesatellite to travel at physical nature oftheorbit the above36,000km theEarth, satellites are located. At most ofthecommunications atellite Coordination iswhere orbit The geostationary i. & Participation Coordination International marketed inGibraltar. transmitter equipment to be has powers to approve radio which emit radio waves and all usersoflicensable equipment The alsoissueslicences GRA to

S These SES-G existing networks These SES-G into existing slots. key orbital thisyear going of theactivity notified withtheITU, with most filings brought into use and andcurrently has11 industry Gibraltar hasamature satellite orbit. slots around thegeostationary filings withtheITUin13orbital To date, hasregistered SES-G 32 bands. into useitsrespective frequency slot, itcanthenbring orbital satellite isplaced intheplanned rights andobligations. When a which grants itinternational Frequency Register (“MIFR”) into theMasterInternational deadlineandenteredregulatory to theITUbeforebe reported the coordinate thefiling, thesecan haveOnce efforts beenmade to interference.harmful and avoidsatellites canco-exist parameters adjusted sothat need to be found andtechnical coordination. Compromises meetings are held to complete of correspondence and and numerous exchanges identified aspotentially affected, with the operators that are process ofcoordination offthelengthy This starts of thenewsatellite filing. inform allotheradministrations toInformation Circulars (“IFIC”) InternationalFrequencyweekly it willbepublishedinthebi- the filingisaccepted by theITU, and terrestrial networks. When could causeto existing satellite interference thesenewsatellites the potential for harmful filed parameters to calculate The ITUwillexamine the respectively willcommence. year timeframe for FSSandBSS clockwitha7-to-8- regulatory is submitted to the ITU, the (“BSS”). Once anewfiling Service (“FSS”) andBroadcasting Satellite RADIO COMMUNICATIONS 23 Electro-Magnetic Spectrum M

Section the Act 56 of provides of the the ownership that electro-magnetic spectrumin exclusively “vest shall Gibraltar and the in the Government for Minister shall be responsible and control”, its management “may Ministerthe that and person any writing, in appoint, be suitable him to appearing to of his powers, any exercise to or functions duties tasks, in of the management to relation electro-magneticthe spectrum in Gibraltar.” above-mentionedThe has been assigned responsibility as partthe GRA and, to of its the Division carries annual remit, inspectionsout regular of the electro-magnetic spectrum capable of using equipment the measuringinterference, of equipment levels power and a waves, radio transmitting number of other factors useful of the state in determining electro-magnetic Gibraltar’s spectrum usage. Division also carriesThe monitoring out compliance emissions from ensure to with comply transmitters guidelines as set international the International Commission by RadiationNon-Ionizing on (“ICNIRP”). partProtection As the process, of the licensing Division conducts annual site inspectionsbase mobile on all Below is an overviewBelow of the by dealt regulatory matters Division during 2020/2021: i. of the anagement Regulatory Matters Plan Review Meeting - Plan Review Update T SES

A virtualheld was meeting Ofcom the Division, between and SES-G discuss 2020 to in June Plan Development the Annual the SES-G for satellite update was plan The updated filings. the by and approved reviewed discussions with Division prior to Ofcom. v. v. coordination, with satellite As Coordination errestrial the the Division examines the ITU published by information services terrestrial respectwith to additions, contains which of or suppressions modifications stations transmitting terrestrial neighbouring or networks from of which could any countries, Gibraltar to cause interference Unlike stations. registered can cause which satellites other many issues to interference administrations, or satellites servicesterrestrial can mainly countries; affect neighbouring Spain and case, in Gibraltar’s Notwithstanding their Morocco. Gibraltar, from distance relative Algeria and, from modifications Portugal a much lesser extent, to Over the also examined. are of period 2020-2021, a total the from 1808 modifications been have above listed countries and only a handful examined been raised of objections have of the high probability due to interference. potential iv. iv. -G Development Satellite Satellite Coordination Meetings sent to Administrations Administrations to sent C

Due to the pandemic and how the pandemic and how Due to for the abilitythis has affected work to other administrations no meetings have remotely, been held during this period. some headway being said, That has been made with minor possible. where agreements, When administrations from from administrations When submit new other countries orbital filings near the Gibraltar the potential have they slots, cause harmful interference. to Division must examine The new these of publications the the relevant networks and inform coordination that administration in-house The is required. software makes the process reduces simpler and drastically therefore and time’ ‘analysis the consult time to more for allows operator with the satellite the expiry of the periodbefore for This comments/objections. software automates application to of notification the process and regulator, UK the Ofcom, the back office streamlines activitiesassociated such as deadlines. filing and logging iii. ii. Requests oordination could potentially suffer harmful suffer potentially could new incoming from interference has and the Division filings networks 715 satellite identified administrations different from could that the world around affect SES-Gpotentially networks harmful (this includes potential a from identified interference same network under different provisions). 24 RADIO COMMUNICATIONS ii. swiftly. transmitters are addressed stations andotherradio emissions from mobilebase regarding electromagnetic that concerns from thepublic the Environment to ensure for closely withtheMinistry has, however, been working or health research. The Division matters concerning biological nor theremit in to participate and ithasneithertheexpertise not setemissionsafety levels Therefore, theDivisiondoes emissions.to electro-magnetic recommendations for exposure responsible for establishingthe be challenging. The is not GRA the source ofinterference can Gibraltar’s topography, locating high volume ofbuildingsand range. –22 GHz to Due the kHz of mosttransmitters withinthe9 frequency, andgeneral direction that canidentify thepower, analysers leading spectrum by trained staff using industry- investigations, are conducted audits, and interference All site spectrum inspections, be found ontheGRA’s website. can details oftheseinspections Gibraltar for compliance. Full audits basestations throughout station installations androutinely In thefuture, on In theservices Channel 56 before this deadline. Gibraltar Freeview powered off European countries. However, to 30thSeptember2020inmany 30th June2020was pushedback pandemic, the agreed date of delays brought about by the date to of30thJune2020.Due 56 by theinternationally agreed to powerinstructed offChannel band, Gibraltar Freeview was inthe700MHz of spectrum preparationIn for the award

Networks Communications Mobile/Fixed nterference andPower- iii. of interference with,ormisuse where there case isasuspected and/or organisations alike, raised by membersofthepublic ifconcerns areinspections out The Divisionalsocarries MHz bands.MHz and700 the 3400–3600MHz in (“MFCN”)Network spectrum Mobile/Fixed Communications three expressions ofinterest for The has also received GRA and DVB-T2 platform. to provide content onaDVB-T onitsmultiplexors the services upgrade equipment andrealign Gibraltar Freeview aimsto ofthisrelocation project, part premises(“GBC”) relocation. As Broadcasting Corporation ITU, oftheGibraltar aspart replacement channelwiththe to Channel39,theregistered Channel 56willbemigrated

I Level Monitoring The fixed anddeployable units locations around Gibraltar. measure EMFlevels at key unitto a handheldportable (for use inside buildings) and an indoordeployable unit four fixed monitoring units, The equipment consists of 40GHz. to band20MHz in thefrequency including allradio transmissions mobile phonebasestations, Gibraltar andemissions from (“EMF”) levels throughout monitor electromagnetic fields in equipment to continuously guidelines, has invested the GRA are compliant withtheICNIRP basestations,mobile network transmitters, including future required to ensure allradio into consideration theresources Government ofGibraltar. Taking the standard adopted by HM or exceed theICNIRPGuidelines, recommended by theDivision at power levels beyond those suchastransmission spectrum, of, Gibraltar’s electro-magnetic RADIO COMMUNICATIONS 25 £84.00 £441.00 £147.00 £310.00 £316.00 £312.00 £2200.00 £8,635.00 £2,090.00 £8,500.00 £9,775.00 £3,450.00 £17,316.00 £40,020.00 £10,190.00 £662,608.00

Magnetic Spectrum Lic

Government of Gibraltar agencies agencies of Gibraltar Government to issues relating address to especially radiocommunications, health risks from perceived radio Throughout transmitters. the rollouts, Project the 5G be in to Division continues with the communication regular Ministry the Environment, for Office of Director, Aviation Civil and RAF, NATS, Planner, Town the Group. Safety the Environmental The GRA collects licence fees GRA fees collectsThe licence on behalf of the Government licensing and uses different the use promote schemes to and maximise of technologies the use of the electro-magnetic spectrum The efficiently. table outlines the following collected during the period fees typeeach of for 2020/2021 VI of issued under Part licence the Act: Accounting Wireless Dealers Wireless Spectrum Usage VSAT during the period Furthermore, 2020/2021, the GRA renewed for Act licences Space six Outer SES-G each of the satellites for Authorities AGRS CB Radio Earth Station Links Fixed Mobile Radio Microphone Paging PMR Ops Port Radar Radio Amateur Licence Ship Station v. v. oftheElectro-ensing with other Agencies with other Agencies A

Lar Events Events b) GBC FM Radio Interference GBC FM b) an investigated Division The report the interference from clickingGBC of an intermittent in their sound breaking through After channel. broadcast 91.5 FM effort between a coordinated the GRA both and from engineers identified, was GBC, the source door garage being a remote that a housing from opener system in the westside development company management The area. after further and, contacted, was confirmed, was source the tests, ratified. and the problem The Division continues to to Division continues The closely with the Ministrywork HM and Environment the for iv. andCooperation dvice c) andSportingge Public Due to the pandemic and and pandemic the Dueto there restrictions on events, been a small number only have temporary for of requests additional spectrum - mainly Heavyweight World the for and several Match Boxing Irrespective matches. football or of the event of the size of spectrumof the amount a number are there required, that requirements of technical ensure to must be met in order within operates the equipment avoid to the local regulations or being causing interference with. interfered The Division has been primarilyThe in dealing with involved issues affecting mobile service the population Given providers. densitybuilding and Gibraltar in demands in and the growing it is networks, mobile radio this of issues that inevitable reappear. continuously nature During the past months, been investigating have we affecting problems intermittent in Main Street, area the coverage and the Souththe Port, District. yet are the sources Although the Division be identified, to with closely work to continues and local network operators other users of the spectrum to not Although problem. the solve the this purpose, for designed project help will monitoring EMF in detecting peaks and assist in the triangulation of interfering which, apart sources from networks, existing disrupting in EMF an increase to contribute levels. a) Mobile Interference In the period 2020/2021, the attended were matters following to: monitor the EMF levels in levels the EMF monitor time in the bands 20MHzreal 40GHz to and automatically onto uploads the information This portal.a publicly available portal the via can be accessed equipment This s website. GRA’ the existing will complement spectrum which are analysers the used primarily identify to of interference. sources 26 RADIO COMMUNICATIONS where addressed. and that all insurance liabilities the missioncould beachieved as well as the UKSA, to ensure collaboration withtheSES-G The process involved close at location. itsneworbital to andoperation ofthe satellite replacement licence for thedrift Gibraltar, issued a the GRA Space licence Act issuedby AMC-18, hadanexisting Outer 2020. Although thespacecraft, locationorbital inDecember andarrived atwas itsnew drifted licensed satellites, oneof which Currently, there are sixGibraltar- outer space. coveringprinciples theuseof with international treaties and are operated in compliance to ensure that thesatellites the UKSpace(“UKSA”), Agency the Divisionworks closelywith and of Space Objects Registry areGRA included in the UK’s All thesatellites licensed by the 2001. (Gibraltar) Order 1996) Notice Functions (Outer Space 1986 Act to by theGRA, theDelegationof responsibilities were delegated These powers, duties, and associated withGibraltar. in outer space by individuals andactivities space objects concerning theoperation of the international obligations to ensure compliance with to theGovernor ofGibraltar licensing andotherpowers Order 1996,whichconferred Outer Space 1986(Gibraltar) Act uter Space Act was to extended Gibraltar by the The UK’s Outer Space 1986 Act vi. was £6,000. result ofissuingtheselicences The total revenue received asa are controlled from Gibraltar. operating inSpace, andwhich

