Tuesday

19th Mar 2019

Focus

EU countries miss cybersecurity deadline

  • EU member states agreed in 2016 to an EU directive aimed at prevent hackers disrupting essential public services (Photo: Santiago Zavala)

European Union member states agreed in 2016 to take measures to prevent cyber attacks from disrupting essential services, like railway traffic control services or water suppliers.

However, a majority of EU member states missed the deadline to transpose the EU directive into national law.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 18 year's of archives. 30 days free trial.

... or join as a group

Moreover, it is unclear to what extent a specific measure – concerning fines for breaking the new cybersecurity rules – has been implemented.

The 'directive concerning measures for a high common level of security of network and information systems across the union' – NIS directive for short – was adopted on 6 July 2016 after three years of negotiations.

Representatives of the EU's 28 national government unanimously approved the text.

However, some of those same governments now appear to have reneged on what they promised.

According to the directive, member states need to identify, before 9 November 2018, which organisations connected to the internet provide vital services to the public.

They also need to make sure that the operators of these so-called essential services do everything in their power to manage the risks of being hacked – and report to the authorities if there is a cybersecurity breach.

Member states were also required to tell the European Commission, by 9 May this year, how they would punish any infringements.

The same day, EUobserver filed an access to documents request, asking the EU executive which member states had complied with the penalties notification requirement.

As often, the EU directive has left it to member states themselves to determine the legal levels of penalties, which has repeatedly led to a patchwork of fines varying across the bloc.

In a reply sent earlier this month, the commission said that it had no list of which member states had submitted their respective potential penalties.

The commission did say that it had received "several submissions from member states comprising transposition measures in relation to the NIS directive".

However, it noted that the commission was still studying those submissions, and that it expected "to have a more complete overview of the penalty provisions by the end of 2018".

"At this stage, the commission services have not identified such penalty provisions in the transposing measures already notified," the commission said.

In progress

In addition to setting penalties, member states had a whole range of requirements to fulfil by 9 May. A majority has apparently still not done so, despite having had two years to prepare.

According to a commission-run website, last updated on 6 June, only eight EU states have fully transposed the directive into national law: the Czech Republic, Estonia, Finland, Germany, Italy, Slovakia, Slovenia, and the United Kingdom.

Denmark, France, Hungary, and Lithuania had "partially" transposed the directive, while transposition was "in progress" in the others.

On 19 July, the commission announced that it has sent warning letters to 17 EU member states, telling them to fully transpose the cybersecurity directive.

The countries are Austria, Bulgaria, Belgium, Croatia, Denmark, France, Greece, Hungary, Ireland, Latvia, Lithuania, Luxembourg, the Netherlands, Poland, Portugal, Romania, and Spain.

They have two months to respond.

This article was updated on 1 August to add that the European Commission had sent letters to 17 member states.

Interview

Greece keen to keep EU cybersecurity agency

Greek official welcomed proposal to give the agency a bigger role, downplayed its kitchen sink problems, and said he was himself the victim of a computer virus.

EU to beef up cybersecurity agency

The Commission's president proposed to set up a European Cybersecurity Agency. The EU already has an agency for Network and Information Security.

EU agency to fight election hacking

A new-model EU cybersecurity agency could help states defend their elections against "hybrid attacks", the Commission has said.

News in Brief

  1. Blow for May as third vote on Brexit deal ruled out
  2. Three killed in possible 'terror' gun attack in Utrecht
  3. Third Brexit vote this week only if DUP will support it
  4. Germany's two largest banks confirm merger talks
  5. Serbian pro-democracy protests reach 15th week
  6. 'Yellow Vest' riots leave Paris shops vandalised
  7. European woman older when having first baby
  8. Majority of Germans want Merkel to stay on

Are EU data watchdogs staffed for GDPR?

The success of the new general data protection regulation (GDPR) will depend on whether data protection authorities enforce the new rules - which, in turn, will be at least partly determined by how many people they employ.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Stakeholders' Highlights

  1. Nordic Council of MinistersNew Secretary General: Nordic co-operation must benefit everybody
  2. Platform for Peace and JusticeMEP Kati Piri: “Our red line on Turkey has been crossed”
  3. UNICEF2018 deadliest year yet for children in Syria as war enters 9th year
  4. Nordic Council of MinistersNordic commitment to driving global gender equality
  5. International Partnership for Human RightsMeet your defender: Rasul Jafarov leading human rights defender from Azerbaijan
  6. UNICEFUNICEF Hosts MEPs in Jordan Ahead of Brussels Conference on the Future of Syria
  7. Nordic Council of MinistersNordic talks on parental leave at the UN
  8. International Partnership for Human RightsTrial of Chechen prisoner of conscience and human rights activist Oyub Titiev continues.
  9. Nordic Council of MinistersNordic food policy inspires India to be a sustainable superpower
  10. Nordic Council of MinistersMilestone for Nordic-Baltic e-ID
  11. Counter BalanceEU bank urged to free itself from fossil fuels and take climate leadership
  12. Intercultural Dialogue PlatformRoundtable: Muslim Heresy and the Politics of Human Rights, Dr. Matthew J. Nelson

Stakeholders' Highlights

  1. Platform for Peace and JusticeTurkey suffering from the lack of the rule of law
  2. UNESDASoft Drinks Europe welcomes Tim Brett as its new president
  3. Nordic Council of MinistersNordic ministers take the lead in combatting climate change
  4. Counter BalanceEuropean Parliament takes incoherent steps on climate in future EU investments
  5. International Partnership For Human RightsKyrgyz authorities have to immediately release human rights defender Azimjon Askarov
  6. Nordic Council of MinistersSeminar on disability and user involvement
  7. Nordic Council of MinistersInternational appetite for Nordic food policies
  8. Nordic Council of MinistersNew Nordic Innovation House in Hong Kong
  9. Nordic Council of MinistersNordic Region has chance to become world leader when it comes to start-ups
  10. Nordic Council of MinistersTheresa May: “We will not be turning our backs on the Nordic region”
  11. International Partnership for Human RightsOpen letter to Emmanuel Macron ahead of Uzbek president's visit
  12. International Partnership for Human RightsRaising key human rights concerns during visit of Turkmenistan's foreign minister

Join EUobserver

Support quality EU news

Join us