FinlandLaki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators
274 ja 275 §, Laki sähköisen viestinnän palveluista (917/2014)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Security, Reporting, Disclosure
As of .
What it requires
- If you are a telecommunications operator (teleyritys) providing a communications service in Finland, notify your subscribers and users without delay when a significant information-security breach, or another event that prevents the service from working or materially disturbs it, affects or threatens your service (Act 917/2014, section 274).
- If you provide a value-added service as a value-added service provider (lisäarvopalvelun tarjoaja), notify your users without delay of a significant information-security breach, or the threat of one, affecting your service (section 274).
- In each such notice state the estimated duration of the disturbance or its threat, the protective measures open to subscribers and users, their probable costs and where more information is available, and keep records of the notices (section 274).
- As a telecommunications operator, notify the Finnish Transport and Communications Agency without delay of the same kind of breach or event, then report without undue delay its estimated duration and effects, the corrective measures taken and the measures taken to prevent it recurring (section 275).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 349 punishes an intentional failure of the section 275(1) notification duty with a fine, and no punishment follows where the failure is minor.
Who enforces it
Enforcement body
The Finnish Transport and Communications Agency (Liikenne- ja viestintävirasto, Traficom), which section 303 charges with supervising compliance with the Act.
Settledness
- As of
What this law does
A telecommunications operator (teleyritys) must tell its subscribers and users without delay when a significant information-security breach, or another event that prevents the communications service from working or materially disturbs it, affects or threatens its service (section 274).
A value-added service provider (lisäarvopalvelun tarjoaja) must tell its users without delay of a significant information-security breach, or the threat of one, affecting its service, and the notice from either must state the expected duration of the disturbance and the protective measures open to subscribers and users, and keep a record of its notices (section 274).
Section 275 requires a telecommunications operator to notify the Finnish Transport and Communications Agency (Liikenne- ja viestintävirasto, Traficom) without delay of the same kind of breach or event, and to report without undue delay the estimated duration and effects of the disturbance, the corrective measures taken and the measures taken to prevent it recurring.
The Agency supervises compliance with the Act and with the provisions and decisions issued under it, unless the Act provides otherwise (section 303). A person who intentionally fails the notification duty in section 275(1) is liable to a fine for an electronic communications data-protection offence, unless the failure is minor (section 349).
When LexLint raises it
When your app profile says your app provides telecom services.