EC proposes new measures to boost cybersecurity and flow of data in EU

The European Commission (EC) has proposed a wide-ranging set of measures to beef up cybersecurity in the EU, which include a set of tools to ensure Europe and its organisations are better equipped to deal with cyberattacks. The EC has also put forward new rules to facilitate free flow of non-personal data across the EU and create a digital single market. The cybersecurity measures include a stronger EU Cybersecurity Agency, a new European certification scheme to ensure products and services are secure in the digital world, and measures to combat fraud and counterfeiting of non-cash payment. "In the past three years, we have made progress in keeping Europeans safe online. But Europe is still not well equipped when it comes to cyberattacks. This is why the Commission is proposing new tools, including a European Cybersecurity Agency, to help defend us against such attacks,” said EC president Jean-Claude Juncker in his annual state of the union address last week. Last year, there were more than 4,000 ransomware attacks per day in the EU and 80% of European companies experienced at least one cybersecurity incident. The economic impact of cybercrime has risen five-fold during the past four years alone. Details on the EU’s proposals to improve cybersecurity were fleshed out this week. The EU plans to create a new and more powerful Cybersecurity Agency by building on the existing European Agency for Network and Information Security. The revamped agency will be given a permanent mandate to assist EU member states in effectively preventing and responding to cyberattacks. It will improve the EU's ability to react by organising yearly pan-European cybersecurity exercises and ensuring better sharing of threat intelligence and knowledge, by creating Information Sharing and Analyses Centres. The agency will help implement the Security of Network and Information Systems directive, which contains reporting obligations for national authorities when serious cyber incidents occur. The Cybersecurity Agency would also help put in place and implement the newly-proposed EU-wide certification framework to ensure that products and services are cyber secure. “Just as consumers can trust what they eat thanks to EU food labels, new European cybersecurity certificates will ensure the trustworthiness of the billions of devices which drive today's critical infrastructures, such as energy and transport networks, but also new consumer devices, such as connected cars,” said the EC. Cybersecurity certificates would be recognised across EU member states and therefore reduce the administrative burden and cost for companies. The EU is proposing to increase its cybersecurity capacity through a variety of other measures. It plans a European Cybersecurity Research and Competence Centre and will pilot the scheme during 2018. The European Cybersecurity Research and Competence Centre will work with member states to develop and roll out the tools and technology needed to keep pace with the ever-changing cyber threat, and make sure defences are as state of the art as the weapons used by cybercriminals, explained the EC. The proposed centre will complement capacity-building efforts at EU and national level. The EU has also put forward a blueprint for how Europe and its member states can respond quickly, operationally and in unison when a large-scale cyberattack strikes. The recommendations will see member states and EU institutions establish an EU Cybersecurity Crisis Response Framework. There is also the possibility of a new Cybersecurity Emergency Response Fund for those member states that have responsibly implemented all cybersecurity measures required under EU law. “The fund could provide emergency support to help member states – just as the EU's Civil Protection Mechanism is used to help with cases of forest fires or natural disasters,” said the EC. The EC’s proposals include plans for stronger cyber defence capabilities and enhanced international cooperation. “Member states are encouraged to include cyber defence within the Framework of Permanent Structured Cooperation and the European Defence Fund, to support cyber defence projects. The European Cybersecurity Research and Competence Centre could also be further developed with a cyber defence dimension,” explained the EC. To address a skills gap in cyber defence, the EU will create a cyber defence training and education platform in 2018. Additionally, the EU and NATO will foster cyber defence research and innovation cooperation and work more closely on all cyber issues, added the EC. The EU is also planning a new directive to deliver more effective and stringent prosecution for cyberfraud and counterfeiting of non-cash means of payment. “The proposed directive will strengthen the ability of law enforcement authorities to tackle this form of crime, by expanding the scope of the offences related to information systems to all payment transactions, including transactions through virtual currencies. The law will also introduce common rules on the level of penalties and clarify the scope of member states' jurisdiction in such offences,” said the EC. To step up effective investigation and prosecution of cyber-enabled crime, the EC will also look at ways to facilitate cross-border access to electronic evidence in early 2018. Mariya Gabriel, European commissioner for the digital economy and society, said: "We need to build on the trust of our citizens and businesses in the digital world, especially at a time when large-scale cyberattacks are becoming more and more common. I want high cybersecurity standards to become the new competitive advantage of our companies." The EC is also proposing a new set of rules to govern the free flow of non-personal data in the EU, to unlock the full potential of the EU data economy. Along with existing EU rules for personal data, the new measures will enable the storage and processing of non-personal data across the bloc, to boost the competitiveness of European businesses and modernise public services in an effective EU single market for data services. The framework proposes free flow of non-personal data across borders. Member states could no longer oblige organisations to locate the storage or processing of data within their borders. Restrictions would only be justified for reasons of public security and member states would have to notify the EC of new or existing data localisation requirements. “The free flow of non-personal data will make it easier and cheaper for businesses to operate across borders, without having to duplicate IT systems or to save the same data in different places,” said the EC. Under the proposals, competent authorities will be able to exercise their rights of access to data wherever it is stored or processed in the EU. The free flow of non-personal data will not affect the obligations for businesses and other organisations to provide certain data for regulatory control purposes. The new scheme would introduce new EU codes of conduct to remove obstacles to switching between service providers of cloud storage and porting data back to users' own IT systems. The EC said the data proposals would benefit both business and European citizens. “The new rules will increase legal certainty and trust for businesses and organisations. They will also clear the way for a truly EU single market in data storage and processing, leading to a competitive, safe and reliable European cloud sector and to lower prices for users of data storage and processing services. As the aim of the new rules is to increase trust, companies are expected to use more cloud services and to feel reassured when entering new markets. They will also be able to move their in-house IT resources to the most cost-effective locations. Ultimately, this means an estimated additional growth of EU GDP by €8bn per year,” said the EC. Andrus Ansip, vice-president for the digital single market, said: "Europe's digital economy is still strongly split along closed national lines. This is holding Europe back from its broader digital growth. Our proposal, together with EU personal data protection rules, will enable the free movement of all types of data in the single market. The free flow of data will make it easier for SMEs and startups to develop new, innovative services and to enter new markets.”

EC proposes new measures to boost cybersecurity and flow of data in EU

Want to read this article?

Read Next

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Want to read this article?

Read Next

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Related Articles