By Mark Young and Vera Coughlan

Formal adoption of the EU Network and Information Security (NIS) Directive is a step closer following a vote on January 14 by the European Parliament’s internal market and consumer protection (IMCO) committee.

As we reported in December, the European institutions reached an informal political agreement on the NIS Directive — dubbed the Cybersecurity Directive — on December 7, 2015, (see press release from the Council).  The informal consolidated text, dated December 18, is available here.  Member States (the Committee of Permanent Representatives (COREPER)) endorsed this agreement on December 18.

On January 14, the European Parliament’s IMCO committee voted in favour of the NIS Directive (34-2).  The committee confirmed that the minimum harmonisation requirements under the Directive do not apply to digital service providers.  This means that Member States would not be able to impose any further security or notification requirements on digital service providers when transposing the Directive into national law.

The IMCO committee also published a table, dated January 13, 2016, which provides an interesting overview of the different institutions’ positions during the negotiations.  This table sets out an article-by-article comparison of differences between the Commission proposal, European Parliament’s position, and the Council position, and shows suggested compromises and also the compromise amendments.

The NIS Directive will now be put forward for a full plenary vote in the European Parliament.  Once it is published in the Official Journal of the European Union and enters into force later this year, Member States will have 21 months to transpose it into national law.  Member States will then have a further 6 months to apply criteria laid down in the Directive to identify specific operators of essential services covered by national rules.  These processes are likely to be complicated, and companies that may fall within scope should participate in consultations and monitor developments across the EU over the coming months.

Print:
EmailTweetLikeLinkedIn
Photo of Mark Young Mark Young

Mark Young advises clients on data protection, cybersecurity and other tech regulatory matters. He has particular expertise in product counselling, GDPR regulatory investigations, and legislative advocacy. Mr. Young leads on EU cybersecurity regulatory matters, and helps to oversee our internet enforcement team.

He…

Mark Young advises clients on data protection, cybersecurity and other tech regulatory matters. He has particular expertise in product counselling, GDPR regulatory investigations, and legislative advocacy. Mr. Young leads on EU cybersecurity regulatory matters, and helps to oversee our internet enforcement team.

He has been recognized in Chambers UK as “a trusted adviser – practical, results-oriented and an expert in the field.” Recent editions note that he is “deeply knowledgeable in the area of privacy and data protection,” “fast, thorough and responsive,” and has “great insight into the regulators.”

Mr. Young has over 15 years of experience advising global companies, particularly in the technology, health and pharmaceutical sectors, on all aspects of data protection and security. This includes providing practical guidance on analyzing and using personal data, transferring personal data across borders, and potential liability exposure. He specializes in advising in relation to new products and services, and providing strategic advice and advocacy on a range of EU law reform issues and references to the EU Court of Justice.

For cybersecurity matters, he counsels clients on practices to protect business-critical information and comply with national and sector-specific regulation, and on preparing for and responding to cyber-based attacks and internal threats to their networks and information. He has helped a range of organizations respond to cyber and data security incidents – including external data breaches and insider theft of trade secrets – through the stages of initial detection, containment, notification, recovery and remediation.

In the IP enforcement space, Mr. Young represents right owners in the sport, media, publishing, fashion and luxury goods industries, and helps coordinate a team of internet investigators that has nearly two decades of experience conducting global notice and takedown programs to combat internet piracy.