Council Act of 3 November 1998 adopting rules on the confidentiality of Europol information
Date: 1998-11-03
Institutions: Council of the European Union
Subjects: Europol, access to information, confidentiality, data processing, data protection

C 26/10

EN

Official  Journal  of  the  European  Communities

30.1.1999

COUNCIL  ACT

of  3  November  1998

adopting  rules  on  the  confidentiality  of  Europol  information

(1999/C 26/02)

THE  COUNCIL  OF  THE  EUROPEAN  UNION,

Having regard to the Convention based on Article K.3 of
the  Treaty  on  European  Union  on  the  establishment  of  a
European  Police  Office  (Europol  Convention) (1),  and  in
particular  Article  31(1)  thereof,

Having  regard  to  the  draft  rules  submitted  by  the
Management  Board,

Whereas  it  is  for  the  Council,  acting  unanimously,  to
adopt  appropriate  rules  on 
the  confidentiality  of
information  which  is  obtained  by  or  exchanged  with
Europol  on  the  basis  of  the  Europol  Convention,

HAS  ADOPTED  THE  FOLLOWING  RULES:

CHAPTER  I

DEFINITIONS  AND  SCOPE

Article  1

Definitions

For  the  purposes  of  these  rules,

(a)

‘processing  of  information’  (‘processing’)  means  any
operation or set of operations which is performed on
personal  or  non-personal  data,  whether  or  not  by
automatic  means,  such  as  collection,  recording,
organisation,  storage,  adaptation  or  alteration,
by
retrieval, 
transmission,  dissemination  or  otherwise  making
available,  alignment  or  combination,  blocking,
erasure  or  destruction;

consultation, 

disclosure 

use, 

(b)

‘third  party’  means  a  third  State  or  body  as  referred
to  in  Article  10(4)  of  the  Convention;

(c)

‘Europol  Security  Committee’  means  the  Committee
consisting  of  representatives  of  the  Member  States
and  Europol  described  in  Article  3;

(1) OJ  C  316,  27.11.1995,  p.  1.

(d)

(e)

(f)

(g)

(h)

(i)

‘Europol  Security  Coordinator’  means  the  Deputy
Director  to  whom  the  Director  of  Europol  —  in
pursuance  of  Article  29(2)  of 
the  Europol
Convention — assigns, alongside his other tasks, the
function  of  coordination  and  control  in  matters  of
security;

‘Europol  Security  Officer’  means  the  Europol  officer
the  Director  of  Europol  and
appointed  by 
responsible  for  security  issues  in  accordance  with
Article  5;

‘Security  Manual’  means  the  manual  implementing
these  rules,  to  be  established  in  accordance  with
Article  6;

‘security  level’  means  a  security  marking  of  Europol
1,  2,  3  assigned  to  a  document  processed  by  or
through  Europol  as  mentioned  in  Article  8;

‘security  package’  means  a  specified  combination  of
security  measures  to  be  applied  to  information
subject  to  a  Europol  security  level  as  mentioned  in
Article  8;

‘basic  protection  level’  means  the  level  of  protection
which will be applied to all information processed by
or  through  Europol,  except  information  which  is
expressly  marked  or  is  clearly  recognisable  as  being
public  information,  as  mentioned  in  Article  8(1).

Article  2

Scope

1.
These  rules  establish  the  security  measures  to  be
applied  to  all  information  which  is  processed  by  or
through  Europol  within  its  organisation.

2. Member  States  undertake  to  ensure  that  such
information shall, within their territory, receive a level of
protection  which  is  equivalent  to  the  level  of  protection
offered  by  these  measures.

3.
Electronic  links  between  Europol  and  the  national
units  of  the  Member  States  shall  provide  a  level  of
protection  which  is  equivalent  to  the  level  offered  by
these  measures.  A  common  standard  for  these  electronic
links  shall  be  approved  unanimously  by  the  Security
Committee  after  consulting  the  competent  authorities  of
the  Member  States.

30.1.1999

EN

Official  Journal  of  the  European  Communities

C 26/11

The  Annex  hereto  shows  an  overview  of  the
4.
Europol security levels, as referred to in Article 8, and the
equivalent  markings  currently  applied  by  the  Member
States  to  information  subject  to  those  security  levels.
When  a  Member  State  informs  the  other  Member  States
and Europol of any changes in the national provisions on
security levels or in the equivalent markings, Europol will
elaborate  a  revised  version  of  the  abovementioned
overview.  At  least  once  a  year  the  Europol  Security
Committee shall ascertain whether or not the overview is
up-to-date.

