Commission Decision of 29 November 2001 amending its internal Rules of Procedure (notified under document number C(2001) 3031) (2001/844/EC, ECSC, Euratom) (repealed)

Appendix 4 Guidelines for the release of EU classified information to third States or international organisations: Level 2 cooperation

PROCEDURES U.K.

1. The authority to release EU classified information to third States or international organisations whose security policy and regulations are markedly different from EU's lies with the originator. The authority to release EUCI created within the Commission lies with the Commission as a college. U.K.

2. In principle, it is restricted to information classified up to and including [F1 SECRET UE]; it excludes classified information protected by special security designators or markings. U.K.

Textual Amendments

F1 Substituted by Commission Decision of 3 February 2005 amending Decision 2001/844/EC, ECSC, Euratom (2005/94/EC, Euratom).

3. Pending the conclusion of a security agreement, the Member of the Commission responsible for security matters is competent to examine requests for the release of EU classified information. U.K.

4. In doing so he/she: U.K.

• Shall seek the opinions of the originators of the EUCI to be released;

• Shall establish the necessary contacts with the security bodies of the beneficiary States or international organisations to find out information on their security policy and provisions, and in particular to draw up a table comparing the classifications applicable in the EU and in the State or organisation concerned;

• Shall arrange for a meeting of the Commission Security Policy Advisory Group or, under a silent procedure if necessary, enquire from the member States' National Security Authorities with a view to obtaining the Commission Security Policy Advisory Group's opinion.

5. The Commission Security Policy Advisory Group's opinion shall be on the following: U.K.

• The confidence that can be placed in the beneficiary States or international organisations with a view to assessing the security risks incurred by the EU or its Member States;

• An assessment of the beneficiaries' ability to protect classified information released by EU;

• Proposals as to practical procedures for the handling of the EU classified information (providing expurgated versions of a text, for example) and documents transmitted (retaining or deleting EU classification headings, specific markings, etc.);

• Downgrading or declassification before the information is released to the beneficiary countries or international organisations.

6. The Member of the Commission responsible for security matters shall forward the request and the Commission Security Policy Advisory Group's opinion to the Commission for a decision. U.K.

SECURITY RULES TO BE APPLIED BY BENEFICIARIES U.K.

7. The Member of the Commission responsible for security matters shall notify the beneficiary States or international organisations of the Commission's decision to authorise the release of EU classified information and of its restrictions. U.K.

8. The decision to release shall come into force only when the beneficiaries have given a written assurance that they will: U.K.

• Use the information for no other than the agreed purposes;

• Protect the information in accordance with the provisions laid down by the Commission.

9. The following rules of protection shall apply unless the Commission, having obtained the Commission Security Policy Advisory Group's technical opinion, decides on a particular procedure for the handling of EU classified documents (deleting mention of the EU classification, specific marking, etc.). U.K.

10. Personnel U.K.

(a)

The number of officials having access to EU classified information shall be strictly limited, based on the need-to-know principle, to those persons whose duties require such access;

(b)

All officials or nationals authorised to have access to the classified information released by the Commission shall have a national security clearance or authorisation for access, to an appropriate level equivalent to that of the EU, as defined in the comparative table;

(c)

These national security clearances or authorisations shall be forwarded to the [F2 Director of the Commission Security Directorate] for information.

Textual Amendments

F2 Substituted by Commission Decision of 31 January 2006 amending Decision 2001/844/EC, ECSC, Euratom (2006/70/EC, Euratom).

11. Transmission of documents U.K.

The practical procedures for the transmission of documents shall be decided by agreement. Pending the conclusion of such an agreement the provisions of Section 21 shall apply. The agreement shall in particular specify the registries to which EU classified information is to be forwarded and the precise addresses to which the documents shall be forwarded as well as the courier or mail services used for the transmission of the EU classified information.

12. Registration on arrival U.K.

The addressee State's NSA or its equivalent in the State receiving on behalf of its government the classified information forwarded by the Commission, or the security bureau of the recipient international organisation, shall open a special register to record EU classified information on its receipt. The Register shall contain columns indicating the date received, particulars of the document (date, reference and copy number), its classification, title, the addressee's name or title, the date of return of the receipt and the date of return of the document to EU or its destruction.

13. Return of documents U.K.

When the recipient returns a classified document to the Commission, it shall proceed as indicated in the paragraph ‘Transmission of documents’ above.

14. Protection U.K.

(a)

When the documents are not in use, they shall be stored in a security container that is approved for the storage of nationally-classified material of the same classification. The container shall bear no indication of its contents, which shall be accessible only to persons authorised to handle EU classified information. Where combination locks are used, the combination shall be known only to those officials in the State or organisation having authorised access to the EU classified information stored in the container and shall be changed every six months, or sooner on the transfer of an official, on withdrawal of the security clearance of one of the officials knowing the combination or if there is a risk of compromise.

(b)

EU classified documents shall be removed from the security container only by those officials cleared for access to the EU classified documents and having need-to-know. They shall remain responsible for the safe custody of those documents as long as they are in their possession and, in particular, for ensuring that no unauthorised person has access to the documents. They shall also ensure that the documents are stored in a security container when they have finished consulting them and outside working hours.

(c)

No photocopies shall be made of a document classified [F1 CONFIDENTIEL UE] or above, nor extracts taken, without the authorisation of the [F2 Commission Security Directorate].

(d)

The procedure for the rapid and total destruction of the documents in an emergency shall be defined and confirmed with the [F2 Commission Security Directorate].

15. Physical security U.K.

(a)

When not in use, security containers used for storage of EU classified documents shall be kept locked at all times;

(b)

When it is necessary for maintenance or cleaning staff to enter or work in a room which houses such security containers, they shall be escorted at all times by a member of the State's or organisation's security service or by the official more specifically responsible for supervising the security of the room;

(c)

Outside normal working hours (at night, at weekends and on public holidays) the security containers containing EU classified documents shall be protected either by a guard or by an automatic alarm system.

16. Breaches of security U.K.

When a breach of security involving a EU classified document has taken place or is suspected, the following action shall be taken immediately:

(a)

Forward a report immediately to the [F2 Commission Security Directorate] or the NSA of the Member State that has taken the initiative in forwarding documents (with a copy to the [F2 Commission Security Directorate]);

(b)

Conduct an enquiry, on completion of which a full report shall be submitted to the security body (see (a) above). The requisite measures to remedy the situation shall then be adopted.

17. Inspections U.K.

The [F2 Commission Security Directorate] shall be permitted, by agreement with the States or international organisations concerned, to carry out an assessment of the effectiveness of measures for the protection of the EU classified information released.

18. Reporting U.K.

Subject to the conclusion of a security agreement, as long as the State or international organisation holds EU classified information, it shall submit a yearly report, by a date specified when the authorisation to release the information is given, confirming that these security provisions have been complied with.