Côte d'IvoireElectronic Communications Law: Security Incident Notification by Operators
Loi n°2024-352 du 6 juin 2024 relative aux communications électroniques, article 98
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds an operator, meaning a legal entity that establishes or operates an electronic communications network or provides electronic communications services (reached by declaring that you provide telecom services).
- Inform ARTCI as soon as you become aware of any security incident that has a significant impact on the operation of your networks or services; the Law sets the clock as soon as the operator is aware and states no hour limit (Article 98).
- Where there is a particular and significant threat of a security incident in a public electronic communications network or service, inform the subscribers concerned of the threat and of any protective or corrective measure they can take (Article 98).
- Comply with the technical requirements ARTCI sets to remedy the incident or prevent its spread (Article 98).
- Once you have analyzed the causes and consequences of the incident, report them to ARTCI together with the measures taken to prevent a recurrence (Article 98).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The sanctions Article 211 lists for a breach of the Law are administrative decisions of the restricted formation (Article 212); this row's Article carries no offense of its own.
Penalty structure
Article 211 lets the restricted formation of the Autorité de Régulation impose a financial sanction proportionate to the gravity of the breach and the advantage drawn from it, capped at 3% of the operator's last closed-year turnover excluding tax and at 5% for a new violation of the same obligation; it also lists a reminder, an injunction with a daily penalty, restriction or suspension of the authorization, withdrawal of the authorization and a ban of one to five years on acting in the sector. The cap for universal-service obligations is 4%, or 8% on a repeat.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 3
Who enforces it
Enforcement body
Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), the Autorité de Régulation of Article 137.
Settledness
- As of
- Open questions
- Does the 'incident de sécurité ayant un impact significatif' (security incident having a significant impact) of Article 98 depend on a threshold the Autorité de Régulation has fixed, beyond the parameters Article 98 lists?
What this law does
Article 98 requires an operator, as soon as it is aware of one, to inform the Autorité de Régulation of any security incident having a significant impact on the operation of its networks or services. Article 98 requires an operator facing a particular and significant threat of a security incident to inform the subscribers concerned of the threat and of any protective or corrective measure they can take.
Article 98 requires the operator to comply with the technical requirements the Autorité de Régulation sets to remedy the incident or prevent its spread. Article 98 requires the operator, once it has analyzed the causes and consequences of the incident, to report them to the Autorité de Régulation together with the measures taken to prevent a recurrence.
Article 98 judges the significance of an incident by, among other parameters, the number of users affected, the duration of the incident and the geographic extent of the area affected. Article 211 caps the financial sanction for a breach at 3% of the operator's turnover excluding tax for the last closed financial year, and at 5% for a new violation of the same obligation.
When LexLint raises it
When your app profile says your app provides telecom services.