NorwayNotification of Security Incidents by Electronic Communications Providers
Lov om elektronisk kommunikasjon (ekomloven), §§ 3-2 and 3-3
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Applies to providers of electronic communications networks and services in Norway. Reached by declaring that you provide telecom services.
- Notify the authority immediately of security incidents that have caused a significant breach of availability, and, as the Norwegian Communications Authority states it, no later than half an hour after you become aware of the incident (section 3-3(1)).
- Notify the authority without undue delay of security incidents that have caused a significant breach of authenticity, integrity or confidentiality (section 3-3(1)).
- Notify subscribers and users without undue delay where there is a particular risk of a security incident in public networks or services, and tell them of protective or remedial measures they can take (section 3-2).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
What this law does
Section 3-3 of the Electronic Communications Act requires a provider to notify the ministry immediately of security incidents that have caused a significant breach of availability in electronic communications networks or services. Section 3-3 requires the provider to notify without undue delay of security incidents that have caused a significant breach of authenticity, integrity or confidentiality.
The Norwegian Communications Authority states that it must be notified immediately and no later than half an hour after the provider becomes aware of a security incident that has caused a significant breach of availability. The Authority states that all providers of electronic communications networks and services under the Act have a duty to notify it under section 3-3 of the Act and section 2-8 of the regulation.
Section 3-2 of the Act requires a provider to notify a subscriber or user without undue delay where there is a particular risk of a security incident in public networks or services. Section 15-12 of the Act lets the ministry impose an administrative fine for a breach of section 3-3(1).
When LexLint raises it
When your app profile says your app provides telecom services.