Articles

The new EU Network and Information Systems Directive has entered in force

The new EU Network and Information Systems Directive has entered in f

The new EU Network and Information Systems Directive has entered in force

13.10.2016

The NIS (network and information systems) Directive was adopted on 6 July 2016 and entered into force on 8 August 2016. This is the first European-wide legislation on cybersecurity.

Andrus Ansip, the EU Commission Vice- President for the Digital Single Market declared, “If we want people and businesses to make the most of digital services, they need to trust them. A Digital Single Market can only be created in a secure online environment.” The Directive aims to generate a global approach towards cybersecurity in Europe based on common, minimum capacity-building and planning requirements, exchange of information, cooperation, and common security and notification requirements for operators of essential services and digital service providers. To these ends, the NIS Directive also set up two working groups: (i) the Cooperation Group to facilitate cooperation and exchange of information between Member States and (ii) a network of computer security incident response teams (a “CSIRTs network”).

The NIS Directive applies to both digital service providers and operators of essential services. The latter will have to be identified by Members States and can be private or public entities operating in the following industries: energy, transportation, banking and financial markets, health care, drinking water supply and distribution, and digital infrastructure. Digital service providers include online market places (e.g. e-commerce platforms), cloud computing services, and online search engines. Because digital service providers bear a lesser risk than operators of essential services, the security obligations imposed on them are lighter. It is also worth mentioning that hardware manufacturers and software developers do not qualify as operators of essential services. In addition, micro- and small-enterprises do not have to abide by the requirements imposed on digital service providers, although they would qualify as such.

A Member State will have jurisdiction over the operators of essential services that it will have identified as such, as well as over digital service providers having their main establishment in this Member State, i.e. generally if the provider has its head office in that country. A digital service provider based outside the EU can also fall under the scope of the NIS Directive if it offers services within the EU (the mere accessibility in the EU of the service offered or an intermediary’s website being not sufficient). In such scenario, this non-EU entity will have to designate a representative in the Member State where it offers its services.

Member States have now up to 9 May 2018 to implement in their national laws the provisions of the NIS Directive. Companies should, as from now, get themselves prepared and ask themselves whether they fall under the scope of the NIS Directive. If they do, they should start reviewing their security processes and follow the implementing laws and practical guidance closely that will be adopted in their respective countries.

Team

Related news

22.02.2019 BE law
Sarah De Wulf on challenges of SAP contracts and indirect use during a Beltug seminar.

Speaking slot - Sarah De Wulf, junior TMT associate, discusses SAP licensing agreements during a Beltug seminar on 20 February 2019. Many of the Beltug members are customers of SAP and face daily questions and challenges regarding SAP's software licensing policies.  These questions include (among others): how the licence models will evolve (especially in terms of the growth of cloud services) and how to cope with indirect access.

Read more

18.02.2019 NL law
Brexit and data protection: preparing for a 'no-deal'

Short Reads - As it stands, the UK will exit the European Union at midnight on 29 March 2019. Therefore, businesses within the UK, or with trade relations with the UK, would be best advised to assume that a no-deal Brexit is inevitable. The exchange of personal data  within the EU is governed by the General Data Protection Regulation (GDPR). In a no-deal Brexit, the GDPR will cease to be applicable in the UK upon its EU exit.

Read more

18.02.2019 EU law
Erik Valgaeren moderates a panel on Data Governance and Compliance during IBA's Silicon Beach Conference

Speaking slot - The discussion topic will cover various legal aspects relating to data lifecycle management, both for personal and non personal data. These aspects will include rights in and obligations regarding data, such retention obligations and portability rights. Practical suggestions on holistic data management and the role of the chief data officer will be debated.

Read more

Our website uses cookies: third party analytics cookies to best adapt our website to your needs & cookies to enable social media functionalities. For more information on the use of cookies, please check our Privacy and Cookie Policy. Please note that you can change your cookie opt-ins at any time via your browser settings.

Privacy – en cookieverklaring