The European Telecommunications Code has now been implemented

4 mn

The law of 17 December 2021, which implements Directive (EU) 2018/1972 establishing the European Electronic Communications Code (the “EECC”) into Luxembourg law, has just been published and, as a Christmas present, will enter into force next week-end on 26 December 2021.

Ultimately, this new legal framework is meant to help cope with the evolution of technologies and changes in the use of telecommunications services by the general public, and to support the development of 5G and very high capacity networks, so that every citizen and business in the EU can enjoy high quality connectivity, a high level of consumer protection and a greater choice of innovative digital services.

The key changes brought by the EECC are:

OTT players will also have to comply with new and existing legal constraints relating to security, interoperability, information and user protection (including their privacy and personal data), or to universal service.

The definition of “electronic communication service” now also explicitly includes machine-to-machine communications.

The right to number portability would no longer be conditional on a simultaneous change of operator, and could extend to one month after the effective termination of the telephone subscription.

In order to ensure sufficient stability and visibility for operators, frequency authorisations will be granted for 15 years, with a possible extension for an appropriate period as decided by the relevant minister. Here, note that in Luxembourg, frequencies relevant for 5G have already been attributed to four operators for an initial period of 15 years.

Here, note that in the event of a security incident, providers may need to notify not only the ILR, but also the Luxembourg data protection authority (the “CNPD”) if the security incident qualifies as a data breach under the EU General Data Protection Regulation (the “GDPR”) or the Luxembourg law of 30 May 2005 on the protection of privacy in the electronic communications sector (the “Law of 2005”).

While under the GDPR and the Law of 2005, a personal data breach will only be established in the event of an actual breach of user data, it should be noted that the definition of “security incident” under the newly approved bill is particularly broad: the mere observation of an event that may have an adverse effect on the security of electronic communications networks and services will be sufficient to trigger notification.

The bill of law approved by the Luxembourg Chamber of Deputies on 8 December 2021 implements the EECC in a very faithful manner. The only Luxembourg specifics are minor, and are as follows:

What sanctions can be incurred by the providers of electronic communications and/or networks falling under the scope of the bill?

Beyond issuing a reprimand or a ban on carrying out certain operations or providing certain services, or temporarily suspending one or more managers of the company, the ILR can also impose fines up to one million euros (subject to a penalty payment if necessary).

The competent minister may also suspend or withdraw administrative authorisations, such as rights to the use of the radio spectrum.

Download the press release

Luxembourg Newsflash – The European Telecommunications Code has now been implemented

pdf167 KB