Sunday

25th Jul 2021

EU countries miss cybersecurity deadline

  • EU member states agreed in 2016 to an EU directive aimed at prevent hackers disrupting essential public services (Photo: Santiago Zavala)

European Union member states agreed in 2016 to take measures to prevent cyber attacks from disrupting essential services, like railway traffic control services or water suppliers.

However, a majority of EU member states missed the deadline to transpose the EU directive into national law.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

Moreover, it is unclear to what extent a specific measure – concerning fines for breaking the new cybersecurity rules – has been implemented.

The 'directive concerning measures for a high common level of security of network and information systems across the union' – NIS directive for short – was adopted on 6 July 2016 after three years of negotiations.

Representatives of the EU's 28 national government unanimously approved the text.

However, some of those same governments now appear to have reneged on what they promised.

According to the directive, member states need to identify, before 9 November 2018, which organisations connected to the internet provide vital services to the public.

They also need to make sure that the operators of these so-called essential services do everything in their power to manage the risks of being hacked – and report to the authorities if there is a cybersecurity breach.

Member states were also required to tell the European Commission, by 9 May this year, how they would punish any infringements.

The same day, EUobserver filed an access to documents request, asking the EU executive which member states had complied with the penalties notification requirement.

As often, the EU directive has left it to member states themselves to determine the legal levels of penalties, which has repeatedly led to a patchwork of fines varying across the bloc.

In a reply sent earlier this month, the commission said that it had no list of which member states had submitted their respective potential penalties.

The commission did say that it had received "several submissions from member states comprising transposition measures in relation to the NIS directive".

However, it noted that the commission was still studying those submissions, and that it expected "to have a more complete overview of the penalty provisions by the end of 2018".

"At this stage, the commission services have not identified such penalty provisions in the transposing measures already notified," the commission said.

In progress

In addition to setting penalties, member states had a whole range of requirements to fulfil by 9 May. A majority has apparently still not done so, despite having had two years to prepare.

According to a commission-run website, last updated on 6 June, only eight EU states have fully transposed the directive into national law: the Czech Republic, Estonia, Finland, Germany, Italy, Slovakia, Slovenia, and the United Kingdom.

Denmark, France, Hungary, and Lithuania had "partially" transposed the directive, while transposition was "in progress" in the others.

On 19 July, the commission announced that it has sent warning letters to 17 EU member states, telling them to fully transpose the cybersecurity directive.

The countries are Austria, Bulgaria, Belgium, Croatia, Denmark, France, Greece, Hungary, Ireland, Latvia, Lithuania, Luxembourg, the Netherlands, Poland, Portugal, Romania, and Spain.

They have two months to respond.

This article was updated on 1 August to add that the European Commission had sent letters to 17 member states.

Interview

Greece keen to keep EU cybersecurity agency

Greek official welcomed proposal to give the agency a bigger role, downplayed its kitchen sink problems, and said he was himself the victim of a computer virus.

EU to beef up cybersecurity agency

The Commission's president proposed to set up a European Cybersecurity Agency. The EU already has an agency for Network and Information Security.

EU agency to fight election hacking

A new-model EU cybersecurity agency could help states defend their elections against "hybrid attacks", the Commission has said.

Microsoft warns EU on election hack threat

Russian hackers posed a threat to EU elections, US tech giant Microsoft has warned, amid fresh revelations of cyber-attacks against European targets.

News in Brief

  1. Macron changes phone after Pegasus spyware revelations
  2. Italy to impose 'vaccinated-only' entry on indoor entertainment
  3. EU 'will not renegotiate' Irish protocol
  4. Brussels migrants end hunger strike
  5. Elderly EU nationals in UK-status limbo after missed deadline
  6. WHO: 11bn doses needed to reach global vaccination target
  7. EU to share 200m Covid vaccine doses by end of 2021
  8. Spain ends outdoor mask-wearing despite surge

Are EU data watchdogs staffed for GDPR?

The success of the new general data protection regulation (GDPR) will depend on whether data protection authorities enforce the new rules - which, in turn, will be at least partly determined by how many people they employ.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Stakeholders' Highlights

  1. Nordic Council of MinistersNineteen demands by Nordic young people to save biodiversity
  2. Nordic Council of MinistersSustainable public procurement is an effective way to achieve global goals
  3. Nordic Council of MinistersNordic Council enters into formal relations with European Parliament
  4. Nordic Council of MinistersWomen more active in violent extremist circles than first assumed
  5. Nordic Council of MinistersDigitalisation can help us pick up the green pace
  6. Nordic Council of MinistersCOVID19 is a wake-up call in the fight against antibiotic resistance

Latest News

  1. Far left and right MEPs less critical of China and Russia
  2. Why is offshore wind the 'Cinderella' of EU climate policy?
  3. Open letter from 30 embassies ahead of Budapest Pride
  4. Orbán counters EU by calling referendum on anti-LGBTI law
  5. Why aren't EU's CSDP missions working?
  6. Romania most keen to join eurozone
  7. Slovenia risks court over EU anti-graft office
  8. Sweden's gang and gun violence sets politicians bickering

Join EUobserver

Support quality EU news

Join us