Decision of the Bureau of the European Parliament of 15 April 2013 concerning the rules governing the treatment of confidential information by the European Parliament

• 1. Classified information shall be transferred to contractors and subcontractors located in third States in accordance with security measures agreed between the European Parliament, as the contracting authority, and the third State concerned in which the contractor is registered.

H. HANDLING AND STORAGE OF INFORMATION CLASSIFIED AT THE LEVEL RESTREINT UE/EU RESTRICTED

• 1. In liaison, as appropriate, with the NSA of the Member State concerned, the European Parliament, as the contracting authority, shall be entitled to conduct visits to contractors'/subcontractors' facilities on the basis of contractual provisions in order to verify that the relevant security measures for the protection of EUCI at the level RESTREINT UE/EU RESTRICTED, as required under the contract, have been put in place.

• 1. To the extent necessary under national laws and regulations, NSAs or any other competent security authorities shall be notified by the European Parliament, as the contracting authority, of contracts or subcontracts containing information classified at the level RESTREINT UE/EU RESTRICTED.

• 1. An FSC or a PSC for contractors or subcontractors and their personnel shall not be required in the case of contracts awarded by the European Parliament which contain information classified at the level RESTREINT UE/EU RESTRICTED.

• 1. The European Parliament, as the contracting authority, shall examine the responses to invitations to tender for contracts which require access to information classified at the level RESTREINT UE/EU RESTRICTED, notwithstanding any requirements relating to FSCs or PSCs which may exist under national laws and regulations.

• 1. The conditions under which the contractor may subcontract shall be defined in the call for tenders and in the contract.

• 1. Where a contract involves the handling of information classified at the level RESTREINT UE/EU RESTRICTED in communication and information systems operated by a contractor, the European Parliament, as contracting authority, shall ensure that the contract or any subcontract specifies the necessary technical and administrative requirements regarding accreditation of the communication and information systems commensurate with the assessed risk, taking account of all relevant factors. The scope of accreditation of such communication and information systems shall be agreed between the contracting authority and the relevant NSA.

SECURITY NOTICE 6

BREACHES OF SECURITY, LOSS OR COMPROMISE OF CONFIDENTIAL INFORMATION

• 1. A breach of security occurs as the result of an act or omission contrary to this Decision which might endanger or compromise confidential information.

• 1. Compromise of confidential information occurs when it has fallen, wholly or in part, into the hands of unauthorised persons, i.e. persons having neither the appropriate security clearance or the necessary need-to-know, or if the likelihood exists of such an event having occurred.

• 1. Confidential information may be compromised as a result of carelessness, negligence or indiscretion, as well as by the activities of services which target the Union or of subversive organisations.

• 1. In the event that the Secretary-General discovers or is informed of a proven or suspected breach of security, loss or compromise relating to confidential information, he/she shall:

• (a) establish the facts;

• (b) assess and minimise the damage done;

• (c) take action to prevent a recurrence;

• (d) notify the competent authority of the third party or Member State that originated or forwarded the confidential information.

Where the case concerns a Member of the European Parliament, the Secretary-General shall act in liaison with the President of Parliament.

If the information is received from another Union Institution, the Secretary-General shall act in conformity with the appropriate security measures for classified information and the established arrangements laid down pursuant to the Framework Agreement with the Commission or the Interinstitutional Agreement with the Council.

• 1. All persons required to handle confidential information shall be thoroughly briefed on security procedures, the dangers of indiscreet conversation and their relationships with the media, and shall, where appropriate, sign a declaration that they will not disclose the contents of confidential information to third persons, that they will respect the obligation to protect classified information and that they acknowledge the consequences of any failure to do so. The access to or use of classified information by a person who has not been briefed and signed the corresponding declaration shall be considered a breach of security.

• 1. Members of the European Parliament, parliament officials and other Parliament employees working for political groups or contractors shall immediately report to the Secretary-General any breach of security, loss or compromise of confidential information which may come to their notice.

• 1. Any person responsible for compromising confidential information shall be subject to disciplinary action in accordance with the relevant rules and regulations. Such action shall be without prejudice to any legal action that may be brought pursuant to the applicable law.

• 1. Without prejudice to other legal action, breaches committed by Parliament officials and other Parliament employees working for political groups shall entail the application of the procedures and penalties provided for in Title VI of the Staff Regulations.

• 1. Without prejudice to other legal action, breaches committed by Members of the European Parliament shall be dealt with in accordance with Rule 10(5) and Rules 182, 183 and 184 of Parliament's Rules of Procedure.

[^E0001]: OJ L 43, 15.2.1983, p. 1.

[^E0002]: OJ L 56, 4.3.1968, p. 1.