Or you could rewind to January 2012, when the EU published the Draft General Data Protection Regulation, which will impose mandatory breach disclosure on every data controller operating in the EU, backed up with potential fines of up to 2% of annual worldwide turnover for those organisations who fail badly.
Or you could go back a little further still, to October 2009, when the EU introduced the mandatory breach disclosure rule for telcos and ISPs, which has been operating since early 2011.
Actually, you don’t need to do any of that. Instead, just focus on the draft EU Cybersecurity Directive, which was published today. Its a short document, easy to get to grips with, and within a few minutes the implications will be obvious to you.
The new Directive makes it compulsory for all “market operators”, including utilities, transport and financial services businesses, as well as public authorities who use “network and information systems” within their businesses to implement technical and organisations measures to manage cyber risks. These organisations will be subject to independent regulation, they will have to disclose security breaches to the regulators, they will have to submit to compulsory regulatory audits and they will be sanctioned if they fail to comply with the law.
The scope and magnitude of this new Directive is huge. Obviously, the regulation of cyber risks in utilities, transport, financial services and public authorities is massive in its own right, but its the wider concept of “market operator” that really needs to be looked at.
A market operator includes a provider of information society services “that enable the provision of other information society services”.
Information society services are colloquially called ecommerce services in the EU, but this is about much more than online shopping, because in the EU an information society service is essentially a service that is provided over the internet, whether or not a fee is charged. In other words, an information society service can be a shopping site, a social network, a search engine, or an “over the top” communications systems (like Skype) and so on, whether or not they are web or app based.
Looking again at the definition of market operator, what really counts is whether the information society service is supporting another information society service. This website, privacylawblog.ffw.com, is an information society service, but it's not supporting another, so its not caught by the Cybersecurity Directive. What the Directive is looking for is the platform of support – if you are a platform for an ISS, then you are regulated.
If all of this sounds too complicated, don’t worry, the Directive provides some indicative examples. These are: ecommerce platforms, internet payment gateways, social networks, search engines, cloud computing services and application stores.
This is an incredible list and the magnitude of the Directive becomes obvious when you start adding names to the list:
* ecommerce platform = Amazon and eBay provide market platforms for traders and iTunes has to be captured too
* internet payment gateways = Paypal is the most obvious one, but there loads of others, like Worldpay
* social networks = Facebook, LinkedIn, Twitter and so on
* search engines = Google (are there any others?)
* cloud = basically every tech co in the World!!!
* application stores = I think Apple has one (!), Google too, Amazon again and what about the telcos … isn’t Blackberry launching one now too?
This seems quite incredible at first, but its real. And its obvious really, isn’t it, because it is the Cybersecurity Directive after all! It wouldn’t deserve this name if it didn’t regulate these household names.
There is a lot to like in the Directive, but businesses will have concerns about the nature of regulation and the competence of the regulators. There are also some worrying grey areas in the Directive, such as the delegation of many powers to quangos, which is never good for legal certainty. I would expect many big tech companies to be looking hard at how to engage with the EU on this, because there is much to be shaped-up.
But wrapping this altogether and tying up the various strands, what we see within the EU is radical lawmaking for security. Any organisation that misses this point will come unstuck. That’s why the law is being reformed, specifically to cause behavioural change. Whether you look at security from a data protection angle or a cyber angle, it does not matter; you just have to be more secure.
I’ve posted a diagram below which shows the core legal pillars for data and cybersecurity in the EU, now and coming. What you are seeing here is a coalescence of approach and obligation. The end game is a single legal test – take appropriate technical and organisational measures to secure your networks and data. That’s the European approach.
Is anyone unsure about the EU agenda for cyber and data security? If you want some insight you could easily check the UK Information Commissioner’s website and you see that in 2012 over 20 data controllers were hit with big fines for security breaches affecting personal data.