SpainLey 11/2022 General Telecommunications Law, Security Incident Notification to the Ministry and to Users
Ley 11/2022, art. 63.3 y 63.4, General de Telecomunicaciones
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Security
What it requires
- If you supply a public electronic communications network or provide a publicly available electronic communications service, this binds you (Article 63.3 and 63.4).
- Notify the Ministry of Economic Affairs and Digital Transformation of every security incident that has had a significant impact on the supply of your networks or services, judging significance by the users affected, the duration, the area affected, the effect on the network or service and the effect on economic and social activities (Article 63.3).
- Where the Ministry considers disclosure of an incident to be in the public interest, inform the public if it requires you to (Article 63.3).
- Where there is a particular and significant threat of a security incident, inform the users who may be affected about the protective measures or solutions they can adopt and, where appropriate, about the threat itself (Article 63.4).
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
Article 109.1(c) sets the fine for a grave infringement at up to EUR 2,000,000, and article 107 classes failure to meet the integrity and security obligations as grave; a different cap applies to grave infringements within the sanctioning competence of the Comisión Nacional de los Mercados y la Competencia.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 2,000,000
Who enforces it
Enforcement body
The Ministry of Economic Affairs and Digital Transformation (Ministerio de Asuntos Económicos y Transformación Digital), which supervises compliance with article 63 and issues binding instructions to operators.
What this law does
Article 63.3 requires operators that supply public networks or provide publicly available electronic communications services to notify the Ministry of Economic Affairs and Digital Transformation of security incidents that have had a significant impact on the supply of the networks or services.
The parameters for judging the significance of an incident include the number of users affected, its duration, the geographic area affected, the extent to which the network or service was affected and the scale of the impact on economic and social activities, where they are available. The Ministry may inform the public, or require operators to do so, where it considers that disclosure of the security incident is in the public interest.
Article 63.4 requires operators, where there is a particular and significant threat of a security incident, to inform the users who may be affected about the possible protective measures or solutions they can adopt and, where appropriate, about the threat itself. Article 107 classes failure to meet the obligations on integrity and security in providing services or supplying electronic communications networks as a grave infringement.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .