Romanian version of EU cybersecurity directive allows warrantless access to data

The law could impact international businesses, as Romania is a hub for IT outsourcing and development

More than a dozen Romanian non-governmental organizations are protesting new cybersecurity legislation passed by the parliament last week that would force businesses to provide the country's national intelligence agencies with access to their data without a court warrant.

The law could also impact businesses from Europe and beyond, as Romania is a hub for IT outsourcing and software development. Many multinational corporations including Amazon, Microsoft, Adobe Systems, Siemens and Intel have research and development centers in the country.

The law, which only lacks the president's signature to come into effect, is based on the European Union's upcoming Network and Information Security (NIS) Directive, a legislative framework that aims to strengthen cybersecurity across the E.U., particularly in key areas like critical infrastructure.

An amended version of the proposed NIS Directive was approved by the European Parliament in March. It requires member states to develop national cybersecurity strategies and appoint central authorities in charge of coordinating the response to cyberthreats and incidents.

It also creates new requirements for operators of critical infrastructure, like those in the energy, transport, banking, financial market or health sectors, to assess the risks they face and to adopt appropriate measures to ensure the security of their networks and information. They will also have to report incidents to the national cybersecurity authorities.

Critics of the new Romanian law claim that it is overly broad, likely unconstitutional and ignores the E.U. recommendation that the authority responsible for national cybersecurity should be a civilian body not linked to law enforcement, intelligence or national defense.

Unlike the NIS Directive, which focuses on operators of critical infrastructure, the Romanian bill applies to all organizations, public or private, that own, administer, operate or use cyberinfrastructures. Cyberinfrastructure is defined in the law as "infrastructure in the field of information technology and communications, consisting of information systems, related applications, networks and electronic communication services."

This means the law would apply to all public institutions, private companies and other legally established organizations that operate computers and networks.

"One company with one computer cannot represent a national cybersecurity problem," the Romanian Association for Technology and Internet (ApTI) said in a blog post. The law must apply only to public and private entities that are identified as operators of critical infrastructure of national importance and they should be clearly listed in the law, the organization said.

ApTI is a member of European Digital Rights (EDRi), a pan-European association of digital rights organizations.

Another problem is that the law requires companies to provide the Romanian Intelligence Service (SRI) -- the Romanian equivalent of the U.S. National Security Agency -- and a half-dozen other government agencies with assistance and access to their data based only on a "motivated request," not a court order.

The agencies that could request data in this manner, according to art. 17 of the law, are the Romanian Intelligence Service, the Ministry of National Defence, the Ministry of Foreign Affairs, the National Registry Office for Classified Information, the Foreign Intelligence Service, the Special Telecommunications Service, the Protection and Guard Service, CERT-RO and the National Authority for Management and Regulation in Communications (ANCOM).

ApTI and other civil society organizations believe this would violate the constitutional rights of citizens, since many companies and organizations process and store data about or generated by private individuals.

"Who decides if these requests are sufficiently motivated and which data are relevant?" ApTI said. "Why not a judge, as currently stipulated in the code of criminal procedure?"

The third issue with the current form of the law is that it designates SRI as the national authority in charge of cybersecurity. This appears to contradict the EU NIS Directive, which says that: "The competent authorities and the single points of contact should be civilian bodies, subject to full democratic oversight and should not fulfil any tasks in the field of intelligence, law enforcement or defence or be organisationally linked in any form to bodies active in those fields."

Thirteen non-governmental organizations, including ApTI, sent a letter Monday to Romania's new president, Klaus Iohannis, as well as the Romanian Parliament, the Romanian High Court of Cassation and Justice and the People's Advocate, urging them to officially ask the Constitutional Court to review the law. This is a required procedure before the Constitutional Court can rule whether a law violates basic constitutional rights.

Another option would be for the president not to promulgate the law and return it to the Parliament for reexamination.

"Since his first day in office, the President is faced with a situation where he can prove his commitment for the respect of human rights in Romania," the letter said.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags amazonGovernment use of ITsecurityMicrosoftadobelegislationgovernmentinteldata protectionprivacy

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?