belgiquelex.be - Carrefour Bank of Legislation

1^er JULY 2011. - Critical Infrastructure Safety and Protection Act (1)

ALBERT II, King of the Belgians,
To all, present and to come, Hi.
The Chambers adopted and We sanction the following:
CHAPTER 1^er. - General provisions
Article 1^er. This Act regulates a matter referred to in Article 78 of the Constitution.
Art. 2. This Act partially transposes Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructure and the assessment of the need to improve their protection.
The DGCC, as defined in Article 3, 1°, is designated as a national contact point for the protection of European critical infrastructure, as described below as "FEIP contact point", for all sectors and subsectors, for Belgium in its relations with the European Commission and the Member States of the European Union.
Art. 3. For the purposes of this Act and its enforcement orders, the following means:
1° "DGCC": General Directorate Crisis Centre of the Federal Interior Public Service, responsible for the special protection of property and people and for national coordination in public order;
2° "OCAM": Coordinating Body for Threat Analysis established by the Act of 10 July 2006 on Threat Analysis;
3° "Sectoral authority":
(a) for the transport sector: the Minister having Transport in his or her functions or, by delegation of the Minister, a senior officer of the staff of his or her administration;
(b) for the energy sector: the Minister with Energy in his or her responsibilities or, by delegation of the Minister, a senior member of the staff of his or her administration;
(c) for the financial sector: the Minister with Finance in his or her functions or, by delegation of the Minister, a senior staff member of his or her administration;
(d) for the electronic communications sector: the Minister with electronic communications in his or her functions or, by delegation of the Minister, a senior staff member of his or her administration or a member of the Belgian Institute of Postal Services and Telecommunications;
4° "critical infrastructure": installation, system or part of it, of federal interest, which is essential to the maintenance of the vital functions of society, health, safety, security and economic or social well-being of citizens, and whose interruption of operation or destruction would have a significant impact as a result of the failure of these functions;
5° "national critical infrastructure": critical infrastructure located in Belgian territory, whose interruption of operation or destruction would have a significant impact in the country;
6° "European Critical Infrastructure": the national critical infrastructure whose interruption of operation or destruction would have a significant impact on two Member States of the European Union at least;
7° "other federal points of interest": places that are not designated as critical infrastructure but are of particular interest to public order, to special protection of persons and property, to emergency management or to military interests and that may require protection measures by the DGCC;
8° "local points of interest": places that are neither critical infrastructure nor other federal points of interest, but which are of particular interest to the execution of administrative police missions at the local level and that may require the taking of protection measures by the bourgmestre;
9° "electronic communications": electronic communications referred to in the Act of 13 June 2005 on electronic communications;
10° "operator": any natural or legal person responsible for the investments related to or the daily management of a national or European critical infrastructure;
11° "police services": the police services covered by the law of 7 December 1998 organizing an integrated police service, structured at two levels;
12° CIC: Information and Communication Centre, as referred to in the Act of 7 December 1998 organizing an integrated police service, structured at two levels.
CHAPTER 2. - Security and protection of critical infrastructure
Section 1^re. - Scope of application
Art. 4. § 1^er. This chapter applies to the transport sector and the energy sector with regard to the safety and protection of critical national and European infrastructure.
However, it does not apply to nuclear facilities under the Act of 15 April 1994 on the protection of the population and the environment from the hazards resulting from ionizing radiation and related to the Federal Nuclear Control Agency, except for elements of a nuclear facility intended for the industrial production of electricity that are used for the transport of electricity.
§ 2. The Energy Sector includes the following subsectors:
1° electricity, consisting of infrastructure and facilities for the production and transport of electricity, for the supply of electricity;
2° Oil, consisting of oil production, refinement, processing, storage and transport by oil pipelines;
3° the gas, consisting of gas production, refinement, processing, storage, gas pipeline transport and liquefied natural gas terminals.
The Transport Sector has the following subsectors:
1° road transport;
2° rail transport;
3° air transport;
4° inland navigation;
5° offshore transport and short-range shipping and ports.
§ 3. By derogation from § 1^erParagraph 1^erThis chapter does not apply to the subsector of air transportation.
Without prejudice to Article 2, paragraph 2, the King shall, by order deliberately in the Council of Ministers, take the necessary measures, including the repeal, addition, modification or replacement of legal provisions, to ensure the transposition of Council Directive 2008/114/EC of 8 December 2008 concerning the identification and designation of European critical infrastructures and the assessment of the need to improve their air transport protection.
