{ "object_type": "card", "schema_version": 1, "id": "card:eu:article:eprivacy--art-4", "core": { "id": "card:eu:article:eprivacy--art-4", "subject": "eu:eprivacy--art-4", "act": "eprivacy", "article": "4", "rule": [ { "role": "service-provider", "duty": "Take appropriate technical and organisational measures to safeguard the security of the service and notify personal data breaches to the competent national authority." } ], "authority": { "sanctioning": [], "supervisors": [ { "name": "IMY: Sweden", "url": "https://www.imy.se/" }, { "name": "Datatilsynet: Norway", "url": "https://www.datatilsynet.no/" } ] }, "timeline": { "in_force": "2002-07-31", "applies": "2003-10-31", "deadlines": [ { "obligation": "obligation:eu:eprivacy-art-4-service-provider", "hours": 24, "days": null, "note": "Initial notification within 24 hours of detection (Regulation (EU) No 611/2013)" } ] }, "provenance": { "source": "Directive 2002/58/EC (ePrivacy)", "source_url": "https://eur-lex.europa.eu/eli/dir/2002/58/oj", "eur_lex": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002L0058", "read_at": "2026-08-31" } }, "core_hash": "02fcd5c9b246b926352e7cc6b12f1dbc0de6936225b26558897cafb11d47a79a", "extended": { "outcome": { "scope": "act", "sample_size": 39, "distribution": [ { "outcome": "interpretation", "count": 9, "share": 0.231 }, { "outcome": "permits", "count": 9, "share": 0.231 }, { "outcome": "does_not_preclude", "count": 8, "share": 0.205 }, { "outcome": "precludes", "count": 8, "share": 0.205 }, { "outcome": "holding", "count": 3, "share": 0.077 } ] }, "action_kit": [ { "step": 1, "role": "service-provider", "do": "Take appropriate technical and organisational measures to safeguard the security of the service and notify personal data breaches to the competent national authority." } ], "timeline_dated": [ { "date": "2003-10-31", "kind": "transposition", "article": null, "what": "The national rules on consent for storing and reading information on a device were to be in force.", "who": "Every operator of a website or service that stores or reads information on a visitor's device." } ], "affected_parties": [ { "role": "service-provider" } ], "documentation_requirements": [ { "kind": "report", "role": "service-provider", "provision": "eprivacy 4", "retention": null, "obligation": "obligation:eu:eprivacy-art-4-service-provider" } ], "risk_if_ignored": "not_in_register", "related_rules": [ "card:eu:article:eprivacy--art-13", "card:eu:article:eprivacy--art-5", "card:eu:article:eprivacy--art-6", "card:eu:article:eprivacy--art-9" ], "related_cases": { "total": 2, "by_jurisdiction": { "eu": 2 }, "readable": [ "eu:62018cj0511", "eu:c-623-17-62017cj0623" ] }, "precedent": { "leading": "eu:62018cj0511", "judgments_in_register": 2 }, "comparison_objects": [ { "jurisdiction": "SE", "kind": "transposition", "instrument": "Lag om elektronisk kommunikation", "identifier": "SFS 2022:482", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2022482-om-elektronisk-kommunikation_sfs-2022-482/" }, { "jurisdiction": "NO", "kind": "transposition", "instrument": "Lov om elektronisk kommunikasjon (ekomloven)", "identifier": "LOV-2024-12-13-76", "url": "https://lovdata.no/dokument/NL/lov/2024-12-13-76" }, { "jurisdiction": "DE", "kind": "transposition", "instrument": "Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz", "identifier": "TDDDG", "url": "https://www.gesetze-im-internet.de/tddsg/" }, { "jurisdiction": "UK", "kind": "transposition", "instrument": "The Privacy and Electronic Communications (EC Directive) Regulations 2003", "identifier": "SI 2003/2426", "url": "https://www.legislation.gov.uk/uksi/2003/2426/contents" }, { "jurisdiction": "FI", "kind": "transposition", "instrument": "Laki sähköisen viestinnän palveluista", "identifier": "917/2014", "url": "https://www.finlex.fi/fi/laki/ajantasa/2014/20140917" } ], "change_history": [ { "day": "2026-08-31", "type": "rechecked", "event": "Raden läst mot EUR-Lex utan ändring", "hash_after": "34fb898fd4ea183b" }, { "day": "2003-10-31", "type": "changed", "event": "Sista dag för genomförande i nationell rätt", "hash_after": "34fb898fd4ea183b" }, { "day": "2002-07-31", "type": "added", "event": "Rättsakten trädde i kraft enligt CELEX 32002L0058", "hash_after": "34fb898fd4ea183b" } ] }, "links": [ { "id": "obligation:eu:eprivacy-art-4-service-provider", "type": "obligation", "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:eprivacy-art-4-service-provider" }, { "id": "eu:62018cj0511", "type": "judgment", "url": "https://legal.exploreworldai.com/eu/praxis/62018cj0511" }, { "id": "eu:c-623-17-62017cj0623", "type": "judgment", "url": "https://legal.exploreworldai.com/eu/praxis/c-623-17-62017cj0623" }, { "id": "card:eu:article:eprivacy--art-13", "type": "card", "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:eprivacy--art-13" }, { "id": "card:eu:article:eprivacy--art-5", "type": "card", "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:eprivacy--art-5" }, { "id": "card:eu:article:eprivacy--art-6", "type": "card", "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:eprivacy--art-6" }, { "id": "card:eu:article:eprivacy--art-9", "type": "card", "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:eprivacy--art-9" }, { "id": "timeline:eu:eprivacy", "type": "timeline", "url": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:eprivacy" }, { "id": "page:/eu/rattsakter/eprivacy-2002-58/artikel-4", "type": "page", "url": "https://legal.exploreworldai.com/eu/rattsakter/eprivacy-2002-58/artikel-4" } ], "link_count": { "total": 9, "public": 9, "meets_target": true }, "next_questions": { "items": [ { "question": "What does Article 13 EPRIVACY require?", "card": "card:eu:article:eprivacy--art-13", "type": "article", "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:eprivacy--art-13&view=compact" }, { "question": "What does Article 5 EPRIVACY require?", "card": "card:eu:article:eprivacy--art-5", "type": "article", "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:eprivacy--art-5&view=compact" }, { "question": "What does Article 6 EPRIVACY require?", "card": "card:eu:article:eprivacy--art-6", "type": "article", "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:eprivacy--art-6&view=compact" }, { "question": "What does Article 9 EPRIVACY require?", "card": "card:eu:article:eprivacy--art-9", "type": "article", "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:eprivacy--art-9&view=compact" } ], "count": 4, "meets_target": true }, "method": "Composed with fixed rules from the obligation, sanction, action kit, timeline, documentation, outcome, judgment reference, national implementation and change journal registers. Missing fields are not_in_register.", "attribution": "Source: NovaCopilot", "withheld": { "links_full": 9 }, "access": { "status": "partner_key_required", "header": "x-partner-key", "contact": "https://legal.exploreworldai.com/kontakt", "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot." }, "access_class": "decision", "access_view": "public" }