Aligning Cybersecurity Information Sharing with the European Data Protection Framework
summary
EU law (NIS2, DORA, CRA) increases mandatory and voluntary incident/vulnerability reporting but leaves Member States wide discretion, creating legal gaps over IP addresses and victim data that often determine whether GDPR applies. Technical fixes proposed include homomorphic encryption for analysis without decryption and zero trust architectures; organizational options contrast centralized EU platforms vs peer‑to‑peer sharing. ENISA and the Commission are building a synchronized sharing platform now; effectiveness depends on binding guidance about legal basis, minimization and anonymization.
AI-written summary · about
chapters (8)
- 0:00Cybersecurity and data protection
- 3:10GDPR information sharing challenges
- 13:57NIS2 obligations
- 22:03EU cybersecurity laws
- 31:03Personal data in threat intelligence
- 44:16Profiling and privacy in cybersecurity
- 53:36Legal bases for data processing
- 1:00:02Final takeaways
related talks
15mEuropean Cybersecurity Regulations who's who
01h 12mCYBERSECURITY FOR EUROPE: FOSTERING RIGHTS THROUGH TECHNOLOGY
01h 12mSecuring cyber critical infrastructure.
01h 17mCoorperation between data protection authorities. Threats, challenges and opportunities.
59mNational Security and Public-Private Partnership for Cybersecurity: Strengths and Challenges
47mLegal Approach to the European Data Strategy
01h 05mDigital Sovereignty in Wartime: Legal and Cybersecurity Considerations
01h 01mNIS2 & CRA: Europe's Response to Cyber Shenanigans