§ 4. This chapter applies to the financial and electronic communications sector with respect to the security and protection of critical national infrastructure.
Section 2
Identification and designation of critical infrastructure
Art. 5. § 1^er. The sectoral authority identifies, for the sector under its jurisdiction, national and European critical infrastructure.
It conducts this identification after consultation with the regions for potential critical infrastructure under their jurisdiction and, if deemed useful, industry representatives and potential critical infrastructure operators.
§ 2. The procedure for identifying national and European critical infrastructure is set out in the Appendix.
Art. 6. § 1^er. The sectoral authority establishes sectoral criteria to be met by critical national infrastructure in relation to the particular characteristics of the sector concerned, in consultation with the DGCC and, where appropriate, after consultation with the regions concerned.
§ 2. The sectoral authority establishes sectoral criteria to be met by critical European infrastructure in relation to the particular characteristics of the sector concerned, in consultation with the DGCC and, where appropriate, after consultation with the regions concerned.
§ 3. The cross-sectoral criteria for national and European critical infrastructure are:
1° the potential number of victims, including the number of deaths or injuries, or
2° the potential economic impact, including the extent of economic losses and/or degradation of products or services, including environmental impacts, or
3° the potential impact on the population, including the impact on population confidence, physical suffering and disruption of daily life, including the disappearance of essential services.
§ 4. The Sectoral Authority sets the levels of impact or thresholds for cross-sectoral criteria to be met by national critical infrastructure, in consultation with the DGCC and, where appropriate, after consultation with the regions concerned.
Impact levels or thresholds of cross-sectoral criteria are based on the severity of the impact of the disruption of the operation or destruction of a particular infrastructure.
§ 5. The sectoral authority shall, on a case-by-case basis, establish the levels of incidence or thresholds applicable to the cross-sectoral criteria to be met by the European critical infrastructure, in consultation with the DGCC, with the Member States concerned and, where appropriate, after consultation with the regions concerned.
Impact levels or thresholds of cross-sectoral criteria are based on the severity of the impact of the disruption of the operation or destruction of a particular infrastructure.
Art. 7. § 1^er. The Sectoral Authority shall communicate the list of potential national critical infrastructure identified by the Branch and, where appropriate, the regions concerned.
It then proceeds with the designation of national critical infrastructure, following the advice of the DGCC and, where appropriate, after consultation with the regions concerned.
§ 2. The Sectoral Authority shall communicate the list of potential European critical infrastructure identified by it to the DGCC and, where appropriate, to the regions concerned.
The EPCIP contact point is tasked, in collaboration with the sectoral authority and, where appropriate, with the regions concerned, to conduct bilateral or multilateral discussions with the Member States of the European Union concerned, both with regard to potential European critical infrastructures identified in Belgian territory and those identified by the other Member States in their territory.
When an agreement has been reached on European critical infrastructure in Belgian territory, the sectoral authority shall appoint these infrastructures.
Art. 8. The sectoral authority shall notify the operator, by carrier with acknowledgement of receipt, of the motivated decision of the designation of its infrastructure as critical infrastructure.
Art. 9. The sectoral authority ensures the ongoing monitoring of the critical infrastructure identification and designation process, and renews it at any time at the first request of the DGCC and within the time frame it sets, in particular according to the obligations imposed by the European Union.
Art. 10. § 1^er. Within one year of the notification of the designation of infrastructure as critical infrastructure, the DGCC is seeking an analysis of the threat to the infrastructure and the subsector of which it is a part of.
§ 2. An analysis of the threat within the meaning of this chapter concerns any type of threat that falls within the competence of the support services referred to in section 2, 2°, of the Act of 10 July 2006 on the analysis of the threat.
The threat analysis consists of an assessment that must assess whether threats to critical infrastructure or subsectors may occur or, if they have already been detected, how they are evolving and, where appropriate, what measures are needed.
Art. 11. § 1^er. Depending on the obligations imposed by the European Union, the sectoral authority shall report in writing to the EPCIP contact point, at the request of the European Union, on the critical infrastructures of its sector and the types of risks encountered.
§ 2. These reports are classified in accordance with the Classification and Enabling, Certification and Security Notice Act of 11 December 1998.
Section 3 Internal Critical Infrastructure Safety Measures
Art. 12. § 1^er. The operator of a critical infrastructure designates a point of contact for security and communicates the contact data to the sectoral authority within six months of notification of designation as critical infrastructure, as well as after each update of that data.
