EN Official Journal of the European Union C 96/1

DECISION OF THE BUREAU OF THE EUROPEAN PARLIAMENT

of 15 April 2013

concerning the rules governing the treatment of confidential information by the European Parliament

2014/C 96/01

THE BUREAU OF THE EUROPEAN PARLIAMENT,

Having regard to Rule 23(12) of the Rules of Procedure of the European Parliament,

Whereas:

(1) In the light of the Framework Agreement on relations between the European Parliament and the European Commission (1) signed on 20 October 2010 (‘the Framework Agreement’) and the Interinstitutional Agreement between the European Parliament and the Council concerning the forwarding to and handling by the European Parliament of classified information held by the Council on matters other than those in the area of the Common Foreign and Security Policy (2) signed on 12 March 2014 (‘the Interinstitutional Agreement’), it is necessary to lay down specific rules on the treatment of confidential information by the European Parliament.

(2) The Lisbon Treaty assigns new tasks to the European Parliament and, in order to develop Parliament's activities in those areas which require a degree of confidentiality, it is necessary to lay down basic principles, minimum standards of security and appropriate procedures for the treatment by the European Parliament of confidential, including classified, information.

(3) The rules laid down in this Decision aim at ensuring equivalent standards of protection and compatibility with the rules adopted by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States, in order to facilitate the smooth functioning of the decision-making process of the European Union.

(4) The provisions of this Decision are without prejudice to current and future rules on access to documents adopted in accordance with Article 15 of the Treaty on the Functioning of the European Union (TFEU).

(5) The provisions of this Decision are without prejudice to current and future rules on the protection of personal data adopted in accordance with Article 16 TFEU,

HAS ADOPTED THIS DECISION:

Article 1

Objective

This Decision governs the management and handling of confidential information by the European Parliament, including the creation, reception, forwarding and storage of such information, with a view to the appropriate protection of its confidential nature. It implements, the Interinstitutional Agreement and the Framework Agreement, in particular Annex II thereto.

Article 2

Definitions

For the purposes of this Decision:

(a) ‘information’ means any written or oral information, whatever the medium and whoever the author may be;

(b) ‘confidential information’ means ‘classified information’, and non-classified ‘other confidential information’;

(c) ‘classified information’ means ‘EU classified information’ and ‘equivalent classified information’;

(d) ‘EU classified information’ (EUCI) means any information and material, classified as ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE/EU SECRET’, ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ or ‘RESTREINT UE/EU RESTRICTED’, unauthorised disclosure of which could cause varying degrees of prejudice to Union interests or to those of one or more of its Member States, whether or not such information originates within the institutions, bodies, offices or agencies established by virtue or on the basis of the Treaties. In this regard, information and material classified at the level: — ‘TRÈS SECRET UE/EU TOP SECRET’ is information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the Union or of one or more of the Member States; — ‘SECRET UE/EU SECRET’ is information and material the unauthorised disclosure of which could seriously harm the essential interests of the Union or of one or more of the Member States; — ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ is information and material the unauthorised disclosure of which could harm the essential interests of the Union or of one or more of the Member States; — ‘RESTREINT UE/EU RESTRICTED’ is information and material the unauthorised disclosure of which could be disadvantageous to the interests of the Union or of one or more of the Member States;

(e) ‘equivalent classified information’ means classified information issued by Member States, third States or international organisations which bears a security classification marking equivalent to one of the security classification markings used for EUCI and which has been forwarded to the European Parliament by the Council or the Commission;

(f) ‘other confidential information’ means any other non-classified confidential information, including information covered by data protection rules or by the obligation of professional secrecy, created in the European Parliament or forwarded to the European Parliament by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States;

(g) ‘document’ means any recorded information, regardless of its physical form or characteristics;

(h) ‘material’ means any document or item of machinery or equipment, either manufactured or in the process of manufacture;

(i) ‘need to know’ means the need of a person to have access to confidential information in order to be able to perform an official function or a task;

(j) ‘authorisation’ means a decision adopted by the President, if it concerns Members of the European Parliament, or by the Secretary-General, if it concerns officials of the European Parliament and other European Parliament employees working for political groups, to grant an individual access to classified information up to a specific level, on the basis of a positive result of a security screening (vetting) carried out by a national authority under national law and pursuant to the provisions laid down in Annex I, Part 2;

(k) ‘downgrading’ means a reduction in the level of classification;

(l) ‘declassification’ means the removal of any classification;

(m) ‘marking’ means a sign affixed to ‘other confidential information’ intended to identify predefined specific instructions about its handling or the field covered by a given document. It may also be affixed to classified information, in order to impose additional requirements for its handling;

(n) ‘unmarking’ means the removal of any marking;

(o) ‘originator’ means the duly authorised author of confidential information;

(p) ‘security notices’ means the implementing measures laid down in Annex II;

(q) ‘handling instructions’ means technical instructions issued to the European Parliament's services concerning the management of confidential information.

Article 3

Basic principles and minimum standards

1. The treatment of confidential information by the European Parliament shall follow the basic principles and minimum standards laid down in Annex I, Part 1.

2. The European Parliament shall set up an information security management system (ISMS) in accordance with those basic principles and minimum standards. The ISMS shall consist of the security notices, the handling instructions and the relevant Rules of Procedure. It shall aim at facilitating parliamentary and administrative work, while ensuring the protection of any confidential information processed by the European Parliament, in full respect of the rules established by the originator of such information as laid down in the security notices.

The processing of confidential information by means of automated communication and information systems (CIS) of the European Parliament shall be implemented in accordance with the concept of information assurance (IA), as provided for in security notice 3.

3. Members of the European Parliament may consult classified information up to and including the level RESTREINT UE/EU RESTRICTED without security clearance.

4. Where the information concerned is classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent, access shall be granted to those Members of the European Parliament who have been authorised by the President pursuant to paragraph 5 or after having signed a solemn declaration of non-disclosure of the content of that information to third persons, of compliance with the obligation to protect information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL and of acknowledgement of the consequences of any failure to do so.

5. Where the information concerned is classified at the level SECRET UE/EU SECRET or TRÈS SECRET/EU TOP SECRET or its equivalent, access shall be granted to those Members of the European Parliament who are authorised by the President after:

(a) they have been security-cleared in accordance with Annex I, Part 2, of this Decision, or

(b) a notification has been received from a competent national authority that the Members concerned are duly authorised by virtue of their functions in accordance with national law.

6. Before being granted access to classified information, Members of the European Parliament shall be briefed on, and shall acknowledge, their responsibilities regarding the protection of such information in accordance with Annex I. They shall also be briefed on the means of ensuring such protection.

7. Officials of the European Parliament and other European Parliament employees working for political groups may consult confidential information if they have an established ‘need to know’, and may consult classified information above the level RESTREINT UE/EU RESTRICTED if they hold the appropriate level of security clearance. Access to classified information shall be granted only if they have been briefed on, and received written instructions concerning, their responsibilities regarding the protection of such information, as well as the means of ensuring such protection, and if they have signed a declaration acknowledging receipt of those instructions and undertaking to comply with them in accordance with the current rules.

Article 4

Creation of confidential information and administrative handling by the European Parliament

1. The President of the European Parliament, the chairs of the parliamentary committees concerned and the Secretary-General and/or any person duly authorised by him/her in writing may originate confidential information and/or classify information as provided for in the security notices.

2. When creating classified information, the originator shall apply the appropriate level of classification in line with the international standards and definitions set out in Annex I. The originator shall also determine, as a general rule, the addressees who are to be authorised to consult the information commensurate to the level of classification. This information shall be communicated to the Classified Information Unit (CIU) when the document is deposited with the CIU.

3. ‘Other confidential information’ covered by professional secrecy shall be dealt with in accordance with Annexes I and II and the handling instructions.

Article 5

Reception of confidential information by the European Parliament

1. Confidential information received by the European Parliament shall be communicated as follows:

(a) information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’: to the secretariat of the parliamentary body/office-holder which submitted the request therefor, or directly to the CIU;

(b) information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent: to the CIU.

2. The registration, storage and traceability of confidential information shall be dealt with, as the case may be, either by the secretariat of the parliamentary body/office-holder who received the information or by the CIU.

3. The agreed arrangements to be established by common accord with a view to preserving the confidentiality of the information, in the case of confidential information communicated by the Commission pursuant to point 3.2 of Annex II to the Framework Agreement, or in the case of classified information forwarded by the Council pursuant to Article 5(4) of the Interinstitutional Agreement, shall be deposited, together with the confidential information, at the secretariat of the parliamentary body/office-holder or at the CIU, as the case may be.

4. The arrangements referred to in paragraph 3 may also be applied mutatis mutandis for the communication of confidential information by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States.

5. In order to ensure a level of protection commensurate with the level of classification TRÈS SECRET UE/EU TOP SECRET or its equivalent, the Conference of Presidents shall set up an oversight committee. Information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent shall be communicated to the European Parliament subject to further arrangements, to be agreed between the European Parliament and the Union Institution from whom the information is received.

Article 6

Communication of classified information by the European Parliament to third parties

The European Parliament may, subject to the prior written consent of the originator or the Union Institution, which has communicated the classified information to the European Parliament, as the case may be, forward such classified information to third parties, on condition that they ensure that, when such information is handled, rules equivalent to those laid down in this Decision are respected within their services and premises.

Article 7

Secure facilities

1. For the purposes of the management of confidential information, the European Parliament shall establish a Secure Area and Secure Reading Rooms.

2. The Secure Area shall provide facilities for the registration, consultation, archiving, transmission and handling of classified information. It shall comprise, inter alia, a reading room and a meeting room for the consultation of classified information and shall be managed by the CIU.

3. Outside the Secure Area, Secure Reading Rooms may be created, in order to allow for the consultation of information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent, and of ‘other confidential information’. Those Secure Reading Rooms shall be managed by the competent services of the secretariat of the parliamentary body/office-holder or by the CIU, as the case may be. They shall not contain photocopying machines, telephones, fax facilities, scanners or any other technical equipment for the reproduction or transmission of documents.

Article 8

Registration, handling and storage of confidential information

1. Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ shall be registered and stored by the competent services of the secretariat of the parliamentary body/office-holder or by the CIU, depending on who received the information.

