EN Official Journal of the European Union C 190/2

DECISION OF THE BUREAU OF THE EUROPEAN PARLIAMENT

of 6 June 2011

concerning the rules governing the treatment of confidential information by the European Parliament

2011/C 190/02

THE BUREAU OF THE EUROPEAN PARLIAMENT,

Having regard to Rule 23(12) of the Rules of Procedure of the European Parliament,

Whereas:

(1) In the light of the Framework Agreement on relations between the European Parliament and the European Commission (1) signed on 20 October 2010 (‘the Framework Agreement’), it is necessary to revise the Bureau Decision of 13 November 2006 on the rules governing the administrative processing of confidential documents.

(2) The Lisbon Treaty assigns new tasks to the European Parliament and, in order to develop Parliament's activities in those areas which require a degree of confidentiality, it is necessary to lay down basic principles, minimum standards of security and appropriate procedures for the treatment by the European Parliament of confidential, including classified, information.

(3) The rules laid down in this Decision aim at ensuring equivalent standards of protection and compatibility with the rules adopted by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States, in order to facilitate the smooth functioning of the decision-making process of the European Union.

(4) The provisions of this Decision are without prejudice to Article 15 of the Treaty on the Functioning of the European Union (TFEU) and to Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (2).

(5) The provisions of this Decision are without prejudice to Article 16 of the TFEU and to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (3),

HAS ADOPTED THIS DECISION:

Article 1

Objective

This Decision governs the creation, reception, forwarding and storage of confidential information by the European Parliament with a view to the appropriate protection of its confidential nature. It implements, in particular, Annex 2 to the Framework Agreement.

Article 2

Definitions

For the purposes of this Decision:

(a) ‘information’ means any written or oral information, whatever the medium and whoever the author may be;

(b) ‘confidential information’ means ‘EU classified information’ (EUCI), and non-classified ‘other confidential information’;

(c) ‘EU classified information’ (EUCI) means any information and material, classified as ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE/EU SECRET’, ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ or ‘RESTREINT UE/EU RESTRICTED’, unauthorised disclosure of which could cause varying degrees of prejudice to EU interests, or to those of one or more of its Member States, whether such information originates within the institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or is received from Member States, third States or international organisations. In this regard: — ‘TRÈS SECRET UE/EU TOP SECRET’ is the classification for information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the Union or of one or more of the Member States, — ‘SECRET UE/EU SECRET’ is the classification for information and material the unauthorised disclosure of which could seriously harm the essential interests of the Union or of one or more of the Member States, — ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ is the classification for information and material the unauthorised disclosure of which could harm the essential interests of the Union or of one or more of the Member States, — ‘RESTREINT UE/EU RESTRICTED’ is the classification for information and material the unauthorised disclosure of which could be disadvantageous to the interests of the Union or of one or more of the Member States;

(d) ‘other confidential information’ means any other non-classified confidential information, including information covered by data protection rules or by the obligation of professional secrecy, created in the European Parliament or forwarded by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States to the European Parliament;

(e) ‘document’ means any recorded information regardless of its physical form or characteristics;

(f) ‘material’ means any document or item of machinery or equipment, either manufactured or in the process of manufacture;

(g) ‘need to know’ means the need of a person to have access to confidential information in order to be able to perform an official function or a task;

(h) ‘authorisation’ means a decision (clearance decision), adopted by the President if it concerns Members of the European Parliament and by the Secretary-General if it concerns officials of the European Parliament and other Parliament employees working for political groups, to grant an individual access to EUCI up to a specific level, on the basis of a positive result of a security screening (vetting) carried out by a national authority under national law and pursuant to the provisions laid down in Annex I, part 2;

(i) ‘downgrading’ means a reduction in the level of classification;

(j) ‘declassification’ means the removal of any classification;

(k) ‘originator’ means the duly authorised author of EUCI or of any other confidential information;

(l) ‘security notices’ mean technical implementing measures as laid down in Annex II (4).

Article 3

Basic principles and minimum standards

1. The treatment of confidential information by the European Parliament shall follow the basic principles and minimum standards laid down Annex I, part 1.

2. The European Parliament shall set up an information security management system (ISMS) in accordance with those basic principles and minimum standards which shall aim at facilitating Parliamentary and administrative work, while ensuring the protection of any confidential information processed by the European Parliament, in full respect of the rules established by the originator of such information as laid down in the security notices.

The processing of confidential information by means of automated information systems (IS) of the European Parliament shall be implemented in accordance with the concept of information assurance (IA) and laid down in the security notices.

3. Members of the European Parliament may consult classified information up to and including the level of ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ without security clearance. For information classified as ‘CONFIDENTIEL UE/EU CONFIDENTIAL’, they shall sign a solemn declaration that they will not disclose the contents of that information to third persons. Information classified above the level of ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ shall be made available only to Members who hold the appropriate level of security clearance.

4. Officials of the European Parliament and other Parliament employees working for political groups may consult confidential information if they have an established ‘need to know’, and may consult classified information above the level of ‘RESTREINT UE/EU RESTRICTED’ if they hold the appropriate level of security clearance.

