Czech RepublicElectronic Communications Act (Zákon o elektronických komunikacích), Notification of Serious Security Breaches
Act No. 127/2005 Coll., Electronic Communications Act, Sections 98(4) and (9) and 118(14)(f)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
What it requires
- This binds a person providing a public communications network or a publicly available electronic communications service in the Czech Republic, including an internet access service or an interpersonal communications service (reached by declaring that you provide telecom services).
- Inform the Czech Telecommunication Office, the operators of emergency communication centres and, in a suitable way, your users without delay of a serious breach of the security of your network or service or a loss of its integrity, stating the extent and reasons of any interruption or denial of access, the measures taken and the expected date the cause will be removed (Section 98(4)).
- Use the criteria for a serious breach and the extent and form of information that the Office sets by an implementing legal regulation (Section 98(4)).
- To the extent the breach originates in cyberspace and similar information duties apply to you under the Cybersecurity Act, the Section 98(4) duty does not apply (Section 98(9)); report under the Cybersecurity Act, Sections 15 and 16, in that case.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
A failure to inform the Office or users under Section 98(4) is an administrative offence (přestupek) of a legal person or sole trader under Section 118(14)(f), not a criminal offence.
Penalty structure
Section 118(26)(c) sets the fine for an offence under Section 118(14)(a) to (g) at up to CZK 50,000,000 or up to 10 percent of the offender's net turnover for the last closed accounting period, whichever is higher.
- Rule
- Higher of
- As of
- Currency
- CZK
- Fixed cap
- 50,000,000
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
The Czech Telecommunication Office (Český telekomunikační úřad), the central administrative authority for the matters the Act lays down (Section 3(1)).
Settledness
- As of
What this law does
Section 98(4) of Act No. 127/2005 Coll. requires a person providing a public communications network or a publicly available electronic communications service to inform the Czech Telecommunication Office, the operators of emergency communication centres and, in a suitable way, users without delay of a serious breach of network or service security or a loss of network integrity.
The information covers the extent and reasons of any interruption of service or denial of access, the measures taken and the expected date the cause will be removed. The Office sets the criteria for a serious breach and the extent and form of the information by an implementing legal regulation.
A failure to inform the Office or users under Section 98(4) is an administrative offence under Section 118(14)(f), punishable by a fine of up to CZK 50,000,000 or up to 10 percent of net turnover, whichever is higher. Section 98(9) disapplies the Section 98(4) duty to the extent a breach originates in cyberspace and similar information duties apply under the Cybersecurity Act.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .