1. Pursuant to point b) of article 54-E of Law no. 5/2004 of 10 February, as amended and republished by Law no. 51/2011 of 13 September (hereinafter "Electronic Communications Law"), it is incumbent upon ICP - Autoridade Nacional de Comunicações (ICP-ANACOM) to require undertakings which provide public communications networks or electronic communications services accessible to the public (hereinafter, the "undertakings") to inform the public, by appropriate means, of breaches of security or losses of network integrity, where deemed by ICP-ANACOM as being in the public interest.
2. ICP-ANACOM determines that it is in the public interest that undertakings inform the public as to any breach of security or loss of integrity whose impact on the functioning of their networks and services is encompassed by the following criteria:
|
Duration and |
Number of subscribers or accesses affected (or, pursuant to point e) of paragraph 3 of Section I, geographic area affected) |
|
≥ 30 minutes |
no. of subscribers or accesses affected ≥ 500,000 (or, pursuant to point e) of paragraph 3 of Section I, geographic area affected - 3,000 km2) |
|
≥ 1 hour |
500.000 > number of affected subscribers or accesses ≥ 100,000 (or, pursuant to point e) of paragraph 3 of Section I, 3,000 km2 > geographic area affected ≥ 2,000 km2) |
|
≥ 2 hours |
100.000 > number of affected subscribers or accesses ≥ 30,000 (or, pursuant to point e) of paragraph 3 of Section I, 2,000 km2 > geographic area affected ≥ 1,500 km2) |
|
≥ 4 hours |
30.000 > number of affected subscribers or accesses ≥ 10,000 (or, pursuant to point e) of paragraph 3 of Section I, 1,500 km2 > geographic area affected ≥ 1,000 km2) |
3. For the purposes of the preceding paragraph:
a) The impact of a breach of security or loss of integrity is to be assessed by reference to all the networks and all the services of a company that are affected thereby;
b) The number of subscribers or accesses affected by a breach of security or loss of integrity corresponds to the sum of the number of subscribers or accesses which are so affected and as comprised by the various networks and services;
c) The number of subscribers to a service that is supported by another service will only be taken into account when the support is not affected;
d) The number of subscribers or accesses affected corresponds to the number of subscribers or accesses covered by the breach of security or loss of integrity, or where it is not possible to determine this number, to an estimate based on statistical data held by the undertaking; and
e) The criterion related to the affected geographical area is only to be applied in the event that the criterion on the number of affected subscribers or accesses is inapplicable or, in the specific case and on a reasoned basis, impossible to determine or estimate.
4. Notwithstanding the provisions of the present Annex B, ICP-ANACOM may, pursuant to paragraph b) of article 54 of the Electronic Communications Law, including in circumstances not provided for in paragraph 2 of the present Section I, order undertakings to inform the public as to other breaches of security or losses of integrity occurring on their networks and as part of their services.
