Text proposed by the Commission Amendments proposed by the ECB (1)

Amendment 1

Recital 5

‘(5) To cover all relevant incidents and risks, this Directive should apply to all network and information systems. The obligations on public administrations and market operators should however not apply to undertakings providing public communication networks or publicly available electronic communication services within the meaning of Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) (2), which are subject to the specific security and integrity requirements laid down in Article 13a of that Directive nor should they apply to trust service providers.’ ‘(5) To cover all relevant incidents and risks, this Directive should apply to all network and information systems. The obligations on public administrations and market operators should however not apply to undertakings providing public communication networks or publicly available electronic communication services within the meaning of Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) (2), which are subject to the specific security and integrity requirements laid down in Article 13a of that Directive nor should they apply to trust service providers. Furthermore, notwithstanding the application of this Directive to public administrations and market operators, this Directive does not affect the tasks and duties conferred on the European System of Central Banks (ESCB) by the Treaty and the Statute of the European System of Central Banks and of the European Central Bank, nor equivalent functions performed by ESCB members under their national frameworks, especially regarding policies relating to the prudential supervision of credit institutions and the oversight of payment and securities settlement systems. Member States shall rely on the prudential supervision and oversight functions exercised by the central banks and supervisors of such operators within their fields of competence.’

Recital 5 should be amended in order to reflect the responsibilities of the ECB and the NCBs in overseeing and regulating payment and settlement systems. Pursuant to the fourth indent of Article 127(2) of the Treaty, one of the core tasks of the ESCB is to promote the smooth operation of payment systems. Article 22 of the Statute of the ESCB also empowers the ECB to make regulations to ensure efficient and sound clearing and payment systems. It should also be taken into consideration that, under Article 127(5) of the Treaty, the ESCB shall contribute to the smooth conduct of policies relating to the stability of the financial system. Furthermore, according to the Eurosystem’s Oversight Policy Framework of July 2011 (2), the ‘oversight of payment and settlement systems is a central bank function whereby the objectives of safety and efficiency are promoted by monitoring existing and planned systems, assessing them against these objectives and, where necessary, inducing change’. In other words, ensuring that the systems are safe and efficient is an important precondition for the Eurosystem’s ability to contribute to financial stability, to implement monetary policy and to maintain public confidence in the euro. Furthermore, in line with the ECB’s comments on the proposed revision of the directive on payment services (PSD2), it should be noted that national supervisors and the central banks are the competent authorities to issue guidelines on incident management and incident notifications for PSPs, as well as to issue guidelines on sharing incident notifications between the relevant authorities. The recital should also take due account of the tasks conferred on the ECB by Regulation (EU) No 1024/2013. Finally, when non-euro area ESCB members perform functions equivalent to those of the Treaty and ESCB Statute tasks, under their national provisions, those functions should also not be affected.

Amendment 2

Article 1(4) and (5) (new)

‘4. This Directive shall be without prejudice to EU laws on cybercrime and Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection (9) 5. This Directive shall also be without prejudice to Directive 95/46/CE of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (10), and to Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector and to the Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (11). 6. The sharing of information within the cooperation network under Chapter III and the notifications of NIS incidents under Article 14 may require the processing of personal data. Such processing, which is necessary to meet the objectives of public interest pursued by this Directive, shall be authorised by the Member State pursuant to Article 7 of Directive 95/46/EC and Directive 2002/58/EC, as implemented in national law.’ ‘4. This Directive shall be without prejudice to EUnion laws on cybercrime and Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection (9). 5. This Directive shall be without prejudice to the oversight and tasks conferred on the ECB and the ESCB concerning policies relating to the prudential supervision of credit institutions, and payment and settlement systems, for which specific risk management and security requirements have been set within the ESCB regulatory framework and that of other related Union directives and regulations. Equally this Directive shall not prejudice equivalent functions performed by ESCB members under their national frameworks. 5 6. This Directive shall also be without prejudice to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (10) and to Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector and to the Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (11). 6 7. The sharing of information within the cooperation network under Chapter III and the notifications of NIS incidents under Article 14 may require the processing of personal data. Such processing, which is necessary to meet the objectives of public interest pursued by this Directive, shall be authorised by the Member State pursuant to Article 7 of Directive 95/46/EC and Directive 2002/58/EC, as implemented in national law.’

