CHAPTER 2CREATING CONFIDENTIEL UE/EU CONFIDENTIAL AND SECRET UE/EU SECRET INFORMATION
Article 3Originator
While the originator within the meaning of Article 1 of Decision (EU, Euratom) 2015/444 is the Union institution, agency or body, Member State, third state or international organisation under whose authority classified information has been created and/or introduced into the Union's structures, the drafter of CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET information will not necessarily be the same.
Article 4Assigning a classification level
1.
Staff drafting a document on the basis of information within the meaning of Article 1 shall always consider whether their document needs to be classified. Classifying a document as EUCI shall involve an assessment and a decision by the originator as to whether the disclosure of the document to unauthorised persons would cause prejudice to the interests of the European Union or of one or more of the Member States. If drafters are in any doubt as to whether the document they are drafting warrants being classified as CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET they should consult the Head of Unit or Director responsible.
2.
A document shall be classified as at least CONFIDENTIEL UE/EU CONFIDENTIAL if its unauthorised disclosure could, inter alia:
(a)
materially damage diplomatic relations, i.e. cause formal protest or other sanctions;
(b)
prejudice individual security or liberty;
(c)
cause damage to the operational effectiveness or security of Member States' or other contributors' deployed personnel, or to the effectiveness of valuable security or intelligence operations;
(d)
substantially undermine the financial viability of major organisations;
(e)
impede the investigation of or facilitate serious crime;
(f)
work substantially against the Union's or Member States' financial, monetary, economic and commercial interests;
(g)
seriously impede the development or operation of major Union policies;
(h)
shut down or otherwise substantially disrupt significant Union activities;
(i)
lead to the discovery of information classified at a higher level.
3.
Information shall be classified as at least SECRET UE/EU SECRET if its unauthorised disclosure could, inter alia:
(a)
raise international tensions;
(b)
seriously damage relations with third countries or international organisations;
(c)
threaten life directly or seriously prejudice public order or individual security or liberty;
(d)
cause serious damage to the operational effectiveness or security of Member States' or other contributors' deployed personnel, or to the continuing effectiveness of highly valuable security or intelligence operations;
(e)
cause substantial material damage to the Union's or Member States' financial, monetary, economic or commercial interests;
(f)
lead to the discovery of information classified at a higher level.
4.
Originators may decide to attribute a standard classification level to categories of information that they create on a regular basis. However, they shall ensure that individual pieces of information are given the appropriate classification level.
Article 5Working with drafts
1.
Information shall be classified as soon as it is produced. Personal notes, preliminary drafts or messages containing information that warrants classification at the level of CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET shall be marked as such from the outset and shall be produced and handled in accordance with this Decision.
2.
If the final document no longer warrants the initial classification level it shall be downgraded or declassified.
Article 6Record of source material
In order to enable the exercise of originator control in accordance with Article 14, originators of CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET documents shall keep a record of any classified sources used for producing classified documents, including details of sources originally from EU Member States, international organisations or third countries. Where appropriate, aggregated classified information shall be marked in such a way as to preserve the identification of the originators of the classified source materials used.
Article 7Classifying parts of a document
1.
In accordance with Article 22(6) of Decision (EU, Euratom) 2015/444, the overall classification level of a document shall be at least as high as that of its most highly classified component. When information from various sources is collated, the final aggregated document shall be reviewed to determine its overall security classification level, since it may warrant a higher classification than its component parts.
2.
Documents containing classified and non-classified parts shall be structured and marked so that components with different classification and/or sensitivity levels can be easily identified and detached if necessary. This shall enable each part to be handled appropriately when detached from the other components.
Article 8Full classification marking
1.
Information that warrants classification shall be marked and handled as such regardless of its physical form. The classification level shall be clearly communicated to recipients, either by a classification marking, if the information is delivered in written form, whether this is on paper, on removable storage media or in a Communication and Information System (CIS), or by an announcement, if the information is delivered in oral form, such as in a conversation or a presentation. Classified material shall be physically marked so as to allow for easy identification of its security classification.
