CELEX: 51992PC0056
Language: en
Date: 1992-02-24
Title: Proposal for a COUNCIL REGULATION ( EEC ) on the security measures applicable to classified information produced or transmitted in connection with EEC or Euratom activities

21 . 3 . 92                             Official Journal of the European Communities                               No C 72 / 15
                                                                II
                                                        (Preparatory Acts)
                                                  COMMISSION
               Proposal for a Council Regulation (EEC) on the security measures applicable to classified infor­
               mation produced or transmitted in connection with European Economic Community or
                                                       Euratom activities
                                                          (92 /C 72/ 16)
                                                       COM(92) 56 final
                                     (Submitted by the Commission on 26 February 1992)
THE COUNCIL OF THE EUROPEAN COMMUNITIES,                            the framework of existing provisions in Member States
                                                                    and the Community institutions ;
Having regard to Article 235 of the Treaty establishing
the European Economic Community,                                    Whereas under present Community law it is for each
                                                                    institution and each Member State to determine which
                                                                    information should be classified, with the proviso that
                                                                    the security gradings should be respected by all parties ;
Having regard to Article 203 of the Treaty establishing             whereas access to information is one of the fundamental
the European Atomic Energy Community,                               principles of democracy; whereas it is therefore
                                                                    necessary to limit classification of information to the
                                                                    absolute minimum ;
Having regard to the proposal from the Commission,
                                                                    Whereas the rules should cover not only physical
                                                                    protection of classified information but also the persons
Having regard to the opinion of the European                        and firms who may have access to it, without prejudice
Parliament,                                                         to the status of persons who are exercising an electoral
                                                                    mandate or a government function or who are members
                                                                    of an institution or body established by the Treaties ;
Whereas the development of the Community will
generate increasing flows of information between the
Member States and the institutions of the European                  Whereas protection of personal data and privacy are
Communities ;                                                       covered by separate measures ;
Whereas protection should be afforded to sensitive infor­           Whereas special measures should be laid down for the
mation      whose   unauthorized     disclosure    could   be       protection of computerized information to allow for the
detrimental to the essential interests of the European              particular characteristics of electronic techniques ;
Communities and of Member States ;
                                                                    Whereas any failure to comply with the requirements of
Whereas      some   common     classification  rules  should        this Regulation or of supplementary provisions adopted
therefore be laid down to ensure adequate protection of             by the institutions or the Member States will render the
information at both the production and the transmission             offender liable to disciplinary action ; whereas provision
stages ; whereas the rules should be implemented by the             must be made for other appropriate sanctions to be
competent administrative and judicial authorities within            taken, where necessary, against serious offenders ;
 ---pagebreak--- No C 72 / 16                              Official Journal of the European Communities                               21 . 3 . 92
Whereas this Regulation will help to further the                    3 . This Regulation does not apply to information
achievement of Community objectives in general and to               covered by Regulation (Euratom) No 3 .
protect the interests of the Community institutions and
Member States ;
                                                                                              Article 2
Whereas a Commission decision based on Article 95 of                                 Supplementary provisions
the Treaty establishing the European Coal and Steel
Community will be adopted to cover ECSC classified                   1 . The security measures laid down in this Regulation
information ;                                                       provide a framework of general principles and coor­
                                                                    dinated rules .
Whereas the Treaties do not provide specific powers of
action for the establishment of common rules in this                2 . The institutions of the European Communities
field :                                                              (hereinafter called 'the institutions') and the Member
                                                                    States may, where necessary, supplement them by rules
                                                                    on matters within their jurisdiction in order to take
                                                                    account of local conditions, provided this does not
Whereas this Regulation is without prejudice to the                 jeopardize the uniformity of treatment of the infor­
application of the specific security measures laid down in          mation referred to in Article 1 ( 1 ).
Council Regulation (Euratom) No 3 (') on the security
gradings and the security measures to be applied to
Euratom classified information ;
                                                                    3. The institutions of the European Communities are
                                                                    the European Parliament, the Council, the Commission
                                                                    and the Court of Justice.
Whereas the provisions of this Regulation do not affect
the normal rules of confidentiality which apply to all
public servants with regard to information not expressly
intended for the public,                                            4.    For the purposes of this Regulation, the Court of
                                                                    Auditors, the Economic and Social Committee and the
                                                                    European Investment Bank are deemed to be institutions .
