LithuaniaLaw on Electronic Communications Article 74, Personal Data Breach Notification by Electronic Communications Providers
Lietuvos Respublikos elektroninių ryšių įstatymas Nr. IX-2135, Art. 74(4)-(8)
In force.
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
As of .
What it requires
- If you provide public electronic communications networks or services, notify the State Data Protection Inspectorate without delay of a personal data security breach (Law on Electronic Communications Article 74, paragraph 4).
- Notify the subscriber, registered user or other person without delay where the breach may adversely affect the security of their data or their privacy, unless you prove to the Inspectorate that appropriate technical measures made the data inaccessible to unauthorized persons (Article 74, paragraphs 4 and 5).
- In the notice, describe the nature of the breach, give contact details and recommend measures to reduce its adverse effects, and add the consequences of the breach and the measures you proposed or took in the notice to the Inspectorate, following Regulation (EU) 611/2013 (Article 74, paragraphs 6 and 7).
- Record every personal data breach, with its causes, its effects and the measures taken (Article 74, paragraph 8).
Who enforces it
Enforcement body
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), which checks whether providers meet the duty to notify personal data security breaches.
What this law does
A provider of public electronic communications networks or services must notify the State Data Protection Inspectorate without delay of a personal data security breach. The provider must also notify the subscriber, registered user or other person where the breach may adversely affect the security of their data or their privacy, unless it proves to the Inspectorate that appropriate technical measures made the data inaccessible to unauthorized persons.
The Inspectorate may order a provider that has not yet notified the subscriber or user to do so. The notice describes the nature of the breach, gives contact details and recommends measures to reduce its adverse effects. Both notices are made in line with Regulation (EU) 611/2013. Providers must keep a record of personal data breaches, with their causes, effects and the measures taken.
When LexLint raises it
When your app profile says your app provides telecom services.