It should be noted that on October 14, 2024, the IEC requested that the parties' agreements in clause 5.3 of the settlement regarding the implementation of an opt-in mechanism for managing cookies on the Company's website be postponed with the Applicant's consent until the first quarter of 2025 due to the delay in submitting the position of the professional entities to the Settlement.
In addition, by the end of 2024, the IEC will appoint a Data Protection Officer (DPO), who will be responsible, inter alia, for monitoring compliance with the provisions of the relevant privacy protection law; conducting risk surveys and auditing information security and privacy protection; advising the company's management on all matters related to the provisions of the law; and the company's liaison with the relevant authorities.
During a period of 36 months from the date of submission of the application, the IEC will begin to conduct penetration tests for the database systems to examine their resistance to internal and external risks in accordance with Regulation 5(d) of the Privacy Protection Regulations (Information Security), 5777-2017 – instead of once every 18 months as stipulated in the said Regulation 5(d), once every 12 months, so that the initial penetration tests will begin in the first quarter of 2024, and the second penetration tests will begin in the first quarter of 2025. And the third penetration tests will begin in the first quarter of 2026. In other words, during the 36 months from the date of submission of the application, the IEC will begin to perform penetration tests to the reservoir's systems three times (instead of twice). After this period, the IEC will operate in accordance with the aforementioned Regulation 5(d) in accordance with its provisions and the time frames set therein.
The IEC will send all of its customers, together with the statement of account sent to its customers, information on privacy and cyber protection for one year from the date of the settlement, which is defined in the settlement as 3 business days from the time the judgment becomes final. The information will be drafted by the IEC.