HAS ADOPTED THIS REGULATION :
                                                                                              Article 3
                                                                                       Classified information
                            TITLE I
                                                                     1.   For the purposes of this Regulation, 'classified
    PROTECTION : PRINCIPLES AND GENERAL RULES                       information' means all forms of information whose
                                                                    unauthorized disclosure could be detrimental to the          1
                           Article 1                                essential interests of the European Communities and of
                                                                    the   Member     States  and   which   therefore must     be
                    Scope : subject matter                          protected by appropriate security measures .
 1.     This Regulation establishes security gradings for
sensitive information connected with EEC or Euratom
 activities and the security measures to be applied to such          2 . 'Information' means any information, whether
 information both inside Member States and institutions              recorded in writing, orally or optically and whatever the
 and when it is transmitted by one Member State or                   medium used : paper, audio or video tape, transmission
 institution to another.                                             networks, technical or physical processes. For the
                                                                     purposes of this Regulation, the concept of classified
                                                                     information must be understood solely by reference to its
                                                                     context.
 2.     This Regulation also establishes the conditions of
 access to classified information by public servants and
persons or firms under contract.
                                                                     3.    Where information is not contained in a written
                                                                     document, protection of classified information may
                                                                     require special rules taking account of the nature of the
                                                                     medium, in particular for audio and video recordings,
 (') OJ No 17, 6. 10. 1958 , p. 406/ 58 .                            microfilm, film or video tapes or computer media.
 ---pagebreak--- 21 . 3 . 92                             Official Journal of the European Communities                             No C 72 / 17
4.      The information referred to in paragraphs 1 and 2         2. Information from any other source, whether or not
above shall retain its classified status even when it is          bearing a security grading, shall if necessary be assigned
preparatory or only for temporary use.                            an EC security grading by the recipient institution or
                                                                  Member State, account being taken of the legitimate
                                                                  interests of the author or the source of the information .
                           Article 4
                   Classification principles                                                 TITLE II
1 . The security grading applicable to an item of infor­
                                                                                  PROCEDURAL PROVISIONS
mation shall be determined by reference to the content
of the information in question.
                                                                                             Article 7
2. Security gradings shall be assigned only where                               Assignment of security gradings
necessary and for the time necessary.                             The assignment of security gradings shall be the respon­
                                                                  sibility of the institution or Member State in which the
                                                                  document originates.
3.      Where the information to be protected has a
temporary security grading, the date shall be indicated
beyond which it can be considered declassified or an
equivalent embargo shall be attached.                             Each institution and each Member State shall determine
                                                                  the internal procedures for assignment of security
                                                                  gradings, taking account of the criteria laid down in
4.      Where a number of items of information are                Article 4 and avoiding unnecessary gradings .
grouped together, the security grading to be applied to
the whole shall be at least as high as that of the item of
information bearing the highest grading. A collection of
information may, however, be given a higher grading                                          Article 8
than any of its constituent parts .
                                                                                 Declassification of information
                           Article 5                              1 . The institution or Member State which assigned the
                                                                  security grading to an item of information shall be
                      Security gradings                           responsible for deciding that the grading is to be lifted or
                                                                  changed and for informing the recipients.
Security gradings for EC classified information shall be
as follows :
                                                                  In the case of TOP SECRET or SECRET information such
(a) EC-TOP SECRET: where unauthorized disclosure                  decisions shall be communicated to recipients in writing.
     might be extremely detrimental to the essential
     interests of the Communities or of one or more
     Member States ;
                                                                  2. Information temporarily classified shall be
                                                                  declassified automatically on the expiry date or as
(b) EC-SECRET: where unauthorized disclosure might be             otherwise specified.
     seriously detrimental to the essential interests of the
     Communities or of one or more Member States ;
                                                                  3 . Information in historical archives is subject to a
(c) EC-CONFIDENTIAL : where unauthorized disclosure               declassification procedure after 30 years with a view to
     might be detrimental to the essential interests of the       allowing public access.
     Communities or of one or more Member States.
                           Article 6                                                         Article 9
              Information from outside sources                                            Scope : persons
1 . Classified information from any of the institutions           1 . The security measures laid down in this Regulation
or Member States shall retain its original security               shall be observed by all officials or other public servants
grading.                                                          who, for any reason, have occasion :
 ---pagebreak---   No C 72/ 18                           Official Journal of the European Communities                                  21 . 3 . 92
  (a) in an institution, in a committee for which an               2.     Authorizations shall terminate when the authorized
      institution is responsible or in the course of work          person leaves the service of the Communities or their
      with the staff of an institution, to have access to          contract ends .
      classified information produced within the institution
      or communicated to it :
                                                                   3. Authorizations shall be subject to periodical review
                                                                   every five years at least.
 (b) in a Member State, to have access to EC classified
      information produced in the Member State or
      communicated to it.
                                                                                             Article 12
                                                                                              Vetting
 2 . Any firm or company, including subcontractors,                1 . (a) Vetting shall be undertaken at the request of the
 working for an institution or Member State whose staff                    institution or Member State to whose authority
 may have occasion to read classified information by                       the person to be given authorization in
 reason of their work shall be bound by the requirements                   accordance with Article 10 (2) or (3) is subject.
 of this Regulation and shall impose the same obligations                  The vetting shall be carried out by the Member
 on every member of staff concerned. It shall designate a                  State of which the person concerned is a national.
 person to be responsible for monitoring the implemen­
 tation of these measures .
                                                                       (b) Where the person concerned is not a Community
                                                                           national, the Member State responsible for vetting
                                                                           is the one in which the person is domiciled or
                           Article 10                                      usually resident.
                Access to classified documents
 1 . Access to and possession of EC classified infor­                  (c) Where the person concerned has been resident for
 mation shall be restricted to the persons referred to in                  a period of time in a Member State other than the
 Article 9 who, by reason of their duties or of service                    one referred to in the previous paragraph, or if
 requirements, need to acquaint themselves with such                       the person has ties in another Member State, the
 information or to handle it.                                              Member State in question shall take part in the
                                                                           vetting procedure. The Member State in question
                                                                           shall communicate the results of its enquiries to
                                                                           the Member State responsible for vetting.
2.     To be allowed access to EC-TOP SECRET and
 EC-SECRET and EC-CONFIDENTIAL information, the
persons referred to in paragraph 1 must be given auth­            2. The vetting procedure shall be governed by the
orization in accordance with Article 11 .                         relevant rules and requirements applied in the Member
                                                                  State in question.
3.     Such authorization shall be granted only to persons
who have been vetted in accordance with Article 12 .              3.     Institutions and Member States shall cooperate and
                                                                  exchange whatever information is necessary for the
                                                                  proper application of this Article.
4 . Where only occasional access to EC-CON­
FIDENTIAL information is required, such access may be             In particular, institutions and Member States shall notify
authorized by way of exception without prior vetting,             each other of anything which may cast doubts on the
provided that all necessary precautions are taken.                credentials of the authorized person.
                                                                                             Article 13
                          Article 11
                                                                                           Instructions
                        Authorization
                                                                  All persons authorized in accordance with Article 10
1 . Authorizations under Article 10 shall be granted by           shall, at the time of authorization and at regular intervals
each institution and Member State to persons subject to           thereafter, be given appropriate instructions concerning
its authority in accordance with its own arrangements.            the protection of classified information and methods to
 ---pagebreak--- 21 . 3 . 92                              Official Journal of the European Communities                                No C 72 / 19
be applied. They shall sign a declaration that they have           2.      It shall be the task of security officers to :
received the instructions and that they undertake to
comply with them.
                                                                   (a) keep up to date the list of persons in their
                                                                         departments authorized to have access to
                                                                         CONFIDENTIAL, SECRET and TOP SECRET infor­
                           TITLE III
                                                                         mation ;
                         STRUCTURES
                                                                    (b) give instructions to staff regarding their responsibility
                                                                         for the protection of classified information ;
                           Article 14
                   Responsibility for security                      (c) enforce the physical security measures ;
Each institution and Member State shall designate a
department to supervise the application of this Regu­               (d) supervise the work of the special offices provided for
lation and of supplementary measures as provided for in                  in Article 17 .
Article 2 and shall inform the other institutions and
Member States through the Commission.
                                                                    3. Only persons authorized in accordance with Article
                                                                    10 to have access to classified information may be
                            Article 15
                                                                    security officers.
   Coordination between institutions and Member States
                                                                                              Article 17
 1.     The institutions and Member States shall set up
whatever procedures are necessary for the coherent                                          Special offices
application of this Regulation.
                                                                    1.     The institutions    and Member States shall use
                                                                    specialized departments (hereinafter called 'special
                                                                    offices') for the exchange of EC-TOP SECRET,
2.      The Commission shall organize the necessary coor­           EC-SECRET, and EC-CONFIDENTIAL information.
dination      between     institutions   and    between    the
institutions and the Member States .
                                                                    2. The special office shall assume responsibility for
                                                                    handling classified information referred to in paragraph
 3.     The Commission shall be assisted in this task by an         1 , in particular registration, reproduction, translation,
Advisory Committee on Security composed of represen­                transmission, storage and destruction.
tatives of the Member States and chaired by a
Commission representative.
                                                                    3. Where necessary for the discharge of their duties,
                                                                    officials assigned to the special offices shall be auth­
4.      The committee shall draw up its rules of procedure.         orized to have access to classified information in
Representatives of other institutions may attend its                accordance with Article 10 .
meetings as observers.
                                                                                               TITLE IV
 5.      The committee's remit shall be to examine, on the
 initiative of its chairman or at the request of an
                                                                                   PROTECTION OF DOCUMENTS
 institution or Member State, any matter coming within
 the scope of this Regulation.
                                                                                               Article 18
                                                                             Distinctive marking of classified documents
                            Article 16
                                                                     1.    The security grading assigned to classified infor­
                         Security officers                           mation in written form shall be shown as follows :
 1.      The institutions and Member States shall designate,
 in each department receiving or handling classified infor­         — EC-TOP SECRET and EC-SECRET : by a clearly
 mation, officials of appropriate rank (hereinafter called               visible stamp on the top and bottom of each page or
 'security officers') to be responsible for the implemen­                by some equivalent indication, such as a diagonal
 tation of this Regulation .                                             band extending across the full page,
 ---pagebreak--- No C 72 / 20                          Official Journal of the European Communities                                   21 . 3 . 92
— EC-CONFIDENTIAL: by a clearly visible sump on                                           Article 20
    each page or by some equivalent indication, such as a
    diagonal band extending across the full page.               Registration, distribution and reception of EC-TOP
                                                                SECRET, EC-SECRET and EC-CONFIDENTIAL infor­
                                                                                           mation
The stamp shall be in all the official languages of the         All EC-TOP SECRET, EC-SECRET and EC-CONFI­
Community.                                                      DENTIAL documents shall be registered in one of the
                                                                special offices referred to in Article 17 ; the special office
                                                                thereby takes delivery of the document and arranges any
                                                                necessary transmission. The purpose of such registration
2. In the case of temporary classification, the date            shall be to make it possible :
after which the document may be considered declassified
or the equivalent embargo formula shall be added in a           — to draw up immediately a list of the persons who
suitable place.                                                      have consulted the information or had it in their
                                                                     possession,
                                                                — to ascertain at once, after distribution, who is in
3. Each copy of an EC-TOP SECRET or EC-SECRET                        possession of each copy and of any duplicates.
document shall bear a serial number, by means of which
the source, recipient and year can be identified. This
serial number shall be repeated on the cover page of                                     Article 21
each document. The pages shall be numbered.
                                                                                         Messengers
                                                                With the agreement of the security department
4. If the security grading of a classified document is          concerned, messengers shall be specially designated to
changed, the document shall be marked as appropriate            carry classified documents, in particular EC-TOP
for the new grading.                                            SECRET and EC-SECRET documents .
                                                                                         Article 22
5. References to EC-TOP SECRET, EC-SECRET and
                                                                                          Delivery
EC-CONFIDENTIAL information, including compu­
terized references, shall be kept to a minimum and under         1.    EC-TOP SECRET, EC-SECRET and EC-CONFI­
no circumstances must they reveal either the content or         DENTIAL information shall be dispatched and received
the security grading of the information.                        by the special offices.
