A.    Consideration of confidential documents communicated to Parliament

Procedure for the consideration of confidential documents communicated to the European Parliament (1)

1.    Confidential documents shall mean documents and information to which public access may be refused in accordance with Article 4 of European Parliament and Council Regulation (EC) No 1049/2001 and shall include sensitive documents as defined in Article 9 of that Regulation.

Where the confidential nature of documents received by Parliament is questioned by one of the institutions, the matter shall be referred to the interinstitutional committee established pursuant to Article 15(2) of Regulation (EC) No 1049/2001.

When confidential documents are communicated to Parliament under cover of confidentiality, the chair of Parliament's committee responsible shall automatically apply the confidential procedure laid down in paragraph 3 below.

2.    Any committee of the European Parliament shall be entitled to apply the confidential procedure to an item of information or a document indicated by one of its members in a written or oral request. A majority of two thirds of the members present shall be required for a decision to apply the confidential procedure.

3.    Once the chair of the committee has declared that proceedings are confidential, they may be attended only by members of the committee and by officials and experts who have been designated in advance by the chair and whose presence is strictly necessary.

The documents, which shall be numbered, shall be distributed at the beginning of the meeting and collected again at the end. No notes of these, and certainly no photocopies, may be taken.

The minutes of the meeting shall make no mention of the discussion of the item taken under the confidential procedure. Only the relevant decision, if any, may be recorded.

4.    Three members of a committee which has applied the confidential procedure may request consideration of a breach of confidentiality, and this may be placed on the agenda. By a majority of its members, the committee may decide that consideration of the breach of confidentiality shall be placed on the agenda for the first meeting following the submission of the request to its chair.

5.    Penalties: in cases of infringement, the chair of the committee shall proceed in accordance with Rules 11(2), 165, 166 and 167.

B.    Interinstitutional agreement on access by Parliament to sensitive information in the field of security and defence policy

Interinstitutional Agreement of 20 November 2002 between the European Parliament and the Council concerning access by the European Parliament to sensitive information of the Council in the field of security and defence policy (2)

THE EUROPEAN PARLIAMENT AND THE COUNCIL,

Whereas:

(1)    Article 21 of the Treaty on European Union states that the Council Presidency shall consult the European Parliament on the main aspects and the basic choices of the common foreign and security policy and shall ensure that the views of the European Parliament are duly taken into consideration. That Article also stipulates that the European Parliament shall be kept regularly informed by the Council Presidency and the Commission of the development of the common foreign and security policy. A mechanism should be introduced to ensure that these principles are implemented in this field.

(2)    In view of the specific nature and the especially sensitive content of certain highly classified information in the field of security and defence policy, special arrangements should be introduced for the handling of documents containing such information.

(3)    In conformity with Article 9(7) of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (3), the Council is to inform the European Parliament regarding sensitive documents as defined in Article 9(1) of that Regulation in accordance with arrangements agreed between the institutions.

(4)    In most Member States there are specific mechanisms for the transmission and handling of classified information between national governments and parliaments. This Interinstitutional Agreement should provide the European Parliament with treatment inspired by best practices in Member States,

HAVE CONCLUDED THIS INTERINSTITUTIONAL AGREEMENT:

1.     Scope

1.1.    This Interinstitutional Agreement deals with access by the European Parliament to sensitive information, i.e. information classified as "TRÈS SECRET/TOP SECRET", "SECRET" or "CONFIDENTIAL", whatever its origin, medium or state of completion, held by the Council in the field of security and defence policy and the handling of documents so classified.

1.2.    Information originating from a third State or international organisation shall be transmitted with the agreement of that State or organisation.

Where information originating from a Member State is transmitted to the Council without explicit restriction on its dissemination to other institutions other than its classification, the rules in sections 2 and 3 of this Interinstitutional Agreement shall apply. Otherwise, such information shall be transmitted with the agreement of the Member State in question.

In the case of a refusal of the transmission of information originating from a third State, an international organisation or a Member State, the Council shall give the reasons.

1.3.    The provisions of this Interinstitutional Agreement shall apply in accordance with applicable law and without prejudice to Decision 95/167/EC, Euratom, ECSC of the European Parliament, the Council and the Commission of 19 April 1995 on the detailed provisions governing the exercise of the European Parliament's right of inquiry (4) and without prejudice to existing arrangements, especially the Interinstitutional Agreement of 6 May 1999 between the European Parliament, the Council and the Commission on budgetary discipline and improvement of the budgetary procedure (5).

2.     General rules

2.1.    The two institutions shall act in accordance with their mutual duties of sincere cooperation and in a spirit of mutual trust as well as in conformity with the relevant Treaty provisions. Transmission and handling of the information covered by this Interinstitutional Agreement must have due regard for the interests which classification is designed to protect, and in particular the public interest as regards the security and defence of the European Union or of one or more of its Member States or military and non-military crisis management.

2.2.    At the request of one of the persons referred to in point 3.1, the Presidency of the Council or the Secretary-General/High Representative shall inform them with all due despatch of the content of any sensitive information required for the exercise of the powers conferred on the European Parliament by the Treaty on European Union in the field covered by this Interinstitutional Agreement, taking into account the public interest in matters relating to the security and defence of the European Union or of one or more of its Member States or military and non-military crisis management, in accordance with the arrangements laid down in section 3.

3.     Arrangements for access to and handling of sensitive information

3.1.    In the context of this Interinstitutional Agreement, the President of the European Parliament or the Chairman of the European Parliament's Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy may request that the Presidency of the Council or the Secretary-General/High Representative convey information to this committee on developments in European security and defence policy, including sensitive information to which point 3.3 applies.

3.2.    In the event of a crisis or at the request of the President of the European Parliament or of the Chairman of the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy, such information shall be provided at the earliest opportunity.

3.3.    In this framework, the President of the European Parliament and a special committee chaired by the Chairman of the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy and composed of four members designated by the Conference of Presidents shall be informed by the Presidency of the Council or the Secretary-General/High Representative of the content of the sensitive information where it is required for the exercise of the powers conferred on the European Parliament by the Treaty on European Union in the field covered by this Interinstitutional Agreement. The President of the European Parliament and the special committee may ask to consult the documents in question on the premises of the Council.

Where this is appropriate and possible in the light of the nature and content of the information or documents concerned, these shall be made available to the President of the European Parliament, who shall select one of the following options:

(a)    information intended for the chairman of the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy;

(b)    access to information restricted to the members of the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy only;

(c)    discussion in the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy, meeting in camera, in accordance with arrangements which may vary by virtue of the degree of confidentiality involved;

(d)    communication of documents from which information has been expunged in the light of the degree of secrecy required.

These options are not applicable if sensitive information is classified as "TRÈS SECRET/TOP SECRET".

As to information or documents classified as "SECRET" or "CONFIDENTIAL", the selection by the President of the European Parliament of one of these options shall be previously agreed with the Council.

The information or documents in question shall not be published or forwarded to any other addressee.

4.     Final provisions

4.1.    The European Parliament and the Council, each for its own part, shall take all necessary measures to ensure the implementation of this Interinstitutional Agreement, including the steps required for the security clearance of the persons involved.

4.2.    The two institutions are willing to discuss comparable Interinstitutional Agreements covering classified information in other areas of the Council's activities, on the understanding that the provisions of this Interinstitutional Agreement do not constitute a precedent for the Union's or the Community's other areas of activity and shall not affect the substance of any other Interinstitutional Agreements.

4.3.    This Interinstitutional Agreement shall be reviewed after two years at the request of either of the two institutions in the light of experience gained in implementing it.

Annex

This Interinstitutional Agreement shall be implemented in conformity with the relevant applicable regulations and in particular with the principle according to which the consent of the originator is a necessary condition for the transmission of classified information as laid down in point 1.2.

Consultation of sensitive documents by the members of the Special Committee of the European Parliament shall take place in a secured room at the Council premises.

This Interinstitutional Agreement shall enter into force after the European Parliament has adopted internal security measures which are in accordance with the principles laid down in point 2.1 and comparable to those of the other institutions in order to guarantee an equivalent level of protection of the sensitive information concerned.

C.    Implementation of the Interinstitutional Agreement governing Parliament access to sensitive information in the sphere of security and defence policy

European Parliament decision of 23 October 2002 on the implementation of the Interinstitutional Agreement governing European Parliament access to sensitive Council information in the sphere of security and defence policy (6)

THE EUROPEAN PARLIAMENT,

having regard to Article 9, and in particular paragraphs 6 and 7 thereof, of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (7),

having regard to point 1 of Annex VII, part A of its Rules of Procedure,

having regard to Article 20 of the Bureau Decision of 28 November 2001 on public access to Parliament documents (8),

having regard to the Interinstitutional Agreement between the European Parliament and the Council on European Parliament access to sensitive Council information in the sphere of security and defence policy,

having regard to the Bureau proposal,

having regard to the specific nature and the particularly sensitive substance of some highly confidential items of information in the sphere of security and defence policy,

whereas, in accordance with the provisions agreed between the institutions, the Council is required to make information about sensitive documents available to Parliament,

whereas the Members of the European Parliament who sit on the special committee set up by the Interinstitutional Agreement must be cleared for access to sensitive information in accordance with the "need-to-know" principle,

having regard to the need to lay down specific arrangements for receiving, dealing with and safeguarding sensitive information forwarded by the Council, Member States, third States or international organisations,

HAS DECIDED:

Article 1

This Decision adopts the additional measures required to implement the Interinstitutional Agreement governing European Parliament access to sensitive Council information in the sphere of security and defence policy.