2.
On documents, the full classification marking CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET shall be written in block capitals, in full in French and English (French first), in accordance with paragraph 3. The marking shall not be translated into other languages.
3.
The CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET classification marking shall be affixed as follows:
(a)
centred at the top and bottom of every page of the document;
(b)
the complete classification marking on one line, with no spaces either side of the forward slash;
(c)
in capitals, black, font Times New Roman 16 (when possible, but at least 14), bold and surrounded by a border on each side.
4.
When creating a CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET document:
(a)
each page shall be marked clearly with the classification level;
(b)
each page shall be numbered;
(c)
the document shall bear a reference number, a registration number and a subject, which itself shall not be classified information unless it is marked as such;
(d)
all the annexes and enclosures shall be listed, whenever possible on the first page; and
(e)
the document shall have the date of its creation on it.
5.
When possible, the SECRET UE/EU SECRET marking shall appear in red.
Article 9Abbreviated C-UE/EU-C and S-UE/EU-S classification markings
The abbreviations C-UE/EU-C and S-UE/EU-S may be used to indicate the classification level of individual parts respectively of a CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET document or where the full classification marking cannot be inserted, for example on a small removable storage medium. It may be used in the body of text where repeated use of the full classification markings is cumbersome. The abbreviation shall not be used instead of the full classification markings in the header and footer of the document.
Article 10Other security designators
1.
CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET documents may bear other markings, or ‘security designators’, specifying, for example, the field to which the document relates, or indicating a particular distribution on a need-to-know basis. An example is:
RELEASABLE TO LIECHTENSTEIN
2.
CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET documents may bear a security caveat that gives specific instructions on how to handle and manage the documents.
3.
Whenever possible, any indications for downgrading or declassifying shall be affixed on the first page of the document at the time it is created. For example, the following marking may be used:
SECRET UE/EU SECRET
until [dd.mm.yyyy]
and RESTREINT UE/EU RESTRICTED
thereafter
Article 11Electronic processing
1.
CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET documents shall be created using electronic means, where these are available.
2.
When creating CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET information, Commission staff shall use CIS accredited for the corresponding classification level or for a higher classification level. Staff shall consult their Local Security Officer (LSO) if there is any doubt as to which CIS may be used. In consultation with the Commission security authority specific procedures may be applied in emergencies or in specific technical configurations.
3.
CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET documents, including drafts, as required by Article 5, shall not be sent by email, printed or scanned on standard printers or scanners, or handled on the personal devices of members of staff. Only printers or copiers connected to standalone computers protected from electromagnetic emissions or to an accredited system shall be used to print out CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET documents.
Article 12Registration for security purposes
1.
Information classified as CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET shall be registered for security purposes prior to distribution and on receipt. It shall be registered:
when it arrives in or leaves an organisational entity; and
when it arrives in or leaves a CIS.
2.
This registration may be carried out in paper or in electronic logbooks.
3.
If the information is handled electronically within a CIS, these recording procedures may be performed by processes within the CIS itself. In this case, the CIS shall include measures to guarantee the integrity of the log records.
4.
The Registry Control Officer shall keep a register that contains at least the following information for each document:
(a)
the date the final classified document was registered;
(b)
the classification level;
(c)
where applicable, the expiry date of the classification level;
(d)
the name of the originating department;
(e)
the recipient or recipients;
(f)
the subject;
(g)
the originating department's reference number for the document;
(h)
the registration number
(i)
the number of copies circulated;
(j)
where possible, the log of sources used for creating the document;
(k)
the date of downgrading or declassification of the document; and
(l)
destruction details (place, date, method, supervision, destruction certificate).
Article 13Distribution
The sender of CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET documents shall decide who to distribute the information to, based on their need-to-know. A distribution list shall be drawn up in order to further enforce the need-to-know principle.