                                                                2. The following procedures shall apply for the
                         Article 19                             delivery of classified documents :
Preparation, production and reproduction of EC-TOP              (a) EC-TOP SECRET and EC-SECRET:
SECRET, EC-SECRET and EC-CONFIDENTIAL docu­
                            ments                                    by authorized messenger, or by diplomatic bag or by
                                                                     insured mail, with advice of delivery;
 1.   Runs    of EC-TOP SECRET,          EC-SECRET and
EC-CONFIDENTIAL documents shall be strictly limited              (b) EC-CONFIDENTIAL :
to the number of copies required to cover estimated
essential needs.                                                     by messenger, internal mail or registered post, with
                                                                     advice of delivery;
                                                                 (c) whatever the means of delivery, the envelope shall
2. Classified information may be reproduced in whole                 bear no distinctive marking on the outside.
or in part, in whatever form and by whatever means,
only under the authority of one of the special offices
referred to in Article 17 .                                                              Article 23
                                                                                       Diplomatic bag
The number of copies (e.g. further runs, duplicates or          The delivery of classified documents by diplomatic bag
extracts) shall be limited to essential needs not foreseen      shall be governed by appropriate rules which afford
when the document was originally produced.                      adequate protection.
 ---pagebreak--- 21 . 3 . 92                              Official Journal of the European Communities                           No C 72 /21
                           Article 24                                                       TITLE VII
      Removal of classified documents from buildings                     TRANSMISSION BY TELECOMMUNICATIONS
1.       Classified documents shall be kept at all times in a                               Article 27
secure location .
                                                                   Transmission of classified documents by telecommuni­
                                                                                              cations
2.       Classified documents may only be taken away
where absolutely necessary and shall remain at all times            1.    EC-TOP SECRET, EC-SECRET and EC-CONFI­
in the personal custody of the person who removes them.            DENTIAL information shall not be sent by telegram,
                                                                   radio, telephone, telex, telefax or any other electronic
                                                                   means unless it is enciphered using a system the security
Classified documents should not be left in locations               department regards as safe.
where they cannot remain under surveillance at all times.
                                                                   2 . Notwithstanding paragraph 1 , EC-CONFIDENTIAL
                                                                   information may in cases of emergency and absolute
                            TITLE V                                necessity be sent by such means without being enci­
                                                                   phered, provided that authorization is obtained from the
                         DESTRUCTION                               competent authority of the institution or the Member
                                                                   State and the Cipher Office is informed.
                           Article 25
               Destruction of classified documents                  3.    EC-CONFIDENTIAL information which has been
                                                                   sent without being enciphered may never subsequently be
1 . Outdated and surplus copies of classified docu­                sent in enciphered form.
ments shall be destroyed under the responsibility of the
appropriate authorities.
                                                                   4. The provisions of this Article shall apply in
The destruction of EC-TOP SECRET, EC-SECRET and                    conjunction with the rules and directives on the security
EC-CONFIDENTIAL documents shall be carried out                     of computerized information laid down in Article 32.
using a shredder or another approved method of
destruction .
                                                                                           TITLE VIII
2.       The destruction of EC-TOP SECRET and
                                                                                    PHYSICAL PROTECTION
EC-SECRET documents shall be witnessed, recorded in a
report and noted in the register of the special office in                                   Article 28
question.
                                                                                             Buildings
3.       At least one copy shall be kept in the archives with       1 . Buildings or parts of buildings housing classified
adequate protection.                                                documents shall be accessible only to persons authorized
                                                                    to enter them. They shall be suitably protected by
                                                                    providing, where necessary, permanent surveillance or
                                                                    installing an alarm system.
                           TITLE VI
PROTECTION OF OTHER INFORMATION MATERIAL                            2. Visitors shall not be left unaccompanied in places
                          AND MEDIA                                 where classified documents are kept.
                           Article 26
                   Other information material                                               Article 29
Information material and media other than those                                         Security furniture
referred to in Tides IV and V shall be protected in
accordance with the principles laid down in these two               EC-TOP SECRET, EC-SECRET and EC-CONFIDENTIAL
titles .                                                            documents shall be kept in cupboards or other storage
 ---pagebreak---  No C 72 / 22                          Official Journal of the European Communities                                  21 . 3 . 92
 units approved by the security office as being sufficiently       2. Each Member State and institution shall adopt
 sturdy and having a safe locking mechanism.                       special rules for the security of computerized infor­
                                                                   mation. These rules shall comprise general measures
                                                                   supplemented by specific measures based on an analysis
                                                                   of the risks.
