Intellectual Property Law

European Union Legislation on Electronic Communication Networks

By Martha L. Arias

Electronic communication networks (ECNs) are technological means that facilitate e-trading; governments deliberately regulate them because they are used to trade financial products. The European Union (EU) has extensively regulated ECNs through a framework directive and additional directives commonly known as Specific Directives. This article provides general information on EU community legislation regulating ECNs and the United Kingdom's challenges to the creation of the European Network and Information Security Agency (ENISA).   

Directive 2002/21/EC, article 1(1), of the European parliament and of the Council of March 7, 2002 is the EU legal framework for ECNs.  This Directive seeks to harmonize the member states' laws regulating ECNs and associated facilities and services.  For instance, it sets the tasks of national regulatory authorities and establishes standard procedures for the application of ECN laws throughout the European Community. The following Directives complement Directive 2002/21/EC and are usually known as "Specific Directives,"   

1.  Directive 2002/19/EC of the European Parliament and the Council of March 7, 2002 regarding access to and interconnection of electronic communications networks and associated facilities; commonly known as the Access Directive;

2.   Directive 2002/22/EC of the European Parliament and of the Council of March 7, 2002 about universal service and users' rights on ECNs and services. This directive is called the Universal Service Directive;

3.  Directive 2002/20/EC of the European Parliament and of the Council of March 7, 2002 regarding authorization of ECNs and services, known as Authorization Directive;

4.   Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002 regarding the processing of personal data and the protection of privacy in the electronic communication sector. This directive is called Directive on Privacy and Electronic Communications;

5.  Directive 2000/31/EC of the European Parliament and of the Council of June 8, 2000 on electronic commerce in the internal market and other legal aspects of information society services. This directive is the Directive on Electronic Commerce;

6.  Directive 1999/93/EC of the European Parliament and of the Council of December 13, 1999 on electronic signatures; known as the Electronic Signatures Directive;

7.  European Union Commission's Decision 2002/627/EC of July 29, 2002, establishing the European Regulators Group for ECNs and services.

8.  Regulation (EC) No 460/2004 of the European Parliament and of the Council of March 10, 2004, establishing the European Network and Information Security Agency.  This regulation was controversial and the United Kingdom of Great Britain and Northern Ireland sought its annulment before the European Court of Justice.  Yet, they lost in their attempt by a decision rendered on May 2, 2006. 

Regulation (EC) No 460/2004 created the European Network and Information Security Agency, (ENISA).  ENISA's goal is to assist the member states and the Commission in meeting the requirements of network and information security laws to assure a smooth functioning of the internal market.  ENISA's objectives as set in this regulation are, among others: (1) helping the community and member states to prevent, address, and respond to network and information security problems; (2) advising member states on network and information security problems; (3) developing expertise to provide assistance to the public and private sector; (4) assisting the Commission to update and develop community legislation.  

The UK and Ireland claimed that Article 95 EC, relied on to created ENISA, did not provide appropriate legal basis for the adoption of regulation No 460/2004. Indeed, they contended that Article 95 EC did not confer the power to create community bodies and delegate tasks to these bodies; the only power conferred by Article 95 EC, they said, was that of harmonizing national laws. UK and Ireland also claimed that ENISA would be precluded from interfering with the competence of national bodies because this agency would be limited to providing non-binding advice. The non-binding character of ENISA's advice would not seek harmonization; instead, it would risk the smooth functioning of the internal market, UK and Ireland claimed.  The UK and Ireland were also concerned with the possible conflict between the ECNs' Framework Directive, the Specific Directives, and ENISA's activities.  Particularly, they argued, ENISA would hold a more extensive power that the power held by the Specific Directives because this agency would be concerned with the security of communication networks and information systems such as databases.  To conclude, the UK and Ireland stated that regulation No 460/2004 should have been based on Article 308 EC instead of Article 95 EC.

The Parliament responded arguing that Article 95 EC did not define the degree to which community measures should approximate member states' laws.  They claimed that Article 95 does not establish that a lesser degree of community action would be more appropriate when harmonizing national laws.  Regulation No 460/2004 sought approximation of member states' provisions on the area of information and network security; the use of more restrictive measures would be incoherent, the Parliament argued.  The Parliament also contended that ENISA's regulations would complement the Framework and Specific Directives and help implement those directives.

The European Court of Justice (ECJ) ruled against the UK and Ireland and ratified the validity of Regulation No 460/2004, which created ENISA.  The ECJ held that Article 95 EC "is used as legal basis when it is actually and objectively apparent from the legal act that its purpose is to improve the conditions for the establishment and functioning of the internal market." This ruling is based on the judgment in Case C-66/04 (United Kingdom v Parliament and Council [2005] ECR I-0000).  The ECJ also held that Article 95 EC intended to confer discretion on the community legislature regarding the appropriate method of approximation to achieve a desired result, particularly in complex technical fields.  The ECJ stated that the legislature may deem necessary to create a community body that contributes to the process of harmonization by adopting non-binding measures when this seems to be the appropriate measure. Hence, the ECJ added, such community body "must be closely linked to the subject-matter of the acts approximating the laws, regulations, and administrative provisions of the member states."

Full post as published by IBLS Internet Law Blog on May 31, 2009 (boomark / email).