The draft law that aims at certain amendments and additions to the Electricity and Natural Gas Law and to the Law on establishing the promotion system for the production of energy from renewable sources is in the public consultation phase, which means that it may undergo modifications, additions or even the elimination of some rules.
The Ministry of Energy comes with a series of clarifications related to Article I, point 6, paragraph. (27) from the draft emergency ordinance regarding the proposal to establish the mandatory cyber security audit on inverters, systems and computer networks associated with photovoltaic power plants, after several criticisms brought by the associations in the field.
„The Ministry of Energy does not pursue under any form the obligation of prosumers to carry out cyber security audits, but only, eventually, of large producers/network operators. The individualization of large producers/network operators can only be achieved by reporting to the quality of service operator essential, as defined by the NIS2 Directive and the future transposition law. The project is only in the public consultation phase, which means that it may undergo changes, additions or even elimination of the norm, if the consulted public authorities, social partners and civil society formulate proposals in the case”, say the representatives of the Ministry of Energy.
According to them, the only intention of the Ministry of Energy is to protect, through preventive measures, the cyber security of the large electricity producers, in order to ensure the security of the national energy system.
„The Ministry of Energy remains open to the dialogue with specialists in the field and publicly guarantees that the final form of the draft normative act will meet the opinions formulated by specialists and the competent national authorities in the field of energy, cyber security, etc,” reads the press release sent by the ministry.
The Association of Prosumers and Energy Communities (APCE) sent a statement on Thursday that the draft emergency ordinance posted on the website of the Ministry of Energy is one in which good and constructive things appear regarding storage, double taxing of stored energy. It also defines what a work of national public interest means, defines exactly what a storage service means and many others with a positive impact in the energy field, but when it comes to prosumers, things become „tragicomic” in the substantiation note of the draft law, says the president of APCE, Dan Pirsan, in a point of view sent to AGERPRES.
„Espionage stories with cyber attackers taking control of our National Energy System… through inverters… The scenario described in the substantiation note seems to be from a James Bond movie, presenting a hypothesis of ANRE in which the inverters with Chinese components spy on prosumers by sending sensitive data to servers in China: production, energy consumption and, possibly, the weather in Romania. Moreover, according to ANRE „specialists”, these inverters, connected to local networks, can be vulnerable to espionage if they are compromised and they can further make the entire National Energy System vulnerable”, states the president of APCE.
He adds that ANRE actually wants total control of inverters in Romania.
The National Supervisory Authority for the Processing of Personal Data (ANSPDCP) has formulated a response to APCE’s request regarding access to data from Romanian inverters, stating that the data provided by the inverter is subject to GDPR rules and is personal data. According to the source cited, this answer will be communicated upon request and to ANRE „in case it does not know the legislation in the field”.
The Association of Prosumers and Energy Communities from Romania has announced that it will formulate a point of view regarding the legislative proposal to the Ministry of Energy in due time, and if it is not taken into account, the association will resort to legal means to challenge this bill.
AGERPRES