O INFORMATION RIGHTS

27 28 INFORMATION RIGHTS In responseIn to the change in protection inGibraltar. framework that governs data Gibraltar GDPRnow provide the 2019. The alongsidethe Act Etc.) (EUExit)Regulations Communications (Amendments andElectronic Privacy within theData Protection, are somedifferences, asdetailed the EU GDPR, although there mirrors GDPR for themostpart Gibraltar GDPR”). The Gibraltar Data Protection Regulation(“the replaced by theGibraltar General 2019,been Act (Withdrawal) 6oftheEuropeansection Union The of EU GDPR has, by virtue jurisdictions. the flow ofdata between the Gibraltar, thereby affecting before data is transferred to required to implement measures within theEuropean Unionare which meansthat organisations for oftheEUGDPR, thepurposes now considered a “third country” is also meansthat thejurisdiction exit from the European Union to apply in Gibraltar. Gibraltar’s ceased EU GDPR”) 2016/679 (“the Data Protection Regulation the samedate, theEUGeneral consequently Gibraltar’s exit on from theEuropean Unionand in theUnited Kingdom’s exit 2021,whichresulted January Brexit transition on 1st period Following the end of the Part V and VI oftheAct. are assignedauthority under powers ofthesupervisory in relation to thetasksand conferred ontheCommissioner Gibraltar. The general functions in authority the supervisory to be Commissioner”), (“the as Data Protection Commissioner designates theGRA, Act”) (“the The Data Protection 2004 Act Introduction effective manner. operational in an efficient and has managedto remain fully with uncertainty, theDivision anunprecedentedIn year, filled COVID-19 related guidance. forums, and the provision of ininternational participation locally andinternationally, included meetingswithofficials surrounding COVID-19 has theworkother activities, warrant some flexibility. Among that theuniquecircumstances protection, although accepting the higheststandards ofdata ensure that Gibraltar applies continuedto withitsefforts pandemic, theDivisionhas With regard to theCOVID-19 have continued. promote itsresponsible use, from digital technology and awareness to oftherisks privacy campaign, whichaimsto raise Privacy”ongoing “ControlYour public awareness events andthe e-newsletters, Officers, quarterly workshops for Data Protection alike. Amongst otherthings, by organisations andindividuals andguidance requiredsupport raising initiatives to provide the has enhanced itsawareness- respond to publicconcerns and the Divisionhascontinued to Division. As inprevious years, guidance publishedby the greaterattract attention to the toof videoisexpected help engagement strategy. The use its communications and videosin the useofshort The Division introduced and socialmediaplatforms. websitepublished ontheGRA addition to otherguidance guidance publishedwas in of 2020. The Brexit-related workshops inthesecond half held dedicated Brexit-related Brexit-related guidance and regime, theDivisionpublished included thefollowing: thisyear has participation The Division’s international effectiveness. the Division’s and efficiency players, thereby maximising ofotherkey from theexpertise the Divisionto gainleverage protection globally, butitallows and enforcement ofdata in relation to the regulation keep abreast ofdevelopments does thisallow theDivisionto level.jurisdictional Notonly onamulti- activity regulatory coordination, andalignment of to facilitate cooperation, international events, aiming invarious year participated The Divisionhasagainthis Participation International arch /April 2020 i. letter to companies providing world, jointly signed anopen regulators from around the data protection and privacy Commissioner, andfive other On 21stJuly2020, the related risks. privacy video conferencing appsand discuss theincreased useof in teleconference meetings to 2020, theDivisionparticipated 2020and15thMayOn 16thApril • Video conferencing platforms - year, including– throughoutin its the activities participated Division hasactively Working Group (“IEWG”). The International Enforcement Assembly’s (“GPA”) permanent as a member of the Global Privacy The was formally GRA accepted

M Group Enforcement Working Assembly International Privacy - Global INFORMATION RIGHTS 29 entre entre ed Irish and Island’s Data Data Irish and Island’s Authorities Protection (“BIIDPA”) Policy Information for (“CIPL”) Leadership Nations Educational, Educational, Nations Scientific and Organisation Cultural (“UNESCO”) 18th June 2020 - British, 17th June 2020 - C June 2020 - Unit

bodies from around the world the world around from bodies overseeing with charged who are to of access the implementation legislation, public information of Freedom Gibraltar’s as such GRA The Act 2018. Information also supported a statement the sixteen members by adopted Working of the Governance the of the ICIC, reiterating Group rights importance of individuals’ during the information access to pandemic. The BIIDPA meetings take BIIDPA The annually and provide place participating protection data authorities with an opportunity and discuss current to the year, This issues. developing Division participated in a virtual discuss COVID-19 to meeting, to addition in matters related strategies. communication attended Commissioner The the CIPL, by hosted an event together brought which of international representatives and data organisations discuss authoritiesprotection to Privacy Data and Effective “Good Accountability”. The Division completed a Division completed The for questionnaire national freedom to relating UNESCO, legislation information of collect to data and intended assist in to and information global the overall monitoring in ensuring public progress information. to access vi. vii. v. pril 2020 - Conference of Conference Information (“ICIC”) Commissioners Market Insight Market for Organisation Cooperation Economic and Development (“OECD”) M 8th A 15th A

The Division provided feedback feedback Division provided The the ICIC’s to the ICIC in relation to connectsICIC The Plan. Strategic Commissioners, Information and other Ombudspersons, The AIC was interviewed by MLex MLex interviewed AIC was by The interview The Market Insight. upon facial recognition, touched cookies and GDPR enforcement. Division participatedThe in online workshop the OECD’s the Data “Addressing on Privacyand Governance Against Fight in the Challenges with the hosted COVID-19” Attended support of the GPA. 260 participants over by governments, representing authorities protection and data organisations, international frontline explored the forum and being considered responses worldwide. adopted iv. 2020-International ay ii. pril 2020-MLex iii. The IEWG hosts ‘Safe Space Space ‘Safe IEWG The hosts in which member Sessions’ discuss to able authoritiesare of are global issues that particular in an intimate interest, and strictly setting. confidential Space a Safe GRA hosted The Session 2021 on 8th March during which the Assistant (“the Commissioner Information a presentation AIC”) delivered IEWGthe of members the on to Stuffing’. ‘Credential of topic and Discussions on the topic, data regarding its implications followed. protection, • Credential stuffing – • Credential In January 2021, the GRA and authorities protection other data regarding published an update VTC with their engagement service and next steps. providers The letter recognised the value the value recognised letter The in teleconferencing of video people connectedkeeping about out concerns but set are whether privacy safeguards increased with keeping pace the sharp uptake of risks from servicesthese during current the signatories joint The pandemic. teleconferencing video provided principles with companies addressing guide them in to The privacykey some risks. the letter sent signatories joint Microsoft,directly to Cisco, House Party and Google. Zoom, invited were companies These demonstrate and respond to principlesthe take they how in the development account into video of their and operation offerings. teleconferencing and Zoom Microsoft, Cisco, the open letter. to Google replied In the companies their responses various privacyhighlighted and security measures, best practices, they advise are that and tools their to or built-in implemented services. video teleconferencing video teleconferencing services. teleconferencing video 30 INFORMATION RIGHTS oiia cmags and campaigns olitical • learning souls: our of irror • re digital identity programmes • to right the does hat • latest the address we do w • countries that ensure to w • ix. viii. following topics: The conference addressed the the meetingsinStrasbourg. delegations that usuallyattend a broader audience thanthe the work oftheCommittee to which was designed to present the CoE’s Data Protection Unit, the Committee ofC-108and event organised byin avirtual The Commissioner participated course oftheyear. and aimsto the publishitduring onaguidance noteis working related challenges. The Division real technology andprivacy- DEWG’s positionthat thisposes platforms worldwide, itisthe the useofeducational online light oftherecent increase in on eLearning platforms. In implementation ofaResolution DEWG’s to promote efforts the The Divisioncontributed to the they shouldstop doing? schools have to do, and what setting? What educational data protection imply in an W elections: whyelections: is data protection facial recognition risks Cicero’s lessonsandaddressing by design? privacy being implemented with in anAIera? challenges posedby profiling mechanism, andwhichone? need afollow-up andevaluation with itsprovisions? Why dowe that commit to C-108+ comply P M A Ho Ho

2nd and3r 2nd July2020-GP 108 (“C-108”) (“CoE”) –Convention - Council of Europe (“DEWG”) Working Group survey EducationDigital d July2020 A xiii. d July2020- xii. xi. d July2020and9th x. eptember 2020 -GPA xiv Media, and Media, Technology sectors. considerations for the Telecoms, anddata protection privacy which discussedtheevolving the IIC-hosted webinar, The Commissioner moderated the pandemic. issuesduring protecting privacy tracing andguidance for approaches towards contact discussed the differing Commissioner.podcast The in conversation withGibraltar’s Commissioner ofNewZealand, podcast featuring thePrivacy The IIC hosted a privacy rights andfreedoms. andother between privacy ontherelationshipreport development of a GPA narrative outby theGPAcarried for the The Divisioncontributed to work related matters was discussed. COVID-19 ondata protection of implications andimpact teleconferences inwhichthe The Commissioner attended experiences andbestpractices that seeks to identify relevant by theGPAbeing undertaken The Divisioncontributed to work so crucial?

29th July2020-IIC 23r July 2020-GP 3r S Pandemic Webinar Privacy and Privacy Podcast Communications (“IIC”) Institute of Institutional Project andFreedomsRight Network (“CTN”) Common ThreadThe 2020- September Survey COVID-19 Taskforce A Privacy, xvi. xv. xviii. xvii. People Safe Online”. “Keeping Children and Young 14th InternationalConference inthe The Divisionparticipated compliance mechanisms. enforcement, any relevant regulators consider, intheir understand theextentto which by theCIPLwhichaimsto research undertaken project ofa questionnaire aspart The Divisioncompleted a discussed. Recognition Technologywere development and use of Facial experiences in relation to the positionsandregulatory policy which keyconcerns,during The Division attended a webinar concerns posedby their use. platforms andtheprivacy discuss videoteleconferencing safe space session followed to of theGPA going forward. A milestones and deliverables and discussedthepriorities, the topic ofgovernance, The meetingfocussed on COVID-19 pandemic. have inthecontext arisen ofthe regarding issues that the privacy within theGPA community,

1st and2ndOc 10th S 12th Oc 8th Oc People Safe Online” and YoungChildren Conference: “Keeping 2020 -14thInternational Policy andPractice EnforcementRegulatory 2020 -CIPLProject on Technology Webinar IEWG Facial Recognition Cooperation Enforcement for International IEWG PracticalSolutions eptember tober 2020-GPA tober 2020-GPA tober INFORMATION RIGHTS 31 M

The GRA, amongst other GPA GRA,GPA other amongst The observers,and members questionnaire a completed against on guarantees focusing to disproportionate access government by data personal and public authorities. As evident from Figure 1, Figure from evident As i. other activities, the Amongst regulatory functions Division’s Activity easured include dealing with inbound data investigations, enquiries, audits and data protection notifications. breach a) Inbound Enquiries Remaining an important point the public and of contact for through alike, organisations inbound enquiries the Division can gain an understanding particularof areas of concern In protection. data with regards the Division queries, to response individuals to guidance provides and organisations. this enquiries180 received The subject by categorized are year the Division can so that matter areas predominant assess any in respect of which the public additional benefit from could or which merit the guidance, otherwise. attention Division’s 1 overleaf)(Figure Regulatory Matters is an outline of following The which the regulatory matters the Division has been involved in during the reporting period 2020/21. arch 2021 – GPA 2021 – GPA arch ebruary – 2021 anuary 2021 - arch 2021 - Global arch Policy Strategy Working Working Policy Strategy 1”) (“PSWG 1 Group Privacy Enforcement Enforcement Privacy – (“GPEN”) Network Sweep OECD CoE – C-108 on Data on Data – C-108 CoE Protection 19th M 5th M 17th F 28th J

public sector data processing. sectorpublic processing. data The PSWG 1 has highlighted the PSWG 1 has highlighted The key principles identify and need to with regards standards common frameworks. protection data The Division is currently Division is currently The participating in this year’s GPEN Sweep The GPEN Sweep. whereby initiative is a yearly authorities, privacy enforcement GRA,the including participate in activity assess to a coordinated of topic The privacy practices. “privacy is Sweep year’s this COVID-19 and considerations solutions and initiatives”. related The Commissioner responded responded Commissioner The stakeholder the OECD’s to ‘Draft on its consultation Children on Recommendation Environment’ in the Digital ‘Draft Guidelines for and Both ServiceDigital Providers’. supportseek to documents policymaking the that ensure to safe both is environment digital for children. and beneficial To mark 40th anniversary the of To 15th 108 and the Convention anniversary Protection of Data a report published the CoE Day, Protection which included Data by organised events Day participants Committee of the The 108. of Convention to contributed Commissioner notifying by initiative the CoE’s activities Day Protection of Data in Gibraltar. xxvi. xxv. xxiv. xxiii. anuary 2021 - GPA anuary 2021 - GPA anuary 2021 - GPA anuary 2021 - GPA o 20th November o 20th November o 15th Octobero 15th Data Governance in the Governance Data SectorPublic Survey Census 2020 Census 2020 - 40th Plenary Meeting of the of C-108 Committee 2020 - GPA Annual Annual 2020 - GPA International Conference 28th J 28th J 18th t 13th t 13th