2. The following conditions shall apply to the handling of information classified at the level RESTREINT EU/EU RESTRICTED or its equivalent and ‘other confidential information’:

(a) documents shall be handed over in person to the head of the secretariat, who shall register them and provide an acknowledgement of receipt;

(b) when not actually being used, such documents shall be kept in a locked location, under the responsibility of the secretariat;

(c) in no case may the information be saved on another medium or transmitted to any person. Such documents may only be duplicated by means of appropriately accredited equipment as defined in the security notices;

(d) access to such information shall be restricted to those designated by the originator or by the Union Institution which communicated the information to the European Parliament, in accordance with the arrangements referred to in Article 4(2) or Article 5(3), (4) and (5);

(e) the secretariat of the parliamentary body/office-holder shall keep a record of the persons who have consulted the information, and of the date and time of such consultation, and shall transmit the record to the CIU at the time when the information is deposited with the CIU.

3. Information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent shall be registered, handled and stored by the CIU in the Secure Area, in accordance with the specific level of classification and as defined in the security notices.

4. In the event of a breach of the rules set out in paragraghs 1 to 3, the responsible official of the secretariat of the parliamentary body/office-holder or of the CIU, as the case may be, shall inform the Secretary-General, who shall refer the matter to the President if a Member of the European Parliament is concerned.

Article 9

Access to secure facilities

1. Only the following persons shall have access to the Secure Area:

(a) persons who, pursuant to Article 3(4) to (7), are authorised to consult the information held there and who have submitted an application pursuant to Article 10(1);

(b) persons who, pursuant to Article 4(1), are authorised to create classified information and who have submitted an application pursuant to Article 10(1);

(c) the European Parliament's officials of the CIU;

(d) the European Parliament officials responsible for managing the CIS;

(e) European Parliament officials responsible for security and fire safety, when necessary;

(f) cleaning staff, but only in the presence of, and under close surveillance by, an official of the CIU.

2. The CIU may deny access to the Secure Area to any person not authorised to enter. Any objection challenging such a denial of access shall be submitted to the President, in the case of a request for access by a Member of the European Parliament, and to the Secretary-General in other cases.

3. The Secretary-General may authorise a meeting for a limited number of persons in the meeting room located within the Secure Area.

4. Only the following persons shall have access to a Secure Reading Room:

(a) Members of the European Parliament, officials of the European Parliament and other European Parliament employees working for political groups, duly identified for the purposes of consultation or creation of confidential information;

(b) the European Parliament officials responsible for managing the CIS, officials of the secretariat of the parliamentary body/office-holder which received the information, and officials of the CIU;

(c) where necessary, European Parliament officials responsible for security and fire safety;

(d) cleaning staff, but only in the presence of, and under close surveillance by, an official working in the secretariat of the parliamentary body/office-holder or in the CIU, as the case may be.

5. The competent secretariat of the parliamentary body/office-holder or the CIU, as the case may be, may deny access to a Secure Reading Room to any person not authorised to enter. Any objection challenging such a denial of access shall be submitted to the President, in the case of a request for access by a Member of the European Parliament, and to the Secretary-General in other cases.

Article 10

Consultation or creation of confidential information in secure facilities

1. Any person wishing to consult or create confidential information in the Secure Area shall communicate his or her name in advance to the CIU. The CIU shall check the identity of that person and verify whether he or she is permitted, in accordance with Article 3(3) to (7), Article 4(1) or Article 5(3), (4) and (5) to consult or create confidential information.

2. Any person wishing, in accordance with Article 3(3) and (7), to consult confidential information classified at the level RESTREINT EU/EU RESTRICTED or its equivalent or ‘other confidential information’ in a Secure Reading Room shall communicate his or her name in advance to the competent services of the secretariat of the parliamentary body/office-holder or to the CIU.

3. Save in exceptional circumstances (e.g. where numerous requests for consultation are submitted within a short period of time), only one person at a time shall be authorised to consult confidential information in a secure facility, in the presence of an official of the secretariat of the parliamentary body/office-holder or of the CIU.

4. During the consultation process, contact with the exterior (including by means of telephones or other technological devices), the taking of notes and the photocopying or photographing of the confidential information consulted shall be prohibited.

5. Before authorising a person to leave the secure facility, the official of the secretariat of the parliamentary body/office-holder or of CIU shall check that the confidential information consulted is still present, intact and complete.

6. In the event of a breach of the rules set out above, the official of the secretariat of the parliamentary body/office-holder or of the CIU shall inform the Secretary-General, who shall refer the matter to the President where a Member of the European Parliament is concerned.

Article 11

Minimum standards for consultation of confidential information at a meeting in camera outside secure facilities

1. Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ may be consulted by members of parliamentary committees or of other political and administrative bodies of the European Parliament at a meeting in camera outside the secure facilities.

2. In the circumstances provided for in paragraph 1, the secretariat of the parliamentary body/office-holder responsible for the meeting shall ensure that the following conditions are complied with:

(a) only the persons designated by the chair of the competent committee or body to participate in the meeting are allowed to enter the meeting room;

(b) all documents are numbered, distributed at the beginning of the meeting and collected again at the end, and no notes of those documents and no photocopies or photographs thereof are taken;

(c) the minutes of the meeting make no mention of the content of the discussion of the information considered. Only the relevant decision, if any, may be recorded;

(d) confidential information provided orally to recipients in the European Parliament is subject to a level of protection equivalent to that applied to confidential information in written form;

(e) no additional stock of documents is held in meeting rooms;

(f) copies of documents are distributed only in the requisite numbers to participants and interpreters at the start of the meeting;

(g) the classification/marking status of the documents is made clear by the chair of the meeting at the start of the meeting;

(h) participants do not remove documents from the meeting room;

(i) all copies of documents are collected and accounted for at the end of the meeting by the secretariat of the parliamentary body/office-holder; and

(j) no electronic communication devices or other electronic devices are taken into the meeting room where the confidential information in question is consulted or discussed.

