3FOOD

Third Industrial Revolution Consulting Group
5.6 Understanding and Respecting Basic Balances
New customer centric models demand a broader and more comprehensive clarification of
customer protection rules, the role to be performed and liabilities to be borne by new business
models. If this point is considered, customers will be able to enjoy much better protection in
relation to their funds and their purchases as well as to their privacy and ability to interoperate;
The regulatory framework should properly balance the promotion of new digital value
propositions while ensuring appropriate consumer and investor protection, data privacy,
security and prudent risk management.
In addition, strengthening cooperation and raising the awareness of EU citizens on the
growing threats from cybercrime is crucial. Financial institutions are one of the primary
targets for cyber-attacks. As a result, the industry is committing considerable IT investments
towards protective measures for customers and to maintain trust. These protective
measures should also encompass more initiatives to increase the awareness of the
employees in the financial sector. Making digital finance secure and building trust should be
a concern for all, including public and private actors.
It notably implies the establishment of a legal framework and creation of a Joint
Public/Private Cybersecurity Platform:
− To exchange information about latest risks and trends.
− To exchange best practices in cyber-crime prevention.
− To disseminate the awareness about the cyber risks among the industry peers and the
public.
Certainly, the (re)insurance sector has an important role to play for increasing the
understanding of the cyber threats, as it covers the risks for now several years. If initially the
covers were restricted to the costs associated to the appointment of IT specialists to deal with
the incident, the covers embed now loss of data and liability. This means that the (re)insurance
sectors has gained experience in preventing the incidents, understanding the origins and
restricting the consequences. This experience should be leveraged.
At the same time, banks are facing increasing information and incident reporting requests from
various authorities (SSM, ENISA, national competent authorities, etc.). A coordinated and more
harmonized approach between various authorities would optimize banks efforts in this field.
Ultimately a clear harmonized legal framework regarding incident information sharing between
companies should be put in place. Concrete actions are urgently needed at the European level.
These actions should be supported by the Luxembourg Government as almost any piece of
Luxembourg legislation is derived from EU regulatory framework.
318