Keywords

“Trust and security” were the words that resonated at the recent East West Institute Cyber Security Summit held in London in 2011 [1]. Whilst discussing the need for a Cyber Security Treaty, there was consensus amongst Government bodies and policy makers that cybersecurity was an issue that needed to be addressed. Amongst the examples in support of a call for a Cybersecurity Initiative, the following examples (not exhaustive) were given:

Is it acceptable for one country to attack another hospital’s database? How about the flight systems that support passenger planes in the air? [2]

Whilst these examples may seem remote with culpability normally attributed to the individual(s) rather than the collective responsibility of a State for the actions or inactions in the event of a cybersecurity breach and criminal sanctions imposed where appropriate (see the UK Computer Misuse Act for instance), it is indicative of the concern for discussion amongst cybersecurity issues by experts, corporations and governmental officials around the world.

Discussion about data protection issues and its role arose very briefly. The Data Protection framework within Europe remains a key focal point in understanding how best to achieve a balance between an individual’s right to their privacy whilst protecting right to freedom of expression. Information security in the data protection context is more concerned with security breaches involving the loss of data held for instance on a CD or a database resulting in calls from the Data Protection Regulatory Authorities (see UK ICO [3] as an example) for stronger legislative remedies for individuals to deal with Information Security setbacks (see UK ICO [3] and Germany [4, 5] as an example).Footnote 1

This SpringerBrief will consider the notion of cybersecurity in the context of data protection. By this, one is referring to “data breach notification and data security breaches”. This will be followed by a detailed analysis of data security provisions under the Data Protection framework by revisiting the background into the Data Protection Directive 95/46/EC and the Directive on Privacy and Electronic Communications 2002/58/EC (as amended by the Citizens Directive 2009/136/EC). The author will then consider the proposed data breach notification provisions introduced under the Data Protection Regulation on January 2012, the UK ICO’s response and the European Parliament’s proposed amendments followed by a consideration of the Directive against Information system and the proposed EU’s draft of the Cybersecurity Directive introduced in January 2013, which is a significant development and its shortcomings.