Article 4

Creation of confidential information and administrative handling by the European Parliament

1. The President of the European Parliament, the chairs of the parliamentary committees concerned and the Secretary-General and/or any person duly authorised by him or her in writing may originate confidential information and/or classify information as laid down in the security notices.

2. When creating classified information, the originator shall apply the appropriate level of classification in line with the international standards and definitions set out in Annex I. The originator shall also determine, as a general rule, the addressees who are to be authorised to consult the information commensurate to the level of classification. This information shall be communicated to the Confidential Information Service (CIS) when the document is deposited with the CIS.

3. Confidential information covered by professional secrecy shall be dealt with in accordance with the handling instructions defined in the security notices.

Article 5

Reception of confidential information by the European Parliament

1. Confidential information received by the European Parliament shall be communicated as follows:

— EUCI classified as ‘RESTREINT UE/EU RESTRICTED’ and other confidential information to the secretariat of the parliamentary body/office-holder who submitted the request therefor,

— EUCI classified as ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ and above to the CIS.

2. The registration, storage and traceability of confidential information shall be assured either by the secretariat of the parliamentary body/office-holder which received the information or by the CIS.

3. In the case of confidential information communicated by the Commission pursuant to the Framework Agreement, the agreed arrangements within the meaning of point 3.2 of Annex 2 to the Framework Agreement (laid down by common accord and concerning addressees, consultation procedure, i.e. secure reading room and meetings in camera, or other matters) designed to preserve the confidentiality of the information shall be deposited together with the confidential information at the secretariat of the parliamentary body/office holder or at the CIS when the information is classified as ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ or above.

4. The arrangements referred to in paragraph 3 may also be applied mutatis mutandis for the communication of confidential information by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States.

5. EUCI classified as ‘TRÈS SECRET UE/EU TOP SECRET’ shall be transmitted to the European Parliament subject to further arrangements, to be agreed between the parliamentary body/office holder who submitted the request for the information and the EU institution or the Member State by whom it is communicated. An oversight committee shall be set up by the Conference of Presidents. It shall aim at ensuring a level of protection commensurate with that level of classification.

Article 6

Communication of EUCI by the European Parliament to third parties

The European Parliament may, subject to the originator's consent, forward EUCI to other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or to Member States on the condition that they ensure that, when EUCI is handled, rules equivalent to those laid down in this Decision are respected within their services and premises.

Article 7

Storage and consultation of confidential information in secured areas (secure reading rooms)

1. Secure reading rooms shall provide for secure storage and shall not contain photocopying machines, telephones, fax facilities, scanners or any other technical equipment for the reproduction or transmission of documents.

2. The following conditions shall govern access to a secure reading room:

(a) only the following persons shall have access: — Members of the European Parliament, officials of the European Parliament and other Parliament employees working for political groups, duly identified in accordance with the arrangements referred to in Article 4(2) or Article 5(3) and (4), — the European Parliament's officials responsible for managing the CIS, — as necessary, the European Parliament's officials responsible for security and fire safety. Cleaning of the secured area shall only occur in the presence of and under close surveillance of an official working in the CIS;

(b) each person wishing to access the confidential information shall communicate in advance his or her name to the CIS. The CIS shall check the identity of each person who submits an application to consult that information and verify, where relevant, consult it in accordance with the arrangements referred to in Article 4(2) or Article 5(3) and (4);

(c) the CIS shall be empowered to deny access to the room to any person not authorised to enter it pursuant to points (a) and (b). Any objection challenging the decision by the CIS shall be submitted to the President, in the case of Members of the European Parliament, and to the Secretary-General, in other cases.

3. The following conditions shall govern the consultation of confidential information in the secure reading room:

(a) persons who are authorised to consult the information and who have submitted the application referred to in point (b) of paragraph 2 shall present themselves to the CIS. Save in exceptional circumstances (e.g. where numerous requests for consultation are submitted in a short period of time), only one person at a time shall be authorised to consult confidential information in the secure reading room, in the presence of an official of the CIS. That official shall inform the person thus authorised of his/her obligations and, in particular, shall ask him/her to sign a solemn declaration undertaking not to disclose the content of the information to any third person;

(b) during the consultation process, contact with the exterior (including by means of telephones or other technologies), the taking of notes and the photocopying or photographing of the confidential information consulted shall be prohibited;

(c) before authorising a person to leave the secure reading room, the official of the CIS referred to in point (a) shall check that the confidential information consulted is still present, intact and complete.

4. In the event of a breach of the rules set out above, the official responsible for the CIS shall inform the Secretary-General, who shall refer the matter to the President, should the perpetrator be a Member of the European Parliament.