3. Where, in accordance with the exceptions laid down in point 3.2.2 of Annex II to the Framework Agreement and in Article 6(5) of the Interinstitutional Agreement, information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent is discussed at a meeting held in camera, the secretariat of the parliamentary body/office-holder responsible for the meeting shall, in addition to ensuring compliance with the provisions laid down in paragraph 2, ensure that the persons designated to participate in the meeting comply with the requirements of Article 3(4) and (7).

4. In the case provided for in paragraph 3, the CIU shall provide to the secretariat of the parliamentary body/office-holder-responsible for the meeting in camera the requisite number of copies of the documents to be discussed, which shall be returned to the CIU after the meeting.

Article 12

Archiving of confidential information

1. Secure archiving facilities shall be provided within the Secure Area. The CIU shall be responsible for managing the secure archive in accordance with standard archiving criteria.

2. Classified information definitively deposited with the CIU, and information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent which is deposited with the secretariat of the parliamentary body/office-holder, shall be transferred to the secure archive in the Secure Area six months after it was last consulted and, at the latest, one year after it was deposited. ‘Other confidential information’ shall be archived, unless deposited with the CIU, by the secretariat of the parliamentary body/office-holder concerned, in accordance with the general rules on document management.

3. Confidential information held in the secure archive may be consulted subject to the following conditions:

(a) only those persons identified by name, by function or by office in the accompanying document drawn up when the confidential information was deposited shall be authorised to consult that information;

(b) the application to consult confidential information shall be submitted to the CIU, which shall transfer the document in question to the Secure Reading Room; and

(c) the procedures and conditions governing the consultation of confidential information set out in Article 10 shall apply.

Article 13

Downgrading, declassification and unmarking of confidential information

1. Confidential information may be downgraded, declassified or unmarked only with the prior consent of the originator, and, if necessary, after discussion with other interested parties.

2. Downgrading or declassification shall be confirmed in writing. The originator shall be responsible for informing its addressees of the change, and they in turn shall be responsible for informing any subsequent addressees to whom they have sent or copied the document, of the change. If possible, originators shall specify on classified documents a date, period or event when the contents may be downgraded or declassified. Otherwise, they shall keep the documents under review every five years, at the latest, in order to ensure that the original classification is necessary.

3. Confidential information held in the secure archives shall be examined in good time, and by no later than the 25th anniversary of its creation, in order to determine whether or not it should be declassified, downgraded or unmarked. The examination and publication of such information shall take place in accordance with the provisions of Council Regulation (EEC, Euratom) No 354/83 of 1 February 1983 concerning the opening to the public of the historical archives of the European Economic Community and the European Atomic Energy Community (3). Declassification shall be effected by the originator of the classified information or the service currently responsible in accordance with Annex I, Part 1, Section 10.

4. Following declassification, formerly classified information held in the secure archive shall be transferred to the historical archives of the European Parliament for permanent preservation and further treatment under the applicable rules.

5. Following unmarking, formerly ‘other confidential information’ shall be subject to the European Parliament rules on document management.

Article 14

Breaches of security, loss or compromise of confidential information

1. A breach of confidentiality in general, and of this Decision in particular, shall in the case of Members of the European Parliament entail the application of the relevant provisions concerning penalties set out in the European Parliament's Rules of Procedure.

2. A breach committed by a member of staff of the European Parliament shall lead to the application of the procedures and penalties provided for by, respectively, the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Union, laid down in Regulation (EEC, Euratom, ECSC) No 259/68 (4) (‘the Staff Regulations’).

3. The President and/or the Secretary-General, as the case may be, shall organise any necessary investigations in the event of a breach as defined in security notice 6.

4. If the confidential information was communicated to the European Parliament by a Union Institution or by a Member State, the President and/or the Secretary-General, as the case may be, shall inform the Union Institution or Member State concerned of any proven or suspected loss or compromise of classified information, of the results of the investigation and of the measures taken to prevent a recurrence.

Article 15

Adaptation of this Decision and its implementing rules and annual reporting on the application of this Decision

1. The Secretary-General shall propose any necessary adaptation of this Decision and the annexes implementing it and shall forward those proposals to the Bureau for decision.

2. The Secretary-General shall be responsible for the implementation of this Decision by the European Parliament's services and shall issue the handling instructions on matters covered by the ISMS in accordance with the principles laid down by this Decision.

3. The Secretary-General shall submit an annual report to the Bureau on the application of this Decision.

Article 16

Transitional and final provisions

1. Non classified information held in the CIU or in any other archive of the European Parliament which is considered as confidential and dated before 1 April 2014 shall be deemed, for the purpose of this Decision, to constitute ‘other confidential information’. Its originator may at any time reconsider the level of its confidentiality.

2. By way of derogation from point (a) of Article 5(1) and from Article 8(1) of this Decision, for a period of twelve months from 1 April 2014, information provided by the Council pursuant to the Interinstitutional Agreement which is classified at the level RESTREINT UE/EU RESTRICTED or its equivalent shall be deposited with, registered by and stored in the CIU. Such information may be consulted in accordance with points (a) and (c) of Article 4(2) and with Article 5(4) of the Interinstitutional Agreement.

3. The decision of the Bureau of 6 June 2011 concerning the rules governing the treatment of confidential information by the European Parliament is repealed.

Article 17

Entry into force

This Decision shall enter into force on the day of its publication in the Official Journal of the European Union.

(1) OJ L 304, 20.11.2010, p. 47.

(2) OJ C 95, 1.4.2014, p. 1.

(3) OJ L 43, 15.2.1983, p. 1.

(4) OJ L 56, 4.3.1968, p. 1.

ANNEX I Part 1 BASIC PRINCIPLES AND MINIMUM STANDARDS OF SECURITY FOR THE PROTECTION OF CONFIDENTIAL INFORMATION 1. INTRODUCTION These provisions set out the basic principles and minimum standards of security for the protection of confidential information to be respected and/or complied with by the European Parliament in all its places of employment, including by all recipients of, classified information and ‘other confidential information’ so that security is safeguarded and all persons concerned may be assured that a common standard of protection is established. These provisions are supplemented by the security notices contained in Annex II and by other provisions governing the treatment of confidential information by parliamentary committees and other parliamentary bodies/office-holders. 2. BASIC PRINCIPLES The European Parliament's security policy forms an integral part of its general internal management policy and is thus based on the principles governing that general policy. Those principles include legality, transparency, accountability, subsidiarity and proportionality. Legality entails the need to remain strictly within the legal framework in the performance of security functions, and to conform to the applicable legal requirements. Furthermore, responsibilities in the field of security must be based on proper legal provisions. The provisions of the Staff Regulations, in particular Article 17 thereof on the obligation of staff to refrain from any unauthorised disclosure of information received in the line of duty and Title VI thereof on disciplinary measures, are fully applicable. Finally, breaches of security within the responsibility of the European Parliament shall be dealt with in a manner consistent with its Rules of Procedure and its policy on disciplinary measures. Transparency entails the need for clarity regarding all security rules and provisions, for a balance between the different services and the different domains (physical security as compared to the protection of information, etc.), and for a consistent and structured security awareness policy. Moreover, clear written guidelines are necessary for the implementation of security measures. Accountability means that responsibilities in the field of security must be clearly defined. Moreover, it entails the need regularly to monitor whether those responsibilities have been properly fulfilled. Subsidiarity means that security must be organised at the lowest possible level and as closely as possible to the European Parliament's Directorates-General and services. Proportionality means that security activities must be strictly limited to those which are absolutely necessary and that security measures must be proportional to the interests to be protected as well as to the actual or potential threat to those interests, so as to enable those interests to be defended in a manner ensuring the least possible disruption. 3. FOUNDATIONS OF INFORMATION SECURITY The foundations of sound information security are: (a) proper communication and information systems (CIS). These fall within the responsibility of the European Parliament's Security Authority (as defined in security notice 1); (b) within the European Parliament, the Information Assurance Authority (as defined in security notice 1) responsible for working with the Security Authority to provide information and advice on technical threats to CIS and the means of protecting against those threats; (c) close cooperation between the European Parliament's responsible services and the security services of the other Union institutions; 4. PRINCIPLES OF INFORMATION SECURITY 4.1. Objectives The principle objectives of information security are as follows: (a) to safeguard confidential information against espionage, compromise or unauthorised disclosure; (b) to safeguard classified information handled in communications and information systems and networks against threats to its confidentiality, integrity and availability; (c) to safeguard European Parliament premises housing classified information against sabotage and malicious wilful damage; (d) in the event of a security failure, to assess the damage caused, limit the consequences, conduct security investigations and adopt any necessary remedial measures. 4.2. Classification 4.2.1. Where confidentiality is concerned, care and experience are needed in the selection of the information and material to be protected as well as in assessing the degree of protection required. It is essential that the degree of protection should correspond to the sensitivity, in terms of security, of the individual item of information or material to be safeguarded. In order to ensure the smooth flow of information, both over-classification and under-classification shall be avoided. 4.2.2. The classification system is the instrument for putting into effect the principles set out in this section. A similar classification system shall be followed in planning and organising ways to counter espionage, sabotage, terrorism and other threats, in order to ensure maximum protection for the most important premises housing classified information and the most sensitive points within those premises. 4.2.3. Responsibility for classifying information lies solely with the originator of the information concerned. 4.2.4. The level of classification may be based solely on the content of the information concerned. 4.2.5. Where several items of information are grouped together, their classification shall be at least as high as the highest classification level assigned to one of its individual items. However, a collection of information may be assigned a higher classification than its constituent parts. 4.2.6. Classifications shall be assigned only when necessary and for as long as necessary. 4.3. Aims of security measures The security measures shall: (a) extend to all persons having access to classified information, media carrying classified information and ‘other confidential information’, as well as all premises containing such information and important installations; (b) be designed in such a way as to identify persons whose position (in terms of access, relationships or otherwise) might jeopardise the security of such information and of important installations housing such information, and provide for their exclusion or removal; (c) prevent unauthorised persons from having access to such information or to installations containing it; (d) ensure that such information is disseminated solely on the basis of the need-to-know principle, which is fundamental to all aspects of security; (e) ensure the integrity (by preventing corruption, unauthorised alteration or unauthorised deletion) and the availability (to those needing and authorised to have access thereto) of confidential information, especially where it is stored, processed or transmitted in electromagnetic form. 5. COMMON MINIMUM STANDARDS The European Parliament shall ensure that common minimum standards of security are observed by all recipients of classified information, both inside the institution and under its competence, namely all its services and contractors, so that such information can be passed on in the confidence that it will be handled with equal care. Such minimum standards shall include criteria for the security clearance of officials of the European Parliament and other Parliament employees working for political groups, and procedures for the protection of confidential information. The European Parliament shall allow third parties access to such information only when such third parties guarantee that it is handled in accordance with provisions that are at least strictly equivalent to these common minimum standards. Such common minimum standards shall also be applied when, pursuant to a contract or grant, the European Parliament entrusts to industrial or other entities tasks involving confidential information. 6. SECURITY AS REGARDS OFFICIALS OF THE EUROPEAN PARLIAMENT AND OTHER PARLIAMENT EMPLOYEES WORKING FOR POLITICAL GROUPS 6.1. Security instructions as regards officials of the European Parliament and other Parliament employees working for political groups Officials of the European Parliament and other Parliament employees working for political groups in positions where they could have access to classified information shall be given thorough instructions, both on taking up their duties and at regular intervals thereafter, on the need for security and the procedures involved. Such persons shall be required to confirm in writing that they have read and fully understand the applicable security provisions. 6.2. Management responsibilities It must be part of the duties of managers to know which of their staff are engaged in work on classified information or have access to secure communication or information systems, and to record and report any incidents or apparent vulnerabilities which are likely to affect security. 6.3. Security status of officials of the European Parliament and other Parliament employees working for political groups Procedures shall be established to ensure that, when adverse information becomes known concerning an official of the European Parliament or other Parliament employee working for a political group, steps are taken to determine whether that individual's work brings him or her into contact with classified information or whether he or she has access to secure communication or information systems, and that the European Parliament's responsible service is informed. If the competent National Security Authority indicates that such an individual constitutes a security risk, he or she shall be barred or removed from assignments where he or she might endanger security. 7. PHYSICAL SECURITY ‘Physical security’ means the application of physical and technical protective measures to prevent unauthorised access to classified information. 7.1. Need for protection The degree of physical security measures to be applied to ensure the protection of classified information shall be proportionate to the classification and volume of, and the threat to, the information and material held. All holders of classified information shall follow uniform practices regarding classification of such information and must meet common standards of protection regarding the custody, transmission and disposal of information and material requiring protection. 7.2. Checking Before leaving areas containing classified information unattended, persons having custody thereof shall ensure that it is securely stored and that all security devices have been activated (locks, alarms, etc.). Further independent checks shall be carried out after working hours. 7.3. Security of buildings Buildings housing classified information or secure communication and information systems shall be protected against unauthorised access. The nature of the protection afforded to classified information, e.g. barring of windows, locks for doors, guards at entrances, automated access control systems, security checks and patrols, alarm systems, intrusion detection systems and guard dogs, shall depend on: (a) the classification, volume and location within the building of the information and material to be protected; (b) the quality of the security containers for the information and material concerned; and (c) the physical nature and location of the building. The nature of the protection afforded to communication and information systems shall depend on an assessment of the value of the assets at stake and of the potential damage if security were to be compromised, on the physical nature and location of the building in which the system is housed, and on the location of that system within the building. 7.4. Contingency plans Detailed plans shall be in place in advance to ensure the protection of classified information in the event of an emergency. 8. SECURITY DESIGNATORS, MARKINGS, AFFIXING AND CLASSIFICATION MANAGEMENT 8.1. Security designators No classifications other than those defined in point (d) of Article 2 of this Decision are permitted. An agreed security designator may be used to set limits to the validity of a classification (for classified information signifying automatic downgrading or declassification). Security designators shall only be used in combination with a classification. Security designators are further regulated in security notice 2 and defined in the handling instructions. 8.2. Markings A marking is used to specify predefined specific instructions about the handling of confidential information. Markings may also indicate the field covered by a given document, a particular distribution on a need-to-know basis, or (for non-classified information) to signify the end of an embargo. A marking is not a classification and shall not be used in lieu of one. Markings are further regulated in security notice 2 and defined in the handling instructions. 8.3. Affixing of classifications and of security designators Affixing of classifications and security designators and markings shall be done in accordance with security notice 2, section E, and the handling instructions. 