Sunday

9th Aug 2020

EU countries miss cybersecurity deadline

  • EU member states agreed in 2016 to an EU directive aimed at prevent hackers disrupting essential public services (Photo: Santiago Zavala)

European Union member states agreed in 2016 to take measures to prevent cyber attacks from disrupting essential services, like railway traffic control services or water suppliers.

However, a majority of EU member states missed the deadline to transpose the EU directive into national law.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

Moreover, it is unclear to what extent a specific measure – concerning fines for breaking the new cybersecurity rules – has been implemented.

The 'directive concerning measures for a high common level of security of network and information systems across the union' – NIS directive for short – was adopted on 6 July 2016 after three years of negotiations.

Representatives of the EU's 28 national government unanimously approved the text.

However, some of those same governments now appear to have reneged on what they promised.

According to the directive, member states need to identify, before 9 November 2018, which organisations connected to the internet provide vital services to the public.

They also need to make sure that the operators of these so-called essential services do everything in their power to manage the risks of being hacked – and report to the authorities if there is a cybersecurity breach.

Member states were also required to tell the European Commission, by 9 May this year, how they would punish any infringements.

The same day, EUobserver filed an access to documents request, asking the EU executive which member states had complied with the penalties notification requirement.

As often, the EU directive has left it to member states themselves to determine the legal levels of penalties, which has repeatedly led to a patchwork of fines varying across the bloc.

In a reply sent earlier this month, the commission said that it had no list of which member states had submitted their respective potential penalties.

The commission did say that it had received "several submissions from member states comprising transposition measures in relation to the NIS directive".

However, it noted that the commission was still studying those submissions, and that it expected "to have a more complete overview of the penalty provisions by the end of 2018".

"At this stage, the commission services have not identified such penalty provisions in the transposing measures already notified," the commission said.

In progress

In addition to setting penalties, member states had a whole range of requirements to fulfil by 9 May. A majority has apparently still not done so, despite having had two years to prepare.

According to a commission-run website, last updated on 6 June, only eight EU states have fully transposed the directive into national law: the Czech Republic, Estonia, Finland, Germany, Italy, Slovakia, Slovenia, and the United Kingdom.

Denmark, France, Hungary, and Lithuania had "partially" transposed the directive, while transposition was "in progress" in the others.

On 19 July, the commission announced that it has sent warning letters to 17 EU member states, telling them to fully transpose the cybersecurity directive.

The countries are Austria, Bulgaria, Belgium, Croatia, Denmark, France, Greece, Hungary, Ireland, Latvia, Lithuania, Luxembourg, the Netherlands, Poland, Portugal, Romania, and Spain.

They have two months to respond.

This article was updated on 1 August to add that the European Commission had sent letters to 17 member states.

Interview

Greece keen to keep EU cybersecurity agency

Greek official welcomed proposal to give the agency a bigger role, downplayed its kitchen sink problems, and said he was himself the victim of a computer virus.

EU to beef up cybersecurity agency

The Commission's president proposed to set up a European Cybersecurity Agency. The EU already has an agency for Network and Information Security.

EU agency to fight election hacking

A new-model EU cybersecurity agency could help states defend their elections against "hybrid attacks", the Commission has said.

Microsoft warns EU on election hack threat

Russian hackers posed a threat to EU elections, US tech giant Microsoft has warned, amid fresh revelations of cyber-attacks against European targets.

News in Brief

  1. Germany breached rights of Madeleine McCann suspect
  2. EU offers trade perks to Lebanon
  3. Germany charges ex-Audi chiefs on emissions cheating
  4. UK quarantines Belgium, as European infections climb
  5. Bulgaria's Borissov mulls resignation
  6. EU prolongs anti-dumping duties on Chinese steel
  7. Swedish economy contracted less during April to June
  8. EU offers help to Lebanon after port explosion

Are EU data watchdogs staffed for GDPR?

The success of the new general data protection regulation (GDPR) will depend on whether data protection authorities enforce the new rules - which, in turn, will be at least partly determined by how many people they employ.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Stakeholders' Highlights

  1. UNESDANext generation Europe should be green and circular
  2. Nordic Council of MinistersNEW REPORT: Eight in ten people are concerned about climate change
  3. UNESDAHow reducing sugar and calories in soft drinks makes the healthier choice the easy choice
  4. Nordic Council of MinistersGreen energy to power Nordic start after Covid-19
  5. European Sustainable Energy WeekThis year’s EU Sustainable Energy Week (EUSEW) will be held digitally!
  6. Nordic Council of MinistersNordic states are fighting to protect gender equality during corona crisis

Latest News

  1. EU wary of violence in Belarus election
  2. Iraqis paid €2,000 each agree to leave Greece
  3. EU's most sustainable islands are Danish 'Sunshine Islands'
  4. Worrying rows over future EU chemicals policy
  5. Rainbow flag protesters charged by Polish police
  6. An open letter to the EPP on end of Hungary's press freedom
  7. Renew Europe has a plan to combat gender-violence
  8. Why EU beats US on green pandemic recovery

Join EUobserver

Support quality EU news

Join us