The Commissioner completed completed Commissioner The an online survey the run by Direction Sub- Strategic GPA’s assist in informing to committee to relating work GPA future The Commissioner completed completed Commissioner The an online survey designed a comprehensive provide to Protection of Data ‘snapshot’ across and Privacy Authorities the how the globe and assess landscape is protection data changing. The Commissioner joined over joined over Commissioner The 100 participants all over from the C-108 meeting. for the world 108 is the only global Convention on legally binding agreement Amongst law. protection data the C-108 meeting other things, enforcement law discussed facial data, to access transborder protection data recognition, digital setting, education an in and personal data identity, political for and by processing campaigns. The conference’s main event was was event main conference’s The focused which session”, “closed its reports workingon and group based on the work resolutions undertakenthe throughout members discussed a GPA year. resolutions proposed 5 of total GRA actedThe as adoption. for ‘Resolution of co-sponsor of the on Emerging Statements Joint Issues’. xxii. xxi. xx. xix. 32 INFORMATION RIGHTS Figure 2 Figure 1 data security. Matters relating increase relating in enquiries to significance isthe particular Of matter.by subject whencategorized top thechart access requestssubject (“SAR”), CCTV, breach notifications, and relatingenquiries to data security, result of the COVID-19 pandemic. asa an increase inhomeworking thisyear followingin particular increased useoftechnology, and radar recent during years dueto same have beenontheDivision’s implemented ofthe inrespect andmeasuresto data security various topics and expanding on issuingguidance notes on concentrate additionalefforts allowedin turn theDivision to decrease cases andhas inactive has resulted inanoverall net number ofinboundcases. This equal to orgreater thanthe the numberofcasesclosedwas months,9 ofthe12reporting As reflected in Figure 2,during data protection matters. from inrelation data subjects to handling complaints received The Divisionisresponsible for GDPR isbeingcomplied with. as to whether theAct/Gibraltar Division, andwhichraises doubts of the function the day-to-day of information obtained as part of acomplaint orasaresult of result eitherasthedirect action which seestheDivisiontaking An investigation is any process omplaints, Investigations b) guidance note onthematter. the update by theDivisionofits an end, andagainresulting in transitional coming period to to bea result oftheBrexit period, said increase considered increased thisreporting during international transfers have also Notably, relating enquiries to Q12021. during under data protection legislation relating to individualrights 2020 andlaunchingacampaign inNovemberon thesubject by updating itsguidance note year. The Divisionresponded inbound casesthisreporting the dominance ofSARsamongst relatingenquiries to SARsmirrors Interestingly, the high number of December 2020. the DPO Workshops held in a sessiononthetopic within March 2020,supplemented by in guidance onData Security response,In theDivision issued and Enforcement C INFORMATION RIGHTS 33 Although not applicable to to applicable not Although majority the the vast cases, of times requires at Commissioner as powers enforcement use of his Act. the of VI Part under granted Commissioner the saw year This issue the first monetary penalty of the EU the introduction since 2018. GDPR in May enforcement any and cases The action the reporting taken in summarised in 2020/21 are year the table below. on amended Act was The Note: implement 2018 to 25th May the EU GDPR in and complement the Act to References Gibraltar. 2018 will refer 25th May prior to the to References “DPA”. the to Act after 2018 will refer 25th May DPA”. “amended the to replaced EU GDPR was The Note: GDPR on 1st the Gibraltar by the to JanuaryReferences 2021. 1st JanuaryGDPR prior to 2021 References the EU GDPR. to are the GDPR after 1st Januaryto GDPR the Gibraltar to 2021 are otherwise.unless stated following the introduction of of introduction the following case new internal the Division’s year’s This procedure. handling without in case closures increase are full investigation a requiring of the effectiveness to testament the that now the new procedure established. same has been fully as was SARs have, Notably, been year, also the case last subjectmost the of matter to relating issues with cases, closely sharing data following thereafter. the period 2020/21 saw The and close a Division complete full involved that cases 13 of total that investigations and thorough the by decision formal a to lead and enforcement Commissioner, The action appropriate. where actions subject are Division’s the and proportionate to particular of the circumstances including amongst other case, controller’s a data matters, cooperation history, compliance willingness and office, our with action. corrective take to During the reporting period, our to complaints following been opened have cases 49 office, the Division. Inby turn, 48 cases closed without been have a full investigation, requiring 33 36, year’s last to contrast in closed of the 36 which were Importantly, a distinctionImportantly, cases can be made between a full closed without requiring because of (e.g., investigation for requirement the Division’s engage to partiesthe involved and/or on the issue(s) raised the to referral the Division’s for organisation/person relevant the resolve to attempt them to a and those requiring matter), the Division. by full investigation their international presence. The The presence. international their complaints internal Division’s as procedure, handling proven has year, last introduced in resource be an invaluable to of efficiencies, the improvement of management better to leading and the Division’s investigations 2) (Figure workload generally. 34 INFORMATION RIGHTS “Resident”) Resident of Waterport Terraces (the AmRes27/19 Payoneer (EU)Limited (“Payoneer”) 24/19 AmRes Xapo (Gibraltar) Limited (“Xapo”) 21/19 AmRes (the “GFSC”) Commission Gibraltar Financial Services AmRes18/19 (“HSGP”) GPLimited (Sports) Hillside 13/19 AmRes (“Betfred”) Petfre (Gibraltar) Limited IV44/18 Companies (“Corinthian”) IV36/18 Corinthian Group of Data Controller Reference and Number Investigation Summary action was required,action into account taking thecircumstances ofthecase. System was no longer processing was personal data. established that Nofurther theCCTV It area at within theparking Waterport Terraces. systemThe investigation (the concerned theuseofaCCTV System”)“CCTV by aresident for purposes.personal data marketing withthird parties (Personal Data Regulationsand GDPR.Further, andPrivacy) Payoneer ceased of thesharing cookies, to ensure thesecomply withtherelevant requirements oftheCommunications personal data for andfor purposes marketing direct theobtainingofconsent for itsuseof As aresult oftheinvestigation, Payoneer reviewed theirprocedures for theprocessing of 5(2),6,7and32oftheGDPR. 5(1)(a),5(1)(f), RegulationsandArticles Privacy) breached: Regulations5and23oftheCommunicationsSections (Personal Data and for purposes. marketing parties processing ofpersonaldata andthesharing withthird ofpersonaldata usingcookies The investigation concerned Payoneer’s procedures to marketing, optoutofdirect the taken. corrective action was required, action into account taking No further thecircumstances ofthecaseand arrangements to provide 13oftheGDPR. individualswiththeinformation at Article information was provided outsidetheprescribed timeframe. Xapo alsoreviewed their Xapo provided information inresponse to therequest for erasure, althoughsome breached: 5(1)(a),12and13oftheGDPR. Articles provided to individualsregarding theretention oftheirpersonaldata by Xapo. The investigation concerned arequest for erasure ofpersonaldata andinformation taken. case andcorrective action was required, action intotimeframe. account taking Nofurther thecircumstances ofthe The GFSCprovided information inresponse to theSAR,albeitoutsideprescribed breached: 12(2),12(3)and15oftheGDPR. Articles The investigation concerned aresponse to aSAR. DPA. The Commissioner could notconclude that there hadbeenabreach oftheGDPRand/or from HSGPto third parties. The investigation concerned thedisclosure ofpersonaldata relating to abet365account taken. corrective action was required, action into account taking No further thecircumstances ofthecaseand The Commissioner issuedBetfred withaReprimand. with theGDPR. Betfred was required to to measures takecorrective ensure action complied theirsecurity 28(1)and32oftheGDPR. 5(1)(f), breached: Articles Articles The investigation concerned apersonaldata breach notification received fromBetfred. taken. corrective action was required, action into account taking no further thecircumstances ofthecaseand Corinthian provided theComplainant withadditionalinformation, following which required to bedisclosedinaccordance withtheprovisions and/ortheGDPR. oftheAct were required to provide theComplainant personaldata whichwas withany further the prescribed timeframes andwas incomplete. As aresult oftheinvestigation, Corinthian Corinthian provided information inresponse to theSAR,butthiswas notprovided within 12and15oftheGDPR. breached: Articles Articles The investigation concerned aresponse to aSAR. INFORMATION RIGHTS 35 24 have been closed and 13 been closed 24 have 3) (Figure ongoing. remain when adding different Notably, of cyber-attack,forms such force brute as phishing, etc. stuffing credential attacks, 25% (7 of 29) of approximately the to notified breaches data Division during the reporting of a been a result period have cyber-attack. cyber- to Exposure of growing is an area attacks protection a data from concern will make recommendations on will make recommendations further mitigate to measures occurrences. risksthe future of enforcement necessary, Where action also be taken. may 3, during Figure in reflected As the reporting period the breach 30 data Division received received were (25 notifications Of year). duringprevious the notifications, breach all data including new cases and those years, previous from continuing The investigation concerned the response to a SAR. to the response concerned investigation The Sections Articles breached: GDPR. 12(4) and 15 of the 12(1), 12(2), issue a to Intent of a Notice Notice, GCPL with an Enforcement issued Commissioner The monetary Notice. penalty and a Penalty SARs facilitating for their procedures action ensure take corrective to to required GCPL were the GDPR. with complied data. of personal the disclosure concerned investigation The Sections Section breached: 65(2), 65(3) and 75 of the Act. 44(1), 44(2), 49, 65(1), and introduced their security procedures the GCS reviewed of the investigation, a result As in future. of personal data disclosures the risk of similar unlawful mitigate to new measures case and of the the circumstances No further taking account into action required, was actioncorrective taken. under sectionAct. a suspected 175 of the offence concerned investigation The the case and could progress unable to was the Commissioner available, On the information of the GDPR and/or DPA. a breach had been there that not conclude of CCTV the circulation originate concerned to which appeared footage investigation The a CCTV Park. from and Car Coach in the Midtown located system Sections GCPL: Articles by breached 5(1)(f), 5(2), 28(1), 28(3) and 33 of the GDPR. ArticlesSections GPMSL: by 5(1)(f), breached 5(2), 28(3), and 28(4) of the GDPR. Sections Securitek: by Articles breached 5(1)(f), of the GDPR. 5(2), 28(3) Notice. issued GCPL with an Enforcement Commissioner The with Articles compliance action 28, 5(2) ensure corrective take to to required GCPL were to in regard their procedures review to and 5(1)(f) required GCPL were the GDPR. Further, of with Article compliance ensure to breaches, of personal data notifying the Commissioner 33 of the GDPR. the CCTV of servers to relating the breakdown concerned located system investigation The Park. and Car Coach in the Midtown Sections Article breached: 5(1)(f), 32 of the GDPR. 5(2) and their security ensure measures to their arrangements review to required GCPL were in place. are back-ups with the GDPR, including ensuring appropriate complied processor controller/data data to the lack of clarity concerned in relation investigation The of the identification to as issues relating as well Group, within the Lottoland relationships purposes. protection data for establishment’ ‘main is LHL, an entity established that based in Gibraltar, it was of the investigation, a result As purposes protection in respect data for establishment’ ‘main and the controller the data taking for all final decisions and implementing and is responsible Group of the Lottoland Group. within the Lottoland all entities by as processed personal data to relating C06/20 Lottoland Holdings Limited Holdings Limited C06/20 Lottoland (“LHL”) C01/20 Limited Parks Car Gibraltar (“GCPL”) Securitek Limited (“Securitek”)Securitek Limited Gibraltar Parking Management Parking Gibraltar Services (“GPMSL”) Limited IV01/19 Limited Parks Car Gibraltar (“GCPL”) C54/19 Firm of a Law employee A former (the “Employee”) C45/19 CourtsGibraltar Service Her of of Gibraltar Government Majesty’s (the “GCS”) C31/19 Limited Parks Car Gibraltar (“GCPL”) Article 33 of the EU GDPR GDPR, the Gibraltar and now certain circumstances provides must under which controllers of a notify the Commissioner by suffered breach personal data Upon receipt their organisation. the notification, of a breach the actionsDivision review taken prior to, controller the data by such breach. to, and in response the Division appropriate, Where c) Data Breach Notifications Notifications Breach c) Data 36 INFORMATION RIGHTS Figure 3 procedures for two organisations instigated data protection audit for these and has conducting documented internal procedure its auditprocess by creating a to formalise the opportunity taken Division hasnevertheless period. the reporting during The outany on-site audits to carry the Divisionhasbeenunable asa resultarising ofthesame, pandemic andrestrictions However, dueto theCOVID-19 in2020. itsinspections to restart theDivision was hoping report, As noted inlastyear’s annual taken where necessary. Enforcement may be action of itsdata processing operations. intermsachieving bestpractice controller/data processor in and thereafter assistthedata data protection legislation check for compliance with The aimofallauditsisto d) Data Protection Audits the area inthecoming year. onprovidingefforts guidance on is hopingto focus additional perspective, andtheDivision ‘joint controllers’ underthe controller’, ‘data processor’ and and responsibilities of a ‘data concepts andthedifferent roles Provides guidance onthe ta Protection ii. e n h Concepts the on e • a) Guidance Notes ofthesame: inrespect period thereporting output during The following liststheDivision’s protection law andbestpractice. organisations candiscussdata provide an open forum whereby collaboration and debate and to workshops intended to promote by organising data protection publishing guidance notes and provide guidance by proactively The Divisioncontinues to visits. which isto befollowed by onsite outadesktop review,carry by requesting information to 2021) Processor (publishedMarch of Data Controller andData Guidanc

 Da Guidance advice andassistance onhow to provide organisations with Guidance Note was updated Brexit transition period, this the run-up to the end ofthe In convictions andoffences. personal data relating to criminal categories ofpersonaldata or be relied onto process special of thelawful basesthat can GDPR. Explicitconsent isone 6oftheGibraltar under Article the processing ofpersonaldata is oneofthelawful grounds for to theGibraltar GDPR.Consent the samewhichisalsorelevant consent under the EU GDPR, Protection Board guidelines on to the reflect European Data This Guidance Note was updated he Rights of Individuals under Individuals of Rights he • etn ray o a n deal” “no a for ready etting • (update Consent on e • legislation are upheld. the applicabledata protection afforded to individualsunder data to ensure therights how bestto process personal to assist them indetermining equally usefulfor organisations, ofeach. respect The guidance is key procedural information in these rightsandproviding individuals inunderstanding aimsto assist personal data. It relation to theprocessing of their the Gibraltar GDPR and the Act in the rightsofindividualsunder Provides detailedguidance on subjects can exercisesubjects their rights. compliance and how data is responsible for data protection organisations to determine who the Gibraltar GDPR,asit allows is essential intheapplication of Understanding these concepts Gibraltar GDPRandthe Act. T January 2021) January the Gibraltar GDPR(published 2020) Brexit (published December 2021) published January G Guidanc INFORMATION RIGHTS 37

C Guidanc Da Assessments (update published (update Assessments 2020) May April (published Data Location 2020) (published June 2020) (published check the body temperature of temperature the body check individuals. • OVID-19: Contact Tracing and and information Provides in respect of the rapid guidance in the use of developments support to technology the fight in particularagainst COVID-19, contact trace to technology and amongst the population, of the virus. map the spread to should adopt Applications securityrobust (including the use encryption,of each covering and processing), stage of the data • e on Exemptions • ta Protection Impact transparency minimisation, data and any and user control, including supporting technology, support to processing centralised should follow contact tracing, the same principles. Provides general advice on the on advice general Provides organisations for requirement carry to Protection out a Data for Impact (“DPIA”) Assessment high-risk processing data any activity. Includes guidance regarding Includes regarding guidance that the various exemptions particular from Actprovides the in the EU GDPR, and provisions The GDPR. the Gibraltar now organisations relieve exemptions in certain some obligations from such as when it is situations, the necessarysafeguard to of and investigation prevention planning or management crime, of others. the rights protect to the exemptions However, on where can only be relied and organisations necessary, should justify and document on an relying for the reasons exemption. C Guidanc I Da (published July 2020) Commissioner’s Regulatory Commissioner’s published Action(update 2020) August published September 2020) Law Enforcement Authorities Authorities Enforcement Law September 2020) (published • OVID-19: Checks Temperature • e on the Information • nternational Transfers (update • ta Protection and Brexit for Published in the wake of the in the wake Published the to due pandemic COVID-19 in the use developments rapid to cameras of thermal imaging Published to update previous previous update to Published Provides on the matter. guidance on the regulatory guidance actionthe Commissioner that take under the Act and, may under the Brexit, following GDPR. Gibraltar Published to update previous previous update to Published on the matter. guidance summaryon guidance Provides V of in Chapter the provisions the EU GDPR (this is mirrored GDPR which the Gibraltar by has superseded the EU GDPR) of personal transfers regarding or countries third to data organisations. international data is useful to guidance This in and processors controllers the identifies it as Gibraltar be used to may mechanisms that to flows data ongoing maintain the EU/EEA. from Gibraltar This Guidance Note provided a provided Note Guidance This five-step checklist Law to assist (“LEAs”) Authorities Enforcement protection data for in preparing of a no- in the event compliance per sections As 39 and deal Brexit. of the processing 40 of the Act, a LEA (referred by personal data in authority” “competent as a to enforcement “law Act)for the III Part by is regulated purposes” and not the Gibraltar “DPA”, of the GDPR. Guidanc Guidanc Conferencing (published Conferencing October 2020) (update published November published November (update 2020) published November 2020) published November T Published to update previous previous update to Published Guidance This on SARs. guidance that sets out key points Note be mindful need to organisations of when handling SARs and practical assist to tips provides they that ensure organisations law protection with data comply SARs. to when responding • Video e on • e on the use of CCTV • he Right of Access (update to ensure the uninterrupted uninterrupted the ensure to business to crucial of data flow activities.and other It provides advice “international on that key steps “six transfers”, and should take”, organisations the use of standard on “advice be to (likely clauses” contractual protect to a popular mechanism to of data the ongoing transfer Gibraltar). and from This Guidance Note was was Note Guidance This of the published in the wake pandemic due to COVID-19 Video use of the increased Applications Conferencing (“VCAs”). information It provides protect to individuals on how to and privacytheir personal data as as well VCAs; when using on organisations for guidance compliance protection data when using VCAs. Published to update previous previous update to Published use and The on CCTV. guidance capabilityof CCTV has systems update and the expanded since good practice provides therefore those involved for guidance CCTVin operating other and surveillance devices, camera understand their better to obligations and responsibilities protection data to in regard when using CCTV. 38 INFORMATION RIGHTS the period reported on: reported the period organised by the Division during Below isalistofworkshops workshops are publicly available onprevious DPO Reports was positive.participants feedback received from agreements.processor The exemptions, anddata controller/ data security, notices, privacy The topics discussedrelated to attendance over thetwo days. with overin 70 participants 2020. These were well attended, the 16thand17thDecember workshops wereVirtual heldon data protection obligations. controllers inrelation to their awareness andaiddata Division’s to promote efforts (“DPO Workshop”) ofthe aspart for Data Protection Officers protection Workshopsdata the organisation ofperiodic launched aprogramme for March 2019,theDivision In in relation to Brexit. thator queries organisations had protection related concerns and/ discuss andassistwithany data which were to about, learn December 2020, the aim of Septemberand held during Brexit related workshops were this transition. of Aseries assist organisations through end ofthetransition period, to work regarding Brexit andthe The Divisionintensified their okhp o Dt Protection Data for orkshop • : The End of the Transition • b) Officers Officers W Period BREXIT Organisational Awareness  oa Workshops/ Local website. be downloaded from theGRA’s Notification whichcan Form our office bysubmittingtheDPO within theregister may notify wishing to includetheirDPO Register ofDPOs. Organisations continues to maintain apublic of theAct, theCommissioner accordanceIn 138 with section egister ofData Protection • c) Registers on [email protected] theDivisionbycontacting email in attending DPOworkshops by DPO’s can register their interest Workshop to 2021. beheldinApril preparations for DPO afourth The Divisionhascommenced on theGRA’s website. Officers (“DPO”) Officers R awareness ofdata protection through whichtheDivisionraises Privacy” (“CYP”) campaign,ublic Awareness Division’sThe “ControlYour iii. faxes. callsand/or marketing direct not want to receive unsolicited whodo and mobilesubscribers isavailable to fixedservice line maintain thisRegister. This free empowered to regulate and authority is thesupervisory 2006 andtheCommissioner Data Regulations andPrivacy) Communications (Personal on provisions found inthe for faxandtelephone, based Register launched theOpt-Out 2013theCommissionerIn • RegisterThe Opt-Out

P INFORMATION RIGHTS 39 P Survey (2019-20) (Social Campaign) Media Post Da COVID-19 (Social Media Post (Social Media Post COVID-19 Campaign) C (Video). tracing measures, must be be must measures, tracing with in compliance processed regulations the Government’s legislation. protection and data • Social Media form Social platforms media public partof the Division’s Ad-hoc strategy. engagement with larger combined posts are cover to campaigns media social relevance. of current topics more link to sometimes These such as documents substantial and/or guidance infographics in- a more which provide notes, at the topic into depth insight hand. social Division’s the year, This media activities, which are website on the GRA’s available on social and/or accounts included the media platforms, following: a) and ta Protection b) School rivacy Awareness c) CTV andGDPRCompliance Six-week campaign which ran which ran campaign Six-week 2020 on Aprilbetween and May challenges the unprecedented because of the many by faced pandemic. COVID-19 that campaign Ten-week in July 2020 commenced the key findings highlighting Privacy Awareness two the from School Surveys carried out in duringthe schools in Gibraltar 2019/20 academic year. The video highlights the video highlights The importance with of compliance when legislation protection data via personal data processing CCTV systems. cybercrime due to the increased cybercrime the increased to due the and resources; use of online the collection ensure need to of personal and processing is what to limited remain data necessary. absolutely requirements One of the the Government by introduced pandemic during the COVID-19 certain that was establishments new implement had to have which include the measures of personal data processing This visitors. and of customers partwas of the contact tracing the fight to scheme introduced pandemic. on release press a Following October26th furthera 2020, interview and radio television GBC conducted between was to and the AIC in relation Within efforts. contact tracing reminded AIC the interview, the all personal that establishments as part collected, data of contact The interviewThe dealt with: the by experienced added strain remote adopting businesses working protection data the and pose; the this may that concerns to data personal for potential remote the in compromised be the working environment; risk of an increased for potential The Gibraltar Broadcasting Broadcasting Gibraltar The (“GBC”) interviewed Cooperation the DeputyHead of the RightsInformation Division of and television the GRAon radio in protection data to in relation climate. the COVID-19 Data Protection and COVID-19 and COVID-19 Protection Data interviews and radio television (15th April 27th 2020 and October 2020) • Media Engagement and privacy, has continued. has continued. privacy, and Interactions the public with following: include the 40 INFORMATION RIGHTS using VCAs. when personal data andprivacy ofprotecting on theimportance to individualsandorganisations The videoprovides information in Gibraltar. of Brexit ondata protection law The videohighlights theimpact e) Brexit (video) law inGibraltar. ondata protection and itsimpact key questionsrelating to Brexit Ten-week campaign addressing basis, providing subscribers to bepublishedonaquarterly E-newsletters have continued i) E-Newsletters events. ininternational participation awareness raising events and notes, publicandorganisational as thepublication ofguidance outby the Division,such carried information relating to activities topics (e.g., Contact tracing), to specific guidance on certain fromThe ad-hoc posts vary h) Ad-hoc posts GDPR” was launched. undertheGibraltar Individuals campaign titled of Rights “The January, aneight-week long Day, celebrated 28th every celebrationIn of Data Protection ndividuals Rights underthe ndividuals Rights g) f) exit FAQ Post Media (Social d) Applications (video)  ie Conferencing Video and videos) Gibraltar GDPR (Infographics I Campaign) Br demographic to educate them the Divisionengageswith the amongst younger generations, technology andsocialmedia With anincreasing use of m) website. which are available ontheGRA’s videos, ofshort a collection Note, asetofinfographics, and GDPR”, includingaGuidance undertheGibraltar Individuals campaign titled of Rights “The launched aneight-week long protection. This year theDivision anddata ofprivacy importance Day commemorates the 28th January, Data Protection Celebrated internationally every l) Data Protection Day the GRA’s website. EU GDPR,whichisavailable on changes brought aboutby the video,two-minute highlighting the Commissioner released a EU GDPR’s second anniversary, GDPR. To commemorate the coming into force oftheEU of thesecond year since the theend 25th May 2020marked k) GDPRAwareness Day email [email protected]. Those wishing to can subscribe additions to theGRA’s website. of guidance notes andany includingthepublication work, information regarding ongoing allows theDivisionto provide protection-related matters staying informed aboutdata or organisations interested in for individualsand/ service The Division’s subscription j) SubscriptionService on theGRA’s website. applicable. These canbefound of information matters where to data protection andfreedom latest developments inrelation with news, updates, and the Education wrns Through Awareness 2-year gap i.e., 5,7,9and11. A students to keep in line with the was decided to survey Year 5 an increasingly younger age. It use ofdigital technology from time; andsecondly, dueto the school students for thefirst excludingin thesurvey middle school students, this resulting 7 students becamesecondary system changeinwhich Year firstly, due to theeducation reasons for thiswere two-fold: students for thefirsttime. The decided to alsosurvey Year 5 were surveyed. However, itwas usual, Year 7,9and11students was thecaseinprevious years. As outrathercarried thanone, as Notably, were two Surveys period. thereporting published during 2019/2020 academicyear, were Surveys”) the during conducted Awareness (“the Surveys School from theDivision’s Privacy from previous years, theresults presentations, andfollowing suit withtheschool conjunction In classrooms. through live feeds from separate of theyear-group watching to oneclass, withtheremainder socially distanced presentation have theDivisiondelivering a presentations was amendedto restrictions, theformat of tohalf of2020.Due COVID-19 11 studentsthesecond during presentations to Year 7,9and The Divisiondelivered same. the risks, associated withthe butequallyabout opportunities, informed decisionsaboutthe encouraging students to make personal data perspective, of digital technology from a promotes theresponsible use with schoolgoers;theDivision schools where theyinteract operates acampaign with rights. privacy The Division on data protection andtheir INFORMATION RIGHTS 41 Figure 5 Figure Figure 4 Figure The combined percentage percentage combined The As reflected in Figure 6, younger 6, Figure in reflected As from seek consent students installing new before guardians (Figure apps on mobile devices. 6) Over a quarter 5 students of year are a mobile device who own of permissions granted unaware including access mobile apps, to their personal data. to The use of security features use of securityThe features access protect to PIN a as such to continues mobile devices to increase. The number of Year 7, 9 and 11 Year number of The information reveal that students about others without their has decreased. consent Risk to privacy from ‘media rich’ rich’ ‘media Risk privacy to from SNS continues. As reflected in Figure 5, use of Figure in reflected As in students for privacy controls increased, has 11 and 9 7, year (Figure trend. which is a positive 5) SNS is used mostly for private private SNS is used mostly for as and its use grows messaging get older. students As evident from Figure 4, all Year Year all 4, Figure from evident As surveyed7, 9 and 11 students use Social Networking Sites 4) (Figure (“SNS”). A report on the results derived A report derived on the results the Surveyfrom published was in June 2020 (“the the Division by Report”) on the and is available findings key The website. GRA’s can be summarised as follows: Notably, the Surveys the included Notably, focussing questions new such as on online platforms gaming consoles, and YouTube highlighted of concern an area report. year’s in the previous total of 1421 students (725 males (725 males 1421 students of total the between females) and 696 part took and 16 years ages of 9 in the Surveys. of students who are aware of privacy controls is moderately high. However, approximately a third of students do not use them, which remains an area of concern.

INFORMATION RIGHTS INFORMATION The Division welcomes the slight improvements in privacy

practices, which in turn may 20 2 2 20 protect individuals from privacy- 0 0 related risks.

iv. Freedom of Information Freedom Of Information (“FOI”) is based on the principle that people have a right to know about the activities of public authorities unless there is a good reason for them not to. With this in mind, the Freedom of Information Act 2018 (“FOIA”) was passed through Gibraltar Parliament in 2018, this being Figure 6 designed to provide public access to information held by alike, and therefore collaborates of common interest, such as data public authorities. with the Government so that the security. This will assist both relevant public authorities are parties in their understanding Although enacted, for the FOIA delivered a presentation by the of each other’s regulatory roles provisions to be enforced, Division prior to their addition to and responsibilities, whilst also applicable public authorities and/ the schedule. The presentation providing them with a better or Government departments aims to provide attendees with understanding of underlying need to be expressly added practical guidance and assistance industry players and the to a Schedule. Following a on FOI and the requirements of challenges they face. Parliamentary session held in the FOIA. March 2021, it was confirmed In a joint statement, the that several departments will signatories noted that, “with the be added to the Schedule on GRA’s commitment to addressing v. Additional Matters 1st June 2021, and that the challenges surrounding privacy FOIA will thereby commence as • Memorandum of Understanding and data protection in the digital of said date, with the intention (“MOU”) signed between the age, and the GGC’s mandate, being to progressively expand Data Protection Commissioner which includes ensuring the Government departments and the Gibraltar Gambling consistently high standards included within the Schedule. Commissioner to Strengthen of operations for Gibraltar gambling licence-holders, this Under the FOIA, the GRA, Cooperation-10th December MOU represents a significant and with powers conferred on the 2020 positive step towards ensuring Commissioner, has regulatory Under the terms of the MOU, the expected standards are met responsibilities and oversight parties agreed to the exchange of within both regulatory spheres.” over the regime, as well as information as they may consider an advisory role. The Division beneficial in the exercise of their recognises the significance of respective regulatory functions. freedom of information and In particular, the MOU is intended access to information, both for to enable both regulators to individuals and public authorities identify and collaborate on areas

42 BROADCASTING

20 2 2 20 0 0

43 44 BROADCASTING in Gibraltar Forces is theBritish second radio licensed network channels inEastern Europe. The Box of Music wider network ofa videos 24/7andare part international andlocal music transmits viacable. They offer was licensed in2019and broadcaster, Box Music Gibraltar, Network. The third television platform isAl-Jazeera Media Digital Terrestrial Television transmitting from Gibraltar’s television broadcaster currently broadcaster. The second is thesolepublicservice Gibraltar,namely Radio and provides oneradio network, Corporation whichalso (“GBC”) by theGibraltar Broadcasting isprovidedbroadcasting service first established television provider.media service The broadcasters, andanaudiovisual broadcasters, two radio Gibraltar hasthree television relationship.working to sustainthegood in aneffort the Divisionmutuallycooperates broadcaster withwhom service Gibraltar, including thepublic in the broadcasting services purchasers, and other users of guidance to consumers, The Division’s isproviding forte ouraging thepromotion of • he issuingofcodes of • egulating matters on • orcing theconditions seton • anting licenses to • responsible for: Division”)(“the hasbeen theBroadcasting Division Act”), Broadcasting 2012(“the Act Since theintroduction ofthe Introduction T practice; and practice; media literacy. broadcasting standards; licensees; broadcasters; Enc R Enf Gr i. in. participated attended and Division virtually and which the period reporting that took place throughout the the main webinars and meetings workshops. Below are someof replaced by webinars and virtual conferences, butthesewere intheusual not participate meant that theDivisioncould all travel was suspendedwhich toDue theCOVID-19 pandemic, Participation International provided three different and This cross-regulator cooperation the Data Protection Authority. the Competition and Authority Telecommunications Authority, conducted jointly by the Italian including theBigData survey initiatives throughout Europe, findings ofthemost recent The webinar focused onthe their radio licence. 2020andhaveearly notrenewed station ceased its transmission in radio broadcaster. The radio Radio’ isnolonger a licensed that The mustreport GRA ‘Rock service. video-on-demand for theirsubscription-based Licence to GibFibreService Ltd issued anAudiovisual Media On 1stSeptember2020,theGRA Corporation. and Sound by theServices Vision providedBroadcasting Service

News, 14thJuly2020 Pluralism andFake Webinar on BigData, of Communications nentoa Institute International ii. iii. effective framework. regulation ofplatforms and upon theissuesrelating to the The webinar alsotouched across Europe.media industry the new technologies impacting (“artificial intelligence”) andthe as well asissuesrelating to AI Union’s Act, Digital Services the keyissuesfor theEuropean ofbroadcastersperspective on to hearthe opportunity This webinar was agreat major changes intheUK The webinar focused onthe markets. companies that utiliseit, andthe from BigData onusers, the examining thechangesresulting perspectives: complementary

21st September 2020 21st September & policies TV” webinar – Europe (ACT) “EU digital Commercial Televisionin November 2020 - Chapter Webinar, 3rd of Communications UK soito of Association nentoa Institute International

BROADCASTING 45 Broadcasting Act 2012 Broadcasting A

public via the online complaints complaints online via the public after having However, form. the these carefully, considered breaches GRA any did not find of codes the GRA’s of of any practice. On 19th September 2020, the On 19th September implement amended to Act was to made the amendments (EU) Directive by the AVMSD 2018/1808 of the European of and of the Council Parliament 2018. 14 November the Act to amendments The the that given required, were servicesmedia audiovisual significantly market had evolved the ongoing due to and rapidly and of television convergence internet services. Technical allowed have developments new types of servicesfor and as such, and, user experiences particularlyviewing habits, those have generations, of younger new In regard, this changed. such as video types of content, content, clips or user-generated an increasing gained have importance and new players, of video- including providers on-demand servicesand video- well- now are sharingplatforms, established. of this convergence Therefore, legal updated an required media reflect to in order framework in the market and developments between a balance achieve to online content to access services,protection consumer and competitiveness. Act goes furtherThe than the of the Directives requirements audio it also covers in that especially transmissions, commercial to with regards albeit in a less communications manner. onerous ii. the to mendments M

regards to media literacy, could could literacy, media to regards and applied. be best understood i. a) Inbound Enquiries Activity easured queries Division has received The the GRA’s to relating on matters practiceAudiovisual of on code Communications Commercial and Programme (“ACCC”) Code (“PSC”) Code mostly Standards broadcasters. from the Division also Additionally, enquiries numerous addressed Most public. the general from information to queries related for applications concerning licences. and/or radio television Monitoring b) a have to Division continues The with good working relationship and is always local broadcasters guidance provide to available recommendations. make and the lockdown due to year, This restrictions and staff having the home, from work to of exercise usual monitoring has not content broadcasting a more Instead, been possible. has of monitoring ad-hoc form been carried out. c) Complaints two GRA received The the general from complaints Regulatory Matters is an outline of following The which the regulatory matters been involved the Division has with during the reporting period 2020/2021. Regulatory Authorities Regulatory Authorities Digital Plenary, (“EPRA”) 22nd January 2021 E

One major change introduced One major change introduced is the AVMSD, the revised by of video sharing regulation (“VSP”).platforms A report all members to presented was relating concerns highlighting activities online platform to European different and how these had transposed countries reportThe also requirements. were regulators how illustrated best practices and developing expertise in the coordination literacymedia of oversight and the Additionally, activity. report how also highlighted with VSP, of the the obligations The session allowed all members session allowed The the work with be updated to being carried EPRA out by the revised to especially relating AVMSD. iv. for Platform uropean The workshop looked at the at looked workshop The with other countries for scope traditions similar democratic This ground. common find to virtual invaluable meeting was of best the development to of regulation practicesthe in standards. broadcasting framework for content content for framework revised namely the regulation, Media ServicesAudiovisual that (“AVMSD”) Directive video to extended regulation Additionally, sharingplatforms. the of Brexit, as a consequence changes to require UK would principle of Origin’ ‘Country the traditional applies to that broadcasting. 46 BROADCASTING iv. iii. the public about the work in itsapproach to informing The Divisionhasbeen proactive of viewers andlisteners. standard, whichmeets theneeds deliver localcontent ofagood local broadcasters’ to ability organisations to enhance the to engagewithpeopleand The Divisionhascontinued available. relation to the different vaccines pandemic, specifically in surrounding thecurrent global major emphasisonfakenews and disinformation witha the dangersofmisinformation News’. The mainfocus was on aged 17-18onthetopic of ‘Fake presentation for olderstudents presented another virtual March early 2021,theDivision In things ontelevision. influence how we perceive placement,and product can of television advertising communications, intheform messages andhow commercial the presentation was onmedia extremely positive. The topic for the feedback received was successful,was very and conferencing, the presentation difficulties associated withvideo aged 14-15.Despite the presentation for students and theDivisionheldavirtual resumption ofthecampaign, of2020sawThe a latter part on hold. that thecampaign hadto beput the COVID-19 pandemicmeant Campaign’ however, inearnest, Awareness Literacy Media The Division began its ‘2020

