Requirements for telecom providers

Are you a provider of public (electronic) telecommunications networks or telecommunications services in the Netherlands? You provide, for example networks or services such as:

• landline or mobile telephony
• internet access or an internet network
• messaging services
• email or webmail services
• video conferencing services
• internet telephony

Then you must register with the ACM. You must make sure your networks and services work properly at all times and are secure (in Dutch). Users must also be able to trust that communications are genuinely coming from the sender (authenticity).

Registering as a telecom provider with the ACM

Do you provide telecom services in the Netherlands? You must register with the Authority for Consumers and Markets (ACM, in Dutch). You have to register if you:

• provide public electronic communications networks, such as wired and wireless networks, or networks for radio and television broadcasting
• provide public electronic communications services, such as telephony
• build or provide facilities that go with these, such as electrical conduits or satellites

You do not have to register with the ACM if you only engage in activities on behalf of a registered telecom provider. For example, if you only offer messaging services, webmail services, video conferencing services, or internet telephony.

Registration is free of charge. If your company is registered, you pay an annual fee. Is your annual turnover from telecom activities less than €2 million? Then you do not pay a fee. You must provide your net annual turnover from 2 years earlier to the ACM (in Dutch).

Solving and reporting interruptions or failures

You must make sure your services and networks are always functional and secure, and do not break down (continuity responsibility). You must take measures, such as encryption and backups, to prevent security issues.

If there is a malfunction or other incident, you need to:

• do everything in your power to restore your services
• report the interruption or security issue to the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur).

You must make sure the emergency number 112 can be reached at all times. You must also make sure your customers can receive the NL-Alert warning system’s messages at all times.

Compensation in case of interruptions

If there is an interruption in internet, television, or telephony services that lasts longer than 12 hours, for instance as a result of technical failure, you must compensate your customers (in Dutch).

Security of communication data

You must secure all telecommunications data, such as data from telephony and internet. Employees who have access to sensitive data must have a certificate of conduct (VOG). You as the owner need a certificate of conduct for legal entities (VOG RP).

Protecting privacy

Traffic and location data are privacy sensitive data. You have to delete or anonymise traffic and location data as soon as these are no longer needed for the transmission of a communication.

You are allowed to use these data for legal obligations, such as investigating telephone calls from scammers, or for business purpose, for example, to write an invoice. You are only allowed to use this data for business purposes if you let your subscriber or user know which data you process and for how long you keep the data.

In some cases you must have your subscriber’s or user’s consent before you start processing the data, for example for market research. Subscribers and users must be able to revoke their consent easily and freely.

Reporting a data leak

Did you experience a security breach where personal data has been leaked? You must report this to the Dutch Data Protection Authority (Dutch DPA, in Dutch)

Submitting client details

A number of government organisations such as judicial authorities, and investigation, intelligence and security services may request information about one of your clients. You may also receive a request for the wiretapping and handing over of telephone communications for criminal investigations. You must ensure that this is possible.

If you are a telecom or internet service provider, you must join the Central Telecommunications Research Information Point (Centraal Informatiepunt Onderzoek Telecommunicatie, CIOT, in Dutch). You provide the CIOT with an updated file of your subscribers with personal data that belongs to IP addresses every 24 hours. You will receive a fee from the government for this.

Net neutrality

As a provider of public telecommunications networks or telecommunications services in the Netherlands you may not delay or block competitive telephone or internet services and applications. You are also not allowed to charge extra money for these services or applications. This is called net neutrality.

In some cases you may block or restrict internet access (in Dutch). For instance, to prevent overload of the network, to stop the spreading of malicious software, or if a law bans a certain website, app, or internet service. In such cases you can block a type of service, such as video services, to make sure other services can keep working. You have to describe how you deal with such issues in the contract.

Reporting telecommunications company takeovers

You are not allowed to sell you telecommunications company to an unreliable, untrustworthy, or criminal company. Such a party also cannot have power of control in your company.

Do you want to purchase Dutch telecom facilities? Then you should report first to the Ministry of Economic Affairs (Ministerie van Economische Zaken, EZ, in Dutch). To secure continuity and reliability of service and to safeguard public interests the government can prohibit or reverse such a takeover (in Dutch). The duty to report concerns takeovers of:

• suppliers of telephone and internet networks with more than 100,000 users in the Netherlands
• hosting services with more than 400,000 .nl domain names
• internet hubs with more than 300 autonomous connected systems
• data centres with an electric capacity of over 50 megawatts (MW)
• certification services (qualified trust services)
• companies that offer services or a network to government organisations concerned with national security

Dispute resolution

Do you as a telecom provider have a problem (dispute) with a customer, municipality, or another telecom provider? Then you can ask the Authority for Consumers & Markets (ACM) to decide on the issue. This is called dispute resolution (geschilbeslechting, in Dutch).