By Mark Young and Vera Coughlan

Formal adoption of the EU Network and Information Security (NIS) Directive is a step closer following a vote on January 14 by the European Parliament’s internal market and consumer protection (IMCO) committee.

As we reported in December, the European institutions reached an informal political agreement on the NIS Directive — dubbed the Cybersecurity Directive — on December 7, 2015, (see press release from the Council).  The informal consolidated text, dated December 18, is available here.  Member States (the Committee of Permanent Representatives (COREPER)) endorsed this agreement on December 18.

On January 14, the European Parliament’s IMCO committee voted in favour of the NIS Directive (34-2).  The committee confirmed that the minimum harmonisation requirements under the Directive do not apply to digital service providers.  This means that Member States would not be able to impose any further security or notification requirements on digital service providers when transposing the Directive into national law.

The IMCO committee also published a table, dated January 13, 2016, which provides an interesting overview of the different institutions’ positions during the negotiations.  This table sets out an article-by-article comparison of differences between the Commission proposal, European Parliament’s position, and the Council position, and shows suggested compromises and also the compromise amendments.

The NIS Directive will now be put forward for a full plenary vote in the European Parliament.  Once it is published in the Official Journal of the European Union and enters into force later this year, Member States will have 21 months to transpose it into national law.  Member States will then have a further 6 months to apply criteria laid down in the Directive to identify specific operators of essential services covered by national rules.  These processes are likely to be complicated, and companies that may fall within scope should participate in consultations and monitor developments across the EU over the coming months.