Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-4202 size-medium" src="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/07/bigstock-Software-Protection-4430456-300x225.jpg" alt="Software protection" width="300" height="225" />The European Union continues to move forward with a proposed unified framework to strengthen network and information security systems across its member countries. On <a href="http://www.eu2015lu.eu/en/actualites/communiques/2015/12/21-coreper-cybersecurity/index.html">December 18, 2015</a>, the Permanent Representatives Committee (Coreper) approved a provisional agreement reached on <a href="http://www.consilium.europa.eu/en/press/press-releases/2015/12/08-improve-cybersecurity/">December 7, 2015</a>, by the European Parliament and European Council on the Network and Information Security Directive (“Cybersecurity Directive”). The Cybersecurity Directive, which was first proposed in 2013, sets forth a multifaceted approach to preventing and responding to cybersecurity incidents by regulated public and private entities. Following the initial proposal, EU member states debated the applicable scope of the Cybersecurity Directive. However, the recent provisional agreement provides a set of clear criteria and requirements for enhancing cybersecurity and addresses two types of entities to be regulated: “operators of essential services” and “digital service providers.” The Cybersecurity Directive would therefore regulate <a href="http://www.europarl.europa.eu/news/en/news-room/20151207IPR06449/MEPs-close-deal-with-Council-on-first-ever-EU-rules-on-cybersecurity">online marketplaces such as eBay and Amazon and search engines such as Google</a> but would provide an exemption for micro and small digital providers.

The Cybersecurity Directive requires member states to adopt its outlined cooperative strategy for regulatory measures for cybersecurity within the EU, to create a computer security incident response team for EU nations to address and respond to cross-border security incidents, and to establish a unified strategic cooperation group to encourage member states to exchange information.

The Cybersecurity Directive sets up guidelines for companies that are “operators of essential services” within the energy, transport, banking, financial market infrastructure, health, water and digital infrastructure sectors. There are three criteria that bring a company within the definition: first, the company provides a service critical for society and the economy; second, the service depends on network and information systems; and third, a cybersecurity incident could have significant disruptive effects on service provision or public safety. Once the companies that provide these critical services are identified, the Cybersecurity Directive would require them to report major security breaches as well as implement minimum standard measures to resist cyber attacks.

The Cybersecurity Directive is expected to enhance cooperation among the member nations of the European Union and increase citizen confidence in network security. The agreement must go through a finalization process that includes formal approval by the European Parliament. This process is expected to conclude in spring 2016, and will provide member nations with 21 months to enact the necessary legislation and an additional six months to identify the “operators of essential services” and “digital service providers” covered by the Cybersecurity Directive.

EU’s Network and Information Security Directive: Regulating “operators of essential services” and “digital service providers”