EU Cybersecurity Rules Increase Liability For Multinationals

Mark Young is quoted in a Law360 article discussing the EU Network and Information Security Directive, which sets a cybersecurity and breach reporting baseline for both critical infrastructure operators, as well as digital service providers. This directive, which is the first of its kind, comes after two years of negotiations. According to Young, “There’s going to be a big question mark over what operators of essential services this directive will apply to.” He continues, “Companies are going to want to keep an eye on the process of transposing the directive into member state laws, because while the agreement Monday is a big step forward at an EU level, it’s just the beginning of the road for companies.”