Organisations offering certain digital services in the United Kingdom (UK) and European Union (EU) should consider the impact of Brexit and their obligations under applicable cybersecurity law.

Introduction

The UK Government recently issued a proposal regarding the application of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) to non-UK "digital service providers" (DSPs) once the UK exits from the EU.

DSPs established inside and outside of the UK should understand the impact of the UK Government's proposal and start planning now to ensure compliance post-Brexit.

The NIS Regulations

The NIS Regulations implement an EU directive, the Network and Information Systems Directive (EU) 2016/148 (NIS Directive). The aim of the NIS Directive is to create common standards on network and information security across the EU.

The NIS Directive, and the UK's NIS Regulations, are an attempt by lawmakers to address some of the risks posed to individuals and the wider economy that can arise from security incidents affecting key networks and information systems.

The NIS Regulations apply to "operators of essential services" (such as organisations operating in the energy, transport, health, water and digital sectors) and DSPs. The DSP category includes organisations providing one of the following digital services:

• Online marketplace;
• Online search engine; and
• Cloud computing service.

See our previous article on the NIS Regulations for further information on some of the key obligations and the consequences associated with non-compliance.

The NIS Regulations post-Brexit

Perhaps unsurprisingly, the UK Government has confirmed that the NIS Regulations will continue to apply in the UK after Brexit.

In practice, unless and until the NIS Regulations are repealed, the essential requirements of the NIS Directive will continue to apply to in-scope organisations in the UK through the application of the NIS Regulations.

Obligations of UK-based DSPs post-Brexit

The NIS Directive requires DSPs not established in the EU, but which offer their services within the EU, to designate a representative in an EU Member State where the DSP offers its services.¹

Once a representative in the EU has been designated, the DSP is required to comply with the domestic legislation giving effect to the NIS Directive in the EU Member State where its nominated representative is established. The representative is required to act on behalf of the DSP and be the point of contact with the relevant authorities.

Once the UK is no longer a Member State of the EU, the NIS Directive requirement to appoint a representative in the EU will apply to DSPs established in the UK (and which are not established in the EU) and which offer their services within the EU. Such DSPs are then required to designate a representative in an EU Member State where they offer their services.

In practice, this may result in some UK-based DSPs being responsible for complying with the NIS Regulations in the UK, and the domestic legislation giving effect to the NIS Directive of an EU Member State. This could lead to complexities and an increase in resource costs associated with compliance, especially if the EU and the UK regimes develop differently over time. For example, a UK-based DSP impacted by a cybersecurity incident may have to notify and liaise with multiple regulators in the UK and the EU, each with their own notification requirements and expectations.

Obligations of DSPs not based in the UK post-Brexit

In its proposal to regulating non-UK based DSPs post-Brexit, the UK Government has outlined its intention to introduce a requirement for DSPs not established in the UK, which offer their services within the UK, to appoint a UK-based representative.

The UK Government intends to implement legislation amending the NIS Regulations to give effect to its proposal, which will become effective on the twentieth day after the UK leaves the EU.

The UK Government's proposal is that the UK-based representative:

• can be any person (natural or legal) established in the UK, and who is able to act on behalf of the relevant DSP with regard to its obligations under the NIS Regulations;
• must be designated in writing;
• must be contactable by the Information Commissioner's Office (which is responsible for regulating DSPs for the purposes of the NIS Regulations) or GCHQ for the purposes of ensuring compliance with the NIS Regulations;
• is nominated without prejudice to any legal action which could be initiated against the DSP which nominates the representative; and
• must be nominated within three months of the amendment to the NIS Regulations coming into force, or within three months of the relevant organisation becoming an in-scope DSP.

Similar to UK-based DSPs offering their services within the EU post-Brexit, some DSPs based outside of the UK will be responsible for complying with the NIS Regulations in the UK, and the domestic legislation giving effect to the NIS Directive of an EU Member State. The same issues facing the UK DSPs mentioned above may also be faced by non-UK DSPs.

Impact for Business

DSPs established in the UK (and not established in the EU), which offer services within the EU, should establish plans to appoint a representative in the EU post-Brexit. Similarly, DSPs established outside of the UK, which offer services within the UK, should establish plans to appoint a representative within the UK post-Brexit.

DSPs that will be subject to both the NIS Regulations and Member State domestic law giving effect to the NIS Directive should consider implementing procedures to ensure regular monitoring and effective and efficient compliance with each regime.

Failure to comply with the relevant requirements of the NIS Regulations in the UK exposes organisations to enforcement action, including the imposition of fines of up to £17 million.

¹ Article 18(2) of the NIS Directive

Click here to download PDF.

[View source.]