EDPB and EDPS Issue Joint Opinion on EU Cybersecurity Act 2 and NIS2 Amendments
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have issued a joint opinion on the European Commission’s proposals for the Cybersecurity Act 2 (CSA2) and amendments to the Network and Information Security Directive 2 (NIS2). These proposals aim to enhance cybersecurity across Europe while simplifying compliance for organizations. The joint opinion highlights the close relationship between data protection and cybersecurity, emphasizing that security measures should protect personal data without compromising fundamental rights and freedoms.
The EDPB and EDPS support strengthening the role of the European Union Agency for Cybersecurity (ENISA) and encouraging the use of cybersecurity certification. They welcome clearer guidelines on how ENISA will provide support to stakeholders, including a recommendation to allow the EDPS to request advice from ENISA alongside the EDPB. The joint opinion also stresses that any additional measures adopted by ENISA related to data protection should be limited to technical details and require prior consultation with the EDPS.
The joint opinion calls for better coordination between ENISA and EU institutions, including explicit cooperation with the EDPS. It also suggests clarifying the relationship between the European Cybersecurity Certification Framework and GDPR certification, urging ENISA to consult the EDPB before adopting certification schemes that impact personal data security. Additionally, the opinion recommends expanding the European Cybersecurity Skills Framework to include profiles beyond cybersecurity professionals, covering the general workforce.
Regarding the NIS2 Directive amendments, the EDPB and EDPS welcome the inclusion of European Digital Identity Wallets and European Business Wallets providers as essential entities. They also support establishing a single-entry point for personal data breach notifications, which would reduce administrative burdens for organizations while maintaining strong protection for individuals. These measures reflect a balanced approach to enhancing cybersecurity and data protection in the European Union.
