IrelandCommunications Regulation and Digital Hub Development Agency (Amendment) Act 2023, Provider Security Measures and Commission Directions
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- If you are a provider of public electronic communications networks or of publicly available electronic communications services, take appropriate and proportionate technical and organisational measures to manage the risks to the security of your networks and services, at a level of security appropriate to the risk having regard to the state of the art (section 6(1) and (2)).
- Take measures, including the use of encryption where appropriate, to prevent security incidents and to minimise the impact of any security incident on users and on other networks and services (section 6(3)).
- When the Commission for Communications Regulation asks, give it the information it needs to assess the security of your networks and services, including your documented security policies (section 14(1)).
- Comply with a security measures direction the Commission serves on you, which may require specified measures within specified time limits, a statement of the measures you have taken, and a security audit by the Commission or a qualified independent person at your cost; you may make written representations within 14 days of service (section 14(2) to (7)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 14(7) makes a failure to comply with a security measures direction an offence, liable on summary conviction to a class A fine; the Commission can also pursue a failure to meet section 6(1) to (3) as a regulatory breach under Part 7.
Penalty structure
Part 7 of the Act lets an adjudicator impose a financial penalty for a regulatory breach, and a failure to comply with a provision the Act states to be a regulatory provision is one. Section 94(5) caps the penalty for a person other than a natural person at the greater of EUR 5 million and 10 per cent of the person's turnover in the State in the financial year before the one in which the breach last occurred. Separately, the offences in the Part 2 sections named in the row are tried summarily and carry a class A fine.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 5,000,000
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
Commission for Communications Regulation (ComReg), which section 13 directs to take reasonable steps to ensure that providers comply with the obligations Part 2 places on them.
Settledness
- As of
What this law does
Section 6(1) of the Communications Regulation and Digital Hub Development Agency (Amendment) Act 2023 requires a provider of public electronic communications networks or of publicly available electronic communications services to take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of networks and services.
Under section 6(2), those measures must ensure a level of security appropriate to the risk presented, having regard to the state of the art. Under section 6(3), measures, including the use of encryption where appropriate, must be taken to prevent security incidents and minimise the impact of any security incident on users and on other networks and services. Section 6(9) makes subsections (1), (2) and (3) regulatory provisions.
Under section 14(1), a provider must, on the request of the Commission for Communications Regulation, provide the Commission with the information needed to assess the security of its networks and services, including documented security policies. Under section 14(2), the Commission may serve a security measures direction on a provider to remedy a security incident, to prevent one when a significant threat has been identified, or to ensure that the provider is in compliance with Part 2.
A security measures direction may require a provider to submit to a security audit by the Commission or a qualified independent person nominated by the Commission, and to bear the costs of the audit (section 14(3)). A provider that fails to comply with a security measures direction commits an offence and is liable on summary conviction to a class A fine (section 14(7)).
Under section 13, the Commission must take reasonable steps to ensure that providers comply with the obligations placed on them by or under Part 2. A regulatory breach includes a failure to comply with a regulatory provision (section 59).
Under section 94(5), the maximum financial penalty that an adjudicator may impose for a regulatory breach on a person other than a natural person is the greater of EUR 5 million and 10 per cent of the person's turnover in the State in the preceding financial year. Parts 2 to 9 of the Act came into operation on .
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .