The European Data Protection Board (EDPB) and EDPS have adopted a joint opinion on the European Commission's cybersecurity package, which includes a revised Cybersecurity Act (CSA2) and targeted amendments to the Network and Information Security 2 (NIS2) Directive.
The package aims to further strengthen cybersecurity across Europe while easing compliance for organisations. The two bodies broadly welcome the proposal's objectives, including the strengthened role of the EU Agency for Cybersecurity (ENISA) in supporting digital resilience and facilitating uptake of cybersecurity certification.
At the same time, they recall that security controls should be implemented in a way that does not undermine individuals’ fundamental rights and freedoms. Against this background, they welcome the opportunities for synergies and cooperation with ENISA to create a robust ecosystem where security and privacy go hand in hand.
The EDPB and EDPS also offer specific recommendations in relation to cybersecurity, such as:
- greater clarity on the relationship between the European Cybersecurity Certification Framework and GDPR certification;
- take into account that certification schemes for products and services likely to be used in data processing may also help to demonstrate GDPR compliance;
- ENISA to consult the EDPB before adopting any certification scheme relating to the security of personal data processing.
Consistent with the earlier EDPB-EDPS position on the Digital Omnibus, the joint opinion also reiterates support for a single-entry point for notifying personal data breaches. This measure would reduce the administrative burden on organisations without weakening protection for individuals.
On the proposed NIS2 amendments, the two bodies welcome the designation of European Digital Identity Wallet and European Business Wallet providers as ‘essential entities’, bringing with it more rigorous risk management requirements and supervisory oversight.
Read the joint opinion here
Read the press release here
