R2.7 Ensure that the private sector applies security measures to establish trust in e-commerce services, including informing users of the utility of deployed security solutions. USER UNDERSTANDING OF PERSONAL INFORMATION PROTECTION ONLINE R2.8 Promote the understanding of protection of personal information online among users and promote the development of their skills to manage their privacy online. R2.9 Encourage a public debate regarding the protection of personal information and about the balance between security and privacy to inform policy-making. R2.10 Promote the compliance to web standards that protect the anonymity of users. R2.11 Promote data protection by default and by design as a tool for transparency. R2.12 Develop user-consent policies designed to notify practices on the collection, use or disclosure of sensitive personal information. R2.13 Establish reporting mechanisms for reporting online fraud, cyber-bullying, child abuse online, identity theft, privacy and security breaches, and other incidents in accordance with GDPR, NIS directive. R2.14 Encourage different stakeholders (public-private sector, Police, DPA, CERTIS) to coordinate the reporting mechanisms and their roles and responsibilities, and to collaborate and share good practices to improve the mechanisms. R2.15 Establish awareness programmes to promote the regular use of reporting mechanisms by public and private sectors, and their use as an investment in loss prevention and risk control. R2.16 Establish awareness programmes to promote cyber security and data protection in the public sphere as well as within private entities that 38 | Cybersecurity Capacity Review Iceland, 2017