Article 2

Parliament’s requests for access to sensitive Council information shall be dealt with by the latter in a manner consistent with its relevant rules. If the documents requested have been drawn up by other institutions, Member States, third countries or international organisations, they shall be forwarded only with the agreement of the institutions, States or organisations concerned.

Article 3

The President of Parliament shall be responsible for the implementation of the Interinstitutional Agreement within the Institution.

In that connection, he/she shall take all the measures required to guarantee that information received directly from the President of the Council or the Secretary-General/High Representative, or information obtained in the course of the consultation of sensitive documents on the Council's premises, is dealt with in a confidential manner.

Article 4

When the President of Parliament or the chairman of the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy asks the Council Presidency or the Secretary-General/High Representative to supply sensitive information to the special committee set up by the Interinstitutional Agreement, that information shall be provided as soon as possible. In that connection, Parliament shall fit out a room specially designed for the holding of meetings to deal with sensitive information. The room shall be chosen with a view to guaranteeing a level of protection equivalent to that laid down for this type of meeting by Council Decision 2001/264/EC of 19 March 2001 (9) adopting the Council's security regulations.

Article 5

The information meeting chaired by the President of Parliament or by the chairman of the above-mentioned committee shall be held in camera.

With the exception of the four Members appointed by the Conference of Presidents, only those officials who, by virtue of their duties or in accordance with operational requirements, have been cleared and authorised to enter it subject to the "need-to-know" principle shall have access to the meeting room.

Article 6

Pursuant to paragraph 3.3 of the above-mentioned Interinstitutional Agreement, when the President of Parliament or the chairman of the above-mentioned committee decides to request authorisation to consult documents containing sensitive information, that consultation shall be carried out on the Council's premises.

Documents shall be consulted on the spot in whatever version they are available.

Article 7

The Members of Parliament who are to attend information meetings or have access to sensitive documents shall be the subject of a clearance procedure similar to that undergone by Members of the Council and Members of the Commission. In that connection, the President of Parliament shall take the requisite steps vis-à-vis the competent national authorities.

Article 8

Officials who are to have access to sensitive information shall be cleared in accordance with the provisions laid down for the other institutions. Officials cleared in this way subject to the "need-to-know" principle shall be invited to attend the above-mentioned information meetings or to peruse the documents in question. In that connection, the Secretary-General, after consulting the competent Member State authorities, shall grant clearance on the basis of the security inquiry carried out by those same authorities.

Article 9

The information obtained at such meetings or during the consultation of such documents on the Council's premises shall not be disclosed, disseminated or reproduced, either in full or in part, in any form. By the same token, no recording of particulars relating to the sensitive information provided by the Council shall be authorised.

Article 10

The Members of Parliament designated by the Conference of Presidents to have access to the sensitive information shall be bound by the requirement to maintain confidentiality. Any Member who breaches that requirement shall be replaced on the special committee by another Member designated by the Conference of Presidents. In that connection, the Member guilty of a breach of the requirement may, prior to his/her exclusion from the special committee, be heard by the Conference of Presidents, which shall hold a special meeting in camera. In addition to his/her exclusion from the special committee, the Member responsible for leaking information may, if appropriate, be the subject of judicial proceedings pursuant to the relevant legislation in force.

Article 11

Officials duly cleared to have access to sensitive information in accordance with the "need-to-know" principle shall be bound by the requirement to maintain confidentiality. Any official who breaches that rule shall be the subject of an inquiry conducted under the authority of the President and, if appropriate, disciplinary proceedings in accordance with the Staff Regulations (statut des fonctionnaires). Should judicial proceedings be initiated, the President shall take all the measures required to enable the competent national authorities to implement the appropriate procedures.

Article 12

The Bureau shall be competent to undertake any revision, amendment or interpretation necessitated by the implementation of this Decision.

Article 13

This Decision shall be annexed to Parliament's Rules of Procedure and shall enter into force on the day of its publication in the Official Journal of the European Communities.

D.    Interinstitutional agreement concerning the forwarding to and handling of classified information on matters other than those in the area of the common foreign and security policy

Interinstitutional agreement of 12 March 2014 between the European Parliament and the Council concerning the forwarding to and handling by the European Parliament of classified information held by the Council on matters other than those in the area of the common foreign and security policy (10)

THE EUROPEAN PARLIAMENT AND THE COUNCIL,

Whereas:

(1)    Article 14(1) of the Treaty on European Union (TEU) provides that the European Parliament jointly with the Council, is to exercise legislative and budgetary functions and that it is to exercise functions of political control and consultation as laid down in the Treaties.

(2)    Article 13(2) TEU provides that each institution is to act within the limits of the powers conferred on it in the Treaties, and in conformity with the procedures, conditions and objectives set out in them. That provision also stipulates that the institutions are to practice mutual sincere cooperation. Article 295 of the Treaty on the Functioning of the European Union (TFEU) provides that the European Parliament and the Council, inter alia, are to make arrangements for their cooperation and that, to that end, they may, in compliance with the Treaties, conclude interinstitutional agreements which may be of a binding nature.

(3)    The Treaties and, as appropriate, other relevant provisions provide that either in the context of a special legislative procedure or under other decision-making procedures, the Council is to consult or obtain the consent of the European Parliament before adopting a legal act. The Treaties also provide that, in certain cases, the European Parliament is to be informed about the progress or the results of a given procedure or be involved in the evaluation or the scrutiny of certain Union agencies.

(4)    In particular, Article 218(6) TFEU provides that, except where an international agreement relates exclusively to the common foreign and security policy, the Council is to adopt the decision concluding the agreement in question after obtaining the consent of or consulting the European Parliament; all such international agreements which do not relate exclusively to the common foreign and security policy are therefore covered by this Interinstitutional Agreement.

(5)    Article 218(10) of the TFEU provides that the European Parliament is to be immediately and fully informed at all stages of the procedure; that provision also applies to agreements relating to the common foreign and security policy.

(6)    In cases where implementation of the Treaties and, as appropriate, other relevant provisions would require access by the European Parliament to classified information held by the Council, appropriate arrangements governing such access should be agreed upon between the European Parliament and the Council.

(7)    Where the Council decides to grant the European Parliament access to classified information held by the Council in the area of the common foreign and security policy, it either takes ad hoc decisions to that effect or uses the Interinstitutional Agreement of 20 November 2002 between the European Parliament and the Council concerning access by the European Parliament to sensitive information of the Council in the field of security and defence policy (11) (hereinafter ‘the Interinstitutional Agreement of 20 November 2002’), as appropriate.

(8)    The Declaration by the High Representative on political accountability (12), made upon the adoption of Council Decision 2010/427/EU of 26 July 2010 establishing the organisation and functioning of the European External Action Service (13), states that the High Representative will review and where necessary propose to adjust the existing provisions on access for Members of the European Parliament to classified documents and information in the field of security and defence policy (i.e. the Interinstitutional Agreement of 20 November 2002).

(9)    It is important that the European Parliament be associated with the principles, standards and rules for protecting classified information which are necessary in order to protect the interests of the European Union and of the Member States. Moreover, the European Parliament will be in a position to provide classified information to the Council.

(10)    On 31 March 2011 the Council adopted Decision 2011/292/EU on the security rules for protecting EU classified information (14) (hereinafter ‘the Council’s security rules’).

(11)    On 6 June 2011, the Bureau of the European Parliament adopted a Decision concerning the rules governing the treatment of confidential information by the European Parliament (15) (hereinafter ‘the European Parliament’s security rules’).

(12)    The security rules of Union institutions, bodies, offices or agencies should together constitute a comprehensive and coherent general framework within the European Union for protecting classified information, and should ensure equivalence of basic principles and minimum standards. The basic principles and minimum standards laid down in the European Parliament’s security rules and in the Council’s security rules should accordingly be equivalent.

(13)    The level of protection afforded to classified information under the European Parliament’s security rules should be equivalent to that afforded to classified information under the Council’s security rules.

(14)    The relevant services of the European Parliament’s Secretariat and of the General Secretariat of the Council will cooperate closely to ensure that equivalent levels of protection are applied to classified information in both institutions.

(15)    This Agreement is without prejudice to existing and future rules on access to documents adopted in accordance with Article 15(3) TFEU; rules on the protection of personal data adopted in accordance with Article 16(2) TFEU; rules on the European Parliament’s right of inquiry adopted in accordance with third paragraph of Article 226 TFEU; and relevant provisions relating to the European Anti-Fraud Office (OLAF),

HAVE AGREED AS FOLLOWS:

Article 1  : Purpose and scope

This Agreement sets out arrangements governing the forwarding to and handling by the European Parliament of classified information held by the Council, on matters other than those in the area of the common foreign and security policy, which is relevant in order for the European Parliament to exercise its powers and functions. It concerns all such matters, namely:

(a)    proposals subject to a special legislative procedure or to another decision-making procedure under which the European Parliament is to be consulted or is required to give its consent;

(b)    international agreements on which the European Parliament is to be consulted or is required to give its consent pursuant to Article 218(6) TFEU;

(c)    negotiating directives for international agreements referred to in point (b);

(d)    activities, evaluation reports or other documents on which the European Parliament is to be informed; and

(e)    documents on the activities of those Union agencies in the evaluation or scrutiny of which the European Parliament is to be involved.

Article 2  : Definition of ‘classified information’

For the purposes of this Agreement, ‘classified information’ shall mean any or all of the following:

(a)    ‘EU classified information’ (EUCI) as defined in the European Parliament’s security rules and in the Council’s security rules and bearing one of the following security classification markings:

-    RESTREINT UE/EU RESTRICTED,

-    CONFIDENTIEL UE/EU CONFIDENTIAL,

-    SECRET UE/EU SECRET,

-    TRÈS SECRET UE/EU TOP SECRET;

(b)    classified information provided to the Council by Member States and bearing a national security classification marking equivalent to one of the security classification markings used for EUCI listed in point (a);

(c)    classified information provided to the European Union by third States or international organisations which bears a security classification marking equivalent to one of the security classification markings used for EUCI listed in point (a), as provided for in the relevant security of information agreements or administrative arrangements.

Article 3  : Protection of classified information

1.    The European Parliament shall protect, in accordance with its security rules and with this Agreement, any classified information provided to it by the Council.

2.    As equivalence is to be maintained between the basic principles and minimum standards for protecting classified information laid down by the European Parliament and by the Council in their respective security rules, the European Parliament shall ensure that the security measures in place in its premises afford a level of protection to classified information equivalent to that afforded to such information on Council premises. The relevant services of the European Parliament and the Council shall cooperate closely to that effect.

3.    The European Parliament shall take the appropriate measures to ensure that classified information provided to it by the Council shall not:

(a)    be used for purposes other than those for which access was provided;

(b)    be disclosed to persons other than those to whom access has been granted in accordance with Articles 4 and 5, or made public;

(c)    be released to other Union institutions, bodies, offices or agencies, or to Member States, third States or international organisations without the prior written consent of the Council.

4.    The Council may grant the European Parliament access to classified information which originates in other Union institutions, bodies, offices or agencies, or in Member States, third States or international organisations only with the prior written consent of the originator.

Article 4  : Personnel security

1.    Access to classified information shall be granted to Members of the European Parliament in accordance with Article 5(4).

2.    Where the information concerned is classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent, access may be granted only to Members of the European Parliament authorised by the President of the European Parliament:

(a)    who have been security-cleared in accordance with the European Parliament’s security rules; or

(b)    for whom notification has been made by a competent national authority that they are duly authorised by virtue of their functions in accordance with national laws and regulations.

Notwithstanding the first subparagraph, where the information concerned is classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent, access may also be granted to those Members of the European Parliament determined in accordance with Article 5(4) who have signed a solemn declaration of non-disclosure in accordance with the European Parliament’s security rules. The Council shall be informed of the names of the Members of the European Parliament granted access under this subparagraph.

3.    Before being granted access to classified information, Members of the European Parliament shall be briefed on and acknowledge their responsibilities to protect such information in accordance with the European Parliament’s security rules, and briefed on the means of ensuring such protection.

4.    Access to classified information shall be granted only to those officials of the European Parliament and other Parliament employees working for political groups who:

(a)    have been designated in advance as having a need-to-know by the relevant parliamentary body or office-holder determined in accordance with Article 5(4);

(b)    have been security-cleared to the appropriate level in accordance with the European Parliament’s security rules where the information is classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent; and

(c)    have been briefed and received written instructions on their responsibilities for protecting such information as well as on the means of ensuring such protection, and have signed a declaration acknowledging receipt of those instructions and undertaking to comply with them in accordance with the European Parliament’s security rules.

Article 5  : Procedure for accessing classified information

1.    The Council shall provide classified information as referred to in Article 1 to the European Parliament where it is under a legal obligation to do so pursuant to the Treaties or to legal acts adopted on the basis of the Treaties. The parliamentary bodies or office-holders referred to in paragraph 3 may also present a written request for such information.

2.    In other cases, the Council may provide classified information as referred to in Article 1 to the European Parliament either at its own initiative or on written request from one of the parliamentary bodies or office-holders referred to in paragraph 3.

3.    The following parliamentary bodies or office-holders may present written requests to the Council:

(a)    the President;

(b)    the Conference of Presidents;

(c)    the Bureau;

(d)    the chair(s) of the committee(s) concerned;

(e)    the rapporteur(s) concerned.

Requests from other Members of the European Parliament shall be made via one of the parliamentary bodies or office-holders referred to in the first subparagraph.

The Council shall respond to such requests without delay.

4.    Where the Council is under a legal obligation to, or has decided to, grant the European Parliament access to classified information, it shall determine the following in writing before that information is forwarded, together with the relevant body or office-holder as listed in paragraph 3:

(a)    that such access may be granted to one or more of the following:

(i)    the President;

(ii)    the Conference of Presidents;

(iii)    the Bureau;

(iv)    the chair(s) of the committee(s) concerned;

(v)    the rapporteur(s) concerned;

(vi)    all or certain members of the committee(s) concerned; and

(b)    any specific handling arrangements for protecting such information.

Article 6  : Registration, storage, consultation and discussion of classified information in the European Parliament

1.    Classified information provided by the Council to the European Parliament, where it is classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent:

(a)    shall be registered for security purposes to record its life-cycle and ensure its traceability at all times;

(b)    shall be stored in a secure area which meets the minimum standards of physical security laid down in the Council’s security rules and the European Parliament’s security rules, which shall be equivalent; and

(c)    may be consulted by the relevant Members of the European Parliament, officials of the European Parliament and other Parliament employees working for political groups referred to in Article 4(4) and Article 5(4) only in a secure reading room within the European Parliament’s premises. In this case, the following conditions shall apply:

(i)    the information shall not be copied by any means, such as photocopying or photographing;

(ii)    no notes shall be taken; and

(iii)    no electronic communication devices may be taken into the room.

2.    Classified information provided by the Council to the European Parliament, where it is classified at the level RESTREINT UE/EU RESTRICTED or its equivalent, shall be handled and stored in accordance with the European Parliament’s security rules which shall afford a level of protection for such classified information equivalent to that of the Council.

Notwithstanding the first subparagraph, for a period of 12 months following the entry into force of this Agreement, information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent shall be handled and stored in accordance with paragraph 1. Access to such classified information shall be governed by points (a) and (c) of Article 4(4) and by Article 5(4).

3.    Classified information may be handled only on communication and information systems which have been duly accredited or approved in accordance with standards equivalent to those laid down in the Council’s security rules.

4.    Classified information provided orally to recipients in the European Parliament shall be subject to the equivalent level of protection as that afforded to classified information in written form.

5.    Notwithstanding point (c) of paragraph 1 of this Article, information classified up to the level of CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent provided by the Council to the European Parliament may be discussed at meetings held in camera and attended only by Members of the European Parliament and those officials of the European Parliament and other Parliament employees working for political groups who have been granted access to the information in accordance with Article 4(4) and Article 5(4). The following conditions shall apply:

-    documents shall be distributed at the beginning of the meeting and collected again at the end,

-    documents shall not be copied by any means, such as photocopying or photographing,

-    no notes shall be taken,

-    no electronic communication devices may be taken into the room, and

-    the minutes of the meeting shall make no mention of the discussion of the item containing classified information.

6.    Where meetings are necessary to discuss information classified at the level SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent, specific arrangements shall be agreed on a case-by-case basis between the European Parliament and the Council.

Article 7  : Breach of security, loss or compromise of classified information

1.    In the case of a proven or suspected loss or compromise of classified information provided by the Council, the Secretary-General of the European Parliament shall immediately inform the Secretary-General of the Council thereof. The Secretary-General of the European Parliament shall conduct an investigation and shall inform the Secretary-General of the Council of the results of the investigation and of measures taken to prevent a recurrence. Where a Member of the European Parliament is concerned, the President of the European Parliament shall act together with the Secretary-General of the European Parliament.

