EU proposes to make data breach disclosure mandatory

The European Commission has today announced the launch of new proposals that include a requirement for EU member states to appoint an independent CERT and pivotally calls for each to create a national authority to whom companies, whose functions are critical to the economy, must report data breaches.

This body would then be responsible for deciding whether to make the breaches public and whether to fine companies.

Echoing the requirements already in place for the telecoms sector, transport companies, banks, energy firms, and hospitals will have to report cyber attacks if the proposals are approved by EU governments and the European Parliament.

Paul Ayers, VP EMEA of Vormetric, has made the following comments:

In a move that harmonises an otherwise disjointed approach in the fight against cybercrime, these new and welcome proposals serve to not only emphasise the dangers posed to the security of the international community, but also act as a crucial reminder to businesses that the onus for effective data protection lies with them.

Cybercrime is a highly-sophisticated and destructive industry targeting organisations of all shapes and sizes. It can damage brands and result in painful compliance penalties. It is no wonder that many businesses have been anticipating the arrival of more stringent data protection legislation – these new proposals are indicative of things to come and set new parameters for businesses endeavouring to operate in a compliant manner on the international stage.

While the litany of highly visible data breach incidents in 2012 galvanised many organisations to revaluate their security measures, some businesses clearly have a considerable way to go. As the custodians of their customers’ data, any organisation touching sensitive information must look to place security controls around sensitive data, as this ultimately is the target of attack. In the face of tougher monetary penalties and legal sanctions for security negligence, encryption of all data is no longer a reasonable expectation – but an absolute necessity.