Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Regulation on information security in the institutions, bodies, offices and agencies of the Union

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2022/C 258/06)

The European Commission adopted on 22 March 2022 a Proposal for a Regulation of the European Parliament and of the Council on the information security in the institutions, bodies, offices and agencies of the Union (‘the Proposal’).

The EDPS welcomes the aim of the Proposal to improve the security of information handled by the EUIs, by establishing common information security rules as well fostering a coherent information security culture in a specific legal instrument.

The EDPS observes that personal data security as mandated by the EUDPR has a scope that only partially overlaps with the scope of the information security under the Proposal. The latter focuses on the confidentiality of information, whereas the EUDPR ensures also integrity and availability. Furthermore, the EUDPR personal data security provisions specifically address the risks for the rights and freedoms of natural persons.

The Proposal requires the EUIs to adopt information security measures, which will inevitably involve the processing of personal data and of electronic communications data, including traffic data. The EDPS considers that it must be made evident that all information security measures involving processing of personal data should be compliant with the current data protection and privacy legal framework and that EUIs should take relevant technical and organisational safeguards to ensure this compliance in an accountable way.

To achieve legal certainty and foreseeability, and to ensure compliance with the EUDPR, the EDPS strongly advises that the Proposal, or at the very least, a delegated act to be adopted subsequently by the Commission, clearly defines the personal data processing activities that are allowed for the purposes of this Regulation. The EDPS also draws the attention to the need to ensure compliance with the EUDPR rules regarding transfers of personal data to third countries and international organisations. Moreover, the EDPS recommends explaining in a Recital, that all of the EUDPR provisions will apply, including the rules on international transfers.

The EDPS stresses the importance of integrating the privacy and data protection perspective in the information security management, in order to achieve positive synergies between the Proposal and privacy and data protection legislation, and provides specific recommendations on how such synergies can be achieved, including: a specific obligation for EU officials responsible for information security to cooperate closely with the data protection officer designated in accordance with Article 43 EUDPR; the integration of end-to-end encryption in the list of minimum security measures of the Proposal, where applicable, and in particular when exchanging sensitive non-classified information; and the promotion of an integrated information security risk management and an integrated incident handling process that serve both information security and data protection obligations on data breach notifications.

1. INTRODUCTION AND BACKGROUND

1. The European Commission adopted on 22 March 2022 a Proposal for a Regulation of the European Parliament and of the Council on the information security in the institutions, bodies, offices and agencies of the Union (1) (‘the Proposal’).

2. On the same date, the European Commission adopted another Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union (2) (‘the Cybersecurity Proposal’).

3. Both Proposals had been envisaged by the EU’s Cybersecurity Strategy for the Digital Decade presented on 16 December 2020 (3) (‘he Strategy’). The overall aim of the Strategy was to strengthen the Union’s strategic autonomy in the fields of cybersecurity and to improve its resilience and collective response as well as to build a global and open Internet with strong guardrails to address the risks to security and fundamental rights and freedoms of people in Europe (4).

4. The Proposal constitutes one of the regulatory initiatives of the Strategy, and in particular in the area of Cybersecurity of the EU Institutions, bodies, offices and agencies (‘the EUIs’). According to the Strategy, the aim of the Proposal is twofold: — to facilitate the interoperability of classified information systems, allowing a seamless transfer of information between the different entities, and — to enable an inter-institutional approach to the handling of EU classified information and sensitive non-classified information, which could also serve as a model for interoperability across Member States, stating that the EU should also further develop its ability to communicate in a secure manner with relevant partners, building to the extent possible on existing arrangements and procedures.

5. The EDPS observes that the subject matter of the Proposal at hand is also directly related to the Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing Directive (EU) 2016/1148 (‘NIS 2.0 Proposal’). The EDPS recalls that he issued the Opinion 5/2021 on the Cybersecurity Strategy (5) and the NIS 2.0 Directive (‘NIS 2.0 Opinion’) (6). For this reason the present Opinion will refer to the NIS 2.0 Opinion.

6. According to the explanatory memorandum of the Proposal, due to the ever-increasing amount of sensitive non-classified (‘SNC’) information and European Union classified information (‘EUCI’) that the EUIs need to share amongst themselves and considering the dramatic development of the threat landscape, the European administration is exposed to attacks in all its areas of activity. The information handled by the EUIs is very attractive for the threat actors and needs to be appropriately protected.

7. According to the explanatory memorandum, the Proposal would: — establish harmonised and comprehensive categories of information, as well as common handling rules for all EUIs, — set up a lean cooperation scheme on information security between EUIs able to foster a coherent information security culture across the European administration, — modernise the information security policies at all levels of classification/categorisation, for all EUIs, taking into account the digital transformation and the development of teleworking as a structural practice.

8. On 22 March 2022 the Commission consulted the European Data Protection Supervisor pursuant to Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (‘EUDPR’) (7). The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection and privacy perspective.

4. CONCLUSIONS

31. In light of the above, the EDPS makes the following main recommendations: — the EDPS strongly advises that the Proposal clearly defines the personal data processing activities that are allowed for the purposes of this Regulation, including: the purpose(s) of the processing; categories of personal data; categories of data subjects; definition of roles as applicable (controller, processor, joint controllers), retention periods, recipients in case of transmission to entities not subject to the EUDPR. The EDPS considers that these elements should be provided for explicitly in the Proposal, or at the very least, in a delegated act to be adopted subsequently by the Commission. The Proposal should provide for such a delegation; — the EDPS recommends explaining in a Recital, that all of the EUDPR provisions will apply, including the rules on international transfers. Recital 6 can also be used to include any other general data protection recommendations made in this Opinion that do not aim at changing the substantive provisions; — the EDPS strongly recommends including end-to-end encryption in the list of minimum security measures of the Proposal, where applicable, and in particular when exchanging sensitive non-classified information; — the EDPS recommends adding in Article 5(3), that in the factors under consideration by the information security risk management process, also the threats stemming from access based on third countries jurisdiction (e.g. by their public authorities) shall be considered; — the EDPS strongly advises to explain in a relevant recital the benefits of having an integrated information security risk management and an integrated incident handling process that serves both information security and data protection obligations on data breach notifications; — the EDPS strongly advises that the proposal provides for a specific obligation for EU officials responsible for information security to cooperate closely with the data protection officer designated in accordance with Article 43 EUDPR, when dealing with activities such as applying data protection by design and by default to information security measures, selecting security measures that involve personal data, integrated risk management, integrated security incident handling.

Brussels, 17 May 2022. Wojciech Rafał WIEWIÓROWSKI

(1) COM(2022) 119 final.

(2) COM(2022) 122 final.

(3) The EU’s Cybersecurity Strategy for the Digital Decade | Shaping Europe’s digital future (europa.eu) including a Joint Communication with the High Representative of the Union for Foreign Affairs and Security Policy (JOIN(2020)18).

(4) See chapter I. INTRODUCTION, page 4 of the Strategy.

(5) Joint Communication from the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy to the European Parliament and the Council, titled ‘The EU’s Cybersecurity Strategy for the Digital Decade’.

(6) EDPS Opinion 5/2021 on the Cybersecurity Strategy and the NIS 2.0 Directive.

(7) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).