Campaign Schools Awareness Campaign – eea Awareness General Literacy Media referendum. in Gibraltar relating to the television andradio services programmes includedinthe and appliesto thecontent of The code isspecific to GBC timeline for thereferendum. the Act, with the new date and paragraph 3of 1(1)ofSchedule code ofpractice, asrequired by the existing standards inthe this, the Division has amended June 2021.At thetimeofwriting take place on Thursday 24th referendumthe abortion would Government announced that On 11th March 2021, the movement ofpeople. recommended on restrictions the referendum dueto the took the decisionto delay however, theGovernment Thursday 19thMarch 2020, erendum onAbortion referendum was onabortion The original date setfor the v. Licences: ofthe followingin respect a total collected GRA of£11,100 (Licensing) Regulations2015,the provisions ofthe Broadcasting venue Collected and inaccordance withthe 2020/2021, theperiod During vi. from localbroadcasting services. about what shouldbeexpected to educate thegeneral public also viasocialmedia,itispossible about itspublishedguidance, informing andraising awareness The Divisionisoftheviewthat by or detrimentalto minors. orradio to beinappropriate TV has beenseenorheard onlocal listener deemssomethingwhich in theevent that aviewer or complaints procedure scheme tothe localcommunity usethe and encourages undertaken

Ref Re Licence Audiovisual Service Media FM Licence Radio

£10,000 £1,100 POSTAL SERVICES

47 48 POSTAL SERVICES developments, settingquality monitoring ofoperational of accounting procedures, in respect and directions includes issuingguidance universal service. This often relating to theprovision ofthe measures imposed by the GRA the Act, aswell asany regulatory with theobligationsfrom arising ensure that theUSPcomplies to The alsohasalegal duty GRA market. inaliberalised postal services freedom to provide competitive balancing the RGPO’s rightand This mustbeachieved whilst obligations.universal service that complies theRGPO withits these standards, andensuring against monitoring performance standards, settingquality USP”) ProviderUniversal Service (“the asthedesignated RGPO”) (“the the Royal Gibraltar Post Office operational developments of Act, includemonitoring the underthe Specific functions inGibraltar.market fully liberalised postalservices licences, the result of which is a a system ofauthorisationsand through facilitating entry market users inGibraltar. This isdoneby at anaffordable price for all efficient universal postalservice theprovisionsecuring ofan sector,local postal services whilst enhance competition withinthe to promote development and The GRA’s is objective statutory Regulations”). Regulations 2012(“the Postal (Authorisation) Services andthe Act”) (“theAct Office in accordance withthePost the Postal inGibraltar Sector the responsibility ofregulating Division”)(“the has oftheGRA The PostalDivision Services Introduction must provide thefollowing the designated USP, theRGPO outgoing international mail. As and onward transmission of within Gibraltar andcollection international mailto addresses ofincomingfor thedelivery The is also RGPO responsible consumer needs. of and that thesemeetavariety both locallyandinternationally recognised standard are available of a postalservices quality with inorder to ensure good- mustcomplywhich theRGPO sets outanumberofobligations The RGPO’s current designation all users. Gibraltar at affordable prices for at allpoints in specified quality of provision ofapostalservice involvingservice thepermanent ersal Service has therightto auniversal aims to user ensure that every obligationThe universal service i. 2020/21. by theDivisionfor theperiod matters out regulatory carried The following isanoutlineofthe Matters Regulatory the rightsofusersare upheld. the requirements and oftheAct order to ensure compliance with providersto in allpostalservice guidance and recommendations The alsoissuesgeneral GRA consumers inGibraltar. forimproving ofservice quality these standards withaviewof against monitoring performance standards, and, more importantly,

Univ • services for registered• services items; ersal Service public ersal Service ii. foree services, blindor vices for insured items; and • • ance, sorting, ance, sorting, • • calendar month to ensure that ofnolongerthanone a period RGPO’s existing designation by the July 2020, which extended Provider”Service on1stof “Designation ofUniversal Notice No. P01/2020 The therefore, GRA, published endeavour. have proved anunproductive ofuncertainty,this period may the publicconsultation during determined that proceeding with COVID-19 pandemic, theGRA 2020, however, becauseofthe public consultation inFebruary out the process of a to carry The hadinitiallyintended GRA universal service. continuity intheprovision of proportionality, to guarantee and non-discrimination, of transparency,principles assigned, are basedonthe arewhich universal services that theconditions under to ensureconsiders necessary to take such measures asit doingso,In isrequired theGRA out a new public consultation. designation andcarry service required to revisit theuniversal period, was the GRA reporting 2020. Consequently, this during of 7 years ending on 17th July astheUSPforRGPO aperiod designated 2013,theGRA In the minimum services: 7kg). sighted persons(upto partially parcels upto 20kgs; of anddistribution transport letters upto 2kgs; of anddistribution transport fr ser the clear the clear

Univ consultation POSTAL SERVICES 49 he c correspondence; the secur individual licence. Given that the that Given licence. individual as RGPO been designated had years, additional seven an USP for the opportunity took the Division and the format both revise to existing of the RGPO’s content bring it in to individual licence changes line with the recent the via established updates and process. public consultation the GRA 2020, On 7th August issued the RGPO with a new which individual licence revised with the runs concurrently as designation recent RGPO’s 2027. It August 6th USP until is that however, important note, to designation, unlike the RGPO’s which imposes the universal service the purpose obligations, is of the individual licence the safeguard ultimately to services of universal provision with compliance and guarantee requirements. its essential the other items, Among ensures licence individual services the universal that meet the needs of to evolve made they are that consumers, form without any available not are and discrimination of also licence The interrupted. of a suitable level that ensures to is made available information respectin universal of consumers services complaints and that fair and are handling procedures conducted in a timely manner. Requirements Essential iv. with the Act, In accordance “essential impose the GRA may on the supply of requirements” postal services in Gibraltar. shall be requirements These non- based on the following – reasons economic a) t onfidentiality of b) ity ofthenetwork ultimately designating a USP, USP, a designating ultimately factors GRAthe such considers of the size as marketshare, ability and network, experience, service. universal provide to the GRA’s In to response the RGPO public consultation, term long detailed a submitted supportin plan business of a designation for their request in respect years period of seven of universal of the provision highlighted request This service. long-term the numerous the RGPO by made investments both its local and improve to quality of service international for reliable ensuring and the efficient services. of universal provision RGPO underlined also The the long-term develop need to and establish strong strategies with relationships business partnersits international to its service provision. improve GRA of the view that, was The existing the RGPO’s given with together infrastructure, its experience, its extensive plan development long-term the to a commitment showed and effective an of provision The service. universal efficient the factGRA also considered none of the alternative that to appeared postal operators in an interest expressed have service the universal providing and as such, thereof, or elements a designation that determined be would years period of seven given and justified reasonable the circumstances. 2020, the GRA On 7th August Decisionpublished Notice the P04/20, which designated all elements RGPO as USP for service a periodof universal for ending on 6th years of seven 2027. August RGPO – Individual Licence universal provide In to order an services, the RGPO requires Designa Service Provider Service Provider L Univ R P P One D A Period. and sender services; registered and insured items; items; and insured registered services blind and partially for persons; sighted to the home of every the to or natural legal person or appropriate installation; and access points; points; and access transport, and distribution of postal packages 20 kgs; up to transport, and distribution of 2 kgs; up to postal items T T iii. tion ofUniversal • Mail; ocal andcross-border • ersal Service Designation • to edirection andreturn • ofcertain rovision free • ofservices rovision for • sorting, he clearance, • sorting, he clearance, • deliveryone and clearance • ensity ofcontact ofpoints • ofpostalservices;ffordability The specific universal service specific universal The upon consulted obligations within the consultation as follows: were document • Quality of postal services; On 1st July 2020, the GRAOn 1st July also Consultation Public published it invited P02/20, in which postal local all from comments service and interested providers parties to questions relating to all aspects service. of universal a suitable and productive public public productive and suitable a be could process consultation carried out. By the close of the designation By the close of the designation the GRA only received period, the RGPO. from comments • Poste Restante; Restante; • Poste • PO Box; When considering responses responses considering When and the public consultation to 50 POSTAL SERVICES own individual needs and size of other things, suitablefor their procedures that are, among mailintegrity the necessary providers inestablishing service topractice assist localpostal includes information onbest of Mail”,the Integrity which of “Guidelines for Protecting guidance material in the form The Division has also published sent isultimately maintained. correspondence orgeneral mail that theconfidentiality ofany are sufficiently adequate and to ensure that these matters procedures underregular review providers toservice keeptheir place an obligation onallpostal The “essential requirements” also access to mail. prevention ofunauthorised management ofaccess and or interference andfor the ofloss, damage,the risk theft, exposure ofpostalitems to of minimising the the purpose forbe reasonably necessary adequate procedures that may Gibraltar establishandapply providers in all postalservice This document ensures that providers inGibraltar.service requirements onallpostal imposed anumberofessential on 14thJuly2020,which published Notice No. P03/2020 Consequently, theDivision legislative requirements. date andinlinewithcurrent also to ensure that itwas upto restructure thedocument but not onlyto streamline and amendments several important in 2013. The Divisionmade requirements” initiallypublished review of the existing “essential outa the Divisionalsocarried ofuniversalin respect service, consultation process out carried Further to theGRA’s public dangerous goods. as regards of thetransport uality of Service ofService uality v. vi. ems to bedelivered in • set asfollows: oflocalmailhasbeen delivery The standard for day thenext addressee. tothat date the andthedelivery of days which elapse between of theday) andNisthenumber (before time the last collection represents thedate ofdeposit to theformula (D+N)where D local mailisexpressed according target for The quality-of-service ofmail. and subsequent delivery sorting, ofthecollection, respect relate to agiven operator in and consider how thiswould situation andrelatively smallsize Gibraltar’s unique geographical mustalsoconsiderthe GRA consultation withtheRGPO, target local quality and after determining this In service. universalof ahighquality postal to ensure services the provision standardsquality for localmail to set hasaduty Act, theGRA 40(1) of the provisions ofSection accordanceIn withthe monitoring oftheestablished independent performance requires 4N(4) of theAct Section of correspondence. maintaining the confidentiality procedures whenitcomes to flexibility to tailortheir own should have the freedom and provider individual postalservice isalsooftheviewthat each GRA andworkforce.their network The (D+1). Gibraltar theday posting after 95% ofit

Q Mail Mail Requirements -Local Services Ombudsman Services - Gibraltar Public efrac Monitoring Performance automated systems that would of incorporating theuseof thefeasibilityalso exploring consultation are with the GRA, The GPSOand RGPO, in procedures currently inplace. monitoring manual performance bythis directly revising the meet withtheGPSOandtackle to advisedthe RGPO the GRA to mitigate thispotential issue, withinGibraltar.delivery order In results for dayperformance next toa contributing thelow factor explainedRGPO that thismay be current monitoring system. The potential for error, inherent inthe statistics provided, dueto the reliability oftheperformance concerns over and theaccuracy hasraisedthe RGPO numerous as thecurrent year underreview, thepreviousDuring year aswell standard. required ofservice quality assist theminmeetingthe improvements that ultimately decisions andoperational informed inmaking the RGPO information generated to assist usesthestatisticalThe often GRA monitored. withinGibraltar is and delivery and subsequent processing locally from variousaccess points involves ofmail thecollection which network, end-to-end This ensures that thefulllocal receiptreport oftheseletters. members ofthepublicwhothen letters to of abroad spectrum sending outnumerous test The GPSOfulfilsthistask by mail throughout Gibraltar. targets for ofservice local quality body taskedwithmonitoring astheindependent has acted with theapproval oftheGRA, who, GPSO”) Ombudsman (“the the Gibraltar Public Services outsuccessfullycarried by out. To date, this task has been standards quality to becarried POSTAL SERVICES 51 The test items contain a radio a radio contain items test The frequency “RFID” identification an antenna by which is read tag, RGPOthe sorting at installed international the where office and processed. mail is received and identified are items test The and once logged automatically is this information delivered, the UPU to to sent immediately qualitythe determine service of being provided. primary in this case, The focus, of the is on the measurement performance of the destination it In other words, country. “last-mile” a is in essence than a full rather measurement It measurement. “end-to-end” confuse not to however, is vital, which only monitors this system, the delivery times of inbound arrives it once mail international in the sorting with the office, the GPSO by adopted system local full the monitors which end-to-end network in Gibraltar. performance The results linked the GMS are by generated dues payments, terminal to the essentially which are exchanges mail in rates payment and therefore countries between between remuneration affects based on postal operators, local deliveryThe performance. the UPU for by established target this purpose is 88% (D+1). the RGPO’s 2 illustrates Figure performancerespectin of results nextdelivery day international of inbound mail within Gibraltar during the period under review. the ongoing due to However, the GMS pandemic, COVID-19 dues suspended terminal have exceptional to owing payments which will have circumstances harmed the undoubtedly quality of service of all operators slide above The worldwide. and the significant illustrates impactadverse the pandemic has International International Inbound Delivery within Gibraltar Delivery within Gibraltar