8.4. Classification management 8.4.1 General Information shall be classified only when necessary. The classification shall be clearly and correctly indicated, and shall be maintained only as long as the information requires protection. The responsibility for classifying information and for any subsequent downgrading or declassification rests solely with the originator. Officials of the European Parliament shall classify, downgrade or declassify information on instructions from, or pursuant to a delegation from, the Secretary-General. The detailed procedures for the treatment of classified documents shall be so framed as to ensure that they are afforded protection appropriate to the information which they contain. The number of persons authorised to originate information classified at the level TRÈS SECRET UE/EU TOP SECRET' shall be kept to a minimum, and their names shall be recorded on a list drawn up by the CIU. 8.4.2 Application of classification The classification of a document shall be determined by the level of sensitivity of its contents in accordance with the definitions contained in point (d) of Article 2. It is important that classifications be assigned correctly and used sparingly. The classification of a letter or note containing enclosures shall be at least as high as the highest classification assigned to one of its enclosures. The originator shall indicate clearly the level at which the letter or note should be classified when detached from its enclosures. The originator of a document that is to be given a classification shall follow the rules set out above and shall avoid over-classification or under-classification. Individual pages, paragraphs, sections, annexes, appendices, attachments and enclosures of a given document may require different classifications and shall be classified accordingly. The classification of the document as a whole shall be that of its most highly classified part. 9. INSPECTIONS Periodic internal inspections of security arrangements for the protection of classified information shall be carried out by the European Parliament's Directorate for Security and Risk Assessment, which may request assistance from the Security Authorities of the Council or of the Commission. The Security Authorities and competent services of the Union Institutions may carry out, as part of an agreed process initiated by either side, peer evaluations of the security arrangements for the protection of classified information exchanged under the relevant interinstitutional agreements. 10. DECLASSIFICATION AND UNMARKING PROCEDURES 10.1. The CIU shall examine confidential information contained in its Register and seek the consent of the originator to the declassification or unmarking of a document by no later than the 25th anniversary of its creation. Documents not declassified or unmarked at the first examination shall be re-examined periodically and at least every five years. In addition to being applied to documents actually located in the secure archives in the Secure Area and duly classified, the unmarking process may also cover other confidential information held either in the parliamentary body/officeor in the service in charge of the Parliament's historical archives. 10.2 The decision with regard to the declassification or unmarking of a document shall, as a general rule, be taken solely by the originator or, exceptionally, in cooperation with the parliamentary body/office-holder of such information, before the information which it contains is transferred to the service in charge of the Parliament's historical archives. Classified information may only be declassified or unmarked with the prior written consent of the originator. In the case of ‘other confidential information’, the secretariat of the parliamentary body/office-holder of such information shall, in cooperation with the originator, decide whether the document can be unmarked. 10.3. On behalf of the originator, the CIU shall be responsible for informing the addressees of the document of the change to the classification or marking, and they in turn shall be responsible for informing any subsequent addressees to whom they have sent or copied the document. 10.4. Declassification shall not affect any security designators or markings which may appear on the document. 10.5. In the case of declassification, the original classification at the top and bottom of every page shall be crossed out. The first (cover) page of the document shall be stamped and completed with the reference of the CIU. In the case of unmarking, the original marking at the top of every page shall be crossed out. 10.6. The text of the declassified or unmarked document shall be attached to the electronic fiche or equivalent system where it has been registered. 10.7. In the case of documents covered by the exception relating to privacy and the integrity of the individual or commercial interests of a natural or legal person, and in the case of sensitive documents, Article 2 of Regulation (EEC, Euratom) No 354/83 shall apply. 10.8. In addition to the provisions of points 10.1 to 10.7, the following rules shall apply: (a) as regards third-party documents, the CIU shall consult the third party concerned before proceeding to carry out the declassification or unmarking; (b) as regards the exception relating to privacy and the integrity of the individual, the declassification or unmarking procedure shall take into account, in particular, the agreement of the person concerned or, as the case may be, the impossibility of identifying the person concerned; (c) as regards the exception relating to commercial interests of a natural or legal person, the person concerned may be notified via publication in the Official Journal of the European Union and given four weeks from the date of that publication in which to submit remarks. Part 2 SECURITY CLEARANCE PROCEDURE 11. SECURITY CLEARANCE PROCEDURE FOR MEMBERS OF THE EUROPEAN PARLIAMENT 11.1. In order to have access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent, Members of the European Parliament shall have been authorised either in accordance with the procedure referred to in points 11.3 and 11.4 of this Annex or on the basis of a solemn declaration of non-disclosure pursuant to Article 3(4) of this Decision. 11.2 In order to have access to information classified at the level SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent, Members of the European Parliament shall have been authorised in accordance with the procedure referred to in points 11.3 and 11.14. 11.3. Authorisation shall be granted only to Members of the European Parliament who have undergone security screening by the competent national authorities of the Member States in accordance with the procedure referred to in points 11.9 to 11.14. The President shall be responsible for granting the authorisation for Members. 11.4 The President may grant written authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with points 11.8 to 11.13. 11.5. The European Parliament's Directorate for Security and Risk Assessment shall maintain an up-to-date list of all Members of the European Parliament who have been granted authorisation, including provisional authorisation within the meaning of point 11.15. 11.6. Authorisation shall be valid for a period of five years or for the duration of the tasks in respect of which it was granted, whichever is the shorter. It may be renewed in accordance with the procedure laid down in point 11.4. 11.7. Authorisation shall be withdrawn by the President where he/she considers that there are justified grounds for such withdrawal. Any decision to withdraw authorisation shall be notified to the Member of the European Parliament concerned, who may ask to be heard by the President before the withdrawal takes effect, and to the competent national authority. 11.8. Security screening shall be carried out with the assistance of the Member of the European Parliament concerned and at the request of the President. The competent national authority for screening shall be that of the Member State of which the Member concerned is a national. 