2.EUROPEAN NETWORK AND INFORMATION SECURITY
AGENCY
(24383)
6410/03
COM(03) 63
|
Draft Regulation establishing the European Network and Information Security Agency.
|
| Legal base: | Articles 95 and 156 EC; co-decision; qualified majority voting
|
| |
| Document originated: | 11 February 2003
|
| Deposited in Parliament: | 26 March 2003
|
| Department: | Trade and Industry
|
| Basis of consideration: | EM of 27 March 2003
|
| Previous Committee Report: | None
|
| To be discussed in Council: | June or December 2003
|
| Committee's assessment: | Legally and politically important
|
| Committee's decision: | Not cleared; further information requested
|
Background
2.1 Although this is a new proposal, it has evolved from
ideas developed in earlier documents, notably the Council Resolution
of 30 May 2001: e-Europe Action Plan: Information and Network
Security,[2] and the
Council Resolution of 28 January 2002: A common approach and
specific actions in the area of network and information security,[3]
which proposed a cyber-security task force. The draft Regulation
has been developed in response to the need for increased co-ordination
between Member States to ensure a sufficiently high level of information
security across the EU.
The document
2.2 The draft Regulation proposes the establishment of
the "European Network and Information Security Agency"
(ENISA) as a European regulatory agency with legal personality
and the privileges and immunities of other Community institutions.
Its objectives will be to develop a common understanding in Europe
of information security issues, to increase the capability of
the Community and the Member States to respond to network and
information security problems, to promote best practice, and to
assist the Commission in its analysis of the implementation of
relevant Community legislation.
2.3 The Agency will initially be set up for five years,
with the possibility of renewal. It will have a formal management
structure, and is scheduled to start work in January 2004.
2.4 The proposal includes a new budget line of _33,300m
(£21,835m) overall, covering the years 2004 to 2008.
The Government's view
2.5 The Minister of State for E-Commerce and Competitiveness
(Mr Stephen Timms) tells us that the Regulation will be directly
applicable in UK law. The Agency will, therefore, have legal personality,
privileges and immunities and be liable in contract and tort (or
delict) under the law of the relevant part of the United Kingdom.
2.6 He continues:
"The Regulation maintains the momentum established under
the French, Swedish and Belgian Presidencies of giving higher
priority to information security issues. It acknowledges the importance
and wide scope of information security
"The Commission is sensitive to the need to ensure that the
proposal does not lead to the establishment of an operational
unit. However the Commission's choice of Articles 95 as the primary
legal basis has to be challenged. It leads to an assumption that
the Agency can take on an operational role. This is being addressed,
and an updated EM will be provided if applicable.
"Clarifying the tasks to be undertaken, the legal basis,
and the structure of the management board would make clear that
the Agency is not an operational unit, and ensure Member States'
influence on its direction."
2.7 The Minister tells us that the minutes of the 27
March Transport, Telecommunications and Energy Council (at which
the proposal was presented) include a Declaration reaffirming
the Commission's intention to set up a temporary interdisciplinary
working group to prepare for the establishment of the Agency.
The draft Regulation itself is expected to be put for adoption
to the Council in June or December.
Conclusion
2.8 We share the Minister's view that there should
be no possibility of the Agency's taking on an operational role.
We shall, therefore, keep the proposal under scrutiny until we
know how the issue of the legal base has been resolved.
2 (22580)
-; see HC 152-ii (2001-02), paragraph 34 (17 October 2001). Back
3 (23093)
-; see HC 152-xiv (2001-02), paragraph 15 (23 January 2002). Back
| 
