S.L. 586.1 Art. 3ASecurity of processing.

(1) In the case of a personal data breach, the provider of publicly available electronic communications services shall, without undue delay, notify the personal data breach to the

Commissioner.

(2) When the personal data breach is likely to adversely affect the personal data or privacy of a subscriber or individual, the provider shall also notify the subscriber or individual of the breach without undue delay.

(3) Notification of a personal data breach to a subscriber or individual concerned shall not be required if the provider has demonstrated to the satisfaction of the Commissioner that he has implemented appropriate technological protection measures, and that those measures were applied to the data concerned by the security breach. Such technological protection measures shall render the data unintelligible to any person who is not authorised to access it.

(4) Without prejudice to the provider’s obligation to notify subscribers and individuals concerned, if the provider has not already notified the subscriber or individual of the personal data breach, the Commissioner, having considered the likely adverse effects of the breach, may require him to do so.

(5) The notification to the subscriber or individual shall at least include the nature of the personal data breach and the contact points where more information can be obtained, and shall recommend measures to mitigate the possible adverse effects of the personal data breach. The notification to the Commissioner shall, in addition, include the consequences of, and the measures proposed or taken by the provider to address, the personal data breach.

(6) The Commissioner shall encourage the drawing up of guidelines and, where necessary, issue instructions concerning the circumstances in which providers are required to notify personal data breaches, the format of such notification and the manner in which the notification has to be made.

(7) Service providers shall maintain an inventory of personal data breaches comprising the facts surrounding the breach, its effects and the remedial action taken which shall be sufficient to enable the Commissioner to verify compliance with the provisions of this regulation.