First Reading of the Draft Act on Amendments to the Cybersecurity Act and Other Acts (Transposition of the Cybersecurity 2 Directive) (Bill 739 SE)
Session: 15th Riigikogu, 6th Session, Plenary Sitting
Date: 2025-10-23 13:10
Participating Politicians:
Total Speeches: 49
Membership: 15
Agenda Duration: 38m
AI Summaries: 49/49 Speeches (100.0%)
Analysis: Structured Analysis
Politicians Speaking Time
Politicians
Analysis
Summary
The Minister of Justice and Digital Affairs, Liisa-Ly Pakosta, presented Bill 739, initiated by the Government of the Republic, concerning the amendment of the Cybersecurity Act and other acts (transposition of the NIS2 directive), to the Riigikogu at its first reading. The Minister emphasized the necessity of the act due to the rapid growth of cyber threats, citing the successful international police operation SIMCARTEL and cyberattacks against Estonian hospitals as examples. The main goal of the bill is to raise the level of cybersecurity in the European Union and harmonize the rules.
The bill extends the application of stricter cybersecurity requirements to approximately 3,000 new organizations, increasing the total number of affected entities in Estonia to around 6,500. Another significant change is that the entire organization will henceforth be responsible for cybersecurity, not just a specific vital service. The Minister confirmed that the goal was to avoid "gold-plating" European Union law and introduced a new "traffic light" table to help assess the accuracy of the transposition. During the discussions, questions were raised regarding the complex wording of the bill (referencing criticism from the Bar Association and ITL) and the lack of an economic impact analysis. The Minister responded that it is difficult to estimate the exact cost, but the state will offer the new entities a three-year transition period, support measures, and free online courses.
Kalev Stoicescu, Chairman of the National Defence Committee, supported the general principles of the bill, noting the need to align the draft with other laws currently under deliberation. The Committee proposed concluding the first reading.
Decisions Made 2
The first reading of Bill 739 was concluded.
The deadline for the submission of amendments was set for 5:15 PM on November 6, 2023.
Most Active Speaker
Lauri Laats was active in posing questions, focusing on the financial burdens for businesses associated with the draft bill and the tightening of punitive measures against cybercriminals. (Position: other)
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller introduced the second item on the agenda, which was the first reading of draft bill 739, the Act amending the Cybersecurity Act and other acts (transposition of the NIS 2 Directive), initiated by the Government of the Republic, and gave the floor for the presentation to the Minister of Justice and Digital Affairs, Liisa-Ly Pakosta.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller opened the discussion on the first reading of Bill 739, initiated by the Government of the Republic, concerning amendments to the Cybersecurity Act and other acts (transposition of the Cybersecurity 2 Directive), and gave the floor to the presenter, Minister of Justice and Digital Affairs Liisa-Ly Pakosta.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta began by commending the successful international police operation SIMCARTEL, which highlighted the enormous scope of cybercrime. She stressed that, due to cyberattacks doubling in Estonia, it is imperative to adopt the EU's NIS2 Directive. This directive will expand the circle of essential service providers subject to stricter cybersecurity requirements by nearly 3,000 companies and place the responsibility for cybersecurity on the entire organization's management.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta emphasized the necessity of transposing the EU's NIS2 Directive, citing the explosive growth of cyberattacks and the cross-border nature of the threat. The directive expands stricter cybersecurity requirements to nearly 3,000 new providers of vital services, placing responsibility directly on the organization’s management, while simultaneously aiming to avoid "gold-plating" and alleviate the administrative burden on smaller institutions.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller thanked the audience and then gave the floor to Vadim Belobrovtsev, noting that the latter had some questions to present.
Vadim Belobrovtsev
Profiling Eesti Keskerakonna fraktsioonAI Summary
Vadim Belobrovtsev pointed out the sheer volume of the draft bill's explanatory memorandum (nearly 140 pages) and requested that the minister outline the most essential content of the bill very concretely and briefly, using just two or three sentences.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta explains that the new draft bill introduces stricter cybersecurity requirements for nearly 3,000 new Estonian companies, thereby increasing the total number of organizations covered by stringent rules to 6,500. The most significant change is that these requirements will henceforth apply to the organization’s entire scope of activity, not just specific services.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta emphasized that the new draft bill introduces stricter cybersecurity requirements for approximately 3,000 new Estonian companies, extending these tougher rules to a total of 6,500 organizations. The most significant amendment is that these security requirements will now apply across the entire organization's operations, rather than just to specific services.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller yielded the floor to Lauri Laats, calling upon him to speak.
