Decision of the Bureau of the European Parliament of 15 April 2013 concerning the rules governing the treatment of confidential information by the European Parliament

This Decision governs the management and handling of confidential information by the European Parliament, including the creation, reception, forwarding and storage of such information, with a view to the appropriate protection of its confidential nature. It implements, the Interinstitutional Agreement and the Framework Agreement, in particular Annex II thereto.

For the purposes of this Decision: (a) ‘information’ means any written or oral information, whatever the medium and whoever the author may be; (b) ‘confidential information’ means ‘classified information’, and non-classified ‘other confidential information’; (c) ‘classified information’ means ‘EU classified information’ and ‘equivalent classified information’; (d) ‘EU classified information’ (EUCI) means any information and material, classified as ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE/EU SECRET’, ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ or ‘RESTREINT UE/EU RESTRICTED’, unauthorised disclosure of which could cause varying degrees of prejudice to Union interests or to those of one or more of its Member States, whether or not such information originates within the institutions, bodies, offices or agencies established by virtue or on the basis of the Treaties. In this regard, information and material classified at the level: ‘TRÈS SECRET UE/EU TOP SECRET’ is information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the Union or of one or more of the Member States; ‘SECRET UE/EU SECRET’ is information and material the unauthorised disclosure of which could seriously harm the essential interests of the Union or of one or more of the Member States; ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ is information and material the unauthorised disclosure of which could harm the essential interests of the Union or of one or more of the Member States; ‘RESTREINT UE/EU RESTRICTED’ is information and material the unauthorised disclosure of which could be disadvantageous to the interests of the Union or of one or more of the Member States; (e) ‘equivalent classified information’ means classified information issued by Member States, third States or international organisations which bears a security classification marking equivalent to one of the security classification markings used for EUCI and which has been forwarded to the European Parliament by the Council or the Commission; (f) ‘other confidential information’ means any other non-classified confidential information, including information covered by data protection rules or by the obligation of professional secrecy, created in the European Parliament or forwarded to the European Parliament by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States; (g) ‘document’ means any recorded information, regardless of its physical form or characteristics; (h) ‘material’ means any document or item of machinery or equipment, either manufactured or in the process of manufacture; (i) ‘need to know’ means the need of a person to have access to confidential information in order to be able to perform an official function or a task; (j) ‘authorisation’ means a decision adopted by the President, if it concerns Members of the European Parliament, or by the Secretary-General, if it concerns officials of the European Parliament and other European Parliament employees working for political groups, to grant an individual access to classified information up to a specific level, on the basis of a positive result of a security screening (vetting) carried out by a national authority under national law and pursuant to the provisions laid down in Annex I, Part 2; (k) ‘downgrading’ means a reduction in the level of classification; (l) ‘declassification’ means the removal of any classification; (m) ‘marking’ means a sign affixed to ‘other confidential information’ intended to identify predefined specific instructions about its handling or the field covered by a given document. It may also be affixed to classified information, in order to impose additional requirements for its handling; (n) ‘unmarking’ means the removal of any marking; (o) ‘originator’ means the duly authorised author of confidential information; (p) ‘security notices’ means the implementing measures laid down in Annex II; (q) ‘handling instructions’ means technical instructions issued to the European Parliament's services concerning the management of confidential information.

1 The treatment of confidential information by the European Parliament shall follow the basic principles and minimum standards laid down in Annex I, Part 1.

2 The European Parliament shall set up an information security management system (ISMS) in accordance with those basic principles and minimum standards. The ISMS shall consist of the security notices, the handling instructions and the relevant Rules of Procedure. It shall aim at facilitating parliamentary and administrative work, while ensuring the protection of any confidential information processed by the European Parliament, in full respect of the rules established by the originator of such information as laid down in the security notices. The processing of confidential information by means of automated communication and information systems (CIS) of the European Parliament shall be implemented in accordance with the concept of information assurance (IA), as provided for in security notice 3.

3 Members of the European Parliament may consult classified information up to and including the level RESTREINT UE/EU RESTRICTED without security clearance.

4 Where the information concerned is classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent, access shall be granted to those Members of the European Parliament who have been authorised by the President pursuant to paragraph 5 or after having signed a solemn declaration of non-disclosure of the content of that information to third persons, of compliance with the obligation to protect information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL and of acknowledgement of the consequences of any failure to do so.

5 Where the information concerned is classified at the level SECRET UE/EU SECRET or TRÈS SECRET/EU TOP SECRET or its equivalent, access shall be granted to those Members of the European Parliament who are authorised by the President after: (a) they have been security-cleared in accordance with Annex I, Part 2, of this Decision, or (b) a notification has been received from a competent national authority that the Members concerned are duly authorised by virtue of their functions in accordance with national law.

6 Before being granted access to classified information, Members of the European Parliament shall be briefed on, and shall acknowledge, their responsibilities regarding the protection of such information in accordance with Annex I. They shall also be briefed on the means of ensuring such protection.

7 Officials of the European Parliament and other European Parliament employees working for political groups may consult confidential information if they have an established ‘need to know’, and may consult classified information above the level RESTREINT UE/EU RESTRICTED if they hold the appropriate level of security clearance. Access to classified information shall be granted only if they have been briefed on, and received written instructions concerning, their responsibilities regarding the protection of such information, as well as the means of ensuring such protection, and if they have signed a declaration acknowledging receipt of those instructions and undertaking to comply with them in accordance with the current rules.

1 The President of the European Parliament, the chairs of the parliamentary committees concerned and the Secretary-General and/or any person duly authorised by him/her in writing may originate confidential information and/or classify information as provided for in the security notices.

2 When creating classified information, the originator shall apply the appropriate level of classification in line with the international standards and definitions set out in Annex I. The originator shall also determine, as a general rule, the addressees who are to be authorised to consult the information commensurate to the level of classification. This information shall be communicated to the Classified Information Unit (CIU) when the document is deposited with the CIU.

3 ‘Other confidential information’ covered by professional secrecy shall be dealt with in accordance with Annexes I and II and the handling instructions.

1 Confidential information received by the European Parliament shall be communicated as follows: (a) information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’: to the secretariat of the parliamentary body/office-holder which submitted the request therefor, or directly to the CIU; (b) information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET or its equivalent: to the CIU.

2 The registration, storage and traceability of confidential information shall be dealt with, as the case may be, either by the secretariat of the parliamentary body/office-holder who received the information or by the CIU.

3 The agreed arrangements to be established by common accord with a view to preserving the confidentiality of the information, in the case of confidential information communicated by the Commission pursuant to point 3.2 of Annex II to the Framework Agreement, or in the case of classified information forwarded by the Council pursuant to Article 5(4) of the Interinstitutional Agreement, shall be deposited, together with the confidential information, at the secretariat of the parliamentary body/office-holder or at the CIU, as the case may be.

4 The arrangements referred to in paragraph 3 may also be applied mutatis mutandis for the communication of confidential information by other institutions, bodies, offices and agencies established by virtue or on the basis of the Treaties or by Member States.

5 In order to ensure a level of protection commensurate with the level of classification TRÈS SECRET UE/EU TOP SECRET or its equivalent, the Conference of Presidents shall set up an oversight committee. Information classified at the level TRÈS SECRET UE/EU TOP SECRET or its equivalent shall be communicated to the European Parliament subject to further arrangements, to be agreed between the European Parliament and the Union Institution from whom the information is received.

The European Parliament may, subject to the prior written consent of the originator or the Union Institution, which has communicated the classified information to the European Parliament, as the case may be, forward such classified information to third parties, on condition that they ensure that, when such information is handled, rules equivalent to those laid down in this Decision are respected within their services and premises.

1 For the purposes of the management of confidential information, the European Parliament shall establish a Secure Area and Secure Reading Rooms.

2 The Secure Area shall provide facilities for the registration, consultation, archiving, transmission and handling of classified information. It shall comprise, inter alia, a reading room and a meeting room for the consultation of classified information and shall be managed by the CIU.

3 Outside the Secure Area, Secure Reading Rooms may be created, in order to allow for the consultation of information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent, and of ‘other confidential information’. Those Secure Reading Rooms shall be managed by the competent services of the secretariat of the parliamentary body/office-holder or by the CIU, as the case may be. They shall not contain photocopying machines, telephones, fax facilities, scanners or any other technical equipment for the reproduction or transmission of documents.

1 Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ shall be registered and stored by the competent services of the secretariat of the parliamentary body/office-holder or by the CIU, depending on who received the information.

2 The following conditions shall apply to the handling of information classified at the level RESTREINT EU/EU RESTRICTED or its equivalent and ‘other confidential information’: (a) documents shall be handed over in person to the head of the secretariat, who shall register them and provide an acknowledgement of receipt; (b) when not actually being used, such documents shall be kept in a locked location, under the responsibility of the secretariat; (c) in no case may the information be saved on another medium or transmitted to any person. Such documents may only be duplicated by means of appropriately accredited equipment as defined in the security notices; (d) access to such information shall be restricted to those designated by the originator or by the Union Institution which communicated the information to the European Parliament, in accordance with the arrangements referred to in Article 4(2) or Article 5(3), (4) and (5); (e) the secretariat of the parliamentary body/office-holder shall keep a record of the persons who have consulted the information, and of the date and time of such consultation, and shall transmit the record to the CIU at the time when the information is deposited with the CIU.

3 Information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET or TRÈS SECRET UE/EU TOP SECRET, or its equivalent shall be registered, handled and stored by the CIU in the Secure Area, in accordance with the specific level of classification and as defined in the security notices.

4 In the event of a breach of the rules set out in paragraghs 1 to 3, the responsible official of the secretariat of the parliamentary body/office-holder or of the CIU, as the case may be, shall inform the Secretary-General, who shall refer the matter to the President if a Member of the European Parliament is concerned.

1 Only the following persons shall have access to the Secure Area: (a) persons who, pursuant to Article 3(4) to (7), are authorised to consult the information held there and who have submitted an application pursuant to Article 10(1); (b) persons who, pursuant to Article 4(1), are authorised to create classified information and who have submitted an application pursuant to Article 10(1); (c) the European Parliament's officials of the CIU; (d) the European Parliament officials responsible for managing the CIS; (e) European Parliament officials responsible for security and fire safety, when necessary; (f) cleaning staff, but only in the presence of, and under close surveillance by, an official of the CIU.

2 The CIU may deny access to the Secure Area to any person not authorised to enter. Any objection challenging such a denial of access shall be submitted to the President, in the case of a request for access by a Member of the European Parliament, and to the Secretary-General in other cases.

3 The Secretary-General may authorise a meeting for a limited number of persons in the meeting room located within the Secure Area.

4 Only the following persons shall have access to a Secure Reading Room: (a) Members of the European Parliament, officials of the European Parliament and other European Parliament employees working for political groups, duly identified for the purposes of consultation or creation of confidential information; (b) the European Parliament officials responsible for managing the CIS, officials of the secretariat of the parliamentary body/office-holder which received the information, and officials of the CIU; (c) where necessary, European Parliament officials responsible for security and fire safety; (d) cleaning staff, but only in the presence of, and under close surveillance by, an official working in the secretariat of the parliamentary body/office-holder or in the CIU, as the case may be.

5 The competent secretariat of the parliamentary body/office-holder or the CIU, as the case may be, may deny access to a Secure Reading Room to any person not authorised to enter. Any objection challenging such a denial of access shall be submitted to the President, in the case of a request for access by a Member of the European Parliament, and to the Secretary-General in other cases.