The point of contact for security shall function as a point of contact vis-à-vis the sectoral authority, the DGCC, the mayor and the police for any issue related to the security and protection of infrastructure.
§ 2. Where there is already a point of contact for security under national or international provisions applicable in a sector or subsector, the operator of critical infrastructure shall communicate the contact information to the sectoral authority.
§ 3. The safety contact point is available at any time.
Art. 13. § 1^er. The operator of a critical infrastructure develops an operator's safety plan, referred to as P.S.E., to prevent, mitigate and neutralize the risks of disruption of the operation or destruction of critical infrastructure through the development of internal physical and organizational measures.
§ 2. The P.S.E. includes:
1° of permanent internal security measures applicable in all circumstances;
2° of the gradual internal security measures to be applied according to the threat.
For a specific sector or, where appropriate, by subsector, the King may specify these measures and impose certain information on P.S.E..
§ 3. The P.S.E. development procedure includes at least the following steps:
1° the inventory and location of the points of the infrastructure that, if affected, could cause the interruption of its operation or its destruction;
2° a risk analysis, consisting of identification of key scenarios of relevant potential threats of intentional actions to interrupt or destroy the operation of critical infrastructure;
3° an analysis of the vulnerabilities of critical infrastructure and the potential impacts of the interruption of its operation or its destruction according to the different scenarios selected;
4° for each risk analysis scenario, identification, selection and priority designation of internal security measures.
§ 4. The operator shall develop the P.S.E. within one year of notification of the designation of its infrastructure as critical infrastructure.
At the same time, it shall implement the internal security measures provided for in the P.S.E.
§ 5. For ports that fall under the scope of the law of February 5, 2007 relating to maritime security, the port security plan imposed by this law is assimilated to P.S.E.
§ 6. The operator is responsible for organizing exercises and updating the P.S.E., based on the lessons of the exercises or any changes in the risk analysis.
The King determines for a specific sector or subsector, the frequency of exercises and updates to the P.S.E.
The King shall determine for a specific sector or, where appropriate, by subsector, the terms and conditions for the participation of police services in exercises organized by the operator.
Art. 14. § 1^er. Without prejudice to the legal or regulatory provisions that impose, in a specified sector or subsector, information on the specific services, where an event occurs, that threatens the safety of critical infrastructure, the operator is required to immediately notify the CIC.
§ 2. In accordance with the terms and conditions determined by the Minister of the Interior, the CIC shall notify the DGCC of any event that it is aware of and that is likely to threaten the security of critical infrastructure.
§ 3. If the event is likely to result in the interruption of the operation or destruction of the critical infrastructure concerned, the EPCIP contact point prevents the competent sectoral authority and, in case of European critical infrastructure, the competent authority of the Member States concerned.
Section 4
External critical infrastructure protection measures
Art. 15. Without prejudice to the competence of the judicial authorities to take judicial police measures, the DGCC takes external measures to protect critical infrastructure, on the basis of an analysis of the threat made at its request or ex officio by the OCAM, in accordance with Article 10, § 2.
Art. 16. If it is necessary to maintain public order in the territory of its commune, the mayor takes external protection measures for critical infrastructure, without these measures being in contradiction with the decisions of the DGCC.
Art. 17. § 1^er. The external protection measures referred to in sections 15 and 16 shall be carried out by the police, under the coordination and operational direction of the designated police officer pursuant to sections 7/1 to 7/3 of the Police Function Act.
§ 2. The DGCC addresses its orders, instructions and directives to the police services on behalf of the Minister of the Interior, respectively pursuant to articles 61, 62 and 97, paragraph 1^er of the Act of 7 December 1998 organizing an integrated, two-tiered police service.
§ 3. The mayor addresses his orders, instructions and directives to the local police, pursuant to section 42 of the Act of 7 December 1998 organizing an integrated, two-tiered police service, or, where applicable, to the federal police department responsible for the aeronautics, the navigation police, the railway police or the road police.
Section 5. - Exchange of information
Art. 18. The DGCC, the police and the OCAM collect information useful for taking external measures to protect critical infrastructure.
Art. 19. The operator, the point of contact for security, the sectoral authority, the DGCC, the OCAM and the police at all times cooperate, through an adequate exchange of information on the security and protection of critical infrastructure, in order to ensure consistency between internal security measures and external protection measures.
