The European Parliament gave the green light to the Network and Information Security 2 Directive (“NIS 2”) in 2020, broadening the reach of the Network and Information Security Directive (“NIS”). The NIS 2 Directive has added more sectors to its scope, increased security and reporting requirements, and imposed more stringent fines in case of non-compliance. Subsequently, Germany has now formally proposed an “NIS 2 Implementation and Cyber Security Strengthening Act,” setting the groundwork for how the German government may choose to act. It’s crucial to understand that the methods adopted by Germany could be considered as a potential template by other EU Member States.
EU Member States have a restriction until 17 October 2024 to implement NIS 2 into their national legislation. As a legal professional, it’s crucial to stay informed about these forthcoming changes. Understanding Germany’s proposal can provide insights into the potential measures other states might take. Here are five points of significance about Germany’s drafted legislation.
-
Germany’s drafted act is the first concrete step taken towards the implementation of the NIS 2 at a national level in the European Union. It sets the precedent and possibly points the direction that other members might follow.
-
The draft reinforces the need for stronger cyber security among industries. It brings more sectors into its fold compared to NIS, thereby expanding the regulatory reach and pursuing an aim of robust network and information security across a wider spectrum of sectors.
-
In case of non-compliance with the security requirements set forth by this directive, sectors covered under the draft act will face increased fines, making it more stringent and impactful.
-
These new regulations will change the legal implications for businesses operating in the EU. Legal professionals across the globe must take note of these developments to assess the impacts on their respective clients or companies.
-
Lastly, given that the European Union has until October 2024 to enact NIS 2 into national legislation, remaining updated about the gradual developments in the implementation process can help in planning ahead and ensuring full compliance.
To gain more detailed insights into these points, legal professionals can read more about Germany’s Draft Law Implementing the NIS2 Directive here. Updates like these are valuable for CIAs, CISOs, DPOs, and attorneys concerned with IT and data protection law.