IrelandCommunications Regulation and Digital Hub Development Agency (Amendment) Act 2023, Provider Incident Notification and User Threat Notices
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security, Disclosure
What it requires
- If you are a provider of public electronic communications networks or of publicly available electronic communications services, notify the Commission for Communications Regulation without undue delay of any security incident that has had or is having a significant impact on the operation of your networks or services; judge significance by the incident's duration, the number and class of users affected, the geographical area, the extent to which the network or service was affected, the impact on economic and societal activities and the cause (section 11(1) and (2)).
- Put in the notification your name, the network or services affected, the date, time and duration of the incident, the information on the section 11(2) matters, the nature and impact of the incident, any likely cross-border impact and any other information the Commission specifies (section 11(3)).
- Once the incident is resolved, tell the Commission as soon as practicable, with the actions you took to remedy it and any actions to reduce the likelihood of a similar incident (section 11(4)).
- If the Commission decides that disclosing a notified incident is in the public interest, inform the public of it when the Commission requires you to (section 11(6)).
- Where there is a particular and significant threat of a security incident, tell the users potentially affected of any possible protective measures or remedies they can take and, where appropriate, of the threat itself (section 12(1)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 11(8) makes a failure to notify the Commission of a significant incident, to make all reasonable efforts to provide the notification information, or to inform the public when required, an offence, and section 12(3) does the same for a failure to inform users of a threat; each is liable on summary conviction to a class A fine.
Penalty structure
Part 7 of the Act lets an adjudicator impose a financial penalty for a regulatory breach, and a failure to comply with a provision the Act states to be a regulatory provision is one. Section 94(5) caps the penalty for a person other than a natural person at the greater of EUR 5 million and 10 per cent of the person's turnover in the State in the financial year before the one in which the breach last occurred. Separately, the offences in the Part 2 sections named in the row are tried summarily and carry a class A fine.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 5,000,000
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
Commission for Communications Regulation (ComReg), which section 13 directs to take reasonable steps to ensure that providers comply with the obligations Part 2 places on them.
Settledness
- As of
What this law does
Section 11(1) of the Communications Regulation and Digital Hub Development Agency (Amendment) Act 2023 requires a provider, where a security incident occurs that has had or is having a significant impact on the operation of its electronic communications networks or services, to notify the Commission for Communications Regulation without undue delay.
Under section 11(2), to decide whether the impact is significant a provider has regard to the duration of the incident, the number of users affected, any class of users particularly affected, the geographical area affected, the extent to which the functioning of the network or service was affected, the impact on economic and societal activities, and the cause of the incident.
The notification must contain the provider's name, the network or services affected, the date, time and duration of the incident, the information on the matters in section 11(2), the nature and impact of the incident, any likely cross-border impact and such other information as the Commission may specify (section 11(3)).
Under section 11(4), a provider that has notified an incident must, as soon as practicable, notify the Commission when the incident is resolved, with the actions taken to remedy it. Under section 11(6), where the Commission determines that the disclosure of a notified security incident is in the public interest, it may inform the public or require the provider concerned to do so. Section 11(7) makes subsections (1) to (4) regulatory provisions.
A provider that fails to notify the Commission in accordance with section 11(1) commits an offence and is liable on summary conviction to a class A fine (section 11(8)). Under section 12(1), in the case of a particular and significant threat of a security incident, a provider must inform its users potentially affected of any possible protective measures or remedies and, where appropriate, of the threat itself. Section 12(2) makes section 12(1) a regulatory provision.
A provider that fails to inform its users in accordance with section 12(1)(a) commits an offence and is liable on summary conviction to a class A fine (section 12(3)). A regulatory breach includes a failure to comply with a regulatory provision (section 59).
Under section 94(5), the maximum financial penalty that an adjudicator may impose for a regulatory breach on a person other than a natural person is the greater of EUR 5 million and 10 per cent of the person's turnover in the State in the preceding financial year. Parts 2 to 9 of the Act came into operation on .
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .