L 173)2 Official Journal of the European Union 26.6.2013 REGULATIONS COMMISSION REGULATION (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) ('), and in particular Article 4(5) thereof, Having consulted the European Network and Information Security Agency (ENISA), Having consulted the Working Party on the Protection of Indi- viduals with regard to the Processing of Personal Data estab- lished by Article 29 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (%) (the Article 29 Working Party), Having consulted the European Data Protection Supervisor (EDPS), Whereas: (1)  Directive 2002/58/EC provides for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the Union. (2)  Under Article 4 of Directive 2002/58/EC, providers of publicly available electronic communications services are obliged to notify the competent national authorities, and in certain cases also the subscribers and individuals concerned, of personal data breaches. Personal data breaches are defined in Article 2(i) of Directive 2002/58/EC as breaches of security leading to the accidental or wunlawful destruction, loss, alteration, () OJ L 201, 31.7.2002, p. 37. () OJ L 281, 23.11.1995, p. 31. ) unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service in the Union. In order to ensure consistency in implementation of the measures referred to in Article 4(2), (3) and (4) of Directive 2002/58/EC, Article 4(5) thereof empowers the Commission to adopt technical implementing measures concerning the circumstances, format and procedures applicable to the information and notification requirements referred to in that Article. Different national requirements in this regard may lead to legal uncertainty, more complex and cumbersome procedures and significant administrative costs for providers operating cross-border. The Commission therefore considers it necessary to adopt such technical implementing measures. This Regulation is limited to the notification of personal data breaches and therefore does not set out technical implementing measures concerning Article 4(2) of Directive 2002/58/EC on informing the subscribers in case of a particular risk of a breach of the security of the network. It follows from the first subparagraph of Article 4(3) of Directive 2002/58/EC that providers should notify to the competent national authority all personal data breaches. Therefore, no discretion should be left to the provider whether or not to notify to the competent national auth- ority. However, this should not prevent the competent national authority concerned from prioritising the inves- tigation of certain breaches in the way it sees fit in accordance with the applicable law, and to take steps as necessary to avoid over- or under-reporting of personal data breaches. It is appropriate to provide for a system for the notifi- cation of personal data breaches to the competent national authority, which consists, where certain conditions are fulfilled, of various stages, each subject to certain time limits. This system is meant to ensure that the competent national authority is informed as early and as fully as possible, without however unduly hindering the provider in its efforts to investigate the breach and to take the necessary measures to confine it and remedy the consequences thereof.