Conceptualising the Legal Notion of ‘State of the Art’ in the Context of IT Security - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

Conceptualising the Legal Notion of ‘State of the Art’ in the Context of IT Security

Sandra Schmitz-Berndt
  • Fonction : Auteur
  • PersonId : 1144680

Résumé

In the context of IT security, legal instruments commonly demand that IT security is brought up to the level of ‘state of the art’.As the first horizontal instrument on cybersecurity at EU level, the NIS Directive requires that Member States shall ensure that operators of essential services (OESs) and digital service providers (DSPs) take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which they use in their operations, or in the context of offering specific services. Having regard to the ‘state of the art’, those measures shall ensure a level of security of NIS appropriate to the risk posed. Similarly, the GDPR requires data controllers, and to some extent processors, to take ‘state of the art’ into account when implementing appropriate technical and organisational measures to mitigate the risks caused by their data processing activities. The same applies to public electronic communications networks or services regarding the security of their networks and services under the EECC.Although the notion is widely referred to in legal texts, there is no standard legal definition of the notion.This paper, based on a workshop held at the 14th IFIP summer school, analyses the contexts in which the notion ‘state of the art’ is being used in legislation. Briefly, the reasons for abstaining from clear technical guidance are addressed. Following an introduction to the three-step theory developed by the German constitutional court, where ‘state of the art’ is located between the ‘generally accepted rules of technology’ and the ‘state of science and technology’, this paper argues that this approach can also be applied at EU level in the context of IT security.
Fichier sous embargo
Fichier sous embargo
0 5 24
Année Mois Jours
Avant la publication
mercredi 1 janvier 2025
Fichier sous embargo
mercredi 1 janvier 2025
Connectez-vous pour demander l'accès au fichier

Dates et versions

hal-04636351 , version 1 (05-07-2024)

Licence

Identifiants

Citer

Sandra Schmitz-Berndt. Conceptualising the Legal Notion of ‘State of the Art’ in the Context of IT Security. 16th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Aug 2021, Virtual, Luxembourg. pp.25-32, ⟨10.1007/978-3-030-99100-5_3⟩. ⟨hal-04636351⟩
0 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More