Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2022/C 258/07)

On 22 March 2022, the European Commission adopted a Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union (‘the Proposal’).

The EDPS welcomes the aim of the Proposal to improve the cybersecurity posture of the Union Institutions, bodies, offices and agencies (“EUIs”), and equally welcomes the new role of the former “Computer Emergency Response Team”, now called “Cybersecurity Centre” (CERT-EU), taking into account the amplified digitisation, the rapidly evolving cybersecurity threat landscape and the recent digitalisation shift due also to the Covid-19 pandemic.

The EDPS regrets that the Proposal does not align with the NIS Directive, and the NIS 2.0 Proposal so that consistent and homogeneous rules for Member States and the EUIs are achieved, contributing to the overall Union cybersecurity level. The EDPS recommends adding in the Proposal that its minimum security requirements should be at least equal or higher than the minimum security requirements of the entities of NIS and NIS 2.0 Proposal.

In order to comply with the Proposal, the EUIs, as well as CERT-EU will have to deploy certain cybersecurity processes and measures, which are bound to imply additional processing of personal data. To achieve legal certainty and foreseeability, and to ensure compliance with the EUDPR, the EDPS strongly advises that the Proposal, or at the very least, a delegated act to be adopted subsequently by the Commission, must clearly provide a legal ground for the processing of personal data by CERT-EU and the EUIs, including in particular the purposes of processing and the categories of personal data.

The EDPS stresses the importance of integrating the privacy and data protection perspective in the cybersecurity management, in order to achieve positive synergies between the Proposal and privacy and data protection legislation, and provides specific recommendations how such synergies can be achieved, including a specific obligation for EU officials responsible for cybersecurity to cooperate closely with the data protection officer designated in accordance with EUDPR.

The EDPS strongly advises that the Proposal provide for close cooperation between CERT-EU and EDPS, in activities like when addressing incidents resulting in personal data breaches, when addressing significant vulnerabilities, significant incidents or major attacks, that have the potential to result in personal data breaches, as well as when CERT-EU has indications that an infringement of the Proposal entails a personal data breach.

The EDPS also strongly recommends that the Proposal provide for the EDPS’ participation in the ‘Interinstitutional Cybersecurity Board’ (IICB).

1. INTRODUCTION AND BACKGROUND

1. On 22 March 2022, the European Commission adopted a Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union (1) (‘the Proposal’).

2. On the same date, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council on the information security in the institutions, bodies, offices and agencies of the Union (2) (‘the Infosec Proposal’).

3. Both Proposals were envisaged by the EU’s Cybersecurity Strategy for the Digital Decade presented on 16 December 2020 (3) (‘the Strategy’). The overall aim of the Strategy is to strengthen the Union’s strategic autonomy in the field of cybersecurity and to improve its resilience and collective response as well as to build a global and open Internet with strong guardrails to address the risks to security and fundamental rights and freedoms of people in Europe (4).

4. The Proposal constitutes one of the regulatory initiatives of the Strategy, and in particular in the area of cybersecurity for the EU institutions, bodies, offices and agencies (EUIs). According to its explanatory memorandum, the aim of the Proposal is twofold: — to address the increasingly hostile cyber threat landscape and the increased incidence of more sophisticated cyberattacks affecting the EU institutions, bodies and agencies, driving the need for increased investments to reach a high level of cyber maturity, and — to reinforce the EU Computer Emergency Response Team (CERT-EU) with an improved funding mechanism that is necessary to increase its ability to help EU institutions, bodies and agencies to apply the new cybersecurity rules, and improve their cyber resilience.

5. The EDPS observes that the subject matter of the Proposal at hand is interlinked with the Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing Directive (EU) 2016/1148 (‘NIS 2.0 Proposal’). The EDPS recalls that he issued the Opinion 5/2021 on the Cybersecurity Strategy (5) and the NIS 2.0 Directive (‘NIS 2.0 Opinion’) (6). For this reason the present Opinion will refer to the NIS 2.0 Opinion.

6. In line with the Strategy, the Proposal aims at further improving the resilience of all Union institutions, bodies and agencies together with their incident response capacities. It is also in line with the Commission’s priorities to make Europe fit for the digital age and to build a future-ready economy that works for the people. Moreover, it stresses that the security and resilience of the public administration is a cornerstone in the digital transformation of society as a whole.

7. According to the explanatory memorandum, the Proposal: — outlines measures with a view to ensuring a high common level of cybersecurity for the European Union institutions, bodies and agencies, — establishes the ‘Interinstitutional Cybersecurity Board’, which shall be responsible for monitoring the implementation of the proposed Regulation, — establishes the new role of the Computer Emergency Response Team for the EU institutions, agencies and bodies (‘CERT-EU’) (7), as the ‘Cybersecurity Centre’ for the Union institutions, bodies and agencies, in line with developments in the Member States and globally.

8. On 22 March 2022 the European Commission requested the EDPS to issue an Opinion on the Proposal pursuant to Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (‘EUDPR’) (8). The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection and privacy perspective.

4. CONCLUSIONS

48. In light of the above, the EDPS makes the following main recommendations: — the EDPS recommends adding in a recital that the Proposal builds on the NIS 2.0 Proposal, and further explain the link between the Proposal and the NIS Directive as well as the NIS 2.0 Proposal in the recitals 4 and 5. In addition, the EDPS recommends the inclusion of wording in the main text as follows: ‘The minimum security requirements should be at least equal or higher than the minimum security requirements of the entities of NIS and NIS 2.0 Proposal’; — the EDPS strongly advises that the Proposal must clearly provide a legal ground for the processing of personal data by CERT-EU and the EUIs, including in particular the purposes of processing and the categories of personal data. In addition, the following elements should be explicitly laid down: (a) Identification of the controller(s), processors or joint controllers, as applicable; (b) Categories of data subjects; (c) Retention periods or at least criteria to determine such periods. The EDPS considers that these elements should be provided for explicitly in the Proposal, or at the very least, in a delegated act to be adopted subsequently by the Commission. The Proposal should provide for such a delegation; — the EDPS strongly recommends including ‘encryption at rest’, ‘encryption in transit’ as well as ‘end-to-end encryption’ in the list of minimum cybersecurity measures of the Annex II of the Proposal; — the EDPS strongly advises that the proposal provides for a specific obligation for the Local Cybersecurity Officer defined in article 4(5) to cooperate with the data protection officer designated in accordance with Article 43 EUDPR, when dealing with overlapping activities like applying data protection by design and by default to cybersecurity measures, selecting cybersecurity measures that involve personal data, integrated risk management, and integrated security incident handling; — the EDPS strongly advises adding a provision in Article 12 ‘CERT-EU mission and tasks’ of the Proposal that ‘CERT-EU shall work in close cooperation with the EDPS, when addressing incidents resulting in personal data breaches or in breach of confidentiality of electronic communications’; — the EDPS recommends adding an obligation for CERT-EU to inform the EDPS when addressing significant vulnerabilities, significant incidents or major attacks that have the potential to result in personal data breaches and/or in the breach of confidentiality of electronic communications; — the EDPS recommends providing in Article 12 that that the EDPS shall be involved in the CERT-EU cybersecurity awareness raising activities of the EUIs, in order to cover the interplay between personal data breach and cybersecurity incidents; — the EDPS recommends adding a provision in Article 12 ‘CERT-EU mission and tasks’ of the Proposal that would specify that CERT-EU shall inform without undue delay the EDPS when it has indications that an infringement by the EUIs of the obligations laid down in the Proposal entails a personal data breach; — the EDPS strongly advises that the European Data Protection Supervisor is added in Article 9(3) as a permanent participant in the IICB with one representative.

Brussels, 17 May 2022. Wojciech Rafał WIEWIÓROWSKI

(1) COM(2022) 122 final.

(2) COM(2022) 119 final.

(3) The EU’s Cybersecurity Strategy for the Digital Decade | Shaping Europe’s digital future (europa.eu) including a Joint Communication with the High Representative of the Union for Foreign Affairs and Security Policy (JOIN(2020)18).

(4) See chapter I. INTRODUCTION of the Strategy, page 4.

(5) Joint Communication from the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy to the European Parliament and the Council, titled ‘The EU’s Cybersecurity Strategy for the Digital Decade’.

(6) EDPS Opinion 5/2021 on the Cybersecurity Strategy and the NIS 2.0 Directive.

(7) The current role of CERT-EU stems from the Interinstitutional Agreement 2018/C 12/01.

(8) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).