2.    Any Member of the European Parliament who is responsible for a breach of the provisions laid down in the European Parliament’s security rules or in this Agreement may be liable to measures and penalties in accordance with Rules 9(2) and 152 to 154 of the European Parliament’s Rules of Procedure (16).

3.    Any official of the European Parliament or other Parliament employee working for a political group who is responsible for a breach of the provisions laid down in the European Parliament’s security rules or in this Agreement may be liable to the penalties set out in the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (17).

4.    Persons responsible for losing or compromising classified information may be liable to disciplinary and/or legal action in accordance with the applicable laws, rules and regulations.

Article 8  : Final provisions

1.    The European Parliament and the Council, each for its own part, shall take all necessary measures to ensure implementation of this Agreement. They shall cooperate to that effect, in particular by organising visits to monitor the implementation of the security-technical aspects of this Agreement.

2.    The relevant services of the European Parliament’s Secretariat and of the General Secretariat of the Council shall consult each other before either institution modifies its respective security rules, in order to ensure that equivalence of basic principles and minimum standards for protecting classified information is maintained.

3.    Classified information shall be provided to the European Parliament under this Agreement once the Council, together with the European Parliament, has determined that equivalence has been achieved between the basic principles and minimum standards for protecting classified information in the European Parliament’s and in the Council’s security rules, on the one hand, and between the level of protection afforded to classified information in the premises of the European Parliament and of the Council, on the other.

4.    This Agreement may be reviewed at the request of either institution in the light of experience in implementing it.

5.    This Agreement shall enter into force on the date of its publication in the Official Journal of the European Union.

E.    Rules governing the treatment of confidential information by the European Parliament

Decision of the Bureau of the European Parliament of 15 April 2013 concerning the rules governing the treatment of confidential information by the European Parliament (18).

THE BUREAU OF THE EUROPEAN PARLIAMENT,

Having regard to Rule 23(12) (19) of the Rules of Procedure of the European Parliament,

Whereas:

(1)    In the light of the Framework Agreement on relations between the European Parliament and the European Commission (20) signed on 20 October 2010 (‘the Framework Agreement’) and the Interinstitutional Agreement between the European Parliament and the Council concerning the forwarding to and handling by the European Parliament of classified information held by the Council on matters other than those in the area of the Common Foreign and Security Policy (21) signed on 12 March 2014 ('the Interinstitutional Agreement'), it is necessary to lay down specific rules on the treatment of confidential information by the European Parliament.

(2)    The Lisbon Treaty assigns new tasks to the European Parliament and, in order to develop Parliament's activities in those areas which require a degree of confidentiality, it is necessary to lay down basic principles, minimum standards of security and appropriate procedures for the treatment by the European Parliament of confidential, including classified, information.

(3)    The rules laid down in this Decision aim at ensuring equivalent standards of protection and compatibility with the rules adopted by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States, in order to facilitate the smooth functioning of the decision-making process of the European Union.

(4)    The provisions of this Decision are without prejudice to current and future rules on access to documents adopted in accordance with Article 15 of the Treaty on the Functioning of the European Union (TFEU).

(5)    The provisions of this Decision are without prejudice to current and future rules on the protection of personal data adopted in accordance with Article 16 TFEU,

HAS ADOPTED THIS DECISION:

Article 1  : Objective

This Decision governs the management and handling of confidential information by the European Parliament, including the creation, reception, forwarding and storage of such information, with a view to the appropriate protection of its confidential nature. It implements, the Interinstitutional Agreement and the Framework Agreement, in particular Annex II thereto.

Article 2  : Definitions

For the purposes of this Decision:

(a)    ‘information’ means any written or oral information, whatever the medium and whoever the author may be;

(b)    ‘confidential information’ means ‘classified information’, and non-classified ‘other confidential information’;

(c)    ‘classified information’ means ‘EU classified information’ and ‘equivalent classified information’;

(d)    ‘EU classified information’ (EUCI) means any information and material, classified as ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE/EU SECRET’, ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ or ‘RESTREINT UE/EU RESTRICTED’, unauthorised disclosure of which could cause varying degrees of prejudice to Union interests or to those of one or more of its Member States, whether or not such information originates within the institutions, bodies, offices or agencies established by virtue or on the basis of the Treaties. In this regard, information and material classified at the level:

-    ‘TRÈS SECRET UE/EU TOP SECRET’ is information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the Union or of one or more of the Member States;

-    ‘SECRET UE/EU SECRET’ is information and material the unauthorised disclosure of which could seriously harm the essential interests of the Union or of one or more of the Member States;

-    ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ is information and material the unauthorised disclosure of which could harm the essential interests of the Union or of one or more of the Member States;

-    ‘RESTREINT UE/EU RESTRICTED’ is information and material the unauthorised disclosure of which could be disadvantageous to the interests of the Union or of one or more of the Member States;

(e)    ‘equivalent classified information’ means classified information issued by Member States, third States or international organisations which bears a security classification marking equivalent to one of the security classification markings used for EUCI and which has been forwarded to the European Parliament by the Council or the Commission;

(f)    ‘other confidential information’ means any other non-classified confidential information, including information covered by data protection rules or by the obligation of professional secrecy, created in the European Parliament or forwarded to the European Parliament by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States;

(g)    ‘document’ means any recorded information, regardless of its physical form or characteristics;

(h)    ‘material’ means any document or item of machinery or equipment, either manufactured or in the process of manufacture;

(i)    ‘need to know’ means the need of a person to have access to confidential information in order to be able to perform an official function or a task;

(j)    ‘authorisation’ means a decision adopted by the President, if it concerns Members of the European Parliament, or by the Secretary-General, if it concerns officials of the European Parliament and other European Parliament employees working for political groups, to grant an individual access to classified information up to a specific level, on the basis of a positive result of a security screening (vetting) carried out by a national authority under national law and pursuant to the provisions laid down in Annex I, Part 2;

(k)    ‘downgrading’ means a reduction in the level of classification;

(l)    ‘declassification’ means the removal of any classification;

(m)    ‘marking’ means a sign affixed to ‘other confidential information’ intended to identify predefined specific instructions about its handling or the field covered by a given document. It may also be affixed to classified information, in order to impose additional requirements for its handling;

(n)    ‘unmarking’ means the removal of any marking;

(o)    ‘originator’ means the duly authorised author of confidential information;

(p)    ‘security notices’ means the implementing measures laid down in Annex II;

(q)    ‘handling instructions’ means technical instructions issued to the European Parliament's services concerning the management of confidential information.

Article 3  : Basic principles and minimum standards

1.    The treatment of confidential information by the European Parliament shall follow the basic principles and minimum standards laid down in Annex I, Part 1.

2.    The European Parliament shall set up an information security management system (ISMS) in accordance with those basic principles and minimum standards. The ISMS shall consist of the security notices, the handling instructions and the relevant Rules of Procedure. It shall aim at facilitating parliamentary and administrative work, while ensuring the protection of any confidential information processed by the European Parliament, in full respect of the rules established by the originator of such information as laid down in the security notices.

The processing of confidential information by means of automated communication and information systems (CIS) of the European Parliament shall be implemented in accordance with the concept of information assurance (IA), as provided for in security notice 3.

3.    Members of the European Parliament may consult classified information up to and including the level RESTREINT UE/EU RESTRICTED without security clearance.

4.    Where the information concerned is classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent, access shall be granted to those Members of the European Parliament who have been authorised by the President pursuant to paragraph 5 or after having signed a solemn declaration of non-disclosure of the content of that information to third persons, of compliance with the obligation to protect information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL and of acknowledgement of the consequences of any failure to do so.

5.    Where the information concerned is classified at the level SECRET UE/EU SECRET or TRÈS SECRET/EU TOP SECRET or its equivalent, access shall be granted to those Members of the European Parliament who are authorised by the President after:

(a)    they have been security-cleared in accordance with Annex I, Part 2, of this Decision, or

(b)    a notification has been received from a competent national authority that the Members concerned are duly authorised by virtue of their functions in accordance with national law.

6.    Before being granted access to classified information, Members of the European Parliament shall be briefed on, and shall acknowledge, their responsibilities regarding the protection of such information in accordance with Annex I. They shall also be briefed on the means of ensuring such protection.

7.    Officials of the European Parliament and other European Parliament employees working for political groups may consult confidential information if they have an established ‘need to know’, and may consult classified information above the level RESTREINT UE/EU RESTRICTED if they hold the appropriate level of security clearance. Access to classified information shall be granted only if they have been briefed on, and received written instructions concerning, their responsibilities regarding the protection of such information, as well as the means of ensuring such protection, and if they have signed a declaration acknowledging receipt of those instructions and undertaking to comply with them in accordance with the current rules.

Article 4  : Creation of confidential information and administrative handling by the European Parliament

1.    The President of the European Parliament, the chairs of the parliamentary committees concerned and the Secretary-General and/or any person duly authorised by him/her in writing may originate confidential information and/or classify information as provided for in the security notices.