1 Any person wishing to consult or create confidential information in the Secure Area shall communicate his or her name in advance to the CIU. The CIU shall check the identity of that person and verify whether he or she is permitted, in accordance with Article 3(3) to (7), Article 4(1) or Article 5(3), (4) and (5) to consult or create confidential information.

2 Any person wishing, in accordance with Article 3(3) and (7), to consult confidential information classified at the level RESTREINT EU/EU RESTRICTED or its equivalent or ‘other confidential information’ in a Secure Reading Room shall communicate his or her name in advance to the competent services of the secretariat of the parliamentary body/office-holder or to the CIU.

3 Save in exceptional circumstances (e.g. where numerous requests for consultation are submitted within a short period of time), only one person at a time shall be authorised to consult confidential information in a secure facility, in the presence of an official of the secretariat of the parliamentary body/office-holder or of the CIU.

4 During the consultation process, contact with the exterior (including by means of telephones or other technological devices), the taking of notes and the photocopying or photographing of the confidential information consulted shall be prohibited.

5 Before authorising a person to leave the secure facility, the official of the secretariat of the parliamentary body/office-holder or of CIU shall check that the confidential information consulted is still present, intact and complete.

6 In the event of a breach of the rules set out above, the official of the secretariat of the parliamentary body/office-holder or of the CIU shall inform the Secretary-General, who shall refer the matter to the President where a Member of the European Parliament is concerned.

1 Information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent and ‘other confidential information’ may be consulted by members of parliamentary committees or of other political and administrative bodies of the European Parliament at a meeting in camera outside the secure facilities.

2 In the circumstances provided for in paragraph 1, the secretariat of the parliamentary body/office-holder responsible for the meeting shall ensure that the following conditions are complied with: (a) only the persons designated by the chair of the competent committee or body to participate in the meeting are allowed to enter the meeting room; (b) all documents are numbered, distributed at the beginning of the meeting and collected again at the end, and no notes of those documents and no photocopies or photographs thereof are taken; (c) the minutes of the meeting make no mention of the content of the discussion of the information considered. Only the relevant decision, if any, may be recorded; (d) confidential information provided orally to recipients in the European Parliament is subject to a level of protection equivalent to that applied to confidential information in written form; (e) no additional stock of documents is held in meeting rooms; (f) copies of documents are distributed only in the requisite numbers to participants and interpreters at the start of the meeting; (g) the classification/marking status of the documents is made clear by the chair of the meeting at the start of the meeting; (h) participants do not remove documents from the meeting room; (i) all copies of documents are collected and accounted for at the end of the meeting by the secretariat of the parliamentary body/office-holder; and (j) no electronic communication devices or other electronic devices are taken into the meeting room where the confidential information in question is consulted or discussed.

3 Where, in accordance with the exceptions laid down in point 3.2.2 of Annex II to the Framework Agreement and in Article 6(5) of the Interinstitutional Agreement, information classified at the level CONFIDENTIEL UE/EU CONFIDENTIAL or its equivalent is discussed at a meeting held in camera, the secretariat of the parliamentary body/office-holder responsible for the meeting shall, in addition to ensuring compliance with the provisions laid down in paragraph 2, ensure that the persons designated to participate in the meeting comply with the requirements of Article 3(4) and (7).

4 In the case provided for in paragraph 3, the CIU shall provide to the secretariat of the parliamentary body/office-holder-responsible for the meeting in camera the requisite number of copies of the documents to be discussed, which shall be returned to the CIU after the meeting.

1 Secure archiving facilities shall be provided within the Secure Area. The CIU shall be responsible for managing the secure archive in accordance with standard archiving criteria.

2 Classified information definitively deposited with the CIU, and information classified at the level RESTREINT UE/EU RESTRICTED or its equivalent which is deposited with the secretariat of the parliamentary body/office-holder, shall be transferred to the secure archive in the Secure Area six months after it was last consulted and, at the latest, one year after it was deposited. ‘Other confidential information’ shall be archived, unless deposited with the CIU, by the secretariat of the parliamentary body/office-holder concerned, in accordance with the general rules on document management.

