Work

Botnet defense under EU data protection law

Year: 2024

Type: article

Abstract: We analyse the legal framework spanned by EU data protection law with respect to the defence against botnet-related threats. In particular, we examine what legal constraints the General Data Protection Regulation (GDPR) (and others) impose on the processing of personal data when that processing aims at detecting botnet-related traffic. We thereby put data protection rules into perspective with current trends in European IT security regulation, specifically Directive 2022/2555/EU (NIS 2 Directive). We find that the resulting legal landscape is complex and has not yet been sufficiently explored. Our analysis provides an initial evaluation of a wide range of emerging legal issues. In particular, we consider four typical processing scenarios, such as DNS sinkholing by a public authority or sharing of cybersecurity-related personal data, and discuss some of their legal problems, linking them as thoroughly as possible to potentially relevant case law of the European Court of Justice.

Source: Computer law & security review

DOI: 10.1016/j.clsr.2024.106080

Author: Piotr Rataj

Institution: Saarland University

Language: English

Topic: Digitalization, Law, and Regulation

Subfield: Law

Field: Social Sciences

Domain: Social Sciences

SDG: Peace, justice, and strong institutions

Open Access status: hybrid

Funder: Deutsche Forschungsgemeinschaft