BeninDigital Code: Electronic Communications Operator Security-Event Detection and Control Duties
In force.
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an operator, meaning anyone who operates an electronic communications network or provides an electronic communications service (Article 1er); you are reached by declaring that you provide a public telecommunications network or an electronic communications service.
- Put in place qualified systems for detecting events that could affect the security of your information systems; the ministry in charge of electronic communications issues the qualifications of those systems and of the service providers that run them (Article 599).
- Submit your information systems to checks of their level of security and of your compliance with security rules, which the national information-systems security agency (ANSSI-BENIN) carries out at your own cost (Article 600).
- Keep in good condition the protection devices you have previously established (Article 601).
- Give ANSSI-BENIN, where it obtains them from you for the security of information systems, the identity, postal address and email address of the users or holders of vulnerable, threatened or attacked systems, so that it can alert them (Article 603).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 601 punishes the omission to keep previously established protection devices in good condition with a fine of 10,000,000 CFA francs.
Penalty structure
Article 601 fixes the fine at 10,000,000 CFA francs for the omission to keep previously established protection devices in good condition.
- Rule
- Fixed only
- As of
- Currency
- XOF
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
L'Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI-BENIN), which carries out the security checks of Article 600.
Settledness
- As of
- Open questions
- Which information systems and which qualification criteria does the ministry in charge of electronic communications apply to the detection systems and service providers of Article 599, given that the Code leaves those qualifications to the ministry?
What this law does
Article 1er defines an operator as any natural or legal person operating an electronic communications network or providing an electronic communications service. Article 599 requires operators to put in place qualified systems for detecting events.
Article 599 provides that the ministry in charge of electronic communications issues the qualifications of the detection systems, which cover events likely to affect the security of operators' information systems, and of the service providers that run them. Article 600 requires operators to submit their information systems to checks of their level of security and of their compliance with security rules, carried out by the national information-systems security agency.
Article 600 puts the cost of the checks on the operator. Article 601 punishes with a fine of 10,000,000 CFA francs the omission to keep in good condition the protection devices previously established. Article 603 lets the national information-systems security agency obtain from operators the identity, postal address and email address of users or holders of vulnerable, threatened or attacked information systems, in order to alert them.
Article 239 applies when a licensed or authorized operator fails to meet the obligations set by the applicable laws and regulations, the decisions of the regulatory authority and the conditions of its licence. Article 239 provides for a penalty of 0.1% to 4% of consolidated turnover for the last financial year, doubled for a repeat breach, set by reasoned decision according to the gravity of the breach.
When LexLint raises it
When your app profile says your app provides telecom services.