to the extent absolutely necessary for
provisions of services for technical reasons.
the
(4) Information obtained via information and
communications networks may be stored on
electronic communication terminal equipment, or
accessed, only on the end-users' and subscribers'
prior consent granted after being in possession of
clear and comprehensive information about
implications.
Security of
information and
communications
services
140. (1) Information and communications service
providers shall take appropriate technical and
organizational measures, jointly with other service
providers if necessary, in order to safeguard
security of their services.
(2) The technical and organizational measures
shall be sufficient, with regard to best practices and
the costs of the proposed measures, to afford a
level of security appropriate to the risk presented in
connection with the services provided.
(3) In case of a particular risk of a breach of the
security of the services in spite of the technical and
organizational measures taken, the service
provider must inform the subscribers of the risk
and of the measures the subscribers may take to
enhance the level of protection.
(4) The information provided under subsection (3)
shall also indicate any software and encryption
technologies available for use by the end-users
and subscribers to safeguard the security of their
communications.
(5) In case of the occurrence of an event effecting
or jeopardizing the security of the services, where
a previously unknown risk of a breach of the
security appears in consequence, the information
and communications service provider shall
promptly inform the subscriber of the risk, free of
charge and of the measures the subscriber may
take to enhance the level of protection, and the
estimated costs involved.
138