A port authority asks why GDPR, ePrivacy, and NIS obligations can all apply to one operational incident. Which explanation is correct?
Select an answer to reveal the explanation.
Short Explanation
One messy dockside outage can trip three different rulebooks at once—personal data (GDPR), communications/cookies-style overlays (ePrivacy), and cyber entity duties (NIS/NIS 2). European law stacks layers; it does not hand you a single “pick only one statute” coupon.
Full Explanation
Related European instruments can apply concurrently when an incident implicates personal-data processing, electronic-communications/terminal-equipment rules, and cybersecurity entity duties under distinct but overlapping regimes. A port authority should plan for GDPR, ePrivacy, and NIS obligations to attach to one operational incident without assuming exclusivity. EU law does not forbid more than one instrument from applying to the same facts. The earliest statute in time does not automatically void later instruments. Concurrent application is not reserved only for US state privacy laws. Exam caveat: concurrency questions reward recognising overlapping material scopes rather than single-statute tunnel vision. Operational check: maintain an incident RACI that lists potential GDPR, ePrivacy, and NIS 2 owners and notice paths so first responders do not pick one regime and ignore the others. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.