Council Decision 2009/968/JHAShow full title

CHAPTER III GENERAL PRINCIPLES

Article 10 Basic protection level, classification levels and security packages

1. All information processed by or through Europol, with the exception of information which is expressly marked or is clearly recognisable as being public information, shall be subject to a basic protection level within Europol and in Member States.

2. In accordance with Article 3, Member States shall ensure the application of the basic protection level referred to in paragraph 1, by a variety of measures in accordance with national legislation and regulations, including the obligation of discretion and confidentiality, limiting access to information to authorised personnel, data protection requirements as far as personal data are concerned and general technical and procedural measures to safeguard the security of the information, taking into account Article 41(2) of the Europol Decision.

3. Information requiring additional security measures shall be subject to a Europol classification level, which shall be indicated by a specific marking. Information shall be subject to a security level only where strictly necessary and only for the time necessary.

4. The following Europol classification levels shall be used:

(a) ‘RESTREINT UE/EU RESTRICTED’

:

this classification shall be applied to information and material the unauthorised disclosure of which could be disadvantageous to the interests of Europol, the EU or one or more Member States;

(b) ‘CONFIDENTIEL UE/EU CONFIDENTIAL’

:

this classification shall be applied to information and material the unauthorised disclosure of which could harm the essential interests of Europol, the EU or one or more Member States;

(c) ‘SECRET UE/EU SECRET’

:

this classification shall be applied to information and material the unauthorised disclosure of which could seriously harm the essential interests of Europol, the EU or one or more Member States;

(d) ‘TRÈS SECRET UE/EU TOP SECRET’

:

this classification shall be applied to information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of Europol, the EU or one or more Member States.

Such classified information and material shall bear an additional marking (‘EUROPOL’) under the classification marking to indicate that it originates in Europol.

Each Europol classification level shall relate to a specific security package, to be applied within Europol. The security packages shall offer different levels of protection, depending on the content of the information, and taking account of the detrimental effect which unauthorised access, dissemination or use of the information might have on the interests of Europol or the Member States.

When information classified at different levels is gathered, the classification level to be applied shall be at least as high as that applicable to the information protected at the highest level. In any event, a group of information may be given a higher protection level than that of each of its parts.

The translation of a classified document shall be given the same classification level, and shall be subject to the same protection, as the original document.

5. A caveat marking may be used for specifying additional conditions such as distribution of the information is limited to specific information exchange channels, embargo and a particular distribution on a need-to-know basis. Such caveat markings shall be defined in the Security Manual.

6. The security packages shall consist of various measures of a physical, technical, organisational or administrative nature, as laid down in the Security Manual.

Article 11 Choice of classification level

1. The Member State supplying information to Europol shall be responsible for the choice of any appropriate classification level for such information in accordance with Article 10. Where applicable, when supplying information to Europol, the Member State shall mark it with a Europol classification level as referred to in Article 10(4).

2. In choosing a classification level, Member States shall take account of the classification of the information under their national regulations, the need for the operational flexibility required for Europol to function adequately and the requirement that classification of law enforcement information should be the exception and that, if such information has to be classified, the lowest possible level should be assigned.

3. If Europol, on the basis of information already in its possession, comes to the conclusion that the choice of a classification level needs changing (for instance removing or adding a classification level, or adding a classification level to a document previously subject to the basic protection level), it shall inform the Member State concerned and seek to agree on an appropriate classification level. Europol shall not specify, change, add or remove a classification level without such agreement.

4. Where information generated by Europol is based upon, or contains, information supplied by a Member State, Europol shall determine, in agreement with the Member State concerned, whether the basic protection level is sufficient or whether the application of a Europol classification level is required.

5. Where information is generated by Europol itself, and such information is not based upon, nor contains, information supplied by a Member State, Europol shall determine any appropriate classification level for such information, using criteria laid down by the Security Committee. Where necessary, Europol shall mark the information accordingly.

6. Member States and Europol shall, where information also concerns the essential interests of another Member State, consult that Member State on whether any classification level should be applied to that information and, if so, which classification level should be applied.

Article 12 Changing the classification level

1. A Member State which has supplied information to Europol may, at any time, require that the selected classification level be changed, including by removing or adding a classification level. Europol shall be obliged to remove, amend or add a classification level in accordance with the wishes of the Member State concerned.

2. The Member State concerned shall, as soon as circumstances allow, request that the classification level in question be downgraded or removed altogether.

3. A Member State supplying information to Europol may specify the time period for which the choice of classification level will apply, and any possible amendments to the classification level thereafter.

4. Where the basic protection level or classification level has been determined by Europol in accordance with Article 11(4), Europol shall only change the basic protection or classification level in agreement with the Member States concerned.

5. Where the classification level has been determined by Europol in accordance with Article 11(5), Europol may change or remove the classification level at any time it is deemed necessary.

6. Where information, the classification level of which is changed in accordance with this Article, has already been supplied to other Member States, Europol shall inform the recipients of the change to the classification level.

Article 13 Processing, access and security clearance

1. Access to, and possession of, information shall be restricted within the Europol organisation to those persons who, by reason of their duties or obligations, need to be acquainted with such information or need to handle it. Persons entrusted with the processing of information shall have obtained an appropriate security clearance and shall further receive special training.

2. All persons who may have access to information subject to a classification level processed by Europol shall undergo security clearance in accordance with Article 40(2) of the Europol Decision and the Security Manual. The Security Coordinator shall, on the basis of the result of the security clearance procedure, subject to the provisions of the Security Manual, grant authorisation to those persons cleared at the appropriate national level, who by reason of their duties or obligations, need to be acquainted with information subject to a Europol classification level. The authorisation is subject to regular review by the Security Coordinator. Authorisation may be withdrawn immediately by the Security Coordinator on justifiable grounds. The Security Coordinator shall also be responsible for ensuring the implementation of paragraph 3.

3. No person shall have access to information subject to a classification level without having been granted security clearance at the appropriate level. Exceptionally, however, the Security Coordinator may, after consultation of a Security Officer,

(a) give a specific and limited authorisation to persons cleared at ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ level to have access to specific information classified up to ‘SECRET UE/EU SECRET’ level, if, by reason of their duties or obligations in a specific case, they need to be acquainted with information subject to a higher Europol classification level; or

(b) grant temporary authorisation to access classified information for a period not exceeding six months, pending the outcome of the security clearance referred to in paragraph 2, if it is in the interest of Europol, and after giving the national competent authorities notification and provided there is no reaction from them within three months; the Security Coordinator shall inform the national competent authorities concerned of the granting of such temporary authorisation. The granting of this temporary authorisation shall not give access to information classified as ‘SECRET UE/EU SECRET’ and above.

4. Such authorisation shall not be granted where a Member State, when supplying the information concerned, has specified that the discretion afforded to the Security Coordinator under paragraph 3 shall not be exercised in relation to that information.

Article 14 Third parties

When concluding confidentiality agreements with third parties, or when concluding agreements in accordance with Articles 22(4) and 23(7) of the Europol Decision, Europol shall take account of the principles laid down in these rules and in the Security Manual, which should be applied accordingly to information exchanged with such third parties.