(1) An undertaking providing a publicly available electronic communications service shall take appropriate technical and organisational measures to safeguard the security of its services, if necessary in conjunction with undertakings upon whose networks such services are transmitted with respect to network security. These measures shall ensure the level of security appropriate to the risk presented, having regard to the state of the art and the cost of their implementation.
(2) In the case of a particular risk of a breach of the security of the public communications network, the undertaking providing the publicly available electronic communications service shall inform its subscribers concerning such risk without delay and where the risk lies outside the scope of the measures to be taken by the relevant service provider, any possible remedies including an indication of the likely costs involved.
(3) An undertaking whose public communications network is used by another undertaking