2.    When creating classified information, the originator shall apply the appropriate level of classification in line with the international standards and definitions set out in Annex I. The originator shall also determine, as a general rule, the addressees who are to be authorised to consult the information commensurate to the level of classification. This information shall be communicated to the Classified Information Unit (CIU) when the document is deposited with the CIU.

3.    ‘Other confidential information’ covered by professional secrecy shall be dealt with in accordance with Annexes I and II and the handling instructions.

Article 5  : Reception of confidential information by the European Parliament

1.    Confidential information received by the European Parliament shall be communicated as follows:

(a)    information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’: to the secretariat of the parliamentary body/office-holder which submitted the request therefor, or directly to the CIU;

(b)    information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent: to the CIU.

2.    The registration, storage and traceability of confidential information shall be dealt with, as the case may be, either by the secretariat of the parliamentary body/office-holder who received the information or by the CIU.

3.    The agreed arrangements to be established by common accord with a view to preserving the confidentiality of the information, in the case of confidential information communicated by the Commission pursuant to point 3.2 of Annex II to the Framework Agreement, or in the case of classified information forwarded by the Council pursuant to Article 5(4) of the Interinstitutional Agreement, shall be deposited, together with the confidential information, at the secretariat of the parliamentary body/office-holder or at the CIU, as the case may be.

4.    The arrangements referred to in paragraph 3 may also be applied mutatis mutandis for the communication of confidential information by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States.

5.    In order to ensure a level of protection commensurate with the level of classification TRÈS SECRET UE/EU TOP SECRET or its equivalent, the Conference of Presidents shall set up an oversight committee. Information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent shall be communicated to the European Parliament subject to further arrangements, to be agreed between the European Parliament and the Union Institution from whom the information is received.

Article 6  : Communication of classified information by the European Parliament to third parties

The European Parliament may, subject to the prior written consent of the originator or the Union Institution, which has communicated the classified information to the European Parliament, as the case may be, forward such classified information to third parties, on condition that they ensure that, when such information is handled, rules equivalent to those laid down in this Decision are respected within their services and premises.

Article 7  : Secure facilities

1.    For the purposes of the management of confidential information, the European Parliament shall establish a Secure Area and Secure Reading Rooms.

2.    The Secure Area shall provide facilities for the registration, consultation, archiving, transmission and handling of classified information. It shall comprise, inter alia, a reading room and a meeting room for the consultation of classified information and shall be managed by the CIU.

3.    Outside the Secure Area, Secure Reading Rooms may be created, in order to allow for the consultation of information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent, and of ‘other confidential information’. Those Secure Reading Rooms shall be managed by the competent services of the secretariat of the parliamentary body/office-holder or by the CIU, as the case may be. They shall not contain photocopying machines, telephones, fax facilities, scanners or any other technical equipment for the reproduction or transmission of documents.

Article 8  : Registration, handling and storage of confidential information

1.    Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ shall be registered and stored by the competent services of the secretariat of the parliamentary body/office-holder or by the CIU, depending on who received the information.

2.    The following conditions shall apply to the handling of information classified at the level RESTREINT EU/EU RESTRICTED or its equivalent and ‘other confidential information’:

(a)    documents shall be handed over in person to the head of the secretariat, who shall register them and provide an acknowledgement of receipt;

(b)    when not actually being used, such documents shall be kept in a locked location, under the responsibility of the secretariat;

(c)    in no case may the information be saved on another medium or transmitted to any person. Such documents may only be duplicated by means of appropriately accredited equipment as defined in the security notices;

(d)    access to such information shall be restricted to those designated by the originator or by the Union Institution which communicated the information to the European Parliament, in accordance with the arrangements referred to in Article 4(2) or Article 5(3), (4) and (5);

(e)    the secretariat of the parliamentary body/office-holder shall keep a record of the persons who have consulted the information, and of the date and time of such consultation, and shall transmit the record to the CIU at the time when the information is deposited with the CIU.

3.    Information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent shall be registered, handled and stored by the CIU in the Secure Area, in accordance with the specific level of classification and as defined in the security notices.

4.    In the event of a breach of the rules set out in paragraphs 1 to 3, the responsible official of the secretariat of the parliamentary body/office-holder or of the CIU, as the case may be, shall inform the Secretary-General, who shall refer the matter to the President if a Member of the European Parliament is concerned.

Article 9  : Access to secure facilities

1.    Only the following persons shall have access to the Secure Area:

(a)    persons who, pursuant to Article 3(4) to (7), are authorised to consult the information held there and who have submitted an application pursuant to Article 10(1);

(b)    persons who, pursuant to Article 4(1), are authorised to create classified information and who have submitted an application pursuant to Article 10(1);

(c)    the European Parliament's officials of the CIU;

(d)    the European Parliament officials responsible for managing the CIS;

(e)    European Parliament officials responsible for security and fire safety, when necessary;

(f)    cleaning staff, but only in the presence of, and under close surveillance by, an official of the CIU.

2.    The CIU may deny access to the Secure Area to any person not authorised to enter. Any objection challenging such a denial of access shall be submitted to the President, in the case of a request for access by a Member of the European Parliament, and to the Secretary-General in other cases.

3.    The Secretary-General may authorise a meeting for a limited number of persons in the meeting room located within the Secure Area.

4.    Only the following persons shall have access to a Secure Reading Room:

(a)    Members of the European Parliament, officials of the European Parliament and other European Parliament employees working for political groups, duly identified for the purposes of consultation or creation of confidential information;

(b)    the European Parliament officials responsible for managing the CIS, officials of the secretariat of the parliamentary body/office-holder which received the information, and officials of the CIU;

(c)    where necessary, European Parliament officials responsible for security and fire safety;

(d)    cleaning staff, but only in the presence of, and under close surveillance by, an official working in the secretariat of the parliamentary body/office-holder or in the CIU, as the case may be.

5.    The competent secretariat of the parliamentary body/office-holder or the CIU, as the case may be, may deny access to a Secure Reading Room to any person not authorised to enter. Any objection challenging such a denial of access shall be submitted to the President, in the case of a request for access by a Member of the European Parliament, and to the Secretary-General in other cases.

Article 10  : Consultation or creation of confidential information in secure facilities

1.    Any person wishing to consult or create confidential information in the Secure Area shall communicate his or her name in advance to the CIU. The CIU shall check the identity of that person and verify whether he or she is permitted, in accordance with Article 3(3) to (7), Article 4(1) or Article 5(3), (4) and (5) to consult or create confidential information.

2.    Any person wishing, in accordance with Article 3(3) and (7), to consult confidential information classified at the level RESTREINT EU/EU RESTRICTED or its equivalent or ‘other confidential information’ in a Secure Reading Room shall communicate his or her name in advance to the competent services of the secretariat of the parliamentary body/office-holder or to the CIU.

3.    Save in exceptional circumstances (e.g. where numerous requests for consultation are submitted within a short period of time), only one person at a time shall be authorised to consult confidential information in a secure facility, in the presence of an official of the secretariat of the parliamentary body/office-holder or of the CIU.

4.    During the consultation process, contact with the exterior (including by means of telephones or other technological devices), the taking of notes and the photocopying or photographing of the confidential information consulted shall be prohibited.

5.    Before authorising a person to leave the secure facility, the official of the secretariat of the parliamentary body/office-holder or of CIU shall check that the confidential information consulted is still present, intact and complete.

6.    In the event of a breach of the rules set out above, the official of the secretariat of the parliamentary body/office-holder or of the CIU shall inform the Secretary-General, who shall refer the matter to the President where a Member of the European Parliament is concerned.

Article 11  : Minimum standards for consultation of confidential information at a meeting in camera outside secure facilities

1.    Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ may be consulted by members of parliamentary committees or of other political and administrative bodies of the European Parliament at a meeting in camera outside the secure facilities.

2.    In the circumstances provided for in paragraph 1, the secretariat of the parliamentary body/office-holder responsible for the meeting shall ensure that the following conditions are complied with:

(a)    only the persons designated by the chair of the competent committee or body to participate in the meeting are allowed to enter the meeting room;

(b)    all documents are numbered, distributed at the beginning of the meeting and collected again at the end, and no notes of those documents and no photocopies or photographs thereof are taken;

(c)    the minutes of the meeting make no mention of the content of the discussion of the information considered. Only the relevant decision, if any, may be recorded;

(d)    confidential information provided orally to recipients in the European Parliament is subject to a level of protection equivalent to that applied to confidential information in written form;

(e)    no additional stock of documents is held in meeting rooms;

(f)    copies of documents are distributed only in the requisite numbers to participants and interpreters at the start of the meeting;

(g)    the classification/marking status of the documents is made clear by the chair of the meeting at the start of the meeting;

(h)    participants do not remove documents from the meeting room;

(i)    all copies of documents are collected and accounted for at the end of the meeting by the secretariat of the parliamentary body/office-holder; and

(j)    no electronic communication devices or other electronic devices are taken into the meeting room where the confidential information in question is consulted or discussed.

