EUROPEAN COMMISSION Brussels, 25.4.2019 COM(2019) 191 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Third report assessing the implementation of the Directive on enhancing port security



REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Third report assessing the implementation of the Directive on enhancing port security 1.Introduction The main objective of Directive 2005/65/EC on enhancing port security (‘the Directive’) was to complement the measures adopted in 2004 by means of Regulation (EC) No 725/2004 on enhancing ship and port facility security (‘the Regulation’). The scope of application of that Regulation was limited to cover security measures on board ships and the immediate interface between ships and ports. It is to these obligations, which essentially fall under the ISPS (International Ship and Port facility Security) Code which Member States have committed as a priority, before agreeing to implement further obligations as part of the adoption of the Directive. The Directive complements the mechanism provided for by establishing a security system for all of the port area, in order to ensure a high and equal level of security for all European ports serving direct sea-going services. Over 1 200 commercial maritime ports are operated along the 70 000 km of coastline in the European Union, one of the regions in the world with the largest number of ports. Around one thousand of these ports (see point 6.1) fall within the scope of the Directive, i.e all ports housing one or more port facilities which are the subject of a security plan approved under the Regulation. The objective of the Directive is to improve security coordination in areas of ports not covered by the Regulation and also to ensure that the enhancement of port security can support the security measures taken under the Regulation. Whilst responsibility for the implementation of security measures at port facility level essentially falls to the port facility operator, the appropriate security measures at port level are, as a priority, the responsibility of the port authority and of those authorities which are responsible for keeping public order, safety and security measures within the port area (in both, public and operational areas). Article 19 of the Directive states that the Commission is to assess compliance with the Directive and the effectiveness of measures taken by 15 December 2008 and every five years thereafter. The first report was adopted on 20 January 2009, the second on 18 November 2013. This third report on progress made in terms of implementing the Directive describes the measures which have been taken in order to promote the implementation of standardised port security measures across the Union, progress made during the last five-year reference period and the continued problems which have arisen during the implementation period. The report is based on: –exchanges of information with Member State authorities responsible for maritime security and other stakeholders; –the results of the large number of port security inspections carried out by the Commission for the monitoring of this Directive during the period of reference; –ongoing dialogue between the national authorities and the various players from the maritime and port sectors. The report draws attention to various difficulties encountered as regards achieving the desired outcomes but also in terms of the global impact of the implementation of the Directive. 2.Conclusions of the first and second report The first report stressed the fact that, although the Directive had been adopted at first reading and approved by a large majority at the European Parliament and unanimously at the Council, there had been significant delays in terms of transposing its provisions in the majority of Member States involved. This led to the opening of infringement proceedings, two of which had resulted in a judgment finding failure to fulfil obligations. At the end of this assessment period, the provisions of the Directive had finally been transposed into the national law of the vast majority of Member States. Unfortunately, there continued to be organisational and functional difficulties in terms of ensuring implementation in practical terms at port level, since local administrations did not yet have all the resources necessary in order to ensure the practical implementation of the Directive. The main difficulty related to defining the port perimeter from a security point of view. The second report showed significant progress but that the measures needed to implement all provisions of the Directive in full still needed to be improved in most Member States. The level of security had increased in European ports and the combination of the implementation of the Regulation and the application of the Directive had made possible a credible framework for preventing security breaches in ports and to obtain adequate protection for maritime and port activities. The introduction of security measures often led to a review of the organisation of ports, such as – for example – the movement and storage of goods, the control of access to different areas of the port or a definition of restricted areas. These measures proved to be very important for making port activities more efficient, in a highly competitive environment.

3.Support and monitoring measures since the previous evaluation period The Directive – in keeping with the principle of subsidiarity– stipulates that Member States should themselves establish each port’s boundaries, leaving ports free to decide whether they should also apply to adjacent areas. Member States should also ensure that port security assessments and plans are properly drawn up. However, in 2014, a number of ports were still unable to meet the requirements of the Directive. During the period 2014-18, the Commission has therefore continued its commitment to ensuring a more effective implementation of the Directive. The measures taken by the Commission took the form of initiatives to help Member States together with a robust programme of monitoring activities deployed through a large number of inspections. The implementation of Directive 2005/65/EC was monitored in the period 2014–2018 through: 17 inspections of national administrations; 41 inspections of ports. These measures have focused on the following main areas: –maintaining a system of regular reporting on the performance and implementation of action plans by Member States in order to ensure the practical implementation of the Directive; –the performance of the above mentioned 58 inspections to monitor implementation of the Directive in accordance with Regulation (EC) No 324/2008, as amended by Commission Implementing Regulation (EU) 2016/462. collating and disseminating best practices within the MARSEC Committee; 4.Monitoring the implementation of the Directive 4.1.Monitoring action plans for completion of the practical implementation of the Directive Since 2009, the Commission has had a system for receiving regular information from Member States on the implementation of the Directive. A sustained dialogue has been opened with the authorities of the Member States in order to obtain regular and reliable information on the extent to which assessments have been carried out and port security plans adopted. In addition, annual Member States monitoring reports submitted to the Commission are the basis for monitoring of the status of port security assessments and plans by the Commission services. 4.2.Inspections carried out by the Commission in order to monitor the implementation of the Directive The procedures for monitoring the implementation of the Directive were carried out during inspections by the Commission in accordance with Regulation (EC) No 324/2008, as amended. The inspections carried out, both regarding national administrations and direct inspections of a sample of ports, have shown that although the general legal framework of the implementation of the Directive has been correctly applied, there is still a series of recurrent common issues regarding proper implementation at the level of Member States ports, as follows. Discrepancy between the objective of improving port security coordination among local authorities, port operators and public law enforcement bodies and the still imperfect results which have actually been reported remain, even if there has been significant improvement over the last years. Defining port boundaries for security purposes is still an issue for certain Member States, and this despite Commission assistance, including two seminars in September 2006 and October 2010 and the study on the technical aspects of port area security (TAPS II) which had been assigned to the Joint Research Centre (JRC Ispra). TAPS II gives clear guidelines on how to proceed with port security boundaries definition which is a basis for establishing the extent of the port secuity plan measures defined in Annex II of this Directive. Another essential issue concerns the review of port security assessments and port security plans. According to Article 10 of the Directive, Member States shall ensure that port security assessments and port security plans are reviewed as appropriate, and be reviewed at least once every five years. Inspections have shown that this five years regular review is not yet done everywhere. Changes or supressions regarding port facilities did not result in a review of the port security assessments and port security plans and in several cases the 5 year deadline had been missed. Furthermore, Commission inspections in the Member States ports disclosed the difficulties that some ports experience to launch the five years review process of port security assesments and plans. These notably include the large number of authorities and actors involved in the revision and on approval process which must be scheduled well in advance before the five years anniversary date.

Furthermore, some Member States still did not ensure adequate supervision of the port security plans and their implementation as requested under Article 13.1 through a regular system of monitoring and inspections jointly with the inspections required in the port facilities of each port as provided in Article 9.4 of Regulation (EC) No725/2004. Other deficiencies relate to taking into account all requirements when establishing the port security assessment or discrepancies between port security assessments and port security plans. 4.3.Infringement procedures The decrease in the number of infringment procedures initiated is also an indicator of significant improvement of the implementation of the Directive. As referred to in the second report, from 2009 to 2013 five infringment procedures had to be initiated; three cases were related to delays regarding the implementation of the Directive at Member State level and the other two cases related to incorrect implementation revealed during inspections. Between 2014 and 2018 only one infringment procedure took place, and this for the reason of incorrect implementation of the Directive: On 6 April 2017 the European Court of Justice gave its judgment on Case C-58/16. For a series of ports the German Land of North Rhine-Westfalia had failed to define the boundaries, approve port security assessments and plans and appoint port security officers. In early 2018 Germany confirmed that all ports in North Rhine-Westfalia were now in conformity with the provision of the Directive and that Germany complies with the Court judgment. 5.Specific points resulting from the assessments 5.1.Critical size of the ports subject to the requirements of the practical implementation of the Directive During discussions with stakeholders, the view was often expressed that the Directive is generally well designed for large ports with high commercial activity but that implementation is harder for small ports. It should be noted that the Directive applies to all ports situated in Member States housing one or more port facilities covered by a port facility security plan approved under Regulation (EC) No 725/2004 (Article 2(2)) and also that Member States are required to ensure that port security measures are closely coordinated with measures taken in application of the Regulation (Articles 4 and 7). The Directive stipulates that the Member States should themselves establish each individual port’s boundaries and allows them discretion in terms of deciding whether to apply the Directive to port adjacent areas if these have an impact on the security of the said port. Consequently, in order to ensure the balanced implementation of useful measures in accordance with the principle of proportionality, the co-legislators have taken the possibility and option provided for in Article 2(4) that if the boundaries of a port facility within the meaning of Regulation (EC) No 725/2004 have been defined as effectively covering the entire port, the relevant provisions of the Regulation shall take precedence over the provisions of the Directive. This provision has been widely used by Member States in ports with only one port facility under the Regulation. On the basis of the port security assessment, the port boundaries have very often (but not always) been defined as being the same as that of the port facility. Therefore, of the 1087 ports housing one or several port facilities covered by a port facility security plan approved under the Regulation, 405 ports have been considered as falling under the provisions of Article 2(4) of the Directive, i.e. 37,2 % of ports in the European Union. This has particularly been the case in Member States with small ports scattered along coastlines or on islands. 5.2.Awareness of the threat and awareness-raising amongst players The work carried out during assessments makes it possible to identify the assets and infrastructure which need to be protected against the threats and risks of intentional illegal action facing port activities. The next phase involves designing and implementing appropriate measures which can be used to counteract threats, at each of the three risk levels identified (normal, increased, high), by means of specific procedures and by using technical equipment tailored to the needs of ports and which make it possible to provide the right response to the potential vulnerability of infrastructure. The Directive has made it possible to set up port security committees responsible for providing practical advice (9th recital). In Member States with this type of structure, this generally consists of local representatives from the bodies responsible for security (police, coastguards, maritime affairs, customs, etc.) and also in most cases private operators acting in the port. This provides an appropriate forum for the essential exchange of information and a forum for the dissemination of knowledge of the threat, thus promoting awareness amongst all stakeholders. Increasing awareness of the protection of ports forms part of general security policy, of which all staff employed at the port (i.e. staff of port undertakings but also those employed by external companies involved in port activities) and also the various users of the port need to be aware. Awareness-raising activities provide key tools for ensuring effective dissemination and appropriate ways of raising awareness as regards security measures. It is important that security measures are seen as a means to encouraging a port’s economic activities and how to develop these activities. 5.3.Inspection and supervision of port security plans