5) A Subscriber whose SIM Card, built-in SIM Card telephone or SIM-enabled mobile communication equipment or device has been deactivated may resubmit a new request for registration of the same number subject to availability. 21. Replacement of a Lost, Stolen, or Damaged SIM Card A Telecommunications Operator shall replace a lost, stolen, or damaged SIM Card upon verification of the original registration and ownership of the SIM Card. 22. Requirement to Submit Quarterly Reports on Deactivated Accounts A Telecommunications Operator shall submit quarterly reports to the Authority of the record of deactivated and suspended Subscribers and shall update the Telecommunications Operator’s Database accordingly. PART SIX DISPUTE RESOLUTION 23. Right to Dispute the Authority’s Findings 1) A Telecommunications Operator has the right to dispute any fine imposed by the Authority by submitting the decision review request in writing to the Authority within seven (7) working days from the date of the imposed fine. 2) Following the written request, the Authority shall respond to the Telecommunications Operator not later than twenty (20) working days whether: a) The Authority requires additional information from the Telecommunications Operator prior to reaching a decision; b) The Authority has accepted the Telecommunications Operator’s appeal; or, c) The Authority has denied the Telecommunications Operator’s request and shall inform the Telecommunications Operator’s rights to seek resolution of the dispute in accordance with the procedures established in the Authority’s Dispute Resolution Directive. PART SEVEN SECURITY AND CONFIDENTIALITY OF SUBSCRIBERS’ REGISTRATION DETAILS 24. Security and Confidentiality of Subscriber Information A Telecommunications Operator shall: 1) Take all reasonable steps to ensure the security and confidentiality of its Subscribers’ registration details; 2) Notify the Authority of the steps taken and processes introduced to ensure the security and confidentiality of its Subscribers’ registration details within thirty (30) days after this Directive comes into force; 3) Verify the accuracy and authenticity of information related to a Subscriber’s details contained in its Operator’s Database as required by the Authority from time to time; 4) Update the Authority, on a monthly basis, of any Subscriber changes to the Operator’s Database; 5) Notify the Authority of any data breach that compromises Subscriber information within seven (7) working days from the discovery of the breach; and, 9