Message 002
Communication from the Commission - TRIS/(2020) 03806
Directive (EU) 2015/1535
Translation of the message 001
Notification: 2020/0659/EE
No abre el plazo - Nezahajuje odklady - Fristerne indledes ikke - Kein Fristbeginn - Viivituste perioodi ei avata - Καμμία έναρξη προθεσμίας - Does not open the delays - N'ouvre pas de délais - Non fa decorrere la mora - Neietekmē atlikšanu - Atidėjimai nepradedami - Nem nyitja meg a késéseket - Ma’ jiftaħx il-perijodi ta’ dawmien - Geen termijnbegin - Nie otwiera opóźnień - Não inicia o prazo - Neotvorí oneskorenia - Ne uvaja zamud - Määräaika ei ala tästä - Inleder ingen frist - Не се предвижда период на прекъсване - Nu deschide perioadele de stagnare - Nu deschide perioadele de stagnare.
(MSG: 202003806.EN)
1. MSG 002 IND 2020 0659 EE EN 20-10-2020 EE NOTIF
2. EE
3A. Majandus- ja Kommunikatsiooniministeerium, siseturuosakond, toote ohutuse ja tarbijakaitse talitus.
Suur-Ameerika 1, 10122 Tallinn.
el.teavitamine@mkm.ee
tel: 00 372 6256 405 – faks: 00 372 6313 029
3B. Majandus- ja Kommunikatsiooniministeerium, riigi infosüsteemide osakond.
Suur-Ameerika 1, 10122 Tallinn.
4. 2020/0659/EE - V00T
5. Draft Regulation of the Government of the Republic on the security of communications networks amending the Regulation No 140 of the Government of the Republic of 22 June 2006 on the requirements for providing communications services and on the technical requirements for communications networks and the Regulation No 129 of 11 December 2015 on the statute for the security commission of the Government of the Republic
6. 5G and other communications networks.
7. -
8. The conditions for 5G and other communications networks are laid down in the Draft Regulation on the security of communications networks to guarantee their compliance with state security interests. Though the Draft Regulation does not set technical conditions, it lays down the obligation to apply for a licence for the use of hardware and software used in the communications network, and a notification obligation. Through the licence application procedure, conditions may be set on the hardware or software, or the licence may be withheld.
The requirements are applied to communications operators meeting at least one of the two following conditions: 1) the communications operator provides critical services, or at least 10 000 end-users use their services 2) for the provision of communications services, they apply the standards established by the European Telecommunications Standards Institute for fifth-generation or newer mobile communications networks.
Under § 87(4) of the Act on Electronic Communications, providers of critical services are providers of telephone services, mobile telephone services and data communications services used by at least 10 000 end-users. There are four such communications operators in Estonia.
While communications operators were previously obliged to take public order and state security into account when providing communication services, this regulation specifies the manner in which operators shall take state security interests into account. The threat posed by hardware and software to state security will be assessed in the licence application procedure. In the licence application procedure, the national Cyber Security Council will assess whether the hardware or software involves a high risk and whether their use may endanger state security for other reasons. All appropriate agencies are represented in the Council, and security agencies and the Information System Authority will present their views to the Council.
According to the draft regulation, the licence obligation and the prohibition of high-risk hardware and software are applied to hardware and software to be commissioned after the entry into force of the regulation. In addition, both shall be applied to existing hardware and software which will implement a 5G or newer mobile communications network standard functionality. The licence obligation and the prohibition of high-risk hardware and software shall be applied in different ways in various parts of the communications network:
• In terms of critical functions (such as core network functions), the licence shall be applied, and the use of high-risk hardware and software shall be prohibited from the entry into force of the regulation onwards.
• In terms of 5G and newer mobile communications network standard functions, the licence shall be applied from the entry into force of the regulation; however, licensed high-risk hardware and software may, according to the proposal, be used until 1 January 2024. Operators shall be given three years to implement the necessary changes in their development plans.
• In terms of other hardware and software (cable communications, older mobile communications network generations), a license application need not be submitted until 1 January 2029. After this, a licence should be sought for new hardware and software, and by 1 July 2029, a licence application should also be submitted for hardware and software implemented during the transition period, or between the entry into force of the regulation and 1 January 2029. In this case, communications operators will be given a transition period of ten years to implement the necessary changes in communications networks.
Communications operators will also have a notification obligation in relation to their entire communications technology, by which means the State will have an overview of the hardware and software used in communications networks, including hardware and software which does not require a licence.
9. The Draft Regulation of the Government of the Republic on the ‘security of communications networks’ amending Regulation No 140 of the Government of the Republic of 22 June 2006 on the ‘requirements for providing communications services and on the technical requirements for communications networks’, and Regulation No 129 of 11 December 2015 on the ‘statutes for the security commission of the Government of the Republic’. The purpose of the Draft Regulation is to lay down measures to guarantee compliance with state security interests in public electronic communication services and the public electronic communications network.
10. Reference(s) to basic text(s): Act on Electronic Communications
Requirements for providing communication services and technical requirements for communications networks
Statute for the security commission of the Government of the Republic
11. Yes
12. The Draft Regulation on the security of communications networks does not set technical conditions. The Draft Regulation lays down the obligation to apply for a licence for the use of hardware and software used in the communications network, and a notification obligation. For the Estonian Government, it is important that the regulation on the security of communications networks enter into force as soon as possible for the following reasons:
- For Estonia, it is essential that the security of 5G networks is guaranteed before frequency licences are granted. The conditions for the security of communications networks shall enter into force before the invitation to tender for 5G frequency licences. In 2020, the State has moved forward in terms of the invitation to tender for frequency licences: a public consultation has been organised and applications have been submitted for participation in the tender, but the tendering procedure cannot be opened before the entry into force of this regulation.
- The entry into force of the regulation is necessary in order to guarantee the security of the communications network, which is a critical service. The State is obliged to guarantee that communications networks be based on reliable technology, the use of which does not result in a situation where the State cannot guarantee the protection of the fundamental rights and freedom of its citizens, such as privacy, the secrecy of communications and intellectual property. Should security threats due to high-risk technology be realised, those in the weakest position will be end-users or ordinary citizens, who cannot take action to guarantee their personal cyber security in a situation where communications networks have been built in an untrustworthy or vulnerable manner.
- The entry into force of the Regulation is necessary in order to give communications operators foresight in their choice of investments and suppliers. Through the ex-ante licence obligation laid down in the Regulation, communications operators may, before making an investment, ensure that it is in harmony with state security interests.
13. No
14. No
15. Yes
16. TBT aspect
No – the draft is neither a technical regulation nor a conformity assessment.
SPS aspect
No - the draft is neither a sanitary nor a phytosanitary measure.
**********
European Commission
Contact point Directive (EU) 2015/1535
Fax: +32 229 98043
email: grow-dir2015-1535-central@ec.europa.eu
