BIG BROTHER IS WATCHING YOU. Or rather, hackers are watching you. The rapid development of new technologies exposes businesses and individuals to increasing cybersecurity risks. The news is often marked by massive computer attacks.
Thus, last January, two third-party payment operators, Viamedis and Almerys, were victims of an unprecedented attack resulting in the data leak of more than 33 million people. We can also cite the famous case involving the British company Cambridge Analytica which collected the data of more than 50 million Facebook users, without authorization, in order to build a computer program making it possible to predict and influence the choice of American voters in 2018.
According to a European Union survey published in May 2022, 28% of European SMEs were victims of cybercrime in 2021[1]. Cybersecurity is a global issue. Indeed, the annual cost of cybercrime for the global economy in 2020 is estimated at 5.5 trillion euros, double that of 2015.[2].
It is essential to take these new threats seriously. According to the World Economic Forum, cyberattacks are among the top ten risks facing humanity[3].
To deal with these risks, the law offers a whole arsenal. We will focus on the different regulations making it possible to regulate and understand the challenges of cybersecurity.
The GDPR, a prevention tool against cyberattacks
The General Data Protection Regulation (GDPR)[4] is a European regulation adopted on April 27, 2016 and entered into force on May 25, 2018, aimed at protecting individuals with regard to the processing of personal data.
It complements and reinforces the prerogatives provided for in the Data Protection and Freedom Act of 1978[5]. The security obligation is an essential preventive tool to avoid the risks of data recovery by a malicious third party.
Indeed, if security is one of the fundamental principles of this latest law, the GDPR complements and reinforces this obligation (article 32). It provides in particular for the implementation of technical and organizational measures to secure data (article 25), maintaining a data breach register (article 33), carrying out an impact analysis for sensitive processing (article 35), notifying the CNIL of any data breach (article 33) as well as informing people of the breach of their data (article 34) and above all the GDPR broadens security by integrating the fight against risks threatening the availability of data. data where the Data Protection Act only aimed to protect confidentiality and the integrity of data. Non-compliance with these rules may result in an administrative fine of up to 20 million euros or 4% of turnover (article 83).
The GDPR is the only text to provide for concrete and precise obligations in terms of cybersecurity. While it imposes certain constraints on companies, it makes it possible to best prevent cyberattacks by allowing companies to strengthen their defense.
NIS and NIS 2, the establishment of a common base of protection
The “Network and Information Security” directive known as NIS 1 (Network and Information System Security) was adopted on July 6, 2016 in order to help EU Member States face cyber challenges by ensuring a high and common level of security for the networks and information systems of the European Union.
The NIS 2 directive of December 27, 2022 reinforces the requirements of the NIS 1 directive and establishes a high level of cybersecurity throughout the European Union. The scope of action is expanded and security requirements are strengthened.
Thus, while the NIS 1 directive covered seven sectors of activity (energy, transport, banking, financial market infrastructures, health, drinking water, digital infrastructures), the NIS 2 directive covers eighteen (the sectors covered by NIS 1 to which are added wastewater, space, ICT services, public administration, postal and shipping services, waste, foodstuffs food, research, manufacturing, chemical production and digital suppliers) divided between two categories of companies: Essential Entities and Important Entities. The distinction between the two types of entities depends on criteria of size or sensitivity of the sectors of activity.
Essential Entities are organizations or companies that operate in a sector considered critical for the functioning of society and the economy of the European Union such as EDF, TotalEnergies, Air France-KLM or the AP-HP Hospitals. Important Entities are organizations or companies operating in sectors which, although not as critical as those of essential entities, nevertheless play a significant role in the economy and society of the European Union such as Danone, La Poste, Amazon or Google.
The sanctions for breaches are significant and can go up to 10 million euros or 2% of global turnover for Essential Entities and up to 7 million or 1.4% of global turnover for Important Entities.
The transposition of the NIS 2 directive, scheduled for October 2024 in France, will impose new obligations on companies. Thus, company management is heavily involved since it must approve risk management measures and supervise their implementation. Members of management must undergo regular training to acquire sufficient knowledge and skills to identify risks and evaluate cybersecurity risk management practices and their impact on the services provided.
The NIS 2 directive also requires the implementation of technical and organizational measures such as risk analysis and information systems security policies, supply chain security and control of Cloud providers, or even the use of multi-factor authentication solutions.
The NIS 2 directive also imposes a framework for alerts and notifications of cybersecurity incidents ranging from early warning to final reporting one month after incident notification.
ANSSI (National Agency for Information Systems Security) is the national authority in matters of cybersecurity and cyberdefense which will be responsible for ensuring compliance with the obligations arising from the directive which will be transposed into national law.
The transposition of the NIS 2 directive is a real opportunity for companies to improve their level of security in order to face the threats of cyberattacks.
Protection measures reinforced by the LPM
Finally, the 2024-2030 military programming law or LPM was adopted on July 13, 2023 and aims to enable France to face new threats and maintain its rank among the leading world powers. Cyber threats are thus taken into account in the field of new issues.
With the adoption of this law, the budget devoted to cyber has tripled compared to previous years, or nearly four billion euros. The LPM strengthens the security of critical information systems for national defense. It establishes a regulatory framework to protect infrastructure from cyberattacks.
Operators of vital importance (OIV), namely entities whose operation is essential to the survival of the nation, affecting sectors such as energy, transport, health, and finance are subject to compliance with mandatory security measures. This is also the case for essential service operators (OSE), which are those who provide an essential service whose interruption would have a significant impact on the functioning of the economy or society. OIVs and OSEs therefore have the obligation to notify security incidents to ANSSI. For example, we can cite the obligation to identify and declare information systems of vital importance by OIVs in order to identify the most critical systems for which a proven attack would have serious consequences for the Nation.
More generally, companies, depending on their OIV or OSE category, will have to respect specific security measures, establish incident detection and reaction procedures and carry out regular security audits.
Good practices to adopt
Companies can quickly feel lost in the face of the multiplication of obligations imposed by the aforementioned regulations. This is why it is recommended to be accompanied by a legal professional accompanied by a cybersecurity professional, in order to implement good practices to avoid sanctions or even cyberattacks.
Concerning the GDPR, the LegalProtech-Avocats firm specializes in carrying out GDPR audits and Maître Christelle Reyno also has AFNOR certification as a Personal Data Protection Officer (DPO).
Concerning the NIS 1 and 2 directives, you must first determine whether the NIS 2 directive applies to your structure (sector of activity listed by the directive, more than 250 employees, annual turnover of more than 50 million euros and/or an annual balance sheet greater than 43 million euros). It is necessary to identify the risks and define the security measures to be put in place.
Concerning the LPM, it is also necessary to establish security governance through a clear and precise security policy.
Thus, a cybersecurity audit is necessary in order to understand the risks and establish the measures to take. We must also think about the training of the company’s employees. For all this, the LegalProtech-Avocats firm, with its partners, can support you in establishing an action plan.
[1] https://europa.eu/eurobarometer/surveys/detail/2280
[2] European Parliament website: Why is cybersecurity important and what are the costs of cyberattacks? | Themes | European Parliament (europa.eu)
[3] https://www.weforum.org/publications/the-global-risks-report-2021/
[4] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
[5] Law No. 78-17 of January 6, 1978 relating to computing, files and freedoms.
Article published on July 18, 2024. Its content reflects the context of its publication.
A question about your situation? Contact the firm ↗