Lauri Laats
Profiling Eesti Keskerakonna fraktsioonAI Summary
Lauri Laats expresses support for strengthening cybersecurity and implementing new security requirements across a wider range of entities, but he highlights the associated costs and questions whether an economic impact analysis of the draft bill has been carried out.
Lauri Laats
Profiling Eesti Keskerakonna fraktsioonAI Summary
Lauri Laats emphasizes the necessity of cybersecurity measures in the current situation, but points out that the draft legislation significantly expands the scope of obligated entities, which will result in additional costs for businesses. Therefore, he asks directly whether an analysis of the economic impact of the draft legislation has been performed.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta clarified that while the exact economic impact resulting from the cybersecurity requirements placed on 3,000 new organizations remains unassessed due to a lack of data—and indeed, it would be impossible to adequately calculate—the government has established extensive support measures. These measures include a dedicated support scheme, free training courses, and solutions from the State Information System Authority (RIA) designed to minimize the administrative burden.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta acknowledges that the precise economic impact of the cybersecurity draft bill, which affects 3,000 organizations, remains unassessed because the actual needs of those organizations have not been analyzed. However, to mitigate this, a support scheme will be launched, free online courses will be provided, and the Information System Authority is developing solutions aimed at reducing the administrative burden resulting from these changes.
Aseesimees Arvo Aller
AI Summary
Deputy Chairmen Arvo Aller and Peeter Ernits were invited to the podium to deliver their presentation.
Peeter Ernits
Profiling Fraktsiooni mittekuuluvad Riigikogu liikmedAI Summary
Peeter Ernits sharply reproached the minister, stating that the government had presented "rubbish" to the Riigikogu, referencing the Estonian Bar Association's devastating criticism regarding the illegibility of the draft bill. He demanded an answer as to how the submission of such text could be justified, even if the reason was the strict requirement for the transposition of an European Union regulation, which does not permit the text to be rewritten.
Peeter Ernits
Profiling Fraktsiooni mittekuuluvad Riigikogu liikmedAI Summary
Peeter Ernits leveled scathing criticism against the submitted draft bill, relying on the Estonian Bar Association's devastating assessment of the text's unintelligibility. He demanded an explanation from the minister as to why "such garbage" was presented to the Riigikogu (Parliament), even though it involves the transposition of an EU regulation, which precludes rewriting the text.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
The Minister of Justice and Digital Affairs, Liisa-Ly Pakosta, explained that the draft bill was prepared following extensive consultation and was amended repeatedly. However, she emphasized that because this is a directly applicable European Union regulation (concerning electricity supply), its text cannot be nationally rewritten, although she simultaneously acknowledged criticism regarding the often confusing wording and unsuccessful translations of EU law.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta confirmed that although the draft bill (which transposes the NIS2 directive) underwent thorough consultation rounds and amendments, they cannot change the text of the directly applicable European Union regulation (which concerned electricity supply), even if she agrees with the criticism regarding the confusing wording and unsuccessful translations of EU law.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller and Urve Tiidus were called to the podium to begin their presentation.
Urve Tiidus
Profiling Eesti Reformierakonna fraktsioonAI Summary
Urve Tiidus, prompted by a presentation on successful cyber cooperation, raised the question concerning the necessity and scope of public awareness campaigns required to reduce the number of fraud victims, specifically asking how legislation supports these efforts and what the best methods are for providing cyber education to older adults.
Urve Tiidus
Profiling Eesti Reformierakonna fraktsioonAI Summary
Urve Tiidus, citing a successful example of cyber cooperation, raised the question of the necessity of public awareness campaigns in reducing the number of cyber fraud victims. She asked the minister how the law under consideration would contribute to educating the public, particularly older adults.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta explains that because nearly 80% of cyberattacks stem from human error, rather than system vulnerabilities, the new draft bill mandates free state-provided online training courses for 6,500 organizations (including private companies) aimed at improving cyber hygiene, with completion certified by a test. Furthermore, the government plans to raise the digital and cyber awareness of the Estonian population more broadly, starting with the creation of a comprehensive course for primary school students focused on navigating the digital society. This course will cover elementary cyber hygiene and threat recognition, and its materials will later be adaptable for the entire population.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta emphasizes that, since approximately 80% of cyberattacks are caused by human error, the new draft bill mandates free online training for 6,500 organizations to improve their cyber hygiene. Additionally, the government plans to raise the digital and cyber awareness of the Estonian population more broadly, starting with teaching elementary skills in primary grades so that these materials can later be adapted for the entire population.