As noted above, the ESCB has a keen interest in ensuring that payment and settlement systems function properly. This stems from the importance of payment, clearing and settlement systems for the smooth conduct of monetary policy operations and from the role they play in ensuring the stability of the financial system in general. Therefore, the ECB recommends that the proposed directive takes note of the role of the ESCB with regard to payment and settlement systems and the oversight framework already in place. The ESCB has highly effective tools to determine the safety and efficiency levels of these systems. The recital should also take due account of the tasks conferred on the ECB by Regulation (EU) No 1024/2013. The proposed directive should also not prejudice equivalent functions performed by non-euro area ESCB members under their national frameworks.

Amendment 3

Article 6(1)

‘1. Each Member State shall designate a national competent authority on the security of network and information systems (the “competent authority”).’ ‘1. Each Member State shall designate a national competent authority on the security of network and information systems (the “competent authority”). Effective cooperation shall be put in place between the competent authority and the European and national regulators. ’

Explanation The ECB recommends that Article 6(1) is amended in order to ensure a good level of cooperation at a Union level.

Amendment 4

Article 8(3)

‘3. Within the cooperation network the competent authorities shall: (a) circulate early warnings on risks and incidents in accordance with Article 10; (b) ensure a coordinated response in accordance with Article 11; (c) publish on a regular basis non-confidential information on on-going early warnings and coordinated response on a common website; (d) jointly discuss and assess, at the request of one Member State or of the Commission, one or more national NIS strategies and national NIS cooperation plans referred to in Article 5, within the scope of this Directive. (e) jointly discuss and assess, at the request of a Member State or the Commission, the effectiveness of the CERTs, in particular when NIS exercises are performed at Union level; (f) cooperate and exchange information on all relevant matters with the EuropeanCybercrime Center within Europol, and with other relevant European bodies in particular in the fields of data protection, energy, transport, banking, stock exchanges and health; (g) exchange information and best practices between themselves and the Commission, and assist each other in building capacity on NIS; (h) organise regular peer reviews on capabilities and preparedness; (i) organise NIS exercises at Union level and participate, as appropriate, in international NIS exercises.’ ‘3. Within the cooperation network the competent authorities shall: (a) circulate early warnings on risks and incidents in accordance with Article 10; (b) ensure a coordinated response in accordance with Article 11; (c) publish on a regular basis non-confidential information on on-going early warnings and coordinated response on a common website; (d) jointly discuss and assess, at the request of one Member State or of the Commission, one or more national NIS strategies and national NIS cooperation plans referred to in Article 5, within the scope of this Directive. ; (e) jointly discuss and assess, at the request of a Member State or the Commission, the effectiveness of the CERTs, in particular when NIS exercises are performed at Union level; (f) cooperate and exchange information on all relevant matters with the European Cybercrime Centrer within Europol, and with other relevant European bodies in particular in the fields of data protection, energy, transport, banking, stock exchanges and health; (g) exchange information and best practices between themselves and the Commission, and assist each other in building capacity on NIS; (h) organise regular peer reviews on capabilities and preparedness; (i) organise NIS exercises at Union level and participate, as appropriate, in international NIS exercises. ; (j) ensure the exchange of information with European and national regulators (i.e. for the financial sector: the European System of Central Banks (ESCB), the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA), which shall work closely together when security incidents are identified that could potentially impede the smooth functioning of payment and settlement systems).’

There is a strong case for sharing information with the European Network and Information Security Agency or competent authorities under the proposed directive, and with the EBA or ESMA as the competent authority for the coordination of responses to incidents relating to PSPs. Hence, the ECB proposes this amendment with a view to fostering information sharing and better coordination at a Union level.

Amendment 5

Article 19(1)

‘1. The Commission shall be assisted by a committee (the Network and Information Security Committee). That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.’ ‘1. The Commission shall be assisted by a committee (the Network and Information Security Committee). That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. The ECB, EBA and ESMA shall be invited to send a representative to the meetings of the Network and Information Security Committee on agenda items that might have implications on the performance of the respective mandates of the ECB, EBA or ESMA.’