Part 5: Data Protection and Privacy Chapter 2: Privacy and electronic communications Section 111: Duty to notify the Commissioner of personal data breach: time periods
The PEC Regulations include rules on reporting breaches of personal data to the Information Commissioner for organisations providing electronic communications services to the public (e.g. telecoms providers and internet service providers). These rules are supplemented by provisions in the retained version of the Commission Regulation (EU) No 611/2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications ("Regulation 611/2013").
	The current effect of regulation 5A of the PEC Regulations and Article 2 of Regulation 611/2013 is that organisations must report personal data breaches to the Information Commissioner no later than 24 hours of becoming aware of the breach. Subsection (1)(a) of section 111 changes this so that personal data breaches must be reported without undue delay and, where feasible, not later than 72 hours.
	Subsection (1)(b) inserts a new paragraph 3A into the PEC Regulations, stating that where a personal data breach notification (under paragraph 2) is not made within 72 hours, reasons for the delay must be provided.
	Subsection (2)(a) and (b) refers to the fixed monetary penalty in 5C of the PEC Regulations and clarifies how to calculate the 21 day period under regulation 5C(4)(f) and (5) of the PEC Regulations.
	Subsection (3) amends Article 2 of Regulation 611/2013 to reflect the new time limits for breach reporting.
	Subsection (3)(a) amends paragraph 2 of Article 2 of Regulation 611/2013. Subsection (3)(a)(i) amends the first subparagraph to state that service providers must report a personal data breach without undue delay and, where feasible, not later than 72 hours of becoming aware of it.
	Subsection (3)(a)(ii) is a consequential amendment on new paragraph 3 of Article 2.
	Subsection (3)(a)(iii) inserts a new subparagraph which states that paragraph 2 is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits. This provision ensures consistency with section 205(2) of the DPA 2018, new Article 4A of the UK GDPR (inserted by paragraph 3 of Schedule 11 to this Act) and new paragraph (5) of Regulation 2 of the PEC Regulations (inserted by section 110 to this Act).
	Subsection (3)(b) amends paragraph 3 of Article 2 of Regulation 611/2013 to state that where the information (which is requested under Annex 1 of the Regulation) is not available to be included in the personal data breach notification, it may be provided in phases to the Information Commissioner without undue further delay.