Article 8

Minimum standards for other consultation of confidential information

1. As regards the administrative processing of confidential information at a meeting in camera, the secretariat of the parliamentary body/office holder responsible for the meeting shall ensure that:

— only the persons designated to participate in the meeting and holding the necessary level of security clearance are allowed to enter the meeting room,

— all documents are numbered, distributed at the beginning of the meeting and collected again at the end, and that no notes of those documents and no photocopies or photographs thereof are taken,

— the minutes of the meeting make no mention of the content of the discussion of the information considered under the confidential procedure,

— confidential information provided orally to recipients in the European Parliament is subject to the equivalent level of protection as that applied to confidential information in written form. This may include a solemn declaration by the recipients of that information not to divulge its contents to any third person.

2. The following rules shall apply to the administrative processing of confidential information by the secretariat of the parliamentary body/office holder outside the meeting in camera:

— the hard copy documents shall be handed over in person to the head of the secretariat, who shall register them and provide an acknowledgement of receipt,

— such documents shall be kept in a locked location, under the responsibility of the secretariat, when they are not actually being used,

— without prejudice to the administrative processing of confidential information at a meeting in camera as provided for in paragraph 1, in no case may they be duplicated, saved on another medium, or transmitted to any person,

— access to such documents shall be restricted to the addressees thereof and shall, in accordance with the arrangements referred to in Article 4(2) or Article 5(3) or (4), be under the supervision of the secretariat,

— the secretariat shall keep a record of the persons who have consulted the documents, and of the date and time of such consultation. That record shall be transmitted to the CIS in view of the establishment of the annual report referred to in Article 12.

Article 9

Archiving of confidential information

1. Secure archiving facilities shall be provided on the European Parliament's premises.

Confidential information definitively deposited with the CIS or the secretariat of the parliamentary body/office-holder shall be transferred to the secure archive in the CIS six months after they were last consulted and, at the latest, one year after they were deposited.

2. The CIS shall be responsible for managing the secure archives, in accordance with standard archiving criteria.

3. Confidential information held in the secure archives may be consulted subject to the following conditions:

— only those persons identified by name or by office in the accompanying document drawn up when the confidential information was deposited shall be authorised to consult that information,

— the application to consult confidential information must be submitted to the CIS, which shall transfer the document in question to the secure reading room,

— the procedures and conditions governing the consultation of confidential information set out in Article 7 shall apply.

Article 10

Downgrading and declassification of EUCI

1. EUCI may be downgraded or declassified only with the permission of the originator, and, if necessary, after discussion with other interested parties. Downgrading or declassification shall be confirmed in writing. The originator shall be responsible for informing its addressees of the change, and they in turn shall be responsible for informing any subsequent addressees to whom they have sent or copied the document, of the change. If possible, originators shall specify on classified documents a date, period or event when the contents may be downgraded or declassified. Otherwise, they shall keep the documents under review every five years, at the latest, in order to ensure that the original classification is necessary.

2. Declassification of documents held in the secure archives will take place at the latest after 30 years pursuant to the provisions of Council Regulation (EEC, Euratom) No 354/83 of 1 February 1983 concerning the opening to the public of the historical archives of the European Economic Community and the European Atomic Energy Community (5). Declassification will be effected by the originator of the classified information or the service currently responsible in accordance with Annex I, Part 1, Section 10.

Article 11

Breaches of confidentiality

1. Breaches of confidentiality in general, and of this Decision in particular, shall in the case of Members of the European Parliament entail the application of the relevant provisions concerning penalties set out in the European Parliament's Rules of Procedure.

2. Breaches committed by staff shall lead to the application of the procedures and penalties provided for by, respectively, the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Union, laid down in Regulation (EEC, Euratom, ECSC) No 259/68 (6) (‘the Staff Regulations’).

3. The President and the Secretary-General shall organise any necessary investigations.

Article 12

Adaptation of this Decision and its implementing rules and annual reporting on the application of this Decision

1. The Secretary-General shall propose any necessary adaptation of this Decision and the annexes implementing it and shall forward those proposals to the Bureau for decision.

2. The Secretary-General shall submit an annual report to the Bureau on the application of this Decision.

Article 13

Transitional and final provisions

1. Confidential information existing in the CIS or in the archives before the application of this Decision shall be classified ‘RESTREINT UE/EU RESTRICTED’ by default unless its originator decides either not to classify it or to classify it at a higher classification level or with a marking within one year from the date of entry into force of this Decision.

2. If its originator decides to give such confidential information a higher classification level, it shall be classified at the lowest possible level by the originator or its delegates, in liaison with the CIS and in accordance with the criteria laid down in the Annex I.

3. The Decision of the Bureau of 13 November 2006 on the rules governing the administrative processing of confidential documents is repealed.

4. The Decision of the Bureau of 24 October 2005 mandating the Secretary-General to set up a declassification committee and to adopt decisions on the issue of declassification is repealed.

Article 14

Entry into force

1. This Decision shall enter into force on the day of its publication in the Official Journal of the European Union.

2. It shall apply from 1 July 2011.

(1) OJ L 304, 20.11.2010, p. 47.

(2) OJ L 145, 31.5.2001, p. 43.

(3) OJ L 8, 12.1.2001, p. 1.

(4) Annex to be adopted.

(5) OJ L 43, 15.2.1983, p. 1.

(6) OJ L 56, 4.3.1968, p. 1.