BeninDigital Code: Trust Service Provider Security-Breach Notification
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), the same provider the security-measures duty of Article 308 binds; you are reached by declaring that you operate an essential service.
- Notify the control body, and where applicable the other bodies concerned, as soon as possible and at the latest within 24 hours of becoming aware of it, of any breach of security or loss of integrity having a significant impact on the trust service you provide or on the personal data kept in it (Article 309).
- Where the breach or loss of integrity is liable to harm a user of the trust service, notify that user as well, as soon as possible (Article 310).
- Inform the public of the breach or loss of integrity when the control body requires you to do so because it finds the public interest requires it (Article 310).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The control body for trust service providers (organe de contrôle), attached to the ministry in charge of electronic communications.
Settledness
- As of
- Open questions
- What form must the Article 309 notification to the control body take, given that the Code states a deadline but no notification format?
What this law does
Article 309 requires qualified and non-qualified trust service providers to notify the control body, and where applicable other bodies concerned, as soon as possible and at the latest within 24 hours of becoming aware of it, of any breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data kept in it.
Article 310 requires a trust service provider to notify a user of the trust service of a breach of security or loss of integrity as soon as possible where it is liable to harm that user. Article 310 lets the control body that received a notification concerning a foreign State inform the competent authorities or control bodies of that State.
Article 310 provides that the control body informs the public of a breach of security or loss of integrity, or requires the trust service provider to do so, whenever it finds that the public interest requires it.
When LexLint raises it
When your app profile says your app runs an essential service.