AGREEMENT

between the Organisation for Joint Armament Cooperation and the European Union on the protection of classified information

The Organisation for Joint Armament Cooperation, hereinafter referred to as ‘OCCAR’,

and

The European Union, hereinafter referred to as ‘the EU’,

hereinafter referred to as ‘the Parties’,

CONSIDERING THAT the Parties agree that consultations and co-operation should be developed between them on questions of common interest relating to security;

RECOGNISING THAT full and effective consultation and co-operation may require access to classified information of OCCAR and the EU, as well as the exchange of classified information between the Parties;

CONSCIOUS THAT such access to and exchange of classified information requires appropriate security measures;

CONSIDERING THAT on 18 May 2009 the Council endorsed the European Defence Agency Steering Board’s recommendation to take work forward on the establishment of a Security Agreement between the EU and OCCAR with the objective of it being available in time for the approval of the Administrative Arrangement between the EDA and OCCAR;

NOTING THAT the Board of Supervisors of OCCAR has authorised the Director of the Executive Administration (EA) of OCCAR to conclude such a Security Agreement;

NOTING THAT on 15 June 2009 the Council authorised the Presidency to open negotiations with OCCAR in order to conclude a security of information agreement,

HAVE AGREED AS FOLLOWS:

Article 1

The Agreement between OCCAR and the EU on the protection of classified information (hereinafter the ‘Agreement’) shall apply to classified information in any form either provided or exchanged between the Parties.

Article 2

For the purposes of this Agreement, ‘classified information’ shall mean any information, (namely, knowledge that can be communicated in any form) document or material which has been determined by either Party to require protection against unauthorised disclosure that could cause varying degrees of damage, harm or prejudice to the interests of OCCAR, or of the EU or one or more of their respective Member States, and has been so designated by a security classification.

Article 3

The EU institutions and entities to which this Agreement applies shall be: the European Council, the Council of the European Union (hereafter ‘the Council’), the General Secretariat of the Council, the High Representative of the Union for Foreign Affairs and Security Policy, the European Commission and the European External Action Service (hereafter ‘the EEAS’). For the purposes of this Agreement, these institutions and entities shall be referred to as ‘the EU’.

Article 4

1.   Classified information may be disclosed or released by one Party (the providing Party) to the other Party (the receiving Party) in accordance with the principle of originator control.

2.   In implementing paragraph 1, no generic release shall be possible unless procedures are agreed between the Parties regarding certain categories of information, relevant to their operational requirements.

Article 5

Each of the Parties, and entities thereof as defined in Article 3 of this Agreement, shall ensure that it has a security system and security measures in place, based on the basic principles and minimum standards of security laid down in its respective security rules and regulations, and reflected in the arrangements to be established pursuant to Article 12, in order to ensure that an equivalent level of protection is applied to classified information provided or exchanged under this Agreement.

Article 6

1.   Classified information shall be marked as follows:

(a)	For OCCAR, classified information shall be marked OCCAR SECRET, OCCAR CONFIDENTIAL or OCCAR RESTRICTED.

(b)	For the EU, classified information shall be marked SECRET UE/EU SECRET, CONFIDENTIEL UE/EU CONFIDENTIAL or RESTREINT UE/EU RESTRICTED.

2.   The corresponding security classifications are:

In OCCAR	In the European Union
OCCAR SECRET	SECRET UE/EU SECRET
OCCAR CONFIDENTIAL	CONFIDENTIEL UE/EU CONFIDENTIAL
OCCAR RESTRICTED	RESTREINT UE/EU RESTRICTED

Article 7

1.   Each Party shall:

(a)	protect and safeguard classified information provided or exchanged by the other Party under this Agreement from unauthorised disclosure, loss or compromise;

(b)

ensure that classified information provided or exchanged under this Agreement keeps the security classification marking given to it by the providing Party. The receiving Party shall protect and safeguard the classified information to a degree no less stringent than the provisions set out in its own security rules and regulations for information or material holding an equivalent security classification, as specified in Article 6;

(c)	ensure that classified information received from the other Party is not downgraded or declassified without the prior written consent of that Party;

(d)	not use such classified information for purposes other than those established by the originator or those for which the information is provided or exchanged;

(e)

not allow access to classified information to individuals unless they have a need-to-know in order to perform their official duties and where access is required to CONFIDENTIEL UE/EU CONFIDENTIAL or OCCAR CONFIDENTIAL or to SECRET UE/EU SECRET or OCCAR SECRET, have been granted a security clearance in accordance with the security rules and regulations of the receiving Party; and

(f)	ensure that all individuals having access to classified information are informed of their responsibilities to protect the information in accordance with the applicable security rules and regulations.

2.   The EU shall not disclose classified information provided by OCCAR under this Agreement to third parties, or to any EU institution or entity not mentioned in Article 3, without the prior written consent of OCCAR.

OCCAR shall not disclose classified information provided by the EU under this Agreement to third parties without the prior written consent of the EU. Such consent shall be given by the Council, acting unanimously.

Article 8

1.   The Parties shall ensure that all persons who, in the conduct of their official duties require access, or whose duties or functions may afford access, to classified information provided or exchanged under this Agreement are appropriately security-cleared before they are granted access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or OCCAR CONFIDENTIAL or to SECRET UE/EU SECRET or OCCAR SECRET.

2.   The security clearance procedures shall be designed to determine whether an individual may, taking into account his or her loyalty, trustworthiness and reliability, have access to classified information.

Article 9

The Parties shall provide mutual assistance with regard to the security of classified information provided or exchanged under this Agreement. Reciprocal security consultations and assessment visits shall be conducted by the authorities referred to in Article 12 to assess the effectiveness of the security arrangements established within their respective responsibilities for protecting such classified information.

Article 10

1.   For the purpose of this Agreement:

(a)	As regards the EU, all correspondence shall be sent through the Chief Registry Officer of the Council and shall be forwarded by him to the Member States and to the entities referred to in Article 3, subject to paragraph 2.

(b)	As regards OCCAR, all correspondence shall be sent to the Registry Control Officer of OCCAR-EA and if necessary shall be forwarded by him to the relevant Classified Registries of OCCAR-EA, subject to paragraph 2 of this Article.

2.   Exceptionally, correspondence from one Party which is accessible to only specific competent officials, organs or services of that Party may, for operational reasons, only be addressed to and be accessible by specific competent officials, organs or services of the other Party specifically designated as recipients by the providing Party, taking into account their competencies and according to the need-to-know principle.

As far as the European Union is concerned, such correspondence shall be transmitted through the Chief Registry Officer of the Council, the Chief Registry Officer of the European Commission or the Chief Registry Officer of the EEAS, as appropriate.

As far as OCCAR is concerned, such correspondence shall be transmitted through the Registry Control Officer of OCCAR-EA.

3.   All classified information shall be transmitted through channels agreed by the security authorities of the Parties.

4.   Classified information transmitted by electronic means shall be encrypted in accordance with the providing Party’s requirements as outlined in its security rules and regulations. The providing Party’s requirements shall be met when transmitting, storing and processing classified information in internal networks of the Parties.

Article 11

The Director of OCCAR-EA shall oversee the implementation of this Agreement by OCCAR. The High Representative of the Union for Foreign Affairs and Security Policy, the Member of the European Commission responsible for security matters and the Secretary-General of the Council shall oversee the implementation of this Agreement by the EU.

Article 12

1.   In order to implement this Agreement, security arrangements shall be established between the four authorities designated in paragraphs 2, 3, 4 and 5 in order to outline the standards for the transmission, reciprocal protection of classified information and visits under this Agreement.

2.   The Security Section of OCCAR-EA, under the direction and on behalf of the OCCAR-EA Director, acting for OCCAR and under its authority, shall draw up security arrangements for protecting and safeguarding classified information provided to OCCAR under this Agreement in accordance with the OCCAR security rules and regulations.

3.   The Security Office of the General Secretariat of the Council, under the direction and on behalf of the Secretary-General of the Council, acting in the name of the Council and under its authority shall draw up security arrangements for protecting and safeguarding classified information provided to the EU under this Agreement in accordance with the Council’s security rules.

4.   The European Commission Security Directorate, acting under the authority of the Member of the Commission responsible for security matters, shall draw up security arrangements for protecting classified information provided under this Agreement within the European Commission and its premises in accordance with the Commission’s security provisions.

5.   The European External Action Service Security Directorate, acting under the authority of the High Representative of the Union for Foreign Affairs and Security Policy, shall draw up security arrangements for protecting classified information provided under this Agreement within the EEAS and its premises in accordance with the security rules for the EEAS.

6.   For the EU, the security arrangements mentioned in paragraph 1 shall be subject to approval by the Council Security Committee.

7.   For OCCAR, the security arrangements mentioned in paragraph 1 shall be subject to approval by the OCCAR Security Committee.

Article 13

In the event of a security breach resulting in the loss or compromise of classified information received from the providing Party or suspicion that such classified information has been disclosed to unauthorised persons, the receiving Party shall immediately inform the providing Party.

An immediate investigation shall be carried out by the receiving Party (with assistance from the providing Party if required) in accordance with its security rules and regulations for the protection of classified information. The receiving Party shall inform the providing Party about the circumstances, measures adopted, and outcome of the investigation as soon as is practicable and of the corrective action taken to prevent recurrence. The authorities referred to in Article 12 may establish procedures to that effect.

Article 14

Each Party shall bear its own costs incurred in implementing this Agreement.

Article 15

Before classified information is provided or exchanged between the Parties under this Agreement, the responsible security authorities referred to in Article 12 shall agree that the receiving Party is able to protect and safeguard the information in a way consistent with the arrangements to be established pursuant to that Article.

Article 16

This Agreement shall not prevent the Parties from concluding other Agreements relating to the provision or exchange of classified information provided that they do not conflict with the provisions of this Agreement.

Article 17

Any disputes between OCCAR and the EU arising out of the interpretation or application of this Agreement shall be addressed by negotiation between the Parties. Pending settlement of any disputes, the Parties shall continue to fulfil all their responsibilities under this Agreement.

Article 18

1.   The present Agreement shall enter into force on the date of signature by the Parties.

2.   Each Party shall notify the other Party of any changes in its rules and regulations that could affect the protection of classified information referred to in this Agreement.

3.   This Agreement may be reviewed for consideration of possible amendments at the request of either Party. It shall be reviewed in the event of any non-EU State becoming a member of OCCAR.

4.   Any amendment to this Agreement shall only be made in writing and shall be signed by each of the Parties to the present Agreement.

Article 19

This Agreement is concluded for an indefinite period of time. It may be denounced by one Party by written notice of denunciation given to the other Party. Such denunciation shall take effect six months after receipt of notification by the other Party, but shall not affect obligations already contracted under the provisions of this Agreement. In particular, all classified information provided or exchanged pursuant to this Agreement shall continue to be protected in accordance with the provisions set forth herein.