CHAPTER  II

SECURITY  RESPONSIBILITIES

Article  3

Europol  Security  Committee

A  Europol  Security  Committee  shall  be  set  up,
1.
consisting of representatives of the Member States and of
Europol,  which  shall  meet  at  least  once  a  year.

The  Europol  Security  Committee  shall  have  as  its
2.
task  to  advise  the  Management  Board  and  Director  of
Europol  on 
issues  relating  to  security  policy  and
including  the  application  of  the  Security  Manual.

The  Europol  Security  Committee  shall  establish  its
3.
rules  of  procedure.  The  meetings  of  the  Europol  Security
Committee  shall  be  chaired  by  the  Security  Coordinator.

Article  4

Security  Coordinator

The  Security  Coordinator  shall  have  general
1.
responsibility  for  all  issues  relating  to  security,  including
the  security  measures  laid  down  in  these  rules  and  the
Security  Manual.  He  shall  monitor  the  enforcement  of
inform  the  Director  of  all
security  provisions  and 
breaches  of  security,  who  shall,  in  serious  cases,  inform
the  Management  Board. 
If  such  a  breach  risks
compromising  the  interests  of  a  Member  State,  that
Member  State  shall  also  be  informed.

2.
The  Security  Coordinator 
answerable  to  the  Director  of  Europol.

shall  be  directly

Article  5

Security  Officer

Officer,  who  shall  be  directly  answerable  to  the  Security
Coordinator.  The  specific  tasks  of  the  Security  Officer
shall  be:

(a)

the  management  of  the  Security  Unit  of  Europol;

(b)

(c)

to  instruct,  assist  and  advise  Europol  staff  and
liaison  officers  as  to  their  duties  under  these  rules
and  the  Security  Manual;

to enforce security provisions, investigate breaches of
such  provisions  and  report  on  them  as  soon  as
possible  to  the  Security  Coordinator;

(d) continuous  review  of  the  adequacy  of  security
measures  on  the  basis  of  threat  assessments.  To  that
end  he  shall  report  to  the  Security  Coordinator  as  a
rule  at  least  once  a  month  and  —  in  exceptional
cases  —  whenever  it  is  deemed  necessary  and  shall
make  observations  and  suggestions;

(e)

tasks  assigned  to  him  under  these  rules  or  the
Security Manual;

(f) other 

tasks  assigned 

to  him  by 

the  Security

Coordinator.

2.
The Security Officer must have security clearance to
the  highest  level  under  the  regulations  applicable  in  the
Member  State  of  which  he  is  a  national.

Article  6

Security  Manual;  procedure  and  contents

1.
The  Security  Manual  shall  be  adopted  by  the
Management  Board  after  consultation  with  the  Security
Committee.

2.

The  Security  Manual  shall  contain:

(a) detailed  rules  on  the  security  measures  to  be  applied
within  the  Europol  organisation  in  order  to  provide
for  a  basic  protection 
in
Article 8(1) of these rules, such measures being based
on  Articles  25  and  32(2)  of  the  Europol  Convention
and  taking  Article  31(3)  of  that  Convention  into
account;

level  as  mentioned 

(b) detailed  rules  on  the  security  measures  associated
with  the  different  Europol  security  levels  and  the
corresponding  security  packages  as  mentioned  in
Article  8(2)  and  (3).

Amendments  to  the  Security  Manual  shall  be
3.
adopted  in  accordance  with  the  procedure  outlined  in
paragraph  1.

1.
The  responsibility  for  the  practical  implementation
of  the  security  measures  laid  down  in  these  rules  and  in
the  Security  Manual  shall  lie  with  the  Europol  Security

For  the  Europol  Computer  System  and  any  other
4.
computer  systems  employed  at  Europol  used  to  process
protectively  marked 
‘System  Specific
Security  Requirement’  (SSSR)  shall  be  adopted  and

information,  a 

C 26/12

EN

Official  Journal  of  the  European  Communities

30.1.1999

amended  in  accordance  with  the  procedure  outlined  in
paragraph  1.  This  System  Specific  Security  Requirement
shall  comply  with  relevant  provisions  of  the  Security
Manual.

Article  7

Observance

The security measures laid down in these rules and in the
Security  Manual  shall  be  observed  by  all  Europol  staff
and  liaison  officers,  as  well  as  any  other  person  under  a
particular  obligation  of  discretion  or  confidentiality.

CHAPTER  III

GENERAL  PRINCIPLES

Article  8

Basic  protection  level,  security  levels  and
security packages

1.
All  information  processed  by  or  through  Europol,
except  information  which  is  expressly  marked  or  is
clearly  recognisable  as  being  public  information,  shall  be
subject  to  a  basic  protection  level  within  the  Europol
the  Member  States.
organisation  as  well  as 
Information  which  is  subject  only  to  the  basic  protection
level  shall  not  require  a  specific  marking  of  a  Europol
security 
level,  but  shall  be  designated  as  Europol
information.

in 

2.
In  accordance  with  Article  2(2),  Member  States
shall  ensure  the  application  of  the  basic  protection  level
mentioned  in  paragraph  1,  by  a  variety  of  measures  in
accordance  with  national  legislation  and  regulations,
including  the  obligation  of  discretion  and  confidentiality,
limiting  access  to  information  to  authorised  personnel,
data  protection  requirements  as  far  as  personal  data  are
concerned and general technical and procedural measures
to  safeguard  the  security  of  the  information,  taking
Article  25(2)  of  the  Europol  Convention  into  account.

Information  requiring  additional  security  measures
3.
shall be subject to a Europol security level, which shall be
indicated  by  a  specific  marking.  Information  shall  be
assigned  such  a  security 
level  only  where  strictly
necessary  and  for  the  time  necessary.

The  Europol  security 

4.
‘Europol  level  1  to  3’,

levels  will  be  numbered

Europol  1:

this  level  is  applicable  to  information  the
unauthorised  circulation  of  which  would
result 
in  serious  harm  to  the  essential
interests  of  Europol,  or  of  one  or  more
Member  States.

Europol  2:

this  level  is  applicable  to  information  the
unauthorised  circulation  of  which  would
result  in  very  serious  harm  to  the  essential
interests  of  Europol,  or  of  one  or  more
Member  States;

Europol  3:

this  level  is  applicable  to  information  the
unauthorised  circulation  of  which  would
result  in  extremely  serious  harm  to  the
essential  interests  of  Europol,  or  of  one  or
more  Member  States.

Each  Europol  security  level  shall  relate  to  a  specific
security  package,  to  be  applied  within  the  Europol
organisation.  The  security  packages  shall  offer  different
levels  of  protection,  depending  on  the  content  of  the
information, and taking account of the detrimental effect
which  unauthorised  access,  dissemination  or  use  of  the
information  might  have  on  the  interests  of  the  Member
States  or  Europol.  Europol  levels  1  to  3  shall  —  with
respect  to  the  security  measures  to  be  applied  —
correspond  as  far  as  possible  to  existing  international
standards.

When  information  protectively  marked  at  different  levels
is  gathered,  the  security  level  to  be  applied  shall  be  at
least  as  high  as  that  applicable  to  the  information
protected  at  the  highest  level.  At  all  events,  a  group  of
information  may  be  given  a  higher  protection  level  than
that  of  each  of  its  parts.

The  translation  of  protectively  marked  documents  shall
be  subject  to  the  same  protection  as  the  originals.

5.
The  security  packages  shall  consist  of  various
measures  of  a  technical,  organisational  or  administrative
nature,  as  laid  down  in  the  Security  Manual.  They  shall
include  permitted  usage  of  the  data  subject  to  Article  17
of  the  Europol  Convention,  from  unrestricted  use  to  no
use  without  the  originator’s  consent.

Article  9

Choice  of  security  level

information 

The  Member  State  supplying 

1.
to
Europol  shall  be  responsible  for  the  choice  of  any
appropriate  security 
in
accordance  with  Article  8.  The  Member  State  shall,
where  necessary,  mark  the  information  with  a  Europol
security 
in  Article  8(4),  when
supplying  it  to  Europol.

level  as  referred  to 

information 

for  such 

level 

30.1.1999

EN

Official  Journal  of  the  European  Communities

C 26/13

In  choosing  any  security  level,  Member  States  shall
2.
take  account  of  the  classification  of  the  information
under  their  national  regulations,  as  well  as  of  the  need
for  the  operational  flexibility  required  for  Europol  to
function  adequately.

A  Member  State  supplying  information  to  Europol
3.
may  specify  the  time  period  for  which  the  choice  of  any
security level will apply, and any possible amendments to
the  security  level  after  such  period.

