SloveniaElectronic Communications Act (ZEKom-2) Article 227, Personal Data Breach Notification by Providers of Public Communications Services
Zakon o elektronskih komunikacijah (ZEKom-2), Uradni list RS, št. 130/2022, 227. člen
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
As of .
What it requires
- If you provide public communications services, notify the Agency for Communication Networks and Services (AKOS) without delay of a personal data security breach (ZEKom-2 Article 227, paragraph 1).
- Notify the affected subscriber or individual without undue delay where the breach is likely to harm their personal data and privacy, unless you have satisfactorily shown the agency that appropriate technical protection measures were applied to the data concerned (Article 227, paragraphs 2 and 3).
- In the notice, describe the breach, give contact points and recommend measures to mitigate its effects, and add the consequences of the breach and the measures you proposed or took in the notice to the agency (Article 227, paragraph 5).
- Keep a sufficient inventory of personal data breaches (Article 227, paragraph 7).
Who enforces it
Enforcement body
Agency for Communication Networks and Services (AKOS), the agency to which providers report personal data breaches under ZEKom-2 Article 227.
What this law does
A provider of public communications services must notify the Agency for Communication Networks and Services (AKOS) without delay of a personal data security breach. The provider must also notify the affected subscriber or individual without undue delay where the breach is likely to harm their personal data and privacy. That notice is not needed where the provider has satisfactorily shown the agency that it applied appropriate technical protection measures to the data concerned.
The agency may order a provider that has not notified the subscriber or individual to do so. The notice to the subscriber or individual must contain at least a description of the breach, contact points and recommended mitigating measures, and the notice to the agency must also describe the consequences and the measures proposed or taken. Providers must keep a sufficient inventory of personal data breaches.
When LexLint raises it
When your app profile says your app provides telecom services.