Art. 20. The King determines, for a specific sector or, where appropriate, by subsector, information from the E.O.S.P. that may be relevant to the performance of the CFOB, police services and the CFOC's critical infrastructure protection missions and the terms and conditions of access to such information.
Art. 21. The CCG may provide the operator with information on the threat and external protection measures that allow the operator to apply its internal gradient security measures appropriately and align them with external protection measures.
CCB may provide a copy of this information to the relevant sectoral authority.
Art. 22. Sectoral authority, DGCC, OCAM and police services limit access to information referred to in Article 6, §§ 1^er2, 4 and 5, and the information entrusted to them by the operator pursuant to sections 19 and 20, to persons who need to know and have access to them for the performance of their duties or mission.
Art. 23. § 1^er. Without prejudice to articles 20 and 25, § 1^er, 2°, the operator is held in professional secrecy with respect to the contents of the P.S.E. and can only give access to the P.S.E. to persons who need to know and have access to it for the performance of their duties or mission.
It shall be held in the same secrecy with respect to all information brought to its knowledge under articles 8, 19 and 21.
§ 2. Offences in § 1^er shall be punished by the penalties provided for in article 458 of the Criminal Code.
Section 6. - Monitoring and sanctions
Art. 24. § 1^er. Without prejudice to the powers of judicial police officers, an inspection service by sector, or, where appropriate, by subsector, is established, responsible for monitoring compliance with the provisions of this Act and its enforcement orders by operators of that sector or subsector.
§ 2. The King shall designate, for a specified sector or, where appropriate, by subsector, the inspection service competent to perform the control.
It may determine the modalities of the control.
§ 3. The members of the inspection service have a legitimation card, the model of which is fixed by the King by sector.
§ 4. The King may determine the training conditions that must be met by inspection service members for a specified sector or subsector.
Art. 25. § 1^er. In the exercise of their mission, inspection service members may, at any time:
1° enter without prior warning, upon presentation of their legitimation card, in all places of the critical infrastructure subject to their control; they have access to inhabited premises only by prior authorization issued by a judge of the police court;
2° to be informed on site of the P.S.E. and of any act, document and other information necessary to carry out their mission;
3° conduct any examination, control and hearing, and require all the information they consider necessary for the exercise of their mission.
§ 2. The King may, for a specified sector or subsector, authorize the inspection service to be provided with a copy of the P.S.E. and any acts, documents or other sources of information that the inspection service considers necessary for the performance of its mission. The King may also determine the terms and conditions under which the copy is delivered to that service.
§ 3. Based on the findings, the inspection service may provide recommendations, instructions or warnings to the operator regarding compliance with the provisions of this Act and its enforcement orders. It may set a time limit to be in good standing and to file minutes.
Art. 26. § 1^er. A prison sentence of eight days to one year and a fine of 26 euros to 10,000 euros or one of these penalties shall be imposed only on the operator who does not comply with the obligations imposed by or under this Act relating to internal security measures and the exchange of information.
In the event of recidivism, the fine is doubled and the offender is punished by imprisonment from fifteen days to three years.
§ 2. It is punishable by imprisonment from eight days to one month and a fine of 26 euros to 1,000 euros or one of these penalties only, anyone who voluntarily prevents or hinders the execution of the inspection service's control, refuses to disclose the information requested to it on the occasion of this inspection, or knowingly communicates inaccurate or incomplete information.
In the event of recidivism, the fine is doubled and the offender is punished by imprisonment from fifteen days to one year.
§ 3. The provisions of Book 1^er the Criminal Code, including Chapter VII and Article 85, shall apply to such offences.
CHAPTER 3
Protection of other federal and local points of interest
Art. 27. § 1^er. Without prejudice to the jurisdiction of the judicial authorities to take judicial police action, the DGCC takes external protection measures for other federal matters.
§ 2. If it is necessary to maintain public order in the territory of its commune, the bourgmestre takes external protection measures for other federal points of interest, without these measures being inconsistent with the decisions of the DGCC.
§ 3. Without prejudice to the competence of the judicial authorities to take judicial police measures, the mayor takes external protection measures for local points of interest.
Art. 28. The DGCC, the police and OCAM collect the information that is useful for taking external protection measures from other federal interests and the police services collect the useful information that is of concrete interest in taking external protection measures for local points of interest.
Art. 29. § 1^er. The external protection measures referred to in section 27 shall be carried out by the police, under the coordination and operational direction of the designated police officer pursuant to sections 7/1 to 7/3 of the Police Function Act.
