European Commission Opens Consultation On Cyber Security Legislation

The European Commission (EC) is looking for views on a legislative proposal on data security, as it draws together fresh plans on countering cyber crime across the continent.

In particular, the EC will look at “future risk management and security breach reporting requirements”. The consultation runs until 12 October 2012.

The proposal will form part of  a joint Strategy on cyber security, due to be presented by the Commission and the EU High Representative for Foreign Affairs and Security Policy later this year.

Fostering ‘a cyber security culture’

“As far as network and information systems are concerned, the aim would be to enhance preparedness, strengthen the resilience of critical infrastructure as well as to foster a cyber security culture in the EU,” it said in a statement.

“The Commission is considering the introduction of a requirement to adopt risk management practices and to report security breaches affecting networks and information systems that are critical to the provision of key economic and societal services.”

The EC is already discussing what changes need to be made to data protection proposals announced in January. The body offered up both a regulation, setting out “a general EU framework for data protection”, and a directive which sets out rules on the protection “of personal data processed for the purposes of prevention, detection, investigation or prosecution of criminal offences and related judicial activities.”

Some aspects of the regulation upset onlookers, including the stipulation that companies must report breaches to the relevant authorities within 24 hours of them happening. The EC also wants businesses with more than 250 employees to appoint a designated data protection officer, adding more cost to compliance. Under the proposals, regulators would be able to fine companies as much as €1 million (£780m) or up to two per cent of their global annual turnover.

The framework has been criticised as over-prescriptive. Even the UK’s data protection watchdog, the Information Commissioner’s Office (ICO), said it needed more work.

Have you got security skills? Try our quiz!