7. European Network and Information Security
Agency
| (24383)
6410/03
COM(03) 63
| Draft Regulation establishing the European Network and Information Security Agency.
|
| Legal base | Articles 95 and 156 EC; co-decision; QMV
|
| Department | Trade and Industry
|
| Basis of consideration | Minister's letter of 23 June 2003
|
| Previous Committee Report | HC 63-xviii (2002-03), paragraph 2 (9 April 2003)
|
| To be discussed in Council | No date set
|
| Committee's assessment | Legally and politically important
|
| Committee's decision | Not cleared; further information requested
|
Background
7.1 The draft Regulation proposes the establishment of the European
Network and Information Security Agency (ENISA) as a European
regulatory agency with legal personality and the privileges and
immunities of other Community institutions. Its objectives will
be to develop a common understanding in Europe of information
security issues, to increase the capability of the Community and
Member States to respond to network and information security problems,
to promote best practice, and to assist the Commission in its
analysis of the implementation of relevant Community legislation.
7.2 In his Explanatory Memorandum of 27 March 2003, which we considered
on 9 April 2003,[17]
the Minister for E-Commerce and Competitiveness (Mr Stephen Timms)
said that the choice of Article 95 EC as the primary legal base
could lead to the assumption that the Agency could take on an
operational role[18].
The Government took the view that the legal base should be challenged
and that the tasks to be undertaken by the Agency should be clarified
to make it clear that no operational role was envisaged. We shared
the Minister's view that the need was for a supportive and consultative
role. The Minister was also keen to ensure that the structure
of the management board would ensure significant Member State
influence in its direction.
7.3 The Chairman of the House of Lords Select Committee on the
European Union (Lord Grenfell), in a letter to the Minister dated
10 April 2003, said that his Committee, too, was cautious about
ENISA taking on an operational role.
The Minister's letter
7.4 The Minister now reports that, in the Telecoms Council on
5 June, despite strong legal arguments in favour of basing the
Regulation on Article 308 EC,[19]
only the UK and Germany were prepared to sustain opposition to
the use of Article 95 EC. Both countries abstained but all other
countries were in favour of a General Approach[20]
to a proposal based on Articles 95 EC and 156 EC.[21]
The UK retained its parliamentary scrutiny reserve.
7.5 The Minister comments:
"This is, of course, an unwelcome development but I do not
think the position reached should worry us too much. First, the
abstention sent a signal that we do not accept, as a general principle,
the use of Article 95 where the impact on the process of creating
a single market is secondary — that is, that the objective
does not focus primarily on the approximation of laws. Secondly,
it is clear that the Commission were driven by a policy objective
of avoiding basing new Agencies on Article 308 and we believe
that the Agency, at this stage, still poses no real threat either
to our national security interests or in confusing the responsibilities
for the implementation of the Communications Directives.
"Nevertheless, we will need to remain vigilant and ensure
that the tasks remain consistent with those incorporated into
the text subject to General Approach. We will also need to ensure
that the governance issues continue to allow for a high degree
of Member State influence. The timing of this proposal in relation
to the European Parliamentary election puts a high premium on
a First Reading deal. This will be a difficult negotiation and
we are sure — you may have seen some press coverage prompted
by the Commission's concern about the ground conceded to the Council
— that MEPs will be lobbied hard from all sides. I will
continue to keep you posted as this proposal progresses."
7.6 The Minister reassures Lord Grenfell that ENISA will not require
an additional call on UK funds.
Press report
7.7 The June Bulletin of the National Infrastructure Security
Co-Ordination Centre (NISCC) carries an item on ENISA, suggesting
that an attempt by Member States to alter the proposed structure
had placed the establishment of the agency in doubt. It notes
that the Commission had proposed that the key role of the agency
should be advisory, but also that the Commission envisaged a 30-strong
team dedicated to rapid reaction to cyber threats and incidents.
It then comments that "with Member States insisting on a
number of bureaucratic measures, the EU is now threatening to
withdraw funding for the agency".
7.8 The Bulletin then prints a comment from NISCC and the DTI
which reads:
"This press article reflects a view of progress in establishing
ENISA that is somewhat misleading, and we hope through this comment
to redress the balance.
"The Council of Ministers has now agreed a common approach
on the establishment of a European Network and Information Security
Agency. This differs in some important respects from the proposal
launched by the Commission in February. The version put by the
Council to the Parliament for the next stage of the legislative
process clearly makes the Agency a consultative and facilitating
body which will serve the interests of both the Commission and
the Member States — and not focus on supporting the Commission
as in the original proposal. The management structure of the
Agency has been changed to reflect this refocusing. It is hoped
that the co-decision process with the Parliament can be completed
by November allowing the Agency to start as scheduled in January
2004.
"Creating such an Agency was never going to be easy but,
as currently drafted, the Agency could make a real contribution
particularly in bringing the performance of some EU Member States
up to the level of the best".
Conclusion
7.9 We thank the Minister for giving us a clear account of
the Government's position on this proposal, which we support,
and for undertaking to keep us informed.
7.10 We do not believe that Article 95 EC confers powers to
create a new Community institution. It is a provision confined
to the approximation of the existing legislation of Member States.
We are concerned that the use of this article in this instance,
in itself incorrect in our view, would set a precedent. Plainly,
Article 308 EC is a necessary legal base for establishing the
envisaged agency, and it is therefore important that the Government
should continue its opposition to the use of Article 95 EC. We
ask the Minister to describe the arguments the other Member States
have deployed to justify their support for the use of Article
95 EC to create a new institution.
7.11 We also ask the Minister to elaborate on his reference
to a threat to the UK's national security interests. What activities
might the Agency undertake which could pose such a threat? We
also ask him to clarify his comment on the risk that responsibilities
for implementing the Communications Directives could be confused.
7.12 Meanwhile, we shall continue to keep the document under
scrutiny.
17 See headnote. Back
18
Article 95 EC provides for the approximation of Member States
laws which have as their object the establishment and functioning
of the internal market. Back
19
Article 308 provides for measures to be taken where the Treaty
has not provided the necessary powers, if these are necessary
to meet one of the objectives of the Community in the course of
the operation of the common market.It requires unanimity in the
Council. Back
20
Incorrectly described in the Explanatory Memorandum as a General
Agreement. Back
21
Article 156 EC provides, indirectly via Article 155(1), for EU
citizens, economic operators and regional and local communities
to derive full benefitfrom trans-European telecommunications networks
(Article 154). Back
| 
