Review of EU Legal Acts
Directive on Security of Network and Information Systems (NIS Directive)
The NIS Directive (Directive 2016/1148) aimed to boost cybersecurity across the EU. It required Member States to adopt national strategies, establish Computer Security Incident Response Teams (CSIRTs), and designate operators of essential services (like energy, transport, banking, healthcare) and digital service providers (like cloud services, search engines, and online marketplaces). These operators and providers had to implement appropriate security measures and report serious incidents to national authorities. The directive sought to create a baseline level of cybersecurity preparedness and cooperation across the EU.
General Data Protection Regulation (GDPR)
The GDPR (Regulation (EU) 2016/679) is the cornerstone of EU data protection law. It regulates the processing of personal data of individuals within the EU, regardless of where the data processing takes place. It establishes principles for data processing, such as lawfulness, fairness, and transparency. It grants individuals significant rights, including the right to access, rectify, erase, and restrict the processing of their personal data. The GDPR also imposes obligations on data controllers and processors, including implementing appropriate security measures, conducting data protection impact assessments, and appointing data protection officers in certain cases. Significant fines can be imposed for non-compliance.
Digital Services Act (DSA)
The Digital Services Act (Regulation (EU) 2022/2065) creates a framework of rules for online intermediaries and platforms. The rules are scaled depending on the size of the platform, with very large online platforms facing the strictest obligations. The DSA aims to tackle illegal content online, ensure transparency of algorithms, and empower users with greater control over their online experience. It includes measures to counter illegal goods, services and content online, and aims to provide better protection for users’ fundamental rights online. Obligations include removing illegal content quickly, implementing safeguards against manipulative practices (“dark patterns”), and providing users with information about why they are seeing certain content.
Digital Markets Act (DMA)
The Digital Markets Act (Regulation (EU) 2022/1925) targets large online platforms designated as “gatekeepers”. These gatekeepers are defined based on their size, user base, and impact on the internal market. The DMA imposes a set of obligations and prohibitions on these gatekeepers, aimed at preventing them from engaging in unfair practices that limit competition. These include obligations relating to data interoperability, self-preferencing, and access to platform data for business users. The DMA is intended to ensure a level playing field in digital markets and prevent gatekeepers from abusing their market power.