and regulatory improvements regulatoryand improvements the with a view of satisfying performance targets. required The RGPO as the USP for RGPO as the USP for The has a duty monitor to Gibraltar, Global The its Quality of Service. is (“GMS”) Monitoring System a state-of-the-art independent performance measurement the managed by system Union (“the Postal Universal primaryits and UPU”) objective participating provide is to high- with accurate, countries results quality operational the performance of regarding mail. letter external, of consists GMS The panellists who independent between items test exchange the participating countries. vii. Figure 1 is an illustration of the 1 is an illustration Figure end delivery full end to standards the by of local mail as monitored 1 It Figure is clear from GPSO. the RGPO has fallen shortthat target required the meeting of next delivery day of 95% for of with local mail within Gibraltar, a performance of 61% result next delivery day for in April 72% in comparison 2020 and by an represents This 2021. March of 11% in respect increase overall of next delivery day standards during the period under review. the GRA RGPO has informed The the due to largely this was that pandemic as ongoing COVID-19 factors. as other contributing well continue GRA therefore will The closely with the RGPO to work to make the necessary operational address potential inadequacies potential address the overall and enhance accuracy of all performance forward. moving results 52 POSTAL SERVICES OVID-19 - Impact on -Impact OVID-19 viii. had ontheRGPO’s performance. warranted. was intervention no regulatory therefore, decidedthat theGRA suchconditions,period. In has encountered thisreporting circumstances the workforce considering the exceptional to betotally when unexpected GPSO, aswell astheGMS,are not results by boththe reported The unusuallylow performance when necessary. 2-day, or more, service delivery andinstead adopted a service to guarantee day delivery anext meant that was theRGPO unable positive withCOVID-19), which of eitherself-isolation ortesting reduced workforce (asa result office, addingsorting toa at mail wastheRGPO arriving volumeweekly ofinternational shopping meant that alarge the suddenincrease inonline The disruptionto dailyflights and COVID-19 measures. flights andongoing worldwide andcancellationthe reduction of albeit withsomedelays dueto member countries worldwide, mail andparcels to the192UPU for of continuous alltypes service hasbeenabletothe RGPO offer a under review,the period During lockdowns experienced to date. pandemic, includingbothpublic the entire ongoingCOVID-19 to throughout thecommunity and operating apostalservice obligations by maintaining to fulfilitsuniversal service steps has takenallthenecessary in Gibraltar’s infrastructure and USP, plays theRGPO akeyrole recent history. As thedesignated their mostchallenging year in whohaveRGPO experienced year for all,trying especiallythe 2020 hasundoubtedly beena

C Local Quality of Service ofService Local Quality yment for postal • • • -MeasuresOVID-19 ix. ssisting withthesupply • ofGHAcards and elivery • toree theover delivery 70s • online duty ayment ofimport • public asfollows: accessibility for members of the inorder to enhancenew services The alsointroduced RGPO certain services. by thecontinuity of ensuring obligation its universal service any andultimately risk fulfil safety measures to mitigate staggered entries, andvarious different shifts, working given time, introduced theRGPO workers inthemailcentre at any to reduce thenumberofpostal pandemic. However, inorder disruption throughout the a week hascontinued without ofpillarboxescollection 6days ofmailand The localdelivery did notoffer sufficient capacity. flights to Gibraltar from theUK overland intheevent that local place ofmail for the delivery planswerecontingency putin of theuniversal further service, toRGPO ensure thecontinuity arrangements made by the additionto thenumerousIn in Gibraltar); (38 total numberofpillarboxes more accessiblepostal service around Gibraltar to makethe rentals; forservices, example POBox Gibraltar; within free day delivery next of essential items to the prescriptions; and and thoseinselfisolation; mail centre; frominstead ofcollecting the to receive theirparcels at home to allow customers theoption 7 newpillarbo Online pa Online salesofstampswith A D F P

C Adopted by theRGPO xes installed OVID-19 -Challenges OVID-19 x. alike have also become more consumersBoth andbusinesses strategies, andbusinessplans. innovate anddevelop newideas, to for thepostalindustry has provided an opportunity On theotherhand, thepandemic and significant financialloss. declining performance service centres being overwhelmed, worldwide including mail problems for postaloperators has ledto many additional unprecedented rate ofgrowth mail. Moreover, thissudden of revenue generated by letter and delivering mailaswell asloss increase inthecost ofprocessing will mostlikelyhave led to an shopping from homewhich an increased number of people parcels,of e-commerce dueto decline ofletters andgrowth the existing trend towards the one hand, it has accelerated alike for thepostalindustry. On challenges andopportunities The pandemichascreated both universal services. ensure theprovision ofbasic in theglobalsupplychainand ofthedisruptions the impacts public healthadvice to mitigate logistical measures inadditionto safety and to adoptimportant were withnooption but left operators throughout theworld on-airtraffic. particularly Postal on international transport, constraintsto posed thestrict international supplychainsdue its widespread disruptionto of the pandemic has been consequences One of the primary operators, butinallindustries. not just on postal impact, caused adramatic economic unprecedented that crisis has The COVID-19 pandemic is an vulnerable, etc.

C the Postal Industry for and Opportunities POSTAL SERVICES 53 restrictions which prevented restrictions prevented which collectingthese them from packages. of is an illustration 4 Figure and complaints of number the the RGPO enquiries handled by many specifically how and more speed and to of these related of local tracking information Figure mail. and international during that the 4 clearly shows 93% of period under review, and enquiries were complaints delivery to times relation in This and tracking information. also unusually high was statistic of the pandemic. as a direct result During the 2020/21 period, the GRA dealt with numerous enquiriescomplaints, and in respect of which were many issues related of COVID-19 subsequent and the RGPO’s changes in and unavoidable quality as the of service, as well just 20 in March 2021, which was was which 2021, March in 20 just expected the impact as the of decreased gradually pandemic and service performance normality. to returned the RGPO also informed The GRA all items most if not that the subject of these were that eventually complaints/enquiries albeit with significant arrived the delivery to due delays numbers, in flight difference issues, logistic international of disruptions and closures flight RGPO The worldwide. frontiers reportedalso demand the that services on their customer placed had been unprecedented, team the fact to they owing that had simultaneously dealt with from of requests hundreds members of the public who were with many of age, 70 years over underlying health conditions their parcels that requesting lockdown due to be delivered Resolution C

As illustrated from the statistics statistics the from illustrated As the number of provided, enquiriesand complaints steadily increased generally 54 from year, the throughout a peak in April 2020, reaching 2020, of 205 in December the expectedwhich was given usual Christmas peak which furtherwas by compounded then figures The COVID-19. to fall considerably began to Figure 3 represents a breakdown a breakdown 3 represents Figure and of the number of complaints the RGPO by enquiries received during this reporting period updated are and these figures on the and published regularly website. RGPO’s In accordance with the provisions with the provisions In accordance of Section the 4P(8) of the Act, publish to RGPOrequired is of number the on information and the received complaints been manner in which they have dealt with. Where a complaint has not a complaint Where been satisfactorily resolved, file then may the customer with the GRA. a complaint GRAthe only can However, genuine and reasonable consider services regarding complaints authorisedby in Gibraltar offered postal service providers. All postal service in All providers have to required are Gibraltar dealing for in place procedures Infirst the with complaints. required are customers instance, contact their postal serviceto with their complaint provider time them adequate and allow any and resolve investigate to issues. xi. andDispute omplaints dependent on postal service on dependent during this difficult providers in their role for especially time, and supplies medical delivering goods. other essential 54 POSTAL SERVICES ostal Services and ostal Services xii. circumstances. flexibility given the extraordinary areasonableRGPO degree of its discretion andafforded the complaints, exercised theGRA and dealing with these enquiries upon any investigation. When havingthe GRA to embark resolved,satisfactorily without werethese queries eventually members of the public and information, andguidance to was abletoGRA offer advice, the pandemic. However, the ofitems during and/or collection ofthedelivery inrespect RGPO procedures adopted by the categories of services that donot categories ofservices to identify thevarious business when advisingthepublic and not. This the OFT would serve services” andthosethat would that would bedeemed “postal ofservices onthetypes GRA from the clarity sought further who, amongotherthings,OFT”) ofthe Office Fair (“the Trading The Divisionliaisedcloselywith provisions oftheAct. and therefore, to the besubject be deemed a “postal service” should ofservices these types companies andwhetherornot provided by freight forwarding various “delivery services” often relating to thelicensing of wereenquiries received, mainly a considerable numberof issues handledby theDivision, the variouspandemicrelated light ofthisandinadditionto by theprovisions oftheAct. In may ormay notbecaptured in Gibraltar that services delivery as well as various services business models, newhybrid emergence of ever-changing tremendously with the hasevolved market services Thepostal “traditional”

P Delivery Services Services Delivery ocial Media ocial xiii. • Articles for theBlind; • Articles • Addressing properly; following topics: way ofsocialmediaslidesonthe information andguidance, by The Divisionhaspublished which are relevant at thetime. numerous topics ofinterest information orguidance on are provided up to date platforms to ensure consumers The Divisionusessocialmedia provisions oftheAct. therefore, may notfallunderthe services, case withsomedelivery element ofthese, the asisoften Simply providing onesingle inthetraditional sense. service constitute apostal, orcourier the inclusive nature that would anditis service full end-to-end that whencombined, provide a encompasses variouselements Additionally, a “postal service” worldwide), asdefinedinthe Act. commercial value to customers or othergeneral mailwithout ship items ofcorrespondence, service” doesnot (theservice features to bedeemeda “postal as theylackedtheconstituent remitthe regulatory ofthe GRA offered locally, may notfallwithin currently services some delivery tookthe GRA theviewthat under review,the period During they seekto provide. ofservice depending onthetype Authorisation from theGRA, from theOFT, oraGeneral either obtain a business license for membersofthepublicto agreement to issue public advice resultingand direction inajoint to provideserved somecontext the OFTandDivisionalso that do. The discussionsbetween specific exemptions for those whilstobserving of theGRA, remitfall undertheregulatory

S 2020/21 period to2020/21 period £6,500. and GeneralAuthorisations for revenue for Licences Individual This hasbrought thetotal wasRGPO £5,000. LicenceIndividual issuedto the ofthe by inrespect theGRA The total amount collected £1,500. of GeneralAuthorisations was bycollected inrespect theGRA of theAct, thetotal amount venue Collected accordance withtheprovisions and the in 2020/21 period During xv. accessible ontheGRA’s website. at theGRA’s office andisalso The Register can be inspected Act. by underPart Iofthe theGRA and individuallicences granted a register persons ofauthorised toGRA establishandmaintain Regulations 2012requires the he Register The Postal(Authorisation) Service xiv. and matters related OVID-19 • • Redirection of Mail; and ofMail; • Redirection ofStamps;• Sale possible delays. C

