{"id":7411,"date":"2019-03-12T11:30:19","date_gmt":"2019-03-12T15:30:19","guid":{"rendered":"https:\/\/gutenberg-atl.staging.breakingmedia.com\/legal-innovation-center\/?p=7411"},"modified":"2019-03-12T14:37:06","modified_gmt":"2019-03-12T18:37:06","slug":"the-eus-data-and-security-regulations-are-sound-policy-and-good-business","status":"publish","type":"post","link":"https:\/\/abovethelaw.com\/legal-innovation-center\/2019\/03\/12\/the-eus-data-and-security-regulations-are-sound-policy-and-good-business\/","title":{"rendered":"The EU\u2019s Data and Security Regulations Are Sound Policy and Good Business"},"content":{"rendered":"

The European Union is not a simple marketplace. It has 28 countries, 24 languages, accounts for almost a quarter of global GDP, and is run via a complex, hybrid governmental system not renowned for quick decision making and alacrity. However, in the area of cybersecurity, the EU has acted deliberately over the last few years and gained a first-movers advantage in forcing the world to adopt regulations to protect its citizens, businesses, and own cyberinfrastructure. This is a case where sound policy is creating good business and making the EU the fulcrum for global security standards.<\/span><\/p>\n

The EU Looks to Protect Critical Infrastructure<\/b><\/span><\/p>\n

With the GDPR, the EU has taken the global lead in regulating personal data. The GDPR puts a formal structure on how to handle personal data privacy, and at the same time, compels the rest of the world to adopt it or suffer liability, fines, and the prospect of losing business in the EU if companies appear untrustworthy. <\/span><\/p>\n

Now, the EU is moving to ensure that its critical infrastructure is protected across all of its member countries by implementing what is known as the Networks and Information Services Directive (NISD). The goal of the NISD is to improve security standards at essential organisations to ensure availability even in the event of a major attack. The NISD covers only essential organisations such as those in utility, healthcare, transport and similar sectors. It also differs from the GDPR in that it is a \u201cdirective\u201d and therefore requires the individual EU countries to transpose it into their respective languages and then pass it into their own national law. <\/span><\/p>\n

Under the NISD, a company must report a cyber incident to a local Response Team when it could significantly impact the \u201ccontinuity of the essential services they provide.” Impact is assessed by looking at the potential duration of the incident and the number of users affected and its geographical reach. It requires companies to have measures in place \u2014 \u201cappropriate and proportionate technical and organizational measures to manage [risk]\u201d \u2014 to prevent attacks or to alternatively minimize any disruption to their systems. <\/span><\/p>\n

Key Technical Requirements<\/b><\/span><\/p>\n

The NISD stipulates that affected operators of essential services and digital service providers must have in place, among other requirements:<\/span><\/p>\n