By determination of its Management Board, on 22 December 2011, Autoridade Nacional de Comunicações (ICP-ANACOM) approved a Draft Decision on:
- The circumstances, format and procedures applicable to the requirements of reporting, by companies that provide public communications networks or publicly available electronic communication services, of security breaches or losses of integrity with significant impact on the operation of networks and services (Paragraph 2 of articles 54C and of the LCE);
- The conditions by which ICP-ANACOM considers that there is public interest in public disclosure, by companies that provide public communications networks or publicly available electronic communication services, of security breaches or losses of integrity with significant impact on the operation of networks and services (point b) of article 54-E of the LCE).
It was also decided to submit this Draft Decision to the prior hearing of interested parties, pursuant to articles 100 and 101 of the Código do Procedimento Administrativo (Administrative Proceeding Code), as well as to the general consultation procedure laid down in article 8 thereof and in paragraph 4 of article 54-C of Lei das Comunicações Eletrónicas (Electronic Communications Law - "LCE" in the present document - as approved by Law no. 5/2004 of 10 February and as subsequently amended by Decree-Law no. 176/2007 of 8 May, by Law no. 35/2008 of 28 July, by Decree-Law no. 123/2009 of 21 May, by Decree-Law no. 258/2009 of 25 September, Law no. 51/2011 of 13 September, Law no. 10/2013 of 28 January and by Law no. 42/2013 of 3 July). Interested parties were granted a period of 20 working days, under both procedures, in which to comment, whereby comments were to be submitted no later than 27 January 2012.
Under this procedure, timely contributions were received from:
- undertakings providing public communications networks or publicly available electronic communications services ("companies" in the present document), AT&T/COLT/Verizon Business in joint response, Cabovisão, CTT, Grupo ONI (Onitelecom, Knewon, and F300), Optimus, Grupo PT (Portugal Telecom, S.G.P.S., S.A., PT Comunicações, S.A., and TMN - Telecomunicações Móveis Nacionais, S.A.), Vodafone and ZON (ZON TV CABO, ZON TV CABO MADEIRENSE and ZON TV CABO AÇOREANA), as well as from APRITEL - Associação dos Operadores de Telecomunicações (Association of Telecommunications Operators);
- consumer associations: ACOP - Associação de Consumidores de Portugal (Portugal Consumer Association) and UGC - União Geral de Consumidores (General Union of Consumers); and
- public bodies: DGC - Direção Geral do Consumidor (Directorate General for the Consumer) and Secretaria Regional da Educação e Recursos Humanos do Governo Regional da Madeira (Regional Education and Human Resources Secretariat of the Regional Government of Madeira).
An additional contribution was received from DECO - Associação Portuguesa para a Defesa do Consumidor (Portuguese Association for Consumer Protection), together with a revised version of the contribution submitted by Optimus, but since both were received subsequent to the stipulated deadline, these were not considered in this report.
With the consultation process concluded, it is now important to prepare the resulting report and publish the responses received, excluding items which were considered confidential (these confidential items were taken fully into account and not just in the content transposed or cited in the summary included in the present report).
This report therefore presents the summary of responses submitted to the public consultation and positions taken by ICP-ANACOM on the issues raised, and sets out the reasoning giving basis to the options taken in the final decision.
First, however, and with regard to the suggestion put by Grupo PT as regards the "establishment of a working group comprising all stakeholders, in order to ensure both the definition of security incidents to be reported and the definition of proportionate measures which are in line with the practical reality of the sector and which take the criticality of the services into account", it can be stated, from the outset, that ICP-ANACOM is of the position that, in the current framework, this suggestion cannot be accepted, given that:
a) Pursuant paragraph 2 of article 54-C of the LCE, it is incumbent upon ICP-ANACOM to approve measures defining the circumstances, format and procedures applicable to notification requirements concerning breach of security or loss of integrity of networks; and
b) Pursuant to 4 paragraph of the same Article, the adoption of implementing measures referred to in paragraphs 1 and 2 is subject to the general consultation procedure provided for in article 8 of the LCE, so that the law deems this the appropriate procedure to ensure that stakeholder contributions are taken on board with a view to improving the content of this decision.
In any case, subsequent to the entry into force of this Decision, the Authority remains available to receive and examine any contributions that might lead to its efficient implementation.
Finally, it should also be noted that after the public consultation, ICP-ANACOM has obtained access to statistical data on the occurrences of crimes of theft and damage to infrastructure used for the provision of electronic communications networks and services in the years 2010 and 2011.
Having examined the facts in order to determine their relevance to the present decision-making process, ICP-ANACOM concluded that the data added no new elements of relevance to the present decision.
