This section applies where there is a significant risk of a security compromise occurring in relation to a public electronic communications network or a public electronic communications service.
The provider of the network or service must take such steps as are reasonable and proportionate for the purpose of bringing the relevant information, expressed in clear and plain language, to the attention of persons who use the network or service and may be adversely affected by the security compromise.
The relevant information is—
the existence of the risk of the security compromise occurring;
the nature of the security compromise;
the technical measures that it may be reasonably practicable for persons who use the network or service to take for the purposes of—
preventing the security compromise adversely affecting them;
remedying or mitigating the adverse effect that the security compromise has on them; and
the name and contact details of a person from whom further information may be obtained about the security compromise.