Greater telecoms security need not mean more state-run operations

Viðskiptaráð has been asked to comment on the pre-consultation on the content of the green paper on telecommunications and cybersecurity. In the Chamber's view, such a pre-consultation is exemplary, as it promotes early stakeholder involvement and ensures that their views are used in shaping the green paper.

Security and resilience of telecommunications infrastructure

Telecommunications are fundamental infrastructure for modern society, and disruptions to them can have far-reaching effects on business, public services and society as a whole. It is therefore important that the government formulate a clear and comprehensive policy on the security and resilience of telecommunications infrastructure, taking into account developments and experience in Iceland's neighbouring countries.

Viðskiptaráð emphasises that, as far as possible, the development of secure telecommunications should build on solutions already available on the market and on the expertise and investment already built up there. Security objectives do not automatically require more state-run operations or dedicated state solutions. Instead, the government should clearly define the requirements that critical telecommunications infrastructure must meet and give companies scope to develop and offer cost-effective solutions that meet those requirements.

It is also important that requirements relating to telecoms and cybersecurity be well-founded, transparent and proportionate to the risks they are intended to address. This can help increase security and resilience without unnecessarily undermining competition, innovation or investment in the telecoms market.

NIS2 and the implementation of EEA legislation

Viðskiptaráð agrees that it is important for the green paper to give companies and other stakeholders greater predictability regarding the changes that the forthcoming implementation of the NIS2 Directive will bring. A predictable regulatory environment is a precondition for companies to prepare in good time for new requirements and to allocate funding and personnel efficiently.

It is also important to exercise restraint in implementing the Directive. Viðskiptaráð has repeatedly warned against gold-plating EEA legislation, that is, imposing stricter or more extensive requirements in the Icelandic implementation than follow from the relevant EEA act. In this context, the timing of implementation must also be considered. Early implementation can in practice have effects similar to gold-plating if Icelandic companies must meet costly requirements earlier than their competitors in other EEA markets.

In general, it is important for the implementation of digital legislation to take Icelandic circumstances into account, within the scope allowed by EEA obligations. The small size of the market, the cost of administration and supervision, and the impact of new requirements on Icelandic companies may differ from those in larger markets. The aim should therefore be efficient and proportionate implementation that secures the intended objectives without placing greater burdens on companies than necessary.

Supervision, competition and investment

In Viðskiptaráð's view, competition and investment in the telecoms market cannot be adequately addressed without specifically examining how supervision of the market is carried out in practice. Supervision must be efficient, predictable and proportionate to the interests it is intended to protect. At the same time, care must be taken to ensure that legislation and supervision do not become unnecessarily burdensome for innovation, investment and the growth of companies in the market.

Alongside the rapid growth of digital legislation in the EEA, the risk of overlap between the remits of supervisory authorities is also increasing, resulting in a greater and more complex administrative burden for companies. It is important that the green paper take this development into account and that, in further shaping the legislation, efforts be made to ensure a clear division of responsibilities, coordinated supervision, and that companies are not unnecessarily subject to comparable requirements or reporting obligations to more than one supervisory authority.

It also matters that the statutory time limits for market supervision are observed. Under Article 44 of the Act on Telecommunications, Fjarskiptastofa is generally required to review market analyses every five years. In practice, delays in such reviews have at times amounted to many years beyond the statutory deadline, and the EFTA Surveillance Authority (ESA) has repeatedly raised concerns about delays in Icelandic authorities' market analyses.[1]

The result is that obligations imposed on telecoms companies may be based on market conditions that are long outdated if the relevant markets have changed significantly. This can impair companies' ability to respond to changed competitive conditions and to invest normally. Timely market analyses are therefore not merely a formality but a precondition for obligations to reflect actual market conditions and for companies to have sufficient investment certainty.

Viðskiptaráð considers it important for the green paper to address how to ensure that supervisory authorities in the telecoms field have the capacity and efficient procedures to meet statutory deadlines. Consideration might also be given to making greater use of the remedies already available, such as involving BEREC where it is foreseeable that a market analysis will not be completed within the statutory time limits.

Iceland's country-code top-level domain

The consultation document also addresses the governance and framework of the Icelandic country-code top-level domain „.is“. Viðskiptaráð agrees that it is important to ensure the reliable and secure operation of the domain, but emphasises that its importance as digital infrastructure cannot, on its own, justify increased government intervention in the operations of the registry.

A clear need must be demonstrated for any additional obligation proposed for the activity, and care must be taken to ensure that obligations and supervision do not go further than necessary. The fact that a single entity handles the registration of „.is“ domains does not, on its own, justify burdensome special regulation or government intervention in operational decisions. It should also be borne in mind that the „.is“ top-level domain competes with numerous other top-level domains and that Iceland-specific obligations could weaken its competitive position and, in the longer term, reduce its use.[2]

Efficiency and cooperation with the market

The government's policy statement identifies simplifying public administration and improving efficiency in state operations among its main priorities. Viðskiptaráð considers it important that objectives relating to greater telecoms security do not automatically lead to more state-run operations where market solutions can achieve the same or better outcomes more cost-effectively.

Security, control and resilience of telecoms systems do not require the state to own or operate the relevant infrastructure itself. On the contrary, purposeful cooperation with specialised telecoms companies can secure access to the latest technology and expertise, while the state defines clear requirements for security, accessibility and service levels. This would make better use of state funds without lowering requirements for security or control over essential services.

In planned mergers of state companies and institutions, care must also be taken to ensure that they do not lead to an unnecessary expansion of state-run operations in the telecoms market or crowd out private investment. This could increase costs to the state, tie up capital that could be used for other projects, and reduce competition and investment incentives in the market.

In this context, it also matters that the framework governing the telecoms market is efficient and predictable. Companies in the telecoms market need clear and timely rules if they are expected to undertake large-scale, long-term investments in telecoms infrastructure. Effective market supervision, measured and well-founded government intervention, and the purposeful use of market solutions therefore go hand in hand with the goal of more secure and cost-effective telecoms.

In shaping the green paper, Viðskiptaráð considers it important to proceed on the basis that greater telecoms security need not require more state-run operations or a greater regulatory burden. Priority should be given to clear security requirements, timely and efficient supervision, and the use of the expertise and infrastructure already available on the market.

Alongside the rapid development of digital legislation, it is particularly important to avoid gold-plating, unnecessary overlap in supervision, and Iceland-specific obligations that reduce competitiveness. With predictable rules and proportionate government intervention, telecoms security can be strengthened while creating conditions for continued innovation, investment and competition.

This article was automatically translated from the Icelandic original.