3.    Where, in accordance with the exceptions laid down in point 3.2.2 of Annex II to the Framework Agreement and in Article 6(5) of the Interinstitutional Agreement, information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent is discussed at a meeting held in camera, the secretariat of the parliamentary body/office-holder responsible for the meeting shall, in addition to ensuring compliance with the provisions laid down in paragraph 2, ensure that the persons designated to participate in the meeting comply with the requirements of Article 3(4) and (7).

4.    In the case provided for in paragraph 3, the CIU shall provide to the secretariat of the parliamentary body/office-holder-responsible for the meeting in camera the requisite number of copies of the documents to be discussed, which shall be returned to the CIU after the meeting.

Article 12  : Archiving of confidential information

1.    Secure archiving facilities shall be provided within the Secure Area. The CIU shall be responsible for managing the secure archive in accordance with standard archiving criteria.

2.    Classified information definitively deposited with the CIU, and information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent which is deposited with the secretariat of the parliamentary body/office-holder, shall be transferred to the secure archive in the Secure Area six months after it was last consulted and, at the latest, one year after it was deposited. ‘Other confidential information’ shall be archived, unless deposited with the CIU, by the secretariat of the parliamentary body/office-holder concerned, in accordance with the general rules on document management.

3.    Confidential information held in the secure archive may be consulted subject to the following conditions:

(a)    only those persons identified by name, by function or by office in the accompanying document drawn up when the confidential information was deposited shall be authorised to consult that information;

(b)    the application to consult confidential information shall be submitted to the CIU, which shall transfer the document in question to the Secure Reading Room; and

(c)    the procedures and conditions governing the consultation of confidential information set out in Article 10 shall apply.

Article 13  : Downgrading, declassification and unmarking of confidential information

1.    Confidential information may be downgraded, declassified or unmarked only with the prior consent of the originator, and, if necessary, after discussion with other interested parties.

2.    Downgrading or declassification shall be confirmed in writing. The originator shall be responsible for informing its addressees of the change, and they in turn shall be responsible for informing any subsequent addressees to whom they have sent or copied the document, of the change. If possible, originators shall specify on classified documents a date, period or event when the contents may be downgraded or declassified. Otherwise, they shall keep the documents under review every five years, at the latest, in order to ensure that the original classification is necessary.

3.    Confidential information held in the secure archives shall be examined in good time, and by no later than the 25th anniversary of its creation, in order to determine whether or not it should be declassified, downgraded or unmarked. The examination and publication of such information shall take place in accordance with the provisions of Council Regulation (EEC, Euratom) No 354/83 of 1 February 1983 concerning the opening to the public of the historical archives of the European Economic Community and the European Atomic Energy Community (22). Declassification shall be effected by the originator of the classified information or the service currently responsible in accordance with Annex I, Part 1, Section 10.

4.    Following declassification, formerly classified information held in the secure archive shall be transferred to the historical archives of the European Parliament for permanent preservation and further treatment under the applicable rules.

5.    Following unmarking, formerly ‘other confidential information’ shall be subject to the European Parliament rules on document management.

Article 14  : Breaches of security, loss or compromise of confidential information

1.    A breach of confidentiality in general, and of this Decision in particular, shall in the case of Members of the European Parliament entail the application of the relevant provisions concerning penalties set out in the European Parliament's Rules of Procedure.

2.    A breach committed by a member of staff of the European Parliament shall lead to the application of the procedures and penalties provided for by, respectively, the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Union, laid down in Regulation (EEC, Euratom, ECSC) No 259/68 (23) (‘the Staff Regulations’).

3.    The President and/or the Secretary-General, as the case may be, shall organise any necessary investigations in the event of a breach as defined in security notice 6.

4.    If the confidential information was communicated to the European Parliament by a Union Institution or by a Member State, the President and/or the Secretary-General, as the case may be, shall inform the Union Institution or Member State concerned of any proven or suspected loss or compromise of classified information, of the results of the investigation and of the measures taken to prevent a recurrence.

Article 15  : Adaptation of this Decision and its implementing rules and annual reporting on the application of this Decision

1.    The Secretary-General shall propose any necessary adaptation of this Decision and the annexes implementing it and shall forward those proposals to the Bureau for decision.

2.    The Secretary-General shall be responsible for the implementation of this Decision by the European Parliament's services and shall issue the handling instructions on matters covered by the ISMS in accordance with the principles laid down by this Decision.

3.    The Secretary-General shall submit an annual report to the Bureau on the application of this Decision.

Article 16  : Transitional and final provisions

1.    Non classified information held in the CIU or in any other archive of the European Parliament which is considered as confidential and dated before 1 April 2014 shall be deemed, for the purpose of this Decision, to constitute ‘other confidential information’. Its originator may at any time reconsider the level of its confidentiality.

2.    By way of derogation from point (a) of Article 5(1) and from Article 8(1) of this Decision, for a period of twelve months from 1 April 2014, information provided by the Council pursuant to the Interinstitutional Agreement which is classified at the level RESTREINT UE/EU RESTRICTED or its equivalent shall be deposited with, registered by and stored in the CIU. Such information may be consulted in accordance with points (a) and (c) of Article 4(2) and with Article 5(4) of the Interinstitutional Agreement.

3.    The decision of the Bureau of 6 June 2011 concerning the rules governing the treatment of confidential information by the European Parliament is repealed.

Article 17  : Entry into force

This Decision shall enter into force on the day of its publication in the Official Journal of the European Union.

Annex I    

PART 1:    BASIC PRINCIPLES AND MINIMUM STANDARDS OF SECURITY FOR THE PROTECTION OF CONFIDENTIAL INFORMATION

1.     INTRODUCTION

These provisions set out the basic principles and minimum standards of security for the protection of confidential information to be respected and/or complied with by the European Parliament in all its places of employment, including by all recipients of, classified information and ‘other confidential information’ so that security is safeguarded and all persons concerned may be assured that a common standard of protection is established. These provisions are supplemented by the security notices contained in Annex II and by other provisions governing the treatment of confidential information by parliamentary committees and other parliamentary bodies/office-holders.

2.     BASIC PRINCIPLES

The European Parliament's security policy forms an integral part of its general internal management policy and is thus based on the principles governing that general policy. Those principles include legality, transparency, accountability, subsidiarity and proportionality.

Legality entails the need to remain strictly within the legal framework in the performance of security functions, and to conform to the applicable legal requirements. Furthermore, responsibilities in the field of security must be based on proper legal provisions. The provisions of the Staff Regulations, in particular Article 17 thereof on the obligation of staff to refrain from any unauthorised disclosure of information received in the line of duty and Title VI thereof on disciplinary measures, are fully applicable. Finally, breaches of security within the responsibility of the European Parliament shall be dealt with in a manner consistent with its Rules of Procedure and its policy on disciplinary measures.

Transparency entails the need for clarity regarding all security rules and provisions, for a balance between the different services and the different domains (physical security as compared to the protection of information, etc.), and for a consistent and structured security awareness policy. Moreover, clear written guidelines are necessary for the implementation of security measures.

Accountability means that responsibilities in the field of security must be clearly defined. Moreover, it entails the need regularly to monitor whether those responsibilities have been properly fulfilled.

Subsidiarity means that security must be organised at the lowest possible level and as closely as possible to the European Parliament's Directorates-General and services.

Proportionality means that security activities must be strictly limited to those which are absolutely necessary and that security measures must be proportional to the interests to be protected as well as to the actual or potential threat to those interests, so as to enable those interests to be defended in a manner ensuring the least possible disruption.

3.     FOUNDATIONS OF INFORMATION SECURITY

The foundations of sound information security are:

(a)    proper communication and information systems (CIS). These fall within the responsibility of the European Parliament's Security Authority (as defined in security notice 1);

(b)    within the European Parliament, the Information Assurance Authority (as defined in security notice 1) responsible for working with the Security Authority to provide information and advice on technical threats to CIS and the means of protecting against those threats;

(c)    close cooperation between the European Parliament's responsible services and the security services of the other Union institutions;

4.     PRINCIPLES OF INFORMATION SECURITY

4.1.     Objectives

The principle objectives of information security are as follows:

(a)    to safeguard confidential information against espionage, compromise or unauthorised disclosure;

(b)    to safeguard classified information handled in communications and information systems and networks against threats to its confidentiality, integrity and availability;

(c)    to safeguard European Parliament premises housing classified information against sabotage and malicious wilful damage;

(d)    in the event of a security failure, to assess the damage caused, limit the consequences, conduct security investigations and adopt any necessary remedial measures.

4.2.     Classification

4.2.1.     Where confidentiality is concerned, care and experience are needed in the selection of the information and material to be protected as well as in assessing the degree of protection required. It is essential that the degree of protection should correspond to the sensitivity, in terms of security, of the individual item of information or material to be safeguarded. In order to ensure the smooth flow of information, both over-classification and under-classification shall be avoided.

