Agency and which occurred when fulfilling obligations set out under this Act and in selected areas
governed by the Act on the Protection of Classified Information and on Security Eligibility.
Section 24c
The obligation of confidentiality legally imposed on the members of the supervisory body shall not be
applicable to cases when the supervisory body submits the information according to Section 24b,
paragraph 2.
Administrative offences
Section 25
(1)
An electronic communication service provider and an entity operating an electronic
communications network or a public authority or legal or natural person administrating an
important network commits an offence by:
a) Not fulfilling an obligation imposed by the Agency´s decision or in a measure of general
nature according to Section 13 under the state of cyber emergency or
b) Not fulfilling all of the obligations imposed under a corrective measure according to
Section 24.
(2)
An operator and an administrator of an information or communication system of a critical
information infrastructure information system, or an operator and an administrator of an
important information system commits an offence by:
a) Not introducing or implementing security measures, or not keeping security documentation
records contrary to Section 4, paragraph 2
b) Not reporting a cyber security incident according to Section 8, paragraphs 1 and 4
c) Not fulfilling an obligation imposed by the Agency´s decision or in a measure of general
nature according to Section 13 or 14
d) Not fulfilling the obligation imposed by the Agency´s decision according to Section 15a,
paragraph 1
e) Not transferring data, operational data and information according to Section 6a, paragraph 2
f)
Not transferring data, operational data and information according to Section 6a, paragraph 3
g) Not destroying the copies of data, operational data and information according to Section 6a,
paragraph 3
h) Not allowing the administrator to supervise the destruction of data, operational data and
information according to Section 6a, paragraph 3
i)
Not notifying the Agency of the contact details or a change to them according to Section 16,
paragraph 2, letter b) or
j)
Not fulfilling all of the obligations imposed under a corrective measure according to
Section 24