Romanian version of EU cybersecurity directive allows warrantless access to data

The law could impact international businesses, as Romania is a hub for IT outsourcing and development

More than a dozen Romanian non-governmental organizations are protesting new cybersecurity legislation passed by the parliament last week that would force businesses to provide the country's national intelligence agencies with access to their data without a court warrant.

The law could also impact businesses from Europe and beyond, as Romania is a hub for IT outsourcing and software development. Many multinational corporations including Amazon, Microsoft, Adobe Systems, Siemens and Intel have research and development centers in the country.

The law, which only lacks the president's signature to come into effect, is based on the European Union's upcoming Network and Information Security (NIS) Directive, a legislative framework that aims to strengthen cybersecurity across the E.U., particularly in key areas like critical infrastructure.

An amended version of the proposed NIS Directive was approved by the European Parliament in March. It requires member states to develop national cybersecurity strategies and appoint central authorities in charge of coordinating the response to cyberthreats and incidents.

It also creates new requirements for operators of critical infrastructure, like those in the energy, transport, banking, financial market or health sectors, to assess the risks they face and to adopt appropriate measures to ensure the security of their networks and information. They will also have to report incidents to the national cybersecurity authorities.

Critics of the new Romanian law claim that it is overly broad, likely unconstitutional and ignores the E.U. recommendation that the authority responsible for national cybersecurity should be a civilian body not linked to law enforcement, intelligence or national defense.

Unlike the NIS Directive, which focuses on operators of critical infrastructure, the Romanian bill applies to all organizations, public or private, that own, administer, operate or use cyberinfrastructures. Cyberinfrastructure is defined in the law as "infrastructure in the field of information technology and communications, consisting of information systems, related applications, networks and electronic communication services."

This means the law would apply to all public institutions, private companies and other legally established organizations that operate computers and networks.

"One company with one computer cannot represent a national cybersecurity problem," the Romanian Association for Technology and Internet (ApTI) said in a blog post. The law must apply only to public and private entities that are identified as operators of critical infrastructure of national importance and they should be clearly listed in the law, the organization said.

ApTI is a member of European Digital Rights (EDRi), a pan-European association of digital rights organizations.

Another problem is that the law requires companies to provide the Romanian Intelligence Service (SRI) -- the Romanian equivalent of the U.S. National Security Agency -- and a half-dozen other government agencies with assistance and access to their data based only on a "motivated request," not a court order.

The agencies that could request data in this manner, according to art. 17 of the law, are the Romanian Intelligence Service, the Ministry of National Defence, the Ministry of Foreign Affairs, the National Registry Office for Classified Information, the Foreign Intelligence Service, the Special Telecommunications Service, the Protection and Guard Service, CERT-RO and the National Authority for Management and Regulation in Communications (ANCOM).

ApTI and other civil society organizations believe this would violate the constitutional rights of citizens, since many companies and organizations process and store data about or generated by private individuals.

"Who decides if these requests are sufficiently motivated and which data are relevant?" ApTI said. "Why not a judge, as currently stipulated in the code of criminal procedure?"

The third issue with the current form of the law is that it designates SRI as the national authority in charge of cybersecurity. This appears to contradict the EU NIS Directive, which says that: "The competent authorities and the single points of contact should be civilian bodies, subject to full democratic oversight and should not fulfil any tasks in the field of intelligence, law enforcement or defence or be organisationally linked in any form to bodies active in those fields."

Thirteen non-governmental organizations, including ApTI, sent a letter Monday to Romania's new president, Klaus Iohannis, as well as the Romanian Parliament, the Romanian High Court of Cassation and Justice and the People's Advocate, urging them to officially ask the Constitutional Court to review the law. This is a required procedure before the Constitutional Court can rule whether a law violates basic constitutional rights.

Another option would be for the president not to promulgate the law and return it to the Parliament for reexamination.

"Since his first day in office, the President is faced with a situation where he can prove his commitment for the respect of human rights in Romania," the letter said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags governmentsecurityprivacyMicrosoftlegislationinteladobedata protectionamazonGovernment use of IT

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?