3.
If Europol — on the basis of information already in
its  possession  —  comes  to  the  conclusion  that  the  choice
of  a  security  level  needs  amendment  (e.g.  a  possible
removal  or  addition  of  such  a  level,  including  the
addition  of  a  security  level  to  a  document  previously
subject  to  the  basic  protection  level),  it  shall  inform  the
Member  State  concerned  and  seek  to  agree  on  an
appropriate  security  level.  Europol  shall  not  specify,
change,  add  or  remove  a  security  level  without  such
agreement.

4. Where  information  generated  by  Europol  is  based
upon  or  contains  information  supplied  by  a  Member
State,  Europol  shall  determine  in  agreement  with  the
Member  State  concerned  whether  the  basic  protection
level is sufficient or whether the application of a Europol
security  level  is  required.

5. Where  information  is  generated  by  Europol  itself,
and  such  information  is  not  based  upon  nor  contains
information  supplied  by  a  Member  State,  Europol  shall
determine  any  appropriate  security 
for  such
information,  using  criteria  laid  down  by  the  Security
Committee.  Where  necessary,  Europol  shall  mark  the
information accordingly.

level 

States 

and  Europol 

shall,  where
6. Member 
interests  of
information  also  concerns  the  essential 
another  Member  State,  consult  that  Member  State  on
whether  any  security  level  should  be  applied  to  that
information  and  if  so  which  security  level  should  be
applied.

Article  10

Amendment  of  security  levels

1.
A Member State which has supplied information to
Europol  may  at  any  time  require  an  amendment  of  any
chosen  security  level,  including  a  possible  removal  or
addition  of  such  a  level.  Europol  shall  be  obliged  to
remove, amend or add a security level in accordance with
the  wishes  of  the  Member  State  concerned.

2.
The  Member  State  concerned  shall,  as  soon  as
circumstances  allow,  request  that  the  security  level  in
question  be  downgraded  or  removed  altogether.

level  has  been  determined  by  Europol 

4. Where  the  choice  of  the  basic  protection  level  or
security 
in
accordance  with  Article  9(4),  an  amendment  of  the  basic
protection  or  security  level  shall  only  be  effected  by
Europol 
the  Member  States
concerned.

in  agreement  with 

5. Where  the  choice  of  the  security  level  has  been
determined  by  Europol  in  accordance  with  Article  9(5),
Europol  may  amend  or  remove  the  security  level  at  any
time  where  this  is  deemed  necessary.

6. Where  information  whose  security  level  is  amended
in accordance with this Article has already been supplied
to  other  Member  States,  Europol  shall  be  obliged  to
inform  the  recipients  of  the  change  of  security  level.

Article  11

Processing,  access  and  security  clearance

1.
Access  to  and  possession  of  information  shall  be
restricted  within  the  Europol  organisation  to  those
persons  who,  by  reason  of  their  duties  or  obligations,
need to be acquainted with such information or to handle
it.  Persons  entrusted  with  the  processing  of  information
shall have undergone any necessary security clearance and
shall  further  receive  special  training.

in 

security 

clearance 

2.
All  persons  that  may  have  access  to  information
subject  to  a  security  level  processed  by  Europol  shall
accordance  with
undergo 
Article 31(2) of the Europol Convention and the Security
Manual.  The  Security  Coordinator  shall,  acting  on  a
proposal  from  the  Security  Officer,  subject  to  the
provisions of the Security Manual, grant authorisation to
those  persons  cleared  at  the  appropriate  national  level,
who  by  reason  of  their  duties  or  obligations,  need  to  be
acquainted with information subject to a Europol security
level.  He  shall  also  be  responsible  for  ensuring  the
implementation  of  paragraph  3.

3. No  person  shall  have  access  to  information  subject
to  a  security  level  without  having  been  granted  security
clearance at the appropriate level. Exceptionally however,
the  Security  Coordinator  may,  after  consultation  of  the
Security  Officer,  give  a  specific  and  limited  authorisation

C 26/14

EN

Official  Journal  of  the  European  Communities

30.1.1999

to  persons  cleared  at  level  1  or  2  to  have  access  to
specific  information  at  a  higher  level,  if,  by  reason  of
their duties or obligations, in a specific case, they need to
be  acquainted  with  information  subject  to  a  higher
Europol  security  level.

Such  authorisation  shall  not  be  granted  where
4.
a  Member  State,  when  supplying 
information
concerned,  has  specified  that  the  discretion  afforded  to
the  Security  Coordinator  by  paragraph  3,  shall  not  be
exercised  in  relation  to  that  information.

the 

Article  12

Third  parties

When  concluding  agreements  on  confidentiality  with
third  parties  in  accordance  with  Article  18(6)  of  the
Europol  Convention,  or  agreements  in  accordance  with
Article  42  thereof,  Europol  shall  take  account  of  the
principles  laid  down  in  these  rules  and  the  Security
Manual,  which  should  be  applied  accordingly 
to
information  exchanged  with  such  third  parties.

CHAPTER  IV

FINAL  PROVISIONS

Article  13

Entry  into  force

These  rules  shall  enter  into  force  on  1  January  1999.

Article  14

Review  of  the  rules

Any  proposals  for  amendments  to  these  rules  shall  be
considered  by  the  Management  Board  with  a  view  to
their  adoption  by  the  Council  in  accordance  with  the
procedure  provided  for  in  Article  31(1)  of  the  Europol
Convention.

Done  at  Brussels,  3  November  1998.

For  the  Council

The  President

B.  PRAMMER

30.1.1999

EN

Official  Journal  of  the  European  Communities

C 26/15

Table  of  equivalence  between  national  classifications  and  corresponding  Europol  classifications

ANNEX

The  following  table  is  illustrative:  the  obligation  on  Member  States  is  to  provide  an  equivalent  level  of  protection  to  that  afforded  by
Europol  rather  than  to  attach  a  particular  label.

Country

Europol  Classification

Europol  1

Europol  2

Europol  3

Belgium (1)

— Diffusion  restreinte

Secret

Très  secret

— Confidentiel

Denmark (2)

Germany (3)

Greece

Spain

France

Ireland

Italy

Confidential

Secret

Top  Secret

VS  Nur  für  den  Dienst-
gebrauch

VS  Vertraulich

VS  Geheim

Confidential  (Εµ(cid:240)Ø(cid:243)(cid:244)(cid:229)υ(cid:244)Øκ(cid:222))

Secret  (Α(cid:240)(cid:222)ρρη(cid:244)(cid:239))

Top  Secret  (˝κρως  Æ(cid:240)(cid:222)ρρη(cid:244)(cid:239))

Confidencial

Reservado

Secreto

Confidentiel  (Défense)

Secret  (Défense)

Secret  (Défense)

Confidential

Secret

Top  Secret

— Diffusione  ristretta

Segreto

Molto  segreto

— Confidenziale

Luxembourg (4)

— Diffusion  restreinte

Secret

Très  secret

— Confidentiel

Netherlands (5)

Austria

Portugal

Finland

Sweden

The  Austrian  delegation  will  submit  in  due  course

Reservado

Confidencial

— Secreto

— Muito  secreto

Salassapidettävä
(=  to  be  kept  secret)

Salassapidettävä
(=  to  be  kept  secret)

Salassapidettävä
(=  to  be  kept  secret)

United  Kingdom

Confidential

Hemlig

Hemlig

Secret

Hemlig

Top  Secret

(1) Data  used  by  the  police  are  rarely  classified  in  Belgium;  should  it  prove  necessary,  NATO  classification  will  be  used.
(2) Data  used  by  the  police  are  rarely  classified  in  Denmark;  should  it  prove  necessary,  NATO  classification  will  be  used.
(3) With  regard  to  the  security  measures  laid  down  by  Europol  for  the  particular  levels,  the  German  security  gradings  shown  above  shall  also  be  held  to
correspond  to  the  Europol  security  levels  referred  to  in  Article  8(4)  of  the  confidentiality  rules,  in  line  with  the  obligation  arising  from  Article  31(2)  of
the Europol Convention for Member States to arrange for the security screening of their own nationals entrusted by Europol with a sensitive activity to
be  carried  out  in  accordance  with  their  national  provisions.

(4) Data  used  by  the  police  are  rarely  classified  in  Luxembourg;  should  it  prove  necessary,  NATO  classification  will  be  used.
(5) Data  used  by  the  police  are  rarely  classified  in  the  Netherlands;  should  it  prove  necessary,  the  indications  for  usages  00;0I  and  II  will  be  used.

C 26/16

EN

Official  Journal  of  the  European  Communities

30.1.1999

NOTE

As  mentioned  in  Article  2(4)  Europol  shall  elaborate  a  revised  version  of  this  overview  if  notified  of  any
changes of national provisions. At least once a year the Europol Security Committee shall examine whether
the  overview  is  up-to-date.  Any  difficulties  in  applying  the  concept  of  equivalence  in  levels  of  protection
shall be discussed between Member States and Europol or collectively by the Security Committee. Similarly,
the Security Committee shall consider the implications for the table of any adjustment to Europol’s Security
packages,  as  set  out  in  the  Security  Manual.