11.9. As part of the screening procedure, the Member of the European Parliament concerned shall be required to complete a personal information form. 11.10. The President shall specify in his/her request to the competent national authority the level of classified information to be made available to the Member of the European Parliament concerned, so that it may carry out the screening process. 11.11 The entire security-screening process carried out by the competent national authority, together with the results obtained, shall be in accordance with the relevant rules and regulations in force in the Member State concerned, including those concerning appeals. 11.12. Where the competent national authority gives a positive opinion, the President may grant the Member of the European Parliament concerned authorisation. 11.13. A negative opinion by the competent national authority shall be notified to the Member of the European Parliament concerned, who may ask to be heard by the President. Should he/she consider it necessary, the President may ask the competent national authority for further clarification. If the negative opinion is confirmed, authorisation shall not be granted. 11.14. All Members of the European Parliament who are granted authorisation within the meaning of point 11.3 shall, at the time when the authorisation is granted and at regular intervals thereafter, receive any necessary guidelines concerning the protection of classified information and the means of ensuring such protection. Such Members shall sign a declaration acknowledging receipt of those guidelines. 11.15. In exceptional circumstances, the President may, after notifying the competent national authority and provided that no reaction is received from that authority within one month, grant provisional authorisation to a Member of the European Parliament for a period not exceeding six months, pending the outcome of the screening referred to in point 11.11. Provisional authorisations thus granted shall not give access to information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent. 12. SECURITY CLEARANCE PROCEDURE FOR OFFICIALS OF THE EUROPEAN PARLIAMENT AND OTHER PARLIAMENT EMPLOYEES WORKING FOR POLITICAL GROUPS 12.1. Only officials of the European Parliament and other Parliament employees working for political groups who, by reason of their duties and the requirements of the service, need to have knowledge of, or to use, classified information may have access thereto. 12.2. In order to have access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET, or TRÈS SECRET UE/EU TOP SECRET, or its equivalent, the officials of the European Parliament and other Parliament employees working for political groups concerned shall have been authorised in accordance with the procedure laid down in points 12.3 and 12.4. 12.3. Authorisation shall be granted only to the persons referred to in point 12.1 who have undergone security screening by the competent national authorities of the Member States in accordance with the procedure referred to in points 12.9 to 12.14. The Secretary-General shall be responsible for granting the authorisation for officials of the European Parliament and other Parliament employees working for political groups. 12.4 The Secretary-General may grant written authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with points 12.8 to 12.13. 12.5. The European Parliament's Directorate for Security and Risk Assessment shall maintain an up-to-date list of all posts requiring a security clearance, as provided by the relevant European Parliament services, and of all persons who have been granted authorisation, including provisional authorisation within the meaning of point 12.15. 12.6. Authorisation shall be valid for a period of five years or for the duration of the tasks in respect of which it was granted, whichever is the shorter. It may be renewed in accordance with the procedure referred to in point 12.4. 12.7. Authorisation shall be withdrawn by the Secretary-General where he/she considers that there are justifiable grounds for such withdrawal. Any decision to withdraw authorisation shall be notified to the official of the European Parliament or other Parliament employee working for a political group concerned, who may ask to be heard by the Secretary-General before the withdrawal takes effect, and to the competent national authority. 12.8. Security screening shall be carried out with the assistance of the official of the European Parliament or other Parliament employee working for political groups concerned and at the request of the Secretary-General. The competent national authority for screening shall be that of the Member State of which the person concerned is a national. Where permissible under national laws and regulations, the competent national authorities may conduct investigations in respect of non-nationals who require access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET. 12.9. As part of the screening procedure, the official of the European Parliament or other Parliament employee working for a political group concerned shall be required to complete a personal information form. 12.10. The Secretary-General shall specify in his/her request to the competent national authority the level of classified information to be made available to the official of the European Parliament or other Parliament employee working for political groups concerned, so that it may carry out the screening process and give its opinion as to the level of authorisation appropriate to be granted to that person. 12.11. The entire security-screening process carried out by the competent national authority, together with the results obtained, shall be in accordance with the relevant rules and regulations in force in the Member State concerned, including those concerning appeals. 12.12. Where the competent national authority gives a positive opinion, the Secretary-General may grant the official of the European Parliament or other Parliament employee working for political groups concerned authorisation. 12.13. A negative opinion by the competent national authority shall be notified to the official of the European Parliament or other Parliament employee working for a political group concerned, who may ask to be heard by the Secretary-General. Should he/she consider it necessary, the Secretary-General may ask the competent national authority for further clarification. If the negative opinion is confirmed, authorisation shall not be granted. 12.14. All officials of the European Parliament and other Parliament employees working for political groups who are granted authorisation within the meaning of points 12.4 and 12.5 shall, at the time when the authorisation is granted and at regular intervals thereafter, receive any necessary instructions concerning the protection of classified information and the means of ensuring such protection. Such officials and employees shall sign a declaration acknowledging receipt of those instructions and give an undertaking to obey them. 12.15. In exceptional circumstances, the Secretary-General may, after notifying the competent national authority and provided that no reaction is received from that authority within one month, grant provisional authorisation to an official of the European Parliament or other Parliament employee working for a political group for a period not exceeding six months, pending the outcome of the screening referred to in point 12.11. Provisional authorisations thus granted shall not give access to information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent.