CELEX: 62004CJ0217
Regulation (EC) No 460/2004
European Network and Information Security Agency
Choice of legal basis

By its application the United Kingdom of Great Britain and Northern Ireland is seeking annulment of Regulation (EC) No 460/2004
of the European Parliament and of the Council of 10 March 2004 establishing the European Network and Information Security
Agency (OJ 2004 L 77, p. 1; ‘the regulation’).
By order of the President of the Court of 25 November 2004 the Republic of Finland and the Commission of the European Communities
were granted leave to intervene in support of the European Parliament and the Council of the European Union.

Legal context

General Community legislation
Article 1(1) of Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory
framework for electronic communications networks and services (Framework Directive) (OJ 2002 L 108, p. 33) seeks to establish
a harmonised framework for the regulation of electronic communications services and associated facilities and services. It
lays down, inter alia, the tasks of national regulatory authorities and establishes a set of procedures to ensure the harmonised
application of the regulatory framework throughout the Community.
Community legislation relating to electronic communications networks also includes the following directives (‘the specific
directives’):
–        Directive 2002/19/EC of the European Parliament and of the Council of 7 March 2002 on access to, and interconnection of, electronic
communications networks and associated facilities (Access Directive) (OJ 2002 L 108, p. 7);
–        Directive 2002/20/EC of the European Parliament and of the Council of 7 March 2002 on the authorisation of electronic communications
networks and services (Authorisation Directive) (OJ 2002 L 108, p. 21);
–        Directive 2002/22/EC of the European Parliament and of the Council of 7 March 2002 on universal service and users’ rights
relating to electronic communications networks and services (Universal Service Directive) (OJ 2002 L 108, p. 51);
–        Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data
and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications)
(OJ 2002 L 201, p. 37);
–        Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic
signatures (OJ 2000 L 13, p. 12) (Electronic Signatures Directive);
–        Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information
society services, in particular electronic commerce, in the internal market (‘Directive on electronic commerce’) (OJ 2000
L 178, p. 1).
By Decision 2002/627/EC of 29 July 2002 (OJ 2002 L 200, p. 38) the Commission established the European Regulators Group for
Electronic Communications Networks and Services.

The regulation
The regulation was adopted on the basis of Article 95 EC. Article 1(1) of the regulation establishes a European Network and
Information Security Agency (‘the Agency’).
Under Article 1(2) of the regulation, the role of the Agency is to ‘assist the Commission and the Member States, and in consequence
cooperate with the business community, in order to help them to meet the requirements of network and information security,
thereby ensuring the smooth functioning of the internal market, including those set out in present and future Community legislation,
such as in the Directive 2002/21/EC’.
Article 2 of the regulation, entitled ‘Objectives’, is worded as follows:
‘1. The Agency shall enhance the capability of the Community, the Member States and, as a consequence, the business community
to prevent, address and respond to network and information security problems.
2. The Agency shall provide assistance and deliver advice to the Commission and the Member States on issues related to network
and information security falling within its competencies as set out in this regulation.
3. Building on national and Community efforts, the Agency shall develop a high level of expertise. The Agency shall use this
expertise to stimulate broad cooperation between actors from the public and private sectors.
4. The Agency shall assist the Commission, where called upon, in the technical preparatory work for updating and developing
Community legislation in the field of network and information security.’
Article 3 of the regulation defines the tasks which the Agency must perform ‘[i]n order to ensure that the scope and objectives
set out in Articles 1 and 2 are complied with and met’. Its tasks are to:
‘(a)      collect appropriate information to analyse current and emerging risks and, in particular at the European level, those which
could produce an impact on the resilience and the availability of electronic communications networks and on the authenticity,
integrity and confidentiality of the information accessed and transmitted through them, and provide the results of the analysis
to the Member States and the Commission;
(b)      provide the European Parliament, the Commission, European bodies or competent national bodies appointed by the Member States
with advice, and when called upon, with assistance within its objectives;
(c)      enhance cooperation between different actors operating in the field of network and information security, inter alia by organising,
on a regular basis, consultation with industry [and] universities, as well as other sectors concerned and by establishing
networks of contacts for Community bodies, public sector bodies appointed by the Member States, private sector and consumer
bodies;
(d)      facilitate cooperation between the Commission and the Member States in the development of common methodologies to prevent,
address and respond to network and information security issues;
(e)      contribute to awareness raising and the availability of timely, objective and comprehensive information on network and information
security issues for all users by, inter alia, promoting exchanges of current best practices, including on methods of alerting
users, and seeking synergy between public and private sector initiatives;
(f)      assist the Commission and the Member States in their dialogue with industry to address security-related problems in the hardware
and software products;
(g)      track the development of standards for products and services on network and information security;
(h)      advise the Commission on research in the area of network and information security as well as on the effective use of risk
prevention technologies;
(i)      promote risk assessment activities, interoperable risk management solutions and studies on prevention management solutions
within public and private sector organisations;
(j)      contribute to Community efforts to cooperate with third countries and, where appropriate, with international organisations
to promote a common global approach to network and information security issues, thereby contributing to the development of
a culture of network and information security;
(k)      express independently its own conclusions, orientations and … advice on matters within its scope and objectives.’
Chapters 2 and 3 of the regulation relate, respectively, to the organisation and operation of the Agency.

The action
Arguments of the parties
In support of its application for annulment of the regulation the United Kingdom submits that Article 95 EC does not provide
an appropriate legal basis for the adoption of that regulation. The power conferred on the Community legislature by Article
95 EC is the power to harmonise national laws and not one which is aimed at setting up Community bodies and conferring tasks
upon such bodies.
According to the United Kingdom, the analysis to be carried out consists in determining whether the instrument adopted under
Article 95 EC achieves a result which could be achieved by the simultaneous enactment of identical legislation in each Member
State. If so, the regulation harmonises national law. If, on the other hand, the regulation ‘does something’ that could not
have been achieved by the simultaneous enactment of identical legislation at Member State level, that is to say if it legislates
in fields which are beyond the capacity of individual Member States, then it is not a harmonising measure.
The United Kingdom admits that a harmonisation measure adopted pursuant to Article 95 EC may contain provisions which do not,
themselves, amount to a harmonisation of national laws where those provisions are merely incidental or correspond to the implementation
of provisions which do not, themselves, harmonise national laws.
The United Kingdom submits that none of the provisions of the regulation approximates, even indirectly and in a very minor
way, national legislation. On the contrary, the Agency is expressly precluded from interfering with the competences of national
bodies since it must limit itself to providing non-binding advice in the area concerned.
The United Kingdom maintains that the regulation responds to the risk to the smooth functioning of the internal market arising
from the complexity of the matter not by harmonising national rules, but by creating a Community body with an advisory role.
The fact that a Community measure may be beneficial to the functioning of the internal market does not mean that it constitutes
a harmonisation measure within the meaning of Article 95 EC.
The United Kingdom states that giving non-binding advice cannot amount to an ‘approximation of the provisions laid down by
law, regulation or administrative action in the Member States’ within the meaning of Article 95 EC. Moreover, the dissemination
of such advice may in practice increase the disparities which exist between national laws. It is entirely a matter of speculation
as to whether in practice the advice given by the Agency will lead the Member States to exercise, in a similar manner, the
discretion granted to them under the Framework Directive and the specific directives.
The United Kingdom draws attention to the fact that the functions of the Agency are limited to developing expertise and giving
advice to a wide range of potential recipients and the only possible connection which might exist between the tasks which
it carries out and the harmonisation of law is the one which results from the fact that it assists the Commission. However,
that role, which seems to be a technical research function, is too far removed from Community legislation seeking harmonisation
of national legislation.
The United Kingdom is of the view that the existence of the Framework Directive and the specific directives cannot alter that
analysis. The Agency’s activities have a much wider scope than the directives. In addition, the giving of non-binding advice,
as provided for in the regulation, does not facilitate the implementation of those directives since that task is reserved
exclusively to the competent bodies in the Member States and not to the Agency.
It points out that the role conferred upon the Agency is more extensive than that determined by the scope of the specific
directives since the regulation is concerned with the security not only of communications networks but also of information
systems such as databases.
The United Kingdom also submits that the regulation is inadequately reasoned in relation to the question of the likely emergence
of obstacles to trade resulting from the existence of different national requirements as to information security. A reference
to the mere possibility of the heterogeneous application of network security requirements and the fact that these requirements
can lead to inefficient solutions and obstacles to the internal market cannot constitute sufficient reasoning in this regard.
Furthermore, the United Kingdom acknowledges that the creation of the Agency does serve a desirable purpose, namely the establishment,
by the Community, of its own centre of expertise in the field of network and information security. It also states that it
does not object to the content of the provisions of the regulation. However, it comes to the conclusion from the arguments
which it puts forward as a whole that that regulation should have been based on Article 308 EC.
The Parliament maintains that Article 95 EC does not define the degree to which the Community measure at issue must approximate
the legal orders of the Member States. The EC Treaty does not require that measures based on that legal basis approximate
substantive rules of national legislation where a lesser degree of Community action would be more appropriate. It is sufficient
that a measure based on that provision is for the approximation of national provisions, even if that measure does not, itself,
carry out such an approximation.
The Parliament points out that the regulation seeks to ensure the approximation of certain provisions that the Member States
have adopted or are about to adopt in the area of information and network security with a view to facilitating the efficient
implementation of existing Community legislation on the subject. In this context, the use of a different and more restrictive
legal basis would be incoherent, given that the regulation should be regarded as complementary to a group of directives concerning
the internal market in electronic communications networks and services.
The Parliament claims that the legislature considered it appropriate to adopt a common approach to current and foreseeable
problems concerning network and information security by establishing a body responsible for advising the public authorities
at Community and national level in the context of close consultation with the private sector. The three fields of activity
of the Agency, namely the collection and dissemination of information, the provision of advice and the promotion of cooperation,
contribute to the adoption of a common approach to different aspects of network and information security.
The Parliament submits that while the Community could in theory have adopted rules harmonising the provisions of the Member
States concerning all or some of the matters dealt with in the regulation, the Community legislature, given the technical
complexity of the area in question and its rapidly evolving character, drew up the regulation in order to prevent the emergence
of obstacles to trade and the loss of efficiency which would arise from the uncoordinated adoption by the Member States of
technical and organisational applications. It sought to achieve this by means of ‘low-intensity approximation’, enabling the
Member States to adopt homogeneous measures to implement the various Community instruments on electronic communications, by
establishing a centre of expertise providing guidance, advice and assistance in the area.
The Parliament adds that the fact that the substantive harmonising provisions were set out in the Framework Directive and
specific directives does not alter the character of the regulation as a complementary measure designed to facilitate the implementation
of those directives.
According to the Parliament, the functions of the Agency are relatively modest in that they do not include the power to adopt
‘standards’. The provision of advice by a single authoritative source of expertise at the European level contributes to the
adoption of common positions in situations where the Community and the national bodies run the risk of receiving conflicting
technical advice. The various forms of cooperation promoted by the Agency also facilitate the approximation of market conditions
and the adoption by the Member States of measures which tackle information security problems.
The Parliament remarks finally that, should the Court conclude that the regulation could not be based on Article 95 EC, it
could, in any event, be based on implied powers conferred on the Community legislature by that very provision. As regards
such implied powers, the creation of the Agency could be regarded as indispensable to the achievement of the objectives pursued
by the specific directives.
The Council considers that the approximation provided for in Article 95 EC concerns not only national laws but also regulations
or administrative action of the Member States. Moreover, acts adopted on that legal basis can contain provisions which do
not, in themselves, constitute harmonisation measures, but which facilitate the approximation of national laws. In particular,
nothing in the wording of that article prevents the legislature from creating a Community body entrusted with the task of
providing expertise in an area which is already subject to harmonisation measures.
The Council states in that regard that Article 95 EC does not prevent the Community legislature from adopting measures to
prevent the emergence of future obstacles to trade resulting from the heterogeneous development of national laws. It is empowered
to adopt acts which, even if they are not in themselves harmonising rules, relate directly to the approximation of national
rules, in particular in order to prevent the development of ineffective solutions and the heterogeneous development of the
laws of the Member States.
The Council maintains that, by assisting the Commission in the technical preparatory work for drawing up Community legislation,
the Agency will provide, even by means of non-binding advice, a decisive contribution to the harmonisation of national laws
and practices in the field of network and information security and to updating, developing and implementing that legislation.
According to the Council, the opinion of an independent authority, providing technical advice at the request of the Commission
and the Member States, facilitates the transposition of directives adopted on the subject into the laws of the Member States.
The regulation does not therefore have an incidental or subsidiary effect on harmonising market conditions within the Community,
but contributes directly to the approximation of national laws.
The Council submits, finally, that Article 308 EC confers on the Community legislature only a residual legislative power in
areas where substantive legislative authority to attain certain objectives has not been attributed to the Community. Where
a specific legal basis exists for the adoption of a Community act recourse to Article 308 EC is precluded since the latter
is only a ‘default’ legal basis.
The Republic of Finland submits that the objectives and content of the regulation are closely linked to the establishment
and smooth functioning of the internal market. The basic task of the Agency consists in ensuring high-level and effective
network and information security and in reducing the obstacles to the working of the internal market presented by the differences
between the laws of the Member States in the area.
The Republic of Finland considers that the Agency facilitates the uniform application of Community provisions in relation
to electronic communications networks and services. The Agency aims in particular to prevent the emergence of future obstacles
to trade which are likely to arise as a result of the complex and technical nature of electronic networks and the differing
practices of the Member States.
The Republic of Finland submits that, when considering the legal basis for the provisions establishing a Community body, it
is appropriate to keep in mind the degree of approximation of the Community legislation concerning the area at issue. Given
that the harmonisation of the Community provisions on electronic communications networks and services is already well advanced,
the legislation adopted at Community level may require measures going further than those usually adopted in the area in order
to ensure uniform practice in the application of those provisions.
The Commission considers that the regulation is, in its aim and content, a measure which directly facilitates the implementation
and the harmonised application of certain directives based on Article 95 EC. One of the principal characteristics of the existing
legislation resides in the fact that much of the detailed application of that legislation is decentralised and conferred on
the national regulatory authorities.
The Commission submits that the creation of the Agency is part of a broader notion of harmonisation, facilitating in particular
the harmonised application of Community directives by national regulatory authorities. The objective of the regulation goes
beyond the mere creation of the Agency since that agency must provide advice and assistance to the Commission and the national
regulatory authorities. Therefore, there is a link between the creation of that agency and the legislative Community framework
in relation to electronic communications.
The Commission states that the Framework Directive creates a harmonised system for the regulation of electronic communications
services and networks, and associated resources. It lays down the tasks of national regulatory authorities, establishing a
set of procedures to ensure the harmonised application of the mechanism concerned throughout the Community.
It points out that even if the framework for the decentralised application of the directives is clearly defined, the national
regulatory authorities may, in exercising their discretion, adopt different positions. The Agency was established to assist
those authorities to achieve a common technical understanding of network and information security issues.
The Commission adds that the Agency functions within the harmonised parameters of the electronic communications Community
legislative framework and it does not matter that the role of that body was not defined when that general framework was adopted.

Findings of the Court
The scope of Article 95 EC
As regards the scope of the legislative powers laid down in Article 95 EC it must be observed that, as the Court held in paragraph
44 of the judgment in Case C-66/04
United Kingdom
v
Parliament and Council
[2005] ECR I-0000, that provision is used as a legal basis only where it is actually and objectively apparent from the legal
act that its purpose is to improve the conditions for the establishment and functioning of the internal market.
The Court also pointed out in paragraph 45 of that judgment that by using the expression ‘measures for the approximation’
in Article 95 EC the authors of the Treaty intended to confer on the Community legislature a discretion, depending on the
general context and the specific circumstances of the matter to be harmonised, as regards the method of approximation most
appropriate for achieving the desired result, in particular in fields with complex technical features.
It must be added in that regard that nothing in the wording of Article 95 EC implies that the addressees of the measures adopted
by the Community legislature on the basis of that provision can only be the individual Member States. The legislature may
deem it necessary to provide for the establishment of a Community body responsible for contributing to the implementation
of a process of harmonisation in situations where, in order to facilitate the uniform implementation and application of acts
based on that provision, the adoption of non-binding supporting and framework measures seems appropriate.
It must be emphasised, however, that the tasks conferred on such a body must be closely linked to the subject-matter of the
acts approximating the laws, regulations and administrative provisions of the Member States. Such is the case in particular
where the Community body thus established provides services to national authorities and/or operators which affect the homogenous
implementation of harmonising instruments and which are likely to facilitate their application.
Conformity of the regulation with the requirements of Article 95 EC
In those circumstances, it must be examined whether the objectives laid down for the Agency in Article 2 of the regulation
and the tasks which are conferred on it pursuant to Article 3 thereof are in line with the requirements set out in paragraphs
44 and 45 of the present judgment.
To that end, it needs to be determined, first, whether those objectives and tasks are closely linked to the subject-matter
of the instruments which are described in Article 1(2) of the regulation as ‘present Community legislation’, and secondly,
if the answer is yes, whether those objectives and tasks may be regarded as supporting and providing a framework for the implementation
of that legislation.
As regards the Framework Directive, referred to in recital 9 in the preamble to the regulation, Article 1(1) thereof states
that it seeks to establish a harmonised framework for the regulation of electronic communications services, electronic communications
networks and associated facilities and services. It lays down the tasks of national regulatory authorities and establishes
a set of procedures to ensure the harmonised application of the regulatory framework throughout the Community.
Recital 16 in the preamble to the Framework Directive indicates in that regard that those authorities are to base their actions
on a harmonised set of objectives and principles. The latter are stated in Article 8 of that directive, and include, inter
alia, a high level of protection of personal data and privacy and the integrity and security of public communications networks
(see Article 8(4)(c) and (f) of the Framework Directive).
Numerous concerns of the specific directives express the concerns of the Community legislature in relation to network and
information security.
First, as is apparent from recital 6 in the preamble to the regulation, the Authorisation Directive mentions, in points 7
and 16 of part A of the annex thereto, personal data and privacy protection in the electronic communications sector and security
of public networks against unauthorised access.
Second, as is apparent from recital 7 in the preamble to the regulation, the Universal Service Directive aims to ensure the
integrity and availability of public telephone networks. In that regard, Article 23 of that directive provides that the Member
States are to take all necessary steps to ensure those functionalities, in particular in the event of catastrophic network
breakdown or in cases of force majeure.
Third, as is specified in recital 8 in the preamble to the regulation, the Directive on privacy and electronic communications
requires providers of publicly available electronic communications services to take appropriate technical and organisational
measures to safeguard security of the services concerned and the confidentiality of the communications and related traffic
data. Those requirements are reflected in particular in Articles 4 and 5 of that directive, which concern network security
and the confidentiality of communications respectively.
Fourth, Article 17 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection
of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)
provides that the Member States are to ensure that the controller implements appropriate technical and organisational measures
to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure
or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful
forms of processing.
Fifth, Article 3(4) of the Electronic Signatures Directive provides that appropriate bodies designated by Member States are
to determine the conditions relating to the conformity of secure signature creation devices.
As regards the tasks conferred on the Agency, those tasks concern the collection of appropriate information with a view to
carrying out an analysis of current and emerging risks, in particular those which are likely to have an impact on the resilience
of electronic communications networks and on the authenticity, integrity and confidentiality of those communications. The
Agency is also called upon to develop ‘common methodologies’ to prevent security issues, contribute to raising awareness,
promote exchanges of ‘current best practices’ and ‘methods of alert’ and risk assessment and management activities.
The Agency is also entrusted with enhancing cooperation between those involved in the area of network and information security,
providing assistance to the Commission and the Member States in their dialogue with industry to address security-related problems
in hardware and software products and contributing to Community efforts to cooperate with third States and, where appropriate,
with international organisations to promote a common global approach to network and information security issues, thereby contributing
to the development of a culture of network and information security.
Consequently, the tasks conferred on the Agency under Article 3 of the regulation are closely linked to the objectives pursued
by the Framework Directive and the specific directives in the area of network and information security.
Accordingly, as stated in paragraph 47 of the present judgment, it needs to be determined whether the tasks of the Agency
may be regarded as supporting and providing a framework for the implementation of the Community legislation in the area, that
is to say, whether the establishment of the Agency and the objectives and tasks which are assigned to it by the regulation
may be regarded as ‘measures for approximation’ within the meaning of Article 95 EC.
In the light of the characteristics of the subject-matter, the regulation does not constitute an isolated measure but forms
part of a normative context circumscribed by the Framework Directive and the specific directives and directed at completing
the internal market in the area of electronic communications.
All the elements in the case-file also tend to show that the Community legislature was confronted with an area in which technology
is being implemented which is not only complex but also developing rapidly. It concluded from this that it was foreseeable
that the transposition and application of the Framework Directive and the specific directives would lead to differences as
between the Member States.
Accordingly, the Community legislature considered that the establishment of a Community body such as the Agency was an appropriate
means of preventing the emergence of disparities likely to create obstacles to the smooth functioning of the internal market
in the area.
It is stated in recitals 3 and 10 in the preamble to the regulation that the Community legislature considers that, as a result
of the technical complexity of networks and information systems, the variety of products and services that are interconnected,
and ‘the huge number of private and public actors that bear their own responsibility’, the smooth functioning of the internal
market risks being undermined by a heterogeneous application of the technical requirements laid down in the Framework Directive
and the specific directives.
In that context, the Community legislature was entitled to consider that the opinion of an independent authority providing
technical advice at the request of the Commission and the Member States might facilitate the transposition of the directives
at issue into the laws of the Member States and the implementation of those directives at national level.
Finally, in accordance with Article 27 of the regulation, the Agency is to be established from 14 March 2004 for a period
of five years, and under Article 25(1) and (2) of the same regulation the Commission is bound to carry out by 17 March 2007
at the latest an evaluation to assess the impact of the Agency in the light of the objectives and tasks assigned to it, as
well as its working practices.
It is thus apparent from those two provisions, read together, that the Community legislature considered that before making
a decision as to the fate of the Agency it was appropriate to carry out an evaluation of the effectiveness of that Agency
and the contribution which it makes to the implementation of the Framework Directive and specific directives.
In those circumstances and in the light of all the elements in the case-file, it must be found that the regulation is rightly
based on Article 95 EC and the action must, therefore, be dismissed.

Costs
Under Article 69(2) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been
applied for in the successful party’s pleadings. Since the Parliament and the Council applied for the United Kingdom to be
ordered to pay the costs and the latter has been unsuccessful, it must be ordered to pay the costs. In accordance with Article
69(4) of those rules, the Republic of Finland and the Commission are to bear their own costs.
On those grounds, the Court (Grand Chamber) hereby:
1.
Dismisses the action;
2.
Orders the United Kingdom of Great Britain and Northern Ireland to pay the costs;
3.
Orders the Republic of Finland and the Commission of the European Communities to bear their own costs.
[Signatures]
*
Language of the case: English.