Document Generated: 2022-06-22 Status: This is the original version (as it was originally made). (i) the number of users affected by the incident and, in particular, the users relying on the digital service for the provision of their own services; (ii) the duration of the incident; (iii) the geographical area affected by the incident; (iv) the extent of the disruption to the functioning of the service; (v) the extent of the impact on economic and societal activities; and (b) assess whether at least one of situations described in Article 4 of EU Regulation 2018/151 has taken place. (8) After receipt of a notification under paragraph (3) the Information Commissioner must share the incident notification with the CSIRT as soon as reasonably practicable. (9) If an OES is reliant on a RDSP to provide an essential service, the operator must notify the relevant competent authority in relation to it about any significant impact on the continuity of the service it provides caused by an incident affecting the RDSP as soon as it occurs. (10) If an incident notified under paragraph (3) affects two or more Member States, the Information Commissioner must inform the relevant authorities in each of the affected Member States about that incident as soon as reasonably practicable. (11) The Information Commissioner is not required to share information under paragraph (9) if the information contains— (a) confidential information; or (b) information which may prejudice the security or commercial interests of a RDSP. (12) If the Information Commissioner or CSIRT— (a) consults with the RDSP responsible for an incident notification under paragraph (3), and (b) is of the view that public awareness about that incident is necessary to prevent or manage it, or is in the public interest, the Information Commissioner or CSIRT may inform the public about that incident or direct the RDSP responsible for the notification to do so. (13) Before the Information Commissioner or CSIRT informs the public about an incident notified under paragraph (3), the Information Commissioner or CSIRT must consult each other and the RDSP who provided the notification. (14) The Information Commissioner may inform the public about an incident affecting digital services in another Member State if— (a) the relevant authorities in the affected Member State notify the Information Commissioner about the incident; (b) the Commissioner consults with those relevant authorities; and (c) the Commissioner is of the view mentioned in paragraph (11)(b). (15) The Information Commissioner must provide an annual report to the SPOC identifying the number and nature of incidents notified to it under paragraph (3). (16) The first report mentioned in paragraph (15) must be submitted on or before 1st July 2018 and subsequent reports must be submitted at annual intervals after that date. (17) In this regulation “EU Regulation 2018/151” means Commission Implementing Regulation (EU) 2018/151 laying down rules for the application of Directive (EU) 2016/148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account 12