Peers ask why UK cyber bill leaves execs off the personal liability hook
UK peers propose amendments to the Cyber Security and Resilience Bill adding personal executive liability and board-level cyber responsibility; government defends fines-only approach.
Baronesses Kidron and Ludford backed amendments to the UK Cyber Security and Resilience Bill that would introduce personal civil liability for senior executives and mandate board-level cybersecurity responsibility, citing NIS2 and financial-sector accountability rules. Cybersecurity minister Baroness Lloyd defended the bill's existing regime of fines up to £17 million or 4% of annual turnover, with governance requirements to come via secondary legislation. Peers also debated the bill's 24-hour and 72-hour incident reporting requirements, with Baroness Harding proposing an additional 14-day intermediate report and a one-month final report.
- Amendments would impose personal civil liability on executives for consent, connivance, or negligent security failures.
- Government cites maximum fines of £17 million or 4% of annual turnover as its enforcement regime.
- Baroness Harding proposed adding a 14-day intermediate and one-month final incident report.
- Critics warned the 'capable of having an adverse effect' wording could cause defensive over-reporting.
- Organizations
- NCSCUK House of Lords
- Countries
- United Kingdom
From the original article
5 min read at theregister.comMinisters say £17M corporate fines and forthcoming board-level governance rules provide sufficient accountability
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.