Menu
Romanian version of EU cybersecurity directive allows warrantless access to data

Romanian version of EU cybersecurity directive allows warrantless access to data

The law could impact international businesses, as Romania is a hub for IT outsourcing and development

More than a dozen Romanian non-governmental organizations are protesting new cybersecurity legislation passed by the parliament last week that would force businesses to provide the country's national intelligence agencies with access to their data without a court warrant.

The law could also impact businesses from Europe and beyond, as Romania is a hub for IT outsourcing and software development. Many multinational corporations including Amazon, Microsoft, Adobe Systems, Siemens and Intel have research and development centers in the country.

The law, which only lacks the president's signature to come into effect, is based on the European Union's upcoming Network and Information Security (NIS) Directive, a legislative framework that aims to strengthen cybersecurity across the E.U., particularly in key areas like critical infrastructure.

An amended version of the proposed NIS Directive was approved by the European Parliament in March. It requires member states to develop national cybersecurity strategies and appoint central authorities in charge of coordinating the response to cyberthreats and incidents.

It also creates new requirements for operators of critical infrastructure, like those in the energy, transport, banking, financial market or health sectors, to assess the risks they face and to adopt appropriate measures to ensure the security of their networks and information. They will also have to report incidents to the national cybersecurity authorities.

Critics of the new Romanian law claim that it is overly broad, likely unconstitutional and ignores the E.U. recommendation that the authority responsible for national cybersecurity should be a civilian body not linked to law enforcement, intelligence or national defense.

Unlike the NIS Directive, which focuses on operators of critical infrastructure, the Romanian bill applies to all organizations, public or private, that own, administer, operate or use cyberinfrastructures. Cyberinfrastructure is defined in the law as "infrastructure in the field of information technology and communications, consisting of information systems, related applications, networks and electronic communication services."

This means the law would apply to all public institutions, private companies and other legally established organizations that operate computers and networks.

"One company with one computer cannot represent a national cybersecurity problem," the Romanian Association for Technology and Internet (ApTI) said in a blog post. The law must apply only to public and private entities that are identified as operators of critical infrastructure of national importance and they should be clearly listed in the law, the organization said.

ApTI is a member of European Digital Rights (EDRi), a pan-European association of digital rights organizations.

Another problem is that the law requires companies to provide the Romanian Intelligence Service (SRI) -- the Romanian equivalent of the U.S. National Security Agency -- and a half-dozen other government agencies with assistance and access to their data based only on a "motivated request," not a court order.

The agencies that could request data in this manner, according to art. 17 of the law, are the Romanian Intelligence Service, the Ministry of National Defence, the Ministry of Foreign Affairs, the National Registry Office for Classified Information, the Foreign Intelligence Service, the Special Telecommunications Service, the Protection and Guard Service, CERT-RO and the National Authority for Management and Regulation in Communications (ANCOM).

ApTI and other civil society organizations believe this would violate the constitutional rights of citizens, since many companies and organizations process and store data about or generated by private individuals.

"Who decides if these requests are sufficiently motivated and which data are relevant?" ApTI said. "Why not a judge, as currently stipulated in the code of criminal procedure?"

The third issue with the current form of the law is that it designates SRI as the national authority in charge of cybersecurity. This appears to contradict the EU NIS Directive, which says that: "The competent authorities and the single points of contact should be civilian bodies, subject to full democratic oversight and should not fulfil any tasks in the field of intelligence, law enforcement or defence or be organisationally linked in any form to bodies active in those fields."

Thirteen non-governmental organizations, including ApTI, sent a letter Monday to Romania's new president, Klaus Iohannis, as well as the Romanian Parliament, the Romanian High Court of Cassation and Justice and the People's Advocate, urging them to officially ask the Constitutional Court to review the law. This is a required procedure before the Constitutional Court can rule whether a law violates basic constitutional rights.

Another option would be for the president not to promulgate the law and return it to the Parliament for reexamination.

"Since his first day in office, the President is faced with a situation where he can prove his commitment for the respect of human rights in Romania," the letter said.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags governmentprivacyMicrosoftlegislationinteladobedata protectionamazonGovernment use of IT

Featured

Slideshows

Reseller News kicks off awards season in 2019 with Judges' Lunch

Reseller News kicks off awards season in 2019 with Judges' Lunch

The 2019 Reseller News Innovation Awards has kicked off with the Judges Lunch in Auckland with 70 judges in the voting panel. The awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors. Photos by Christine Wong.

Reseller News kicks off awards season in 2019 with Judges' Lunch
Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomed 2018 inductees - Chris Simpson, Kendra Ross and Phill Patton - to the third running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing landscape of the technology industry in New Zealand, while outlining ways to attract a new breed of players to the ecosystem. Photos by Gino Demeer.

Reseller News welcomes industry figures for 2019 Hall of Fame lunch
Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

The channel came together for the inaugural Reseller News Emerging Leaders Forum in New Zealand, created to provide a program that identifies, educates and showcases the upcoming talent of the ICT industry. Hosted as a half day event, attendees heard from industry champions as keynoters and panelists talked about future opportunities and leadership paths and joined mentoring sessions with members of the ICT industry Hall of Fame. The forum concluded with 30 Under 30 Tech Awards across areas of Sales, Entrepreneur, Marketing, Management, Technical and Human Resources. Photos by Gino Demeer.

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019
Show Comments