3 Confidential information held in the secure archive may be consulted subject to the following conditions: (a) only those persons identified by name, by function or by office in the accompanying document drawn up when the confidential information was deposited shall be authorised to consult that information; (b) the application to consult confidential information shall be submitted to the CIU, which shall transfer the document in question to the Secure Reading Room; and (c) the procedures and conditions governing the consultation of confidential information set out in Article 10 shall apply.

1 Confidential information may be downgraded, declassified or unmarked only with the prior consent of the originator, and, if necessary, after discussion with other interested parties.

2 Downgrading or declassification shall be confirmed in writing. The originator shall be responsible for informing its addressees of the change, and they in turn shall be responsible for informing any subsequent addressees to whom they have sent or copied the document, of the change. If possible, originators shall specify on classified documents a date, period or event when the contents may be downgraded or declassified. Otherwise, they shall keep the documents under review every five years, at the latest, in order to ensure that the original classification is necessary.

3 Confidential information held in the secure archives shall be examined in good time, and by no later than the 25th anniversary of its creation, in order to determine whether or not it should be declassified, downgraded or unmarked. The examination and publication of such information shall take place in accordance with the provisions of Council Regulation (EEC, Euratom) No 354/83 of 1 February 1983 concerning the opening to the public of the historical archives of the European Economic Community and the European Atomic Energy Community . Declassification shall be effected by the originator of the classified information or the service currently responsible in accordance with Annex I, Part 1, Section 10.

4 Following declassification, formerly classified information held in the secure archive shall be transferred to the historical archives of the European Parliament for permanent preservation and further treatment under the applicable rules.

5 Following unmarking, formerly ‘other confidential information’ shall be subject to the European Parliament rules on document management.

1 A breach of confidentiality in general, and of this Decision in particular, shall in the case of Members of the European Parliament entail the application of the relevant provisions concerning penalties set out in the European Parliament's Rules of Procedure.

2 A breach committed by a member of staff of the European Parliament shall lead to the application of the procedures and penalties provided for by, respectively, the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Union, laid down in Regulation (EEC, Euratom, ECSC) No 259/68 (‘the Staff Regulations’).

3 The President and/or the Secretary-General, as the case may be, shall organise any necessary investigations in the event of a breach as defined in security notice 6.

4 If the confidential information was communicated to the European Parliament by a Union Institution or by a Member State, the President and/or the Secretary-General, as the case may be, shall inform the Union Institution or Member State concerned of any proven or suspected loss or compromise of classified information, of the results of the investigation and of the measures taken to prevent a recurrence.

1 The Secretary-General shall propose any necessary adaptation of this Decision and the annexes implementing it and shall forward those proposals to the Bureau for decision.

2 The Secretary-General shall be responsible for the implementation of this Decision by the European Parliament's services and shall issue the handling instructions on matters covered by the ISMS in accordance with the principles laid down by this Decision.

3 The Secretary-General shall submit an annual report to the Bureau on the application of this Decision.

1 Non classified information held in the CIU or in any other archive of the European Parliament which is considered as confidential and dated before 1 April 2014 shall be deemed, for the purpose of this Decision, to constitute ‘other confidential information’. Its originator may at any time reconsider the level of its confidentiality.

2 By way of derogation from point (a) of Article 5(1) and from Article 8(1) of this Decision, for a period of twelve months from 1 April 2014, information provided by the Council pursuant to the Interinstitutional Agreement which is classified at the level RESTREINT UE/EU RESTRICTED or its equivalent shall be deposited with, registered by and stored in the CIU. Such information may be consulted in accordance with points (a) and (c) of Article 4(2) and with Article 5(4) of the Interinstitutional Agreement.

3 The decision of the Bureau of 6 June 2011 concerning the rules governing the treatment of confidential information by the European Parliament is repealed.

This Decision shall enter into force on the day of its publication in the Official Journal of the European Union.