Aseesimees Arvo Aller
AI Summary
Vice-Chairman Arvo Aller, Jüri Jaanson, was called to the podium so that he could begin his presentation.
Jüri Jaanson
Profiling Eesti Reformierakonna fraktsioonAI Summary
Jüri Jaanson raises concerns regarding the significant increase in costs (on average, a quarter) for the public sector and businesses resulting from the transposition of the directive. He asks the Minister to clarify how the previously mentioned "minimalist" transposition aligns with this—specifically, whether it will result in lower costs or if it will actually jeopardize security.
Jüri Jaanson
Profiling Eesti Reformierakonna fraktsioonAI Summary
Jüri Jaanson is highlighting the contradiction that while the transposition of the directive has been described as minimalist, costs for the public sector and larger enterprises are nonetheless predicted to rise by a quarter. He is asking the minister to clarify whether "minimalist" in this context implies cost savings or, rather, a decrease in security.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta emphasizes that following feedback on the initial, overly idealistic cybersecurity draft, the decision was made to avoid "gold-plating" EU law. This means transposing the directive precisely to the extent required, thereby ensuring the state does not impose additional mandatory requirements, although organizations remain free to voluntarily implement higher standards.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta emphasized that although the initial version of the cybersecurity draft bill was too idealistic and raised questions within society, it was decided to transpose the European Union law exactly to the extent prescribed. This decision avoided the typical Estonian tendency to add supplementary, or 'gold-plating,' requirements enforced by the state, while still leaving organizations the opportunity to voluntarily contribute more than what is stipulated in the law.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller gave the floor to Lauri Laats, inviting him to the podium.
Lauri Laats
Profiling Eesti Keskerakonna fraktsioonAI Summary
Lauri Laats highlighted the potentially significant financial burden that the draft bill amending ten laws would place on businesses, while simultaneously stressing the absence of a proper analysis. He then asked the rapporteur whether the Estonian state plans to stiffen penalties against individuals who organize cyber attacks.
Lauri Laats
Profiling Eesti Keskerakonna fraktsioonAI Summary
Lauri Laats voiced concern regarding the significant financial burden the draft legislation would place on companies, noting the lack of accompanying analysis, and asked whether the state intends to stiffen penalties for individuals carrying out cyberattacks.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta notes that in the case of cybercrimes, it is difficult both to apprehend the perpetrators and to prove guilt. For this reason, the cybersecurity knowledge of the prosecutor's office and the police is being strengthened. She emphasizes, however, that according to the current principle for determining punishment, the crucial factor is the extent of the damage caused, not whether the crime was committed using a computer or not.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
The Minister of Justice and Digital Affairs, Liisa-Ly Pakosta, explained that apprehending perpetrators of cybercrimes and proving their guilt is extremely complicated due to the technological capabilities available. Consequently, the Prosecutor's Office, the Police and Border Guard Board, and the courts are strengthening their knowledge related to cybersecurity, while simultaneously emphasizing that the severity of the sentence must be based on the extent of the damage caused, and not on whether the crime was committed using a computer or otherwise.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller, Peeter Ernits was called by name to the speaker's stand to begin his presentation.
Peeter Ernits
Profiling Fraktsiooni mittekuuluvad Riigikogu liikmedAI Summary
Peeter Ernits sharply criticized the government's proposed bill, labeling it a crude and hard-to-digest piece of legal text that suffers from an inadequate impact assessment and requires fundamental amendments—or perhaps even drafting an entirely new law.