4.2.2.     The classification system is the instrument for putting into effect the principles set out in this section. A similar classification system shall be followed in planning and organising ways to counter espionage, sabotage, terrorism and other threats, in order to ensure maximum protection for the most important premises housing classified information and the most sensitive points within those premises.

4.2.3.     Responsibility for classifying information lies solely with the originator of the information concerned.

4.2.4.     The level of classification may be based solely on the content of the information concerned.

4.2.5.     Where several items of information are grouped together, their classification shall be at least as high as the highest classification level assigned to one of its individual items. However, a collection of information may be assigned a higher classification than its constituent parts.

4.2.6.     Classifications shall be assigned only when necessary and for as long as necessary.

4.3.     Aims of security measures

The security measures shall:

(a)    extend to all persons having access to classified information, media carrying classified information and ‘other confidential information’, as well as all premises containing such information and important installations;

(b)    be designed in such a way as to identify persons whose position (in terms of access, relationships or otherwise) might jeopardise the security of such information and of important installations housing such information, and provide for their exclusion or removal;

(c)    prevent unauthorised persons from having access to such information or to installations containing it;

(d)    ensure that such information is disseminated solely on the basis of the need-to-know principle, which is fundamental to all aspects of security;

(e)    ensure the integrity (by preventing corruption, unauthorised alteration or unauthorised deletion) and the availability (to those needing and authorised to have access thereto) of confidential information, especially where it is stored, processed or transmitted in electromagnetic form.

5.     COMMON MINIMUM STANDARDS

The European Parliament shall ensure that common minimum standards of security are observed by all recipients of classified information, both inside the institution and under its competence, namely all its services and contractors, so that such information can be passed on in the confidence that it will be handled with equal care. Such minimum standards shall include criteria for the security clearance of officials of the European Parliament and other Parliament employees working for political groups, and procedures for the protection of confidential information.

The European Parliament shall allow third parties access to such information only when such third parties guarantee that it is handled in accordance with provisions that are at least strictly equivalent to these common minimum standards.

Such common minimum standards shall also be applied when, pursuant to a contract or grant, the European Parliament entrusts to industrial or other entities tasks involving confidential information.

6.     SECURITY AS REGARDS OFFICIALS OF THE EUROPEAN PARLIAMENT AND OTHER PARLIAMENT EMPLOYEES WORKING FOR POLITICAL GROUPS

6.1.     Security instructions as regards officials of the European Parliament and other Parliament employees working for political groups

Officials of the European Parliament and other Parliament employees working for political groups in positions where they could have access to classified information shall be given thorough instructions, both on taking up their duties and at regular intervals thereafter, on the need for security and the procedures involved. Such persons shall be required to confirm in writing that they have read and fully understand the applicable security provisions.

6.2.     Management responsibilities

It must be part of the duties of managers to know which of their staff are engaged in work on classified information or have access to secure communication or information systems, and to record and report any incidents or apparent vulnerabilities which are likely to affect security.

6.3.     Security status of officials of the European Parliament and other Parliament employees working for political groups

Procedures shall be established to ensure that, when adverse information becomes known concerning an official of the European Parliament or other Parliament employee working for a political group, steps are taken to determine whether that individual's work brings him or her into contact with classified information or whether he or she has access to secure communication or information systems, and that the European Parliament's responsible service is informed. If the competent National Security Authority indicates that such an individual constitutes a security risk, he or she shall be barred or removed from assignments where he or she might endanger security.

7.     PHYSICAL SECURITY

‘Physical security’ means the application of physical and technical protective measures to prevent unauthorised access to classified information.

7.1.     Need for protection

The degree of physical security measures to be applied to ensure the protection of classified information shall be proportionate to the classification and volume of, and the threat to, the information and material held. All holders of classified information shall follow uniform practices regarding classification of such information and must meet common standards of protection regarding the custody, transmission and disposal of information and material requiring protection.

7.2.     Checking

Before leaving areas containing classified information unattended, persons having custody thereof shall ensure that it is securely stored and that all security devices have been activated (locks, alarms, etc.). Further independent checks shall be carried out after working hours.

7.3.     Security of buildings

Buildings housing classified information or secure communication and information systems shall be protected against unauthorised access.

The nature of the protection afforded to classified information, e.g. barring of windows, locks for doors, guards at entrances, automated access control systems, security checks and patrols, alarm systems, intrusion detection systems and guard dogs, shall depend on:

(a)    the classification, volume and location within the building of the information and material to be protected;

(b)    the quality of the security containers for the information and material concerned; and

(c)    the physical nature and location of the building.

The nature of the protection afforded to communication and information systems shall depend on an assessment of the value of the assets at stake and of the potential damage if security were to be compromised, on the physical nature and location of the building in which the system is housed, and on the location of that system within the building.

7.4.     Contingency plans

Detailed plans shall be in place in advance to ensure the protection of classified information in the event of an emergency.

8.     SECURITY DESIGNATORS, MARKINGS, AFFIXING AND CLASSIFICATION MANAGEMENT

8.1.     Security designators

No classifications other than those defined in point (d) of Article 2 of this Decision are permitted.

An agreed security designator may be used to set limits to the validity of a classification (for classified information signifying automatic downgrading or declassification).

Security designators shall only be used in combination with a classification.

Security designators are further regulated in security notice 2 and defined in the handling instructions.

8.2.     Markings

A marking is used to specify predefined specific instructions about the handling of confidential information. Markings may also indicate the field covered by a given document, a particular distribution on a need-to-know basis, or (for non-classified information) to signify the end of an embargo.

A marking is not a classification and shall not be used in lieu of one.

Markings are further regulated in security notice 2 and defined in the handling instructions.

8.3.     Affixing of classifications and of security designators

Affixing of classifications and security designators and markings shall be done in accordance with security notice 2, section E, and the handling instructions.

8.4.     Classification management

8.4.1     General

Information shall be classified only when necessary. The classification shall be clearly and correctly indicated, and shall be maintained only as long as the information requires protection.

The responsibility for classifying information and for any subsequent downgrading or declassification rests solely with the originator.

Officials of the European Parliament shall classify, downgrade or declassify information on instructions from or pursuant to a delegation from the Secretary-General.

The detailed procedures for the treatment of classified documents shall be so framed as to ensure that they are afforded protection appropriate to the information which they contain.

The number of persons authorised to originate information classified at the level TRÈS SECRET UE/EU TOP SECRET' shall be kept to a minimum, and their names shall be recorded on a list drawn up by the CIU.

8.4.2     Application of classification

The classification of a document shall be determined by the level of sensitivity of its contents in accordance with the definitions contained in point (d) of Article 2. It is important that classifications be assigned correctly and used sparingly.

The classification of a letter or note containing enclosures shall be at least as high as the highest classification assigned to one of its enclosures. The originator shall indicate clearly the level at which the letter or note should be classified when detached from its enclosures.

The originator of a document that is to be given a classification shall follow the rules set out above and shall avoid over-classification or under-classification.

Individual pages, paragraphs, sections, annexes, appendices, attachments and enclosures of a given document may require different classifications and shall be classified accordingly. The classification of the document as a whole shall be that of its most highly classified part.

9.     INSPECTIONS

Periodic internal inspections of security arrangements for the protection of classified information shall be carried out by the European Parliament's Directorate for Security and Risk Assessment, which may request assistance from the Security Authorities of the Council or of the Commission.

The Security Authorities and competent services of the Union Institutions may carry out, as part of an agreed process initiated by either side, peer evaluations of the security arrangements for the protection of classified information exchanged under the relevant interinstitutional agreements.

10.     DECLASSIFICATION AND UNMARKING PROCEDURES

10.1.     The CIU shall examine confidential information contained in its Register and seek the consent of the originator to the declassification or unmarking of a document by no later than the 25th anniversary of its creation. Documents not declassified or unmarked at the first examination shall be re-examined periodically and at least every five years. In addition to being applied to documents actually located in the secure archives in the Secure Area and duly classified, the unmarking process may also cover other confidential information held either in the parliamentary body/office or in the service in charge of the Parliament's historical archives.

10.2.     The decision with regard to the declassification or unmarking of a document shall, as a general rule, be taken solely by the originator or, exceptionally, in cooperation with the parliamentary body/office-holder of such information, before the information which it contains is transferred to the service in charge of the Parliament's historical archives. Classified information may only be declassified or unmarked with the prior written consent of the originator. In the case of ‘other confidential information’, the secretariat of the parliamentary body/office-holder of such information shall, in cooperation with the originator, decide whether the document can be unmarked.

10.3.     On behalf of the originator, the CIU shall be responsible for informing the addressees of the document of the change to the classification or marking, and they in turn shall be responsible for informing any subsequent addressees to whom they have sent or copied the document.

