The European Union (EU) and the Republic of Korea (South Korea) are considered normatively like-minded in the cyber and digital sphere. They face shared threats, common concerns and common interests relating to cybersecurity, data protection and emerging technologies and work bilaterally and multilaterally to achieve a resilient, stable and secure global cyber ecosystem. This chapter interrogates how cooperation and collaboration have evolved between the EU and South Korea to address shared threats. It is argued that whilst there is a high degree of convergence across the issue areas explored, divergence still exists and cooperation can be significantly improved beyond dialogue, information sharing and trust-building.
Anzeige
Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.
European Commission and High Representative of the Union for Foreign Affairs and Security Policy (2020), Joint Communication to the European Parliament and the Council, “The EU’s Cybersecurity Strategy for the Digital Decade”, Brussels, 16.12.2020 JOIN (2020) 16 final, 19.
See also Hannes Ebert and Laura Groenendaal, “Cyber Resilience and Diplomacy in the Republic of Korea: Prospects for EU Cooperation”, Digital Dialogue, EU Cyber Direct (August 2020), 3.
George Christou and Ji Soo Lee, “EU–ROK cooperation on cyber-security and data protection” in EU-Korea Security Relations, ed. Nicola Casarini (London: Routledge, 2021), 55.
Elaine Fahey “The EU’s cybercrime and cyber-security rulemaking: mapping the internal and external dimensions of EU security”, European Journal of Risk Regulation, 5, Issue 1 (2014), 46–60.
Helena Carrapico and Benjamin Farrand, “Discursive continuity and change in the time of Covid-19: the case of EU cybersecurity policy”, Journal of European Integration, 42, Issue 8 (2020), 1111–1126.
European Commission “A Digital Agenda for Europe” (No.COM (2010)245 Final/2), Brussels; European Commission “The EU internal Security Strategy in Action: Five Steps Towards a More Secure Europe” (No. COM (2010) 673 Final), Brussels.
European Commission and High Representative of the European Union for Foreign Affairs and Security Policy/Vice-President of the Commission, “Cybersecurity Strategy of the EU: An Open, Safe and Secure Cyberspace”, Brussels, 7 February 2013.
George Christou “Cybersecurity in the European Union: Resilience and Adaptability in Governance Policy” (Houndmills, Basingstoke: Palgrave Macmillan, 2016).
On cybercrime, the main piece of legislation was the 2013 Directive on Attacks against Information Systems, which member states had to transpose into domestic law by 2015. The Directive (EU) 2016/1148 was introduced to further bolster and ensure enhanced the security of network and information systems within the European Union.
It is now closely aligned with the proposal for the Critical Entities Resilience Directive which enhances the NIS 2 Directive by imposing new security requirements on to companies that provide essential services as well as sector-specific Regulations such as the Digital Operational Resilience Act (DORA) for the financial sector.
European Commission. “European agenda on security”, 28 April, COM (2015) 185 final. European Commission and European External Action Service. Joint Communication to the European Parliament and the Council, Joint Framework on Countering Hybrid Threats: A European Union response. 6 April, JOIN (2016) 18 final. Council of the European Union “Shared Vision, Common Action: A Stronger Europe. A Global Strategy for the EU’s Foreign and Security Policy” (2016). European Commission, Communication from the Commission to the European Parliament, The European Council, The Council, The European Economic and Social Committee and the Committee of the Regions on the “EU Security Union Strategy”, Brussels, 24.7.2020, COM (2020) 605 final.
Council of the European Union. “Council Conclusions on Shaping Europe’s Digital Future (No. OJ 2020C: 202); Council of the European Union. “Council Conclusions on Covid-19 (No.” In OJ C, 57/4). European Commission. “Shaping Europe’s Digital Future”; European Commission. “A European Strategy for Data” (No. COM (2020) 66); European Commission. “A New Industrial Strategy for Europe” (No. COM (2020) 102 F).
Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance) PE/86/2018/REV/1.
European Commission and High Representative of the Union for Foreign Affairs and Security Policy. Joint communication to the European Parliament and the Council, Resilience, Deterrence and Defence: Building strong cybersecurity for the EU, JOIN/2017/0450 final.
European Commission. “Proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)”, COM (2012) 11 final, Brussels, 25.1.2012, 2.
European Commission. Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, “A Digital Agenda for Europe”, COM (2010) 245, 19 May 2010.
Directive 2006/24/EC regulated data retention where data was generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks.
2021 National Cybersecurity White Paper (Korean version), (National Intelligence Service et al., May 2021), 21; Christou and Lee, “EU–ROK cooperation on cyber-security and data protection,” 68–69.
George Christou and Michael Raska, “EU–ASIA Cybersecurity Cooperation: Paths and Patterns” in The European Union’s Security Relations with Asian Partners, Eds. Thomas Christiansen, Emil Kirchner and Tan See Seng (Springer, 2021); Ebert and Groenendaal, 5–8 and 29–30.
For example, see “Joint Press Statement by Mr. Lee Hyo-sung, Chairman of the Korea Communications Commission (KCC) and Mrs. Věra Jourová, Commissioner for Justice, Consumers and Gender Equality of the European Commission on the state of play of the adequacy dialogue” (1 June 2018).
Jong In Yoon (Chairperson of the PIPC) [윤종인 위원장], “Announcement of Conclusion of Discussions on Adequacy Decision between South Korea and the EU [한-EU 적정성 결정 논의 마무리 발표],” Republic of Korea Policy Briefing [대한민국 정책브리핑], 29 March 2021. https://www.korea.kr/news/policyBriefingView.do?newsId=156443808; Ebert and Groenendaal, “Cyber Resilience”, 30.
But the processing of personal credit information by commercial operators that are supervised by the PIPC is included in the scope of granting adequacy status in the initial finding. European Commission. “Draft Decision on the adequate protection of personal data by the Republic of Korea,” 14 June 2021, 2, 4, 27–31, 63–64, and 67. Available at https://ec.europa.eu/info/files/draft-decision-adequate-protection-personal-data-republic-korea_en.
See European Commission, “Implementing Decision”, 66–71, and 5., footnote 23; See also Jong In Yoon (Chairperson of the PIPC), “Conclusion of Discussions on Adequacy Decision”.