Peeter Ernits
Profiling Fraktsiooni mittekuuluvad Riigikogu liikmedAI Summary
Peeter Ernits sharply criticizes the government for submitting an immature and crude draft law for consideration, which he refers to as a hard-to-digest "chunk of meat." He emphasizes that both ITL and the Bar Association find the text difficult to read, and the inadequate impact assessment fails to reflect the true, significant impact of the bill, which is why the draft requires a complete overhaul.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta confirms that the draft bill has been thoroughly worked through, incorporating criticism and involving two law firms. She emphasizes that the resulting detailed, traffic-light table, which shows the evolution of the provisions, has received the full approval of the private sector, including ITL, which recommended that this method be used for the future transposition of EU law as well.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta confirmed that criticism and engagement were taken extremely seriously during the drafting of the bill, noting that they even involved two law firms for the necessary amendment work. She emphasized that the result was a detailed "traffic light" table approved by the private sector (including ITL), which makes the bill a transparent and thoroughly considered piece of legislation.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller invited Eero Merilind to the podium as the next speaker.
Eero Merilind
Profiling Fraktsiooni mittekuuluvad Riigikogu liikmedAI Summary
Eero Merilind is raising the issue of the necessity of extending the auditing period for the information security standard, arguing that the current 2–3-year cycle is excessively time-consuming and resource-intensive for healthcare institutions.
Eero Merilind
Profiling Fraktsiooni mittekuuluvad Riigikogu liikmedAI Summary
Eero Merilind raises the question of the expediency of extending the auditing period for the information security standard for hospitals and health centers, citing the significant time and resource intensity of this process.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta confirmed that although the transition period is currently three years and can be extended if necessary, a review and simplification of the extensive and complex cybersecurity standards is underway to ensure people have a better understanding of their cyber obligations and work-related requirements.
Justiits- ja digiminister Liisa-Ly Pakosta
AI Summary
Minister of Justice and Digital Affairs Liisa-Ly Pakosta confirmed that the current three-year transition period can be extended up to five years if necessary, emphasizing that complex cybersecurity standards are currently being reviewed and simplified to ensure people understand their obligations.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller concluded the Q&A session, thanked the participants, and then gave the floor to Kalev Stoicescu, the Chairman of the National Defence Committee, who was scheduled to present an overview of the discussion held in the lead committee.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller concluded the round of questions and introduced the next item on the agenda, which was an overview of the discussion held in the lead committee, handing the role of presenter over to Kalev Stoicescu, Chairman of the National Defence Committee.
Kalev Stoicescu
Profiling Fraktsiooni mittekuuluvad Riigikogu liikmedAI Summary
Kalev Stoicescu presented the position of the National Defence Committee on the draft bill, which transposes the EU Cybersecurity Directive 2 (NIS2) into Estonian law, with the aim of raising the level of cybersecurity and harmonizing regulations, and designating the Information System Authority (RIA) as the competent authority. The committee supports the general principles of the draft bill but stressed the necessity of aligning it with other legislative drafts and considering the inclusion of cyberspace sovereignty within national defense objectives. It also confirmed that the focus during the law's implementation will be on ensuring compliance with requirements, rather than on imposing penalties, and proposed that the Riigikogu conclude the first reading of the draft bill.
Kalev Stoicescu
Profiling Fraktsiooni mittekuuluvad Riigikogu liikmedAI Summary
Kalev Stoicescu, on behalf of the National Defence Committee, provided an overview of the draft bill for the transposition of the European Union's Cybersecurity 2 Directive (NIS2) into Estonian law. The objective of this bill is to raise the level of cybersecurity and harmonize regulations, designating the State Information System Authority (RIA) as the competent authority. The Committee supported the general principles of the draft but stressed the necessity of aligning it with other legislative amendments and considering the enshrinement of cyberspace sovereignty within national defense objectives. Furthermore, the Committee affirmed that the goal of implementing the law is to ensure compliance by critical and important enterprises, not to impose penalties.
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller confirmed that the first reading of Draft Bill 739 had been successfully completed, the factions did not request a debate, and the sitting was declared closed after setting the deadline for amendments (November 6 at 5:15 p.m.).
Aseesimees Arvo Aller
AI Summary
Deputy Chairman Arvo Aller announced that, since neither questions nor requests for debate had been submitted, the first reading of Draft Bill 739 was concluded upon the proposal of the lead committee, setting the deadline for submitting amendments as November 6th at 17:15, and subsequently declared the session adjourned.