Regulatory Impact on 5G Security and Privacy 403
have implemented legislation that prohibits the transfer of personal information
from the EU to third countries, unless such countries have adequate privacy protection in their laws [1].
On 25 January 2012, the European Commission proposed a comprehensive reform of
the EU data protection rules. The new European Data Protection Regulation is meant
to supersede the EU Data Protection Directive from 1995. According to the EC, the new
rules will strengthen online privacy rights and boost Europe’s digital economy. The
reform of the outdated privacy rules reflects that technological progress and globalization have profoundly changed the way data are collected, accessed and used [13].
The European Parliament, having already voted in favor of the General Data Protection
Regulation (“GDPR”) [14], voted on 14 March 2014, on the proposed Network and
Information Security (“NIS”) Directive [15]. In line with the previous committee
reports, the Parliament vote ensures that the Proposed Network and Information
Security Directive focuses on protecting critical infrastructure in the energy, transport,
financial services and health sectors. The EU legislative bodies will now enter into negotiations to agree a final text [16].
The Commission proposed the NIS Directive in February 2013. In addition to provisions aimed at Member State governments (e.g. to improve cyber security capabilities
and cooperation to prevent and respond to cyber‐attacks), the Directive targets private
companies in the energy, transport, financial services and health sectors. These sectors
are seen to be dependent on the correctly functioning network and information
systems. The Commission draft also applied to “enablers of key internet services”, such
as providers of cloud computing services, app stores, e‐commerce platforms, internet
payment gateways, search engines and social networks.
The policy options for ensuring NIS have been assessed in the Impact Assessment of
the NIS Directive [17]. Three policy options have been named as:
1) Option 1 – Business as usual;
2) Option 2 – Regulatory approach; and
3) Option 3 – Mixed approach.
The assessment covers, in addition to the level of security, the economic and social
impacts of the three options.
For comparison, the United States does not provide adequate privacy protection from
the European point of view [18]. To address this problem, the European Commission
and the US Department of Commerce negotiated the Safe Harbor agreement, which is
only applicable to transfers between the USA and the EU. Organizations outside the
USA that have business operations within the EU, have to rely on different mechanisms
to adhere to the Transborder Transfer principle from Directive 95/46/EC. This principle requires that personal identifiable information can only be transferred to those
countries that are deemed to provide adequate security.
17.3.2 Legal Framework for Security and Privacy in Cloud Computing
In Europe, the processing of personal data is mainly regulated by the Data Protection
Directive 95/46/EC [12], which is currently under revision. The Directive imposes
stringent duties and obligations on the actors of such processing, mainly on the
have implemented legislation that prohibits the transfer of personal information
from the EU to third countries, unless such countries have adequate privacy protection in their laws [1].
On 25 January 2012, the European Commission proposed a comprehensive reform of
the EU data protection rules. The new European Data Protection Regulation is meant
to supersede the EU Data Protection Directive from 1995. According to the EC, the new
rules will strengthen online privacy rights and boost Europe’s digital economy. The
reform of the outdated privacy rules reflects that technological progress and globalization have profoundly changed the way data are collected, accessed and used [13].
The European Parliament, having already voted in favor of the General Data Protection
Regulation (“GDPR”) [14], voted on 14 March 2014, on the proposed Network and
Information Security (“NIS”) Directive [15]. In line with the previous committee
reports, the Parliament vote ensures that the Proposed Network and Information
Security Directive focuses on protecting critical infrastructure in the energy, transport,
financial services and health sectors. The EU legislative bodies will now enter into negotiations to agree a final text [16].
The Commission proposed the NIS Directive in February 2013. In addition to provisions aimed at Member State governments (e.g. to improve cyber security capabilities
and cooperation to prevent and respond to cyber‐attacks), the Directive targets private
companies in the energy, transport, financial services and health sectors. These sectors
are seen to be dependent on the correctly functioning network and information
systems. The Commission draft also applied to “enablers of key internet services”, such
as providers of cloud computing services, app stores, e‐commerce platforms, internet
payment gateways, search engines and social networks.
The policy options for ensuring NIS have been assessed in the Impact Assessment of
the NIS Directive [17]. Three policy options have been named as:
1) Option 1 – Business as usual;
2) Option 2 – Regulatory approach; and
3) Option 3 – Mixed approach.
The assessment covers, in addition to the level of security, the economic and social
impacts of the three options.
For comparison, the United States does not provide adequate privacy protection from
the European point of view [18]. To address this problem, the European Commission
and the US Department of Commerce negotiated the Safe Harbor agreement, which is
only applicable to transfers between the USA and the EU. Organizations outside the
USA that have business operations within the EU, have to rely on different mechanisms
to adhere to the Transborder Transfer principle from Directive 95/46/EC. This principle requires that personal identifiable information can only be transferred to those
countries that are deemed to provide adequate security.
17.3.2 Legal Framework for Security and Privacy in Cloud Computing
In Europe, the processing of personal data is mainly regulated by the Data Protection
Directive 95/46/EC [12], which is currently under revision. The Directive imposes
stringent duties and obligations on the actors of such processing, mainly on the