Network and Information Systems (EU Exit) (Amendment) Regulations 2021

Digital service providers, which form one of these six sectors, are regulated by the Information Commissioner, who acts as the competent authority. In other sectors, the factors and incident reporting thresholds, which determine what constitutes a “substantial impact” for the purposes of reporting, are set out in guidance published by the relevant competent authority.

Under the original EU directive and the UK’s subsequent implementation, digital services are treated differently from essential services. They were regulated at an EU level, with one country taking responsibility for the activities of an individual digital service provider across the whole of the European Union. For this reason, the factors to be taken into account when determining whether an incident had a substantial impact for the purpose of reporting were not left to member states but set out in the Commission’s implementing regulation, which applied across the EU market. When an incident reaches this threshold, it must be reported to the relevant competent authority, which regulates that provider on behalf of the European Union.

When the UK left the EU, the Commission implementing regulation remained embedded in UK law by virtue of the European Union (Withdrawal) Act 2018. However, the parameters and thresholds for reporting incidents set by that Commission regulation are no longer appropriate for the UK as an independent state. The most significant issue relating to reporting thresholds is that they were set by reference to the number of users affected or user hours lost. As these had been set with the EU market in mind, they were set at a level that is too high for the smaller UK market. As a result, the Information Commissioner has received only one report of a cyber incident affecting digital service providers since our departure from the European Union.

Under the current scenario, an incident needs to have a noticeable impact on an economy the size of the EU to be reportable in the UK. If the Information Commissioner is not receiving reports of incidents within the UK because the thresholds are too high, they will not have an accurate picture of what is happening in their sector. They will be unable to identify the threat, provide guidance or take necessary enforcement action if the provider is found to have breached its duties to protect its services. It is important, if the legislation is to remain effective, that the Information Commissioner is afforded the ability to set the reporting thresholds at a level appropriate for the UK.

I will now set out in a little more detail how the instrument before us seeks to resolve this deficiency. The key proposed amendment will remove the defective reporting thresholds from the UK version of the Commission implementing regulation. The NIS regulations already allow the Information Commissioner to issue guidance and the Information Commissioner has already carried out a consultation on these thresholds in parallel to the instrument being developed.

The instrument before the Committee strengthens the role of that guidance by adding a provision to the NIS regulations ensuring that digital service providers have regard to that guidance when considering whether an incident has substantial impact and is therefore reportable. The practice of setting these reporting thresholds in guidance is common among all other NIS competent authorities in the country; it is only by virtue of how digital services were supervised across the EU that their reporting requirements were set by an EU regulation.

The approach of using guidance to set the thresholds affords far greater agility to the regulator, allowing the Information Commissioner to respond to new developments and to set levels that are proportionate and not burdensome on the providers or, indeed, her own office. This amendment would bring digital service providers in line with operators of essential services in all other sectors across the NIS framework, ensuring that regulators are able to identify significant incidents affecting key services across the economy and act accordingly.

I turn to my final point. Is alignment with EU practices an issue at all, and do we have a continuing relationship with the EU regulator and regulation? Do we have to work within a commonly accepted framework, even though we are now outside the EU and obviously have to have our own system for regulation, appropriate to the size of our market?