Opinion on the Proposal for a Regulation on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020

The European Data Protection Supervisor (EDPS) published its Opinion on a proposed Regulation laying down cybersecurity requirements for products with digital elements. 

Concretely, the proposed Regulation aims to set out EU-wide cybersecurity requirements for a broad range of hardware and software products and their remote data processing solutions. These include, for example, browsers, operating systems, firewalls, network management systems, smart meters or routers.

Wojciech Wiewiórowski, EDPS, said: “The cybersecurity of products with digital elements is of utmost importance to protect effectively individuals’ fundamental rights in the digital age, including their rights to privacy and data protection. Harmonised cybersecurity requirements across the EU should reduce the risks for Europeans of being victims of cyber-attacks and of the vast consequences that these may entail, such as the theft and misuse of their personal data.”

In its Opinion, the EDPS reiterates that under the General Data Protection Regulation (GDPR), an appropriate level of security of the processing of personal data must be ensured by controllers and processors. In addition, data protection principles must be embedded throughout the development of technologies that process personal data, including many products with digital elements. As such, the EDPS welcomes the proposed Regulation’s measures that would make security and data minimisation principles an essential part of the EU-wide cybersecurity requirements. Nevertheless, the EDPS strongly recommends to also include the data protection by design and by default principles as an essential part of these requirements.

Concerning the standardisation and certification on cybersecurity mentioned in the proposed Regulation, the EDPS suggests clarifying the type of synergies envisaged between the relevant bodies and organisations. This includes the European Data Protection Board, which brings together the national data protection authorities of the EU and the EDPS.

The EDPS highlights that the proposed European cybersecurity certificate under the cybersecurity standardisation and certification for certain products with digital elements should not serve as a replacement for the GDPR certification, which already guarantees compliance with the GDPR.  It should be made clear in the proposed Regulation that the cybersecurity certificate does not mean that a particular product with digital elements is compliant with the GDPR.

The EDPS suggests clarifying the relationship between the proposed Regulation and EU data protection laws, specifically how these will interact in the area of market surveillance and enforcement. To this end, it is the EDPS’ opinion that the proposed Regulation should not affect, or seek to affect, existing EU laws that are already governing the processing of individuals’ personal data and the tasks and powers of independent data protection authorities. (source: edps.europa.eu/ photo: freepik.com)

The Opinion 23/2022 is available here

Comments

Post a Comment

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld her find
Read more

The Lawyer's right to refuse the defense of an accused person for ethical reasons

Image
by Giorgos Kazoleas, Lawyer LL.M. Lawyers have the right to refuse to undertake a case when it conflicts with their moral principles, their dignity and conscience. Both the Code of Lawyers in Greece and the Code of Lawyers 'Ethics in Cyprus provide the legal framework to support this choice.   The Greek Legislation The lawyer's right to refuse the defense of a specific defendant in a criminal trial clearly follows from the wording of article 37 of the Lawyers' Code (Law 4194/2013). According to paragraph 1 of this article, the lawyer has an obligation to undertake any case, unless it is manifestly unfounded, not amenable to defense, conflicts with the interests of other clients or goes against his/her principles. According to paragraph 2, the lawyer must undertake the defense of any accused, if requested by the judicial authorities, subject to paragraph 1. The reasons for refusing to undertake a case are expanded by article 6 of the Greek Code of Ethics of the Legal Pro
Read more

First judgment of the ECHR: Lawless v. Ireland

Image
60 years ago, on 14 November 1960, the Court delivered its first judgment, Lawless v. Ireland, with René Cassin as its President. The judgment concerned preliminary objections and procedural questions regarding the application, on which a judgment on the merits was delivered the following year. Since its inauguration the Court has delivered 23,291 judgments on just over 51,650 applications. The case was filed by Gerard Richard Lawless, who had been an IRA member, although he claimed to have left the IRA. He was arrested on 11 July 1957, as he was about to travel to Great Britain from Ireland, and subsequently detained under the special powers of indefinite detention without trial under the Offences against the State (Amendment) Act 1940. The case was filed by Lawless for violation, by the Irish Government, of Articles 5, 6 and 7 of the European Convention of Human Rights, providing rights to liberty and security, fair trial and the principle of 'no punishment without law'
Read more

Sanction imposed on judge for Facebook posts concerning matters of public interest infringed his freedom of expression (ECtHR)

Image
In Chamber’s judgment   in the case of Danileţ v. Romania (application no. 16915/21) the European Court of Human Rights held, by a majority (four votes to three), that there had been a violation of Article 10 (freedom of expression) of the European Convention on Human Rights. The case concerned a disciplinary sanction imposed on a judge by the National Judicial and Legal Service Commission for posting two messages on his Facebook account. The Court found that the domestic courts had failed to give due consideration to several important factors, in particular concerning the broader context in which the applicant’s statements had been made, his participation in a debate on matters of public interest, the question whether the value judgments expressed had been sufficiently based in fact and, lastly, the potentially chilling effect of the sanction. In addition, the existence of an attack on the dignity and honour of the profession of judge had not been sufficiently demonstrated. In the
Read more

Politically Exposed Persons (PEPs): What and Why?

Image
By Christina Poursanidou, Lawyer Politically Exposed Persons (PEPs) are considered as high-risk individuals for financial institutions and obliged entities, which justifies the application of additional Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) preventive measures with respect to business relationships with them. But who is considered as a PEP and why being a PEP poses a risk? The Financial Action Task Force (FATF) has defined a PEP as an individual who is or has been entrusted with a prominent public function, while the Article 3 par. 9 of the 4th EU AML Directive (AMLD) repeats the definition of the FATF and provides a list of particular political positions, which make somebody a PEP. It is crucial to note that both FATF and EU have included in the scope of PEPs, the family members and close associates of PEPs, which means that not only the persons with have been entrusted with prominent public function are considered as high-risk, but also their family member
Read more

Gigantic fine for unfair practices imposed on Booking.com by the Competition Authority of Hungary

Image
One of the highest fines for violation of unfair competition law has been imposed (28/4/2020) on online hotel booking platform ‘’Booking.com’’ by the Hungarian Competition Authority. The amount of the fine (approximately EUR 6 million / HUF 2.5 billion) imposed by the Authority illustrates the seriousness of the Dutch company's violations. The Hungarian Competition Authority (GVH) imposed a fine of HUF 2.5 billion on the operator of the online booking portal booking.com, and at the same time banned the Dutch company from continuing its aggressive sales methods. According to the decision of the competition authority, Booking.com B.V. engaged in unfair commercial practices against consumers by, among other things, misleadingly advertising some of its accommodations with a free cancellation option and exerting undue psychological pressure on consumers to make early bookings. As a result of the Competition Authority’s competition supervision proceeding  initiated in 2018, the autho
Read more

Graduate Programme 2024 for EU Nationals in European Central Bank

Image
European Central Bank (ECB) is looking for 15 highly talented recent graduates with a postgraduate degree, eventually a PhD, for the ECB’s Graduate Programme offering full time monthly net salary €4,611 plus benefits. General Information  Type of contract: Two-year fixed-term contract starting on 1 September. It may be extended for one additional year upon successful completion of the programme. Who can apply?  EU nationals Salary  E/F (bracket 1 - step 1) full time monthly net salary: €4,611 plus benefits, for further information see  here . Working time:  Full time Place of work:  Frankfurt am Main, Germany Closing date:  21.02.2024 ECB is looking for 15 highly talented recent graduates with a postgraduate degree, eventually a PhD, for the ECB’s Graduate Programme.  You will have different ages, backgrounds and interests and will find intellectual challenges, varied opportunities and a people-centred working culture that gives you a voice and the chance to make an i
Read more