Hard Brexit Impact Analysis

Page 56 of 106 Category If no agreement is reached: Consequence EU Document Internet Security As of the withdrawal date the EU rules in the field of security of network and information systems no longer apply to the United Kingdom. WITHDRAWAL OF THE UNITED KINGDOM AND EU RULES IN THE FIELD OF SECURITY OF NETWORK AND INFORMATION SYSTEMS Internet Security Where a digital service provider is established in the Union, it will be, subject to the jurisdiction of the Member State where it has its main establishment, which in principle corresponds to the place where the provider has its head office in the Union. WITHDRAWAL OF THE UNITED KINGDOM AND EU RULES IN THE FIELD OF SECURITY OF NETWORK AND INFORMATION SYSTEMS Internet Security Where a digital service provider, is not established in the Union but offers digital services into the Union, it must, in accordance with Article 18(2) of Directive (EU) 2016/1148, designate a representative in the Union. A representative means any natural or legal person established in the Union explicitly designated to act on behalf of a digital service provider not established in the Union. WITHDRAWAL OF THE UNITED KINGDOM AND EU RULES IN THE FIELD OF SECURITY OF NETWORK AND INFORMATION SYSTEMS Internet Security As of the withdrawal date, a digital service provider subject to the jurisdiction of the United Kingdom before the withdrawal date because its main establishment in the EU was in the United Kingdom may be subject to the following: If the digital service provider maintains one or several establishments in the EU27 Member States, it will be deemed to be under the jurisdiction of the EU27 Member State where it has its main establishment in the EU27, thus effectively resulting in a change of competent authority. WITHDRAWAL OF THE UNITED KINGDOM AND EU RULES IN THE FIELD OF SECURITY OF NETWORK AND INFORMATION SYSTEMS Internet Security As of the withdrawal date , a digital service provider subject to the jurisdiction of the United Kingdom before the withdrawal date because its main establishment in the EU was in the United Kingdom may be subject to the following: If the digital service provider is no longer established in the EU27 but offers digital services into the EU27, it will be subject to the obligation to designate a representative in an EU27 Member State WITHDRAWAL OF THE UNITED KINGDOM AND EU RULES IN THE FIELD OF SECURITY OF NETWORK AND INFORMATION SYSTEMS