Re T HIGHER EDUCATION REGULATION

55 56 HIGHER EDUCATION REGULATION b) a) i. Matters Regulatory entities. therole ofbothlegal to perform comply with Part 11 of Act and set upto to enabletheGRA Division”)Division (“the was EducationThe Regulation Higher Standards Education. inHigher and the Gibraltar Authority for Education Higher Commission, designated asboththeGibraltar commenced was and the GRA Regulations”)2018 (“the were Accountability) Regulations of Gibraltar (Regulation and On 31stMay 2018,theUniversity Education Commission.Higher astheGibraltarto beknown designate authority aregulatory Education andalsotoin Higher Gibraltar for Authority Standards asthe to beknown authority designate assurance aquality to for theMinister Education to 2nd July2015andgave powers commenced on Act”) 2015 (“the The University ofGibraltar Act Introduction to:- Education isrequiredin Higher Gibraltar for Authority Standards accordanceIn withtheAct, the

awarded by theUniversity; recognition ofqualifications establish cr qualifications; and register oftheUniversity’s keep andmain Role andr Regulation Division Educationof theHigher iteria for the esponsibilities esponsibilities tain a out how:- out how:- to theUniversity setting (“MoR”) ofRegulation a Memorandum Education Commission issued 2018, theGibraltar Higher Regulations, onthe1stJune As required underthe ii. ersity’s autonomy f) isexpected ersity e) d) y theUniversity of c) ompliance by theUniversity y andstandards of b) a) and omote thequality c) the University. time to timeinconsultation with Division needs to review from set outamemorandum that the Regulations alsoincluded and Education. However,Higher the forAuthority Standards in Commission andtheGibraltar Educationthe Gibraltar Higher powers the roles of to perform Division withthenecessary Regulations was to provide the ofthe One oftheobjectives

maintained. and academicfreedom are the Univ monitored; funds provided to itshallbe its fundsincludingany public awards. academic programmes, and assurance ofcourses, through asystem ofquality education andtraining standards ofUniversity the useb pr shall bemonitored; education intheUniversity the qualit accountability; and accountability; governance and to demonstrate effective the Univ monitored; University’s are performance other aspec shall bemonitored; obligations undertheAct dutiesand with itsfunctions, c Regulation eoadm of Memorandum ts ofthe iii. expertise in governance,expertise independent members with the UAB iscomprised of four Under itsterms ofreference, Education. in Higher Gibraltar for Authority Standards Commission andthe Regulatory head oftheGibraltar University inhisroleof theGRA asthe to theCEO advice andsupport The aimoftheUAB isto provide 48oftheAct. set outinsection board areto appoint anadvisory Board UAB”). (“the The provisions setup theUniversity Advisory Standards Education, inHigher role astheGibraltar for Authority inits On June2018,theGRA, courses being provided. ofthe audits to assess thequality schedule ofinternal andexternal determine amutuallyacceptable closely with the University to Education, continues to liaise forAuthority Standards inHigher the Division as the Gibraltar the University. Furthermore, provides recommendations to Board,University Advisory and withtheassistance ofthe of thedocumentation provided outadesktop analysiscarries Commission, the Division Educationthe Gibraltar Higher ofitsresponsibilities as As part sustainability. facilities, ofcourses and quality includinggovernance,aspects and improvements inall theirdevelopments support annual documentation to the University willprovide out theprocess by which and thememorandum sets consulting withUKexperts, plans. The Divisionhasbeen anditsdevelopmentstructure to identify itsgovernance and liaising with the University The Division has been working

Board University Advisory Advisory University HIGHER EDUCATION REGULATION 57 a quality review by Spring 2022. by a quality review developed has University The in line courses degree all of its and qualityUK with standards the to applied the University Agency Quality Assurance UK’s Higher to Education for (“QAA”) International Quality an undergo Review (“IQR”). In November underwent2019, the University from visit” “scoping the initial in a resulted which the QAA, report IRQthe and favourable December for has been planned 2021. the IRQ and to for In preparation further the quality that of ensure meet the to continue all courses the University highest standards, an Academic has appointed Quality Manager. and Learning key of five IQR consists The and stages including analysis of the University’s evaluation taking part processes, own in an peer QAA’s by externalreview action and follow-up reviewers planning. mean would review A successful of Gibraltar the University that accredited be officially would the Furthermore, the QAA. by use be able to would University quality mark the IQR accreditation and marketing on their website indicate which would materials, against accredited are they that recognised internationally standards. provide would accreditation This further and students to assurance the programmes that parents international meet offered academic standards. Higher of Gibraltar University 2020 -2021 Courses Education Postgraduate MSc in MarineScience and Change Climate Masters of Business Administration Q G

with the University. In October the University. with GRA2020, the also met with Chairman of the University’s gain to Committee the Audit and work the into an insight Audit of the responsibilities Committee. v. Regulations and the MoR The undergo to the University require uality Assurance iv. graduation first University’s The in December held was ceremony raduations 2020, during which 20 taught received students programme after successfully their awards and their studies, completing awarded was student a PhD Doctor of of the degree The ceremony Philosophy. Point the Europa held at was three split into and was Campus comply to smaller ceremonies Health Covid-19 with Public family As recommendations. attend, not friendsand could streamed were the ceremonies on the online and can be viewed Website. University Overall, the GRA the liaises closely Overall, and maintains with the University a good working relationship. the During this reporting year, meetings GRA has had several The Division will meet with the Division will meet with the The discuss the annual to University areas risk and any assessment is this analysis once of concern takes analysis The completed. the expert consideration into of the opinions of the members UAB. During this reporting year, the During this reportingyear, and the meetings met twice, UAB conducted virtuallywere due A pandemic. the Covid-19 to further meeting is scheduled 2021 in May later take place to the University’s review to in submitted documents 2020 in compliance December of the with the requirements will then be able UAB The MoR. the GRA CEO with an provide to annual Division’s the of analysis University. the of riskassessment regulation, and higher education, education, and higher regulation, other amongst and is required, GRAthe advise on CEO to things, of the and operation the design the and regulatory framework MoR. Photograph provided by the University of Gibraltar by provided Photograph 58 HIGHER EDUCATION REGULATION Photograph provided by ofGibraltar theUniversity Photograph provided by ofGibraltar theUniversity programmes. undergoing research There are 14students PhD Nursing BSc Administration Bachelor ofBusiness Undergraduate Education (PGCE) Postgraduate in Certificate Management Masters inLeadership and CYBER SECURITY COMPLIANCE

59 60 CYBER SECURITY COMPLIANCE a) following responsibilities: (the “Division”) withallthe Compliance Division Security The formed GRA theCyber Providers Digital Service (“DSP”). (“OES”)of essential services and systems ofoperators inrespect and informationnetwork forof authority thesecurity Part asthecompetent 7oftheAct The was alsodesignated GRA in Authority The oftheCompetent Role of theEU. States withMember co-operate (ENISA)Agency and continue to and Information Security work of the European Network to continue inthe to participate set-up aframework withinwhich have beenremoved, theUKhas toobligations theEU to report meant that even though the the European Union(EU)has State. The UK’s from departure affect moreMember thanone where incidents co-operation largely concerns cross-border for Gibraltar. The SPOC’s role point (“SPOC”) ofcontact was designated asthesingle Part 7 of the Act, In the GRA States.Member among and incident reporting culture management ofrisk cooperation andpromote a throughout the EU, to build capabilities ofessential services improve national cybersecurity The NISDirective was required to EU (the “NIS Directive”). information systems across the and ofnetwork the security of Directive 2016/1148on to includetherequirements 2007(the Act “Act”) was amended 2018,theCivil ContingenciesIn Introduction

and enforcing compliance; Regulating, supervising supervising Regulating, YBERUK Conference i. Participation International or organising onducting ecording andreporting h) awing upCodes of g) f) nvestigating breaches; e) d) c) b) worldwide. presence from across theUKand will alsobeastrong industry and widergovernment. There andacross centraldepartments ingovernment security cyber with overall responsibility for This event isattended by those and solution-basedcasestudies. interactive panel discussions oftop-level keynotes,a series 12 May 2021,andwillprovide event on11- place as a virtual CYBERUK event willnow take conference was postponed. The to the coronavirus pandemic the Centre however, (“NCSC”), due by the National Cyber Security scheduled to behosted inCardiff event, security was cyber is theUKgovernment’s flagship The CYBERUK conference which

C C R Dr Issuing guidanc I Establishing alistofdig Establishing alistof 2020 inspections. incident notifications; and Practice; or DSP; providers; service services; operators ofessential e to OES ital potentially have animpact. have beenmitigated butcould incidents andattacks that may Division ofpotential cyber company the orbodyto alert and DSPorany otherrelated but itcanalsobeusedby OES designed for majorincidents, formThe was NISreporting the incident. becominghours after aware of as possiblebutnolater than72 and shouldbesubmitted assoon available website ontheGRA form done viatheNISreporting ofincidents is The reporting provision oftheessential service. have onthe asubstantial impact Division ofany incident that may respectively, to notifythe 42 (1)and43(3)oftheAct ofIncidents orting are required undersections The designated OESandDSP i. competent by theAct. authority since itwas designated asthe on Division hasbeenworking mattersregulatory which the The following isanoutlineofthe Matters Regulatory the ECG. collated withtheUK’s to report to theNCSC,forreport thisto be Division submitted anincident 40(3)ofthe Act, the of section accordanceIn withtheprovisions cyberattacks. specific blocking mitigating theeffectsandeven provide recommendations for threats acrosscyber theEUand incidents, to determine the main onCyberort Incidents andnaturethe quantity ofcyber Group (“ECG”) collates on reports The European Cooperation ii.

Rep Rep CYBER SECURITY COMPLIANCE 61 Framework C

impact on the provision of their of impact provision on the Division The service.digital not identified has currently falls that in Gibraltar DSP any in the EU definitions within the reassess but will NIS Directive services digital the the once Act, the to changes anticipated departure Gibraltar’s due to and completed are the EU, from enacted. The Act requires an OES to take an OES to Act requires The and proportionate appropriate and organisational technical risksthe manage to measures the security to of network and which systems information supportdelivery the essential of Assessment Cyber The services. encourages (“CAF”) Framework meet a set of fourteen NIS OES to cyber security principles written of outcomes. in terms an as CAF is intended The specifies that tool assessment be achieved to needs what exactly than stating what rather Division The done. be to needs complete all OES to requires v. v. yber Assessment tion of Digital Service Providers Service Providers (“DSP”) Designa

35(2) of the Act, as providers of providers as Act, of the 35(2) services.essential In accordance sectionwith the Act, the of 35(9) of the different review biennial sectors conducted an and was identified OES was additional and designated. take OES to an Act requires The and proportionate appropriate and organisational technical risksthe manage to measures and minimise posed and prevent impactthe affecting incidents of the security their network of systems. information and an OES is also Furthermore, Division the notify to required have may that incident of any impacta significant on the service. of an essential provision DSP, just like OES, must ensure just like OES, must ensure DSP, of securitythe level of their the to appropriate are systems risks and as far as identified possible minimise the impact cyber must DSP of any incident. also notify the Division of any a significant having incident iv. iv. of Operators of Essential of Essential of Operators Services (“OES”) Rep

Dr F distribution The Act requires the GRA to the GRA to Act requires The sectors: assess the following • Energy Transport • • Banking The Division is required to to is required Division The services the essential identify network by being provided and systems and information the maintenance for essential criticalof economic or societal activities in Gibraltar. • Health Sector • inking supplyand water • infrastructures market inancial iii. ort ondesignation The UK considers cybersecurity UK considers The importanceof critical national co- to will continue and it with and collaborate operate and security countries European worldwide. organisations The Division originally identified identified Division originally The OES by four and designated under section of a Notice way • Digital infrastructure • Digital 62 CYBER SECURITY COMPLIANCE process. intheassessment support may provide you withmore Bodies andthey Certification with oneoftherecognised options or you can engage questions, online certification IASME provides self-assessment refer to the IASMEwebsite. please Essentials Certification, For more information on Cyber incidents. cyber to minimise theeffectsof andthemeasuresservices, taken oftheiressential criticality in place is appropriate for the demonstrate thelevel ofsecurity required from OESandDSPto ofthedeliverables as part shall beaccepted by theDivision Cyber Essentials Certification the scheme. responsible of for thedelivery Centre’s Cyber Essentials Partner, the National Cyber Security 2020, IASMEbecame 1st April threats. security On based cyber of the most common internet their size, againstawholerange protect organisations, whatever backed schemethat willhelpto but effective,Government UK Essentials yber Cyber Essentials isasimple vi. cyber-security-compliance/caf website: https://www.gra.gi/ the CAF, pleasevisittheGRA on the assessment process and practice. For information further on setsofindicators ofgood thatspecific principles are based into andstructured objectives The isbasedonfour CAF main service. providingnetworks theessential at systems thecritical andthe order for to the CAF be targeted their own assessments risk in

C vii. cyber security.cyber will leadto better standards of guidance andmeasures taken to ensure that all experts Coordinator and industry Gibraltar, theCivil Contingencies withtheGovernmentworking of The Divisioniscurrently also border issues. (GCHQ) and NCSCfor any cross- Communications Headquarters with theUK’s Government Division will continue to liaise as thedesignated SPOC,the authorities. Internationally, with Gibraltar law enforcement Response Team and (CSIRT) ComputerIncident Security closely withtheGibraltar Act, theDivisioniscooperating 38and40ofthe with sections requirements andinaccordance in each sector. of our As part thatrisks needto beaddressed security the possiblecyber the designated OESto identify The Divisionisliaisingwithall

Liaison withother Bodies

GRA GIBRALTAR REGULATORY AUTHORITY

2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar Tel: 200 74636

www.gra.gi