Article 11.3

• 1

  The provider of a publicly available electronic communications service shall notify the Autoriteit persoonsgegevens without delay of any breach of security referred to in Article 11.3 that adversely affects the protection of personal data processed in connection with the provision of a publicly available electronic communications service in the European Union.

• 2

  The provider referred to in the first paragraph shall immediately notify the person whose personal data is affected of a personal data breach if the breach is likely to adversely affect his or her privacy.

• 3

  The notification to the Autoriteit persoonsgegevens and the person whose personal data is affected shall include at least the nature of the personal data breach, the authorities where more information on the breach can be obtained, and the recommended measures to mitigate the negative consequences of the breach.

  The notification to the Autoriteit persoonsgegevens shall also include the consequences of the personal data breach and the measures the provider proposes or has taken to address the breach.

• 4

  If the provider of a public electronic communications service does not give a notification as referred to in the second paragraph, the Autoriteit persoonsgegevens may, if it considers that the personal data breach is likely to adversely affect the privacy of the person whose personal data is affected, require the provider to still notify that person of the breach.

• 5

  The notification referred to in the second paragraph shall not be required if, in the opinion of the Autoriteit persoonsgegevens Authority, the provider has implemented appropriate technical protection measures that make the personal data in question encrypted or otherwise unintelligible to any person not entitled to access that data.

• 6

  The provider of a public electronic communications service shall keep a record of all breaches related to personal data. This record shall include at least the facts and the data referred to in the third paragraph.

• 7

  Further rules may be issued by or pursuant to general order in council regarding the information and notification requirements referred to in this article.