NIS Representation in the EU and UK – Is the March 31 deadline a turning point?

It all started with the NIS Directive

The Network and Information System Directive (EU 2016/1148 – NISD) aims to achieve a high standard network and information systems security in the European Union (including the UK. when initiated). It applies to two types of organisations, Operators of Essential Services and Digital Service Providers. This article focuses on DSPs as the recent changes are especially relevant for DSPs (to check whether you are an DSP have a look here).

Due to its legal nature, the NIS Directive is different from the EU General Data Protection Regulation, as it is not directly applicable in EU Member States. It needed to be trans-posed into national law. Technically, there are 28 different NIS laws in force. It is important to note that the NISD, or its transposition into national laws, has extraterritorial scope like the GDPR, which means that companies based outside the EU or the UK. can also be affected by these national laws. The core obligation arising from the extraterritorial scope is the requirement for companies located outside the EU/UK. to appoint a NIS representative.

What is a digital service provider?

A digital service provider is any legal person that offers a digital service. However, not all digital services are subject to NIS, only specific services. The following digital service providers are subject to the NIS.

Online marketplaces: An online marketplace allows consumers and traders to conclude online sales or service contracts with traders and which function as the destination for the conclusion of those contracts. Application stores, which operate as online stores enabling the digital distribution of applications or software programs from third parties, are understood as being a type of online marketplace. They do not include online services that serve only as an intermediary to third-party services through which a contract can ultimately be concluded.

Online search engines: An online search engine allows the user to perform searches of websites based on a query on any subject. It can also be focused on websites in certain languages. Search functions that are limited to the content of a specific website, even if the function is provided by an external search engine, are not subject to NIS. Online services that compare the price of particular products or services from different traders and then redirect the user to the preferred trader to purchase the product are also not included.

Cloud Computing Services: Cloud computing services allow access to a scalable and elastic pool of shareable computing resources, such as networks, servers or other infrastructure, storage, applications, and services. The NISD mentions three properties a cloud computing service must have to be qualified as a cloud service:

• Scalable resources: Resources can be flexibly allocated by the cloud services provider irrespective of their geographical location to handle fluctuations in demand.
• Elastic pool of resources: Computing resources that are provisioned and released according to demand to increase and decrease resources available depending on workload.
• Shareable: Computing resources are provided to multiple users who share common access to the service, but the processing is carried out separately for each user even though it is provided from the same electronic equipment. Included are different models such as IaaS (Infrastructure as a Service), PaaS (Platform as a Service), or SaaS (Software as a Service).

As the NISD aims to improve the level of network and information systems security, it applies to companies with a certain impact on such infrastructure; therefore, small businesses are exempt. Neither the EU NISD and its national transpositions nor the U.K. NIS Regulation applies to businesses with less than 50 staff members and an annual turnover or balance sheet of fewer than 10 million euros.

Assessing if the company offers services within the EU or U.K.

When it comes to assessing whether a DSP is offering its services to a certain market, the NISD seems to pursue a similar approach to the GDPR. The recitals of the NISD suggest that it must be apparent the DSP is trying to offer its services to one or more Member States in the EU, or in other words, evidence of “actively targeting” a certain market. When it comes to the UK.’s NIS Regulation, they will likely follow a similar approach.

Like with the scope of GDPR, the mere accessibility of a website or using a language typically used in different countries is not sufficient to ascertain the intention to target a specific market. However, here are some criteria to be considered that might suggest such intentions:

• Using a language or a currency used in one or more Member States or the UK.
• The possibility of ordering services in those languages.
• The mentioning of customers or users who are in the EU or the UK.

We have adapted our SaaS solution for UK representation and can offer you our LegalTech services from our UK office.

Implications of Brexit on the requirement for a representative

The NISD was transposed into U.K. law through the Network and Information System Regulations (NIS Regulation) when the U.K. was still part of the European Union. Brexit did not affect the NIS Regulation’s validity; however, it has been amended to fit a U.K.-only application. At first, the U.K. NIS Regulation did not include the obligation to appoint a NIS representative. The Brexit amendments of the NIS Regulation introduced the obligation. Under the new regulations, non- U.K. companies must appoint a U.K. representative if:

• They are a digital service provider (online marketplace, online search engine, or cloud computing service).
• Their head office is not located in the U.K.
• They offer services in the U.K The obligation to appoint a U.K. representative, even if the company has a branch in the UK. that is not its headquarters, might be the most significant and hard-hitting difference between the NIS Regulation’s and the GDPR’s approach to appointing a representative. If all of this applies, a company is considered a digital service provider under U.K. law and consequently must comply with U.K. NIS Regulations. This means they should have appointed a representative before the 31 March deadline. Furthermore, DSPs should have appropriate and pro-portionate security measures in place to manage risks to the network and information systems that support their services. They must notify the U.K. Information Commissioner’s Office in the event of incidents that substantially impact the provision of their services. It needs to be highlighted that the U.K. NIS Regulation is not the GDPR’s little sibling but an equal partner when it comes to the fines stipulated for noncompliance. According to the U.K. NIS Regulation, the ICO (as the relevant authority) may issue fines up to 17 million pounds in the most serious cases - like the fines stipulated in the GDPR.

NIS Representation in the EU

Art. 18 (2) NISD requires Member States to provide national measures that oblige DSPs estab-lished outside the European Union offering their services in the EU to appoint a European repre-sentative, which is similar to the obligation under Art. 27 GDPR. However, this requirement was plemented differently in the various Member States. Some - including the U.K. at first - did not implement such obligation at all.

But does the 31 March deadline to appoint a U.K. representative also apply to a European rep-resentative’s appointment? The answer is no, since the deadline is U.K. specific, triggered by the fact that the U.K. only adopted their representative obligation with the Brexit amendments, which were recently introduced. The amendments to the U.K. NIS Regulation provide for a three-month timeframe to appoint a representative, which began when the amendments came into force, 1st January 2021.

What companies should do now

There are certain impacts on DSPs arising from Brexit, which should be carefully assessed in view of the above. The key issue is that there are now two legal frameworks that might require com-panies to appoint a NIS-representative. These frameworks apply to:

• DSPs that do not have headquarters in the U.K., which may be companies in or outside the EU;
• U.K. DSPs and relevant digital service providers without an establishment in the EU;
• DSPs without their headquarters in the U.K. and an establishment in the EU. We have created a detailed FAQ about the NIS-representative requirements for further guidance. Companies who need an EU or U.K. NIS representative or both are very likely to need an Arti. 27 (U.K.) GDPR-representative. The NIS representative can be the same as the GDPR representative, so it is possible to have the same person or entity be your GDPR and NIS representative, which is probably the easiest and most favourable option, especially when it comes to data breaches. Choosing the European representative does have implications on the jurisdiction to be applied to the DSP since it is under the Member State jurisdiction where their representative is established. The DSP must comply with the domestic NIS law which includes implementing technical and organisational measures to manage risks posed to the security of network and information systems, and reporting obligations in case of incidents that have substantial impacts on the pro-vision of their service.