                         Article 30
 Protection of combination-lock settings and security keys
                                                                   3.    These measures shall in particular :
 1 . The setting of combination locks shall be changed
 at the time of delivery, every time staff having
 knowledge of the setting is changed, whenever the                 (a) define responsibilities for:
 setting has or appears to have been compromised and, at
 all events, every 12 months at least.
                                                                       — authorizing access,
 2.    The term 'security keys' shall mean all keys to                 — applying the authorization           procedure    (i.e.
furniture used to house classified documents.
                                                                           permitting access),
 3. Holders of security keys and the departments                       — checking effective access against authorizations
responsible shall take whatever measures are necessary to                  granted ;
 safeguard security keys, in particular, to prevent unauth­
orized persons from having access to them.
                                                                  (b) ensure reliable identification and authentication of
                                                                       users ;
4. The loss of a security key or the compromising of a
combination-lock setting shall be brought to the
immediate attention of the security officer, who shall            (c) set the technical security criteria for operating
                                                                       systems, networks and software on the basis of
arrange at once for the lock to be replaced or the setting             recognized standards ;
to be changed.
                                                                  (d) determine rules for the management of computer
                         Article 31                                    configurations and in particular rules for the certifi­
                                                                       cation of the criteria provided for in (c).
Special provisions for the protection of classified infor­
                          mation
                                                                  4.    The measures shall also include common rules and
If special circumstances prevent the application of any of        technical options as regards :
the provisions of this Regulation or dictate stricter
measures, the responsible security officer, after
consulting the security department, shall take or cause to        (a) the enciphering and authentication of data and the
be taken appropriate measures to provide a degree of                   management of keys ;
protection equivalent to that provided for in this Regu­
lation .
                                                                  (b) the precautions to be taken for the elimination of
                                                                       electromagnetic radiation by reference to the
                                                                       Tempest standard (or a European equivalent to be
                         TITLE IX                                      defined).
    PROTECTION OF COMPUTERIZED INFORMATION
                         Article 32                                                          TITLE X
           Security of computerized information                                       FINAL PROVISIONS
 1 . Classified information in computerized or elec­                                        Article 33
tronic form shall be governed by the protective measures
laid down in this Regulation. The processing of such            . Procedure in the event of infringement of this Regulation
information (for example, its storage or transmission)
using equipment such as computers, networks and                   1.    Any person employed by an institution who in the
terminals shall be subject to security measures specially         course of his duties has access to classified information
devised for these techniques .                                    shall be informed by the security department or the
 ---pagebreak--- 21 . 3 . 92                          Official Journal of the European Communities                          No C 72/23
security officers that failure to comply with the                                        Article 34
requirements of this Regulation renders him liable to
                                                                                         Penalties
disciplinary action.
                                                               Member States and institutions shall take appropriate
                                                               action to penalize failure to comply with the
2.      Any person who finds, or has reason to believe,        requirements of this Regulation.
that classified information has gone astray or been
compromised or that an infringement of this Regulation                                  Article 35
or of security measures has been committed shall
immediately inform the security officer, who will at once      Treaties or agreements with Member States and regu­
inform his superior.                                                                      lations
                                                                1 . These provisions shall be without prejudice to the
                                                               obligations of the Community and/or the Member States
3.      If there is a suggestion that EC-TOP SECRET,           in this field arising out of treaties or agreements
EC-SECRET or EC-CONFIDENTIAL information has                   concluded with third countries, international organiz­
come to the knowledge of an unauthorized person, the           ations or a national of a third country.
security department shall be informed immediately so
that it can assess the situation.
                                                               2 . This Regulation shall be without prejudice to
                                                               Regulation (Euratom) No 3 implementing Article 24 of
                                                               the Treaty establishing the European Atomic Energy
                                                               Community.
4. If the suspected breach within the meaning of
paragraph 3 is confirmed, the security department shall
take appropriate steps with the responsible officials                                   Article 36
concerned in order to limit the damage caused to a
minimum and to prevent any recurrence.                                               Entry into force
                                                               This Regulation shall enter into force on the 20th day
                                                               following its publication in the Official Journal of the
5. If a serious infringement committed in an                   European Communities.
institution or a Member State concerns information orig­
inating in another institution or Member State, that           This Regulation shall be binding in its entirety and
institution or Member State shall be advised.                  directly applicable in all Member States.