On 23 June 2016, the people of the United Kingdom voted to leave the European Union. Read our initial Q&A on Brexit and Privacy here. However, it is important to remember that (for now) the UK remains part of the EU and we must abide by the current and upcoming data protection and security legislation until we are told otherwise. Plus, ask yourselves this – is cybersecurity something you are willing to sacrifice?
GDPR
What is it? The General Data Protection Regulation ("GDPR") is a Regulation by which the European Commission intends to strengthen and unify data protection for EU citizens. It is due to come into force on Friday 25th May 2018 (before the UK will be able to leave the EU).
What's at stake? It will overhaul data protection legislation across the EU, imposing much stricter obligations on data controllers and data processors (regardless of their location or establishment) that offer goods or services to EU citizens' or monitor EU citizens' personal data in some way. Further, the UK's data protection regulator, the Information Commissioner's Office ("ICO") has commented that it intends to push for the UK to adopt the GDPR, despite Brexit.
Key takeaway: In or out. The GDPR is here to stay.
NISD
What is it? The Network and Information Security Directive (aka "the Cyber Directive", "the NIS Directive" or the "NISD") is part of the EU's cybersecurity strategy aimed at tackling network and information security incidents and risks across the EU. It is important to note that it is a Directive, which means each Member State will have to draft implementing legislation in order for it to become law, unlike a Regulation (like the GDPR), which becomes law automatically. On its current timetable, the NISD seems likely to enter into force this summer. Following this, Member States will have 21 months to implement this Directive into their national laws and a further six months to identify operators of essential services. Practically, this means the UK will have to begin to draft implementing legislation over the coming months, a serious challenge against the current political backdrop.
What's at stake? The NISD will impose new network security and reporting requirements on operators of essential services and digital service providers in the energy, transport, banking and healthcare sectors, as well as providers of key digital services like search engines and cloud computing. Most commentary on the NISD agrees that this is a piece of legislation the UK will want to (and should) keep. It is aimed at countering cyber risk on a pan-European scale, via building and planning requirements, exchange of information, cooperation and common security requirements.
Key takeaway: Cyber risk has no borders, so pan-EU cooperation is vital. This is a welcome piece of EU red tape that is coming soon.
ePrivacy Directive
What is it? A proposal by European Commission to reform the current ePrivacy Directive by 2017. Essentially, it will aim to be consistent with the GDPR and the NISD.
What's at stake? Like for the NISD (as a Directive rather than a Regulation) each Member State can choose the form of national legislation the ePrivacy rules will take. Currently, rules on cookies, processing of location data and unsolicited marketing vary across the EU. The rules affect almost everyone from telecom operators and other service providers to public authorities, consumer associations, citizens, businesses, manufacturers and academics. The UK will have to decide what line it wants to take on ePrivacy.
Key takeaway: Could go either way, but it would be sensible for the UK to follow the EU's recipe when it comes to cookies and the like.
[View source.]