10.4.     Declassification shall not affect any security designators or markings which may appear on the document.

10.5.     In the case of declassification, the original classification at the top and bottom of every page shall be crossed out. The first (cover) page of the document shall be stamped and completed with the reference of the CIU. In the case of unmarking, the original marking at the top of every page shall be crossed out.

10.6.     The text of the declassified or unmarked document shall be attached to the electronic fiche or equivalent system where it has been registered.

10.7.     In the case of documents covered by the exception relating to privacy and the integrity of the individual or commercial interests of a natural or legal person and in the case of sensitive documents, Article 2 of Regulation (EEC, Euratom) No 354/83 shall apply.

10.8    In addition to the provisions of points 10.1 to 10.7, the following rules shall apply:

(a)    as regards third-party documents, the CIU shall consult the third party concerned before proceeding to carry out the declassification or unmarking;

(b)    as regards the exception relating to privacy and the integrity of the individual, the declassification or unmarking procedure shall take into account, in particular, the agreement of the person concerned or, as the case may be, the impossibility of identifying the person concerned;

(c)    as regards the exception relating to commercial interests of a natural or legal person, the person concerned may be notified via publication in the Official Journal of the European Union and given four weeks from the date of that publication in which to submit remarks.

PART 2:    SECURITY CLEARANCE PROCEDURE

11.     SECURITY CLEARANCE PROCEDURE FOR MEMBERS OF THE EUROPEAN PARLIAMENT

11.1.     In order to have access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent, Members of the European Parliament shall have been authorised either in accordance with the procedure referred to in points 11.3 and 11.4 of this Annex or on the basis of a solemn declaration of non-disclosure pursuant to Article 3(4) of this Decision.

11.2.     In order to have access to information classified at the level SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent, Members of the European Parliament shall have been authorised in accordance with the procedure referred to in points 11.3 and 11.14.

11.3     Authorisation shall be granted only to Members of the European Parliament who have undergone security screening by the competent national authorities of the Member States in accordance with the procedure referred to in points 11.9 to 11.14. The President shall be responsible for granting the authorisation for Members.

11.4.     The President may grant written authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with points 11.8 to 11.13.

11.5.     The European Parliament's Directorate for Security and Risk Assessment shall maintain an up-to-date list of all Members of the European Parliament who have been granted authorisation, including provisional authorisation within the meaning of point 11.15.

11.6.     Authorisation shall be valid for a period of five years or for the duration of the tasks in respect of which it was granted, whichever is the shorter. It may be renewed in accordance with the procedure laid down in point 11.4.

11.7.     Authorisation shall be withdrawn by the President where he/she considers that there are justified grounds for such withdrawal. Any decision to withdraw authorisation shall be notified to the Member of the European Parliament concerned, who may ask to be heard by the President before the withdrawal takes effect, and to the competent national authority.

11.8.     Security screening shall be carried out with the assistance of the Member of the European Parliament concerned and at the request of the President. The competent national authority for screening shall be that of the Member State of which the Member concerned is a national.

11.9.     As part of the screening procedure, the Member of the European Parliament concerned shall be required to complete a personal information form.

11.10.     The President shall specify in his/her request to the competent national authority the level of classified information to be made available to the Member of the European Parliament concerned, so that it may carry out the screening process.

11.11.     The entire security-screening process carried out by the competent national authority, together with the results obtained, shall be in accordance with the relevant rules and regulations in force in the Member State concerned, including those concerning appeals.

11.12.     Where the competent national authority gives a positive opinion, the President may grant the Member of the European Parliament concerned authorisation.

11.13.     A negative opinion by the competent national authority shall be notified to the Member of the European Parliament concerned, who may ask to be heard by the President. Should he/she consider it necessary, the President may ask the competent national authority for further clarification. If the negative opinion is confirmed, authorisation shall not be granted.

11.14.     All Members of the European Parliament who are granted authorisation within the meaning of point 11.3 shall, at the time when the authorisation is granted and at regular intervals thereafter, receive any necessary guidelines concerning the protection of classified information and the means of ensuring such protection. Such Members shall sign a declaration acknowledging receipt of those guidelines.

11.15.     In exceptional circumstances, the President may, after notifying the competent national authority and provided that no reaction is received from that authority within one month, grant provisional authorisation to a Member of the European Parliament for a period not exceeding six months, pending the outcome of the screening referred to in point 11.11. Provisional authorisations thus granted shall not give access to information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent.

12.     SECURITY CLEARANCE PROCEDURE FOR OFFICIALS OF THE EUROPEAN PARLIAMENT AND OTHER PARLIAMENT EMPLOYEES WORKING FOR POLITICAL GROUPS

12.1.     Only officials of the European Parliament and other Parliament employees working for political groups who, by reason of their duties and the requirements of the service, need to have knowledge of, or to use, classified information may have access thereto.

12.2.     In order to have access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET, or TRÈS SECRET UE/EU TOP SECRET, or its equivalent, the officials of the European Parliament and other Parliament employees working for political groups concerned shall have been authorised in accordance with the procedure laid down in points 12.3 and 12.4.

12.3.     Authorisation shall be granted only to the persons referred to in point 12.1 who have undergone security screening by the competent national authorities of the Member States in accordance with the procedure referred to in points 12.9 to 12.14. The Secretary-General shall be responsible for granting the authorisation for officials of the European Parliament and other Parliament employees working for political groups.

12.4.     The Secretary General may grant written authorisation after obtaining the opinion of the competent national authorities of the Member States on the basis of security screening carried out in accordance with points 12.8 to 12.13.

12.5.     The European Parliament's Directorate for Security and Risk Assessment shall maintain an up-to-date list of all posts requiring a security clearance, as provided by the relevant European Parliament services, and of all persons who have been granted authorisation, including provisional authorisation within the meaning of point 12.15.

12.6.     Authorisation shall be valid for a period of five years or for the duration of the tasks in respect of which it was granted, whichever is the shorter. It may be renewed in accordance with the procedure referred to in point 12.4.

12.7.     Authorisation shall be withdrawn by the Secretary-General where he/she considers that there are justifiable grounds for such withdrawal. Any decision to withdraw authorisation shall be notified to the official of the European Parliament or other Parliament employee working for a political group concerned, who may ask to be heard by the Secretary-General before the withdrawal takes effect, and to the competent national authority.

12.8.     Security screening shall be carried out with the assistance of the official of the European Parliament or other Parliament employee working for political groups concerned and at the request of the Secretary-General. The competent national authority for screening shall be that of the Member State of which the person concerned is a national. Where permissible under national laws and regulations, the competent national authorities may conduct investigations in respect of non-nationals who require access to information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET.

12.9.     As part of the screening procedure, the official of the European Parliament or other Parliament employee working for a political group concerned shall be required to complete a personal information form.

12.10.     The Secretary-General shall specify in his/her request to the competent national authority the level of classified information to be made available to the official of the European Parliament or other Parliament employee working for political groups concerned, so that it may carry out the screening process and give its opinion as to the level of authorisation appropriate to be granted to that person.

12.11.     The entire security-screening process carried out by the competent national authority, together with the results obtained, shall be in accordance with the relevant rules and regulations in force in the Member State concerned, including those concerning appeals.

12.12.     Where the competent national authority gives a positive opinion, the Secretary-General may grant the official of the European Parliament or other Parliament employee working for political groups concerned authorisation.

12.13.     A negative opinion by the competent national authority shall be notified to the official of the European Parliament or other Parliament employee working for a political group concerned, who may ask to be heard by the Secretary-General. Should he/she consider it necessary, the Secretary-General may ask the competent national authority for further clarification. If the negative opinion is confirmed, authorisation shall not be granted.

12.14.     All officials of the European Parliament and other Parliament employees working for political groups who are granted authorisation within the meaning of points 12.4 and 12.5 shall, at the time when the authorisation is granted and at regular intervals thereafter, receive any necessary instructions concerning the protection of classified information and the means of ensuring such protection. Such officials and employees shall sign a declaration acknowledging receipt of those instructions and give an undertaking to obey them.

12.15.     In exceptional circumstances, the Secretary-General may, after notifying the competent national authority and provided that no reaction is received from that authority within one month, grant provisional authorisation to an official of the European Parliament or other Parliament employee working for a political group for a period not exceeding six months, pending the outcome of the screening referred to in point 12.11. Provisional authorisations thus granted shall not give access to information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent.

Annex II     (24)

F.    Personal conflicts of interest

With the approval of the Bureau, a Member may, on the basis of a reasoned decision, be denied the right to inspect a Parliament document if, after having heard the Member concerned, the Bureau comes to the conclusion that such inspection would cause unacceptable damage to Parliament’s institutional interests or to the public interest, and that the Member concerned is seeking to inspect the document for private and personal reasons. The Member may lodge a written appeal, which must include reasons, against such a decision within one month of notification thereof. Parliament shall reach a decision on the appeal without debate during the part-session that follows its being lodged.