The Transnational Dimension of Cybersecurity: The NIS Directive and Its Jurisdictional Challenges

Abstract

This paper explores the jurisdictional challenges that arise from the transnational dimension of cybersecurity, by analysing and comparing the jurisdictional rules applicable to cross-border actors under the NIS Directive and the NIS 2 Proposal. It also comparatively examines the jurisdictional rules of two other EU regulatory instruments applicable to digital services—the GDPR and the DSA Proposal—that rely on the ‘main establishment’ connecting factor to allocate jurisdiction to one Member State over the others (one-stop-shop mechanisms). Lastly, it assesses whether the NIS 2 Proposal represents a step forward in addressing the complex jurisdictional challenges created by cybersecurity cases with cross-border elements.