§ 2. The DGCC addresses its orders, instructions and directives to the police services on behalf of the Minister of the Interior, respectively pursuant to sections 61, 62 and 97, paragraph 1^er of the Act of 7 December 1998 organizing an integrated, two-tiered police service.
§ 3. The mayor addresses his orders, instructions and directives to the local police, pursuant to section 42 of the Act of 7 December 1998 organizing an integrated, two-tiered police service, or, where applicable, to the federal police department responsible for the aeronautics, the navigation police, the railway police or the road police.
CHAPTER 4. - Amendment of the Act of 15 April 1994 on the Protection of Population and the Environment from the Hazards of Atomic Radiation and the Federal Nuclear Control Agency
Art. 30. In Chapter III of the Act of 15 April 1994 on the Protection of Population and the Environment from the Hazards of Atomic Radiation and the Federal Nuclear Control Agency, an article 15bis is inserted as follows:
"Art. 15bis. Pursuant to Article 24 of the Law of 1^er July 2011 on the security and protection of critical infrastructure and its enforcement orders, the Agency is responsible for monitoring the application of the provisions of the said Act to elements of a nuclear facility intended for industrial electricity production, which are used for the transport of electricity and which have been designated as critical infrastructure under the law of the ... mentioned above.
The terms and conditions of control are settled by the King. »
CHAPTER 5. - Final provisions
Art. 31. The King shall, by order deliberately in the Council of Ministers, take the necessary measures, including the repeal, addition, modification or replacement of legal provisions, to ensure the transposition of the European directives concerning critical infrastructures.
It may, by deliberate decree in the Council of Ministers, make applicable in whole or in part the provisions of Chapter 2 and its enforcement orders to other sectors than those referred to in Article 4, § 2, with respect to national critical infrastructure.
Art. 32. This Act comes into force on the day of its publication in the Belgian Monitor.
Promulgate this law, order that it be clothed with the seal of the State and published by the Belgian Monitor.
Given in Brussels, 1^er July 2011.
ALBERT
By the King:
The Prime Minister,
Y. LETERME
The Minister of the Interior,
Ms. A. TURTELBOOM
Minister of Finance,
D. REYNDERS
Minister of Justice,
S. DE CLERCK
Minister of Climate and Energy,
P. MAGNETTE
Minister for Business and Simplification,
VAN QUICKENBORNE
The Secretary of State for Mobility,
E. SCHOUPPE
Seal of the state seal:
Minister of Justice,
S. DE CLERCK
____
Note
(1) 2010-2011 session.
House of Representatives:
Documents. - Bill, 53-1357 - No. 1. - Report, 53-1357 No. 2. - Text corrected by the commission, 53-1357 - No. 3. - Text adopted in plenary and transmitted to the Senate, 53-1357 - No. 4.
Full report. - 19 May 2011.
Senate:
Documents. - Project not referred to by the Senate, 5-1039 - No. 1.

Annex
Procedure for the identification of national and European critical infrastructures
The identification of national and European critical infrastructure is subject to the following steps:
A. Identification of national critical infrastructure
I. The sectoral authority shall apply the sectoral criteria referred to in Article 6, § 1^er, in order to operate a first selection of existing infrastructure within its sector.
II. The sectoral authority applies the definition of the national critical infrastructure referred to in Article 3, 5° to the selection made at the first stage and draws a list of potential national critical infrastructure identified.
The severity of the incidence is determined on the basis of the characteristics of the sector concerned, based on the intersectoral criteria referred to in Article 6, §§ 3 and 4. It is taken into account the existence of alternatives as well as the duration of the interruption/resumption of activity.
B. Identification of European critical infrastructure
I. The sectoral authority applies to the list of national critical infrastructures identified the sectoral criteria referred to in Article 6, § 2. If the infrastructure meets these criteria, it is subject to the next stage of the procedure.
II. The sectoral authority then applies the cross-border element of the definition of the European critical infrastructure referred to in Article 3, 6°. If the infrastructure meets this definition, it is subject to the next step of the procedure.
III. The sectoral authority applies the intersectoral criteria referred to in Article 6, §§ 3 and 5 to the remaining potential European critical infrastructure.
The cross-sectoral criteria take into account the following elements: the severity of the impact and the existence of alternatives, as well as the duration of the cessation/resumption of activity.
IV. The identification of potential European critical infrastructures that cross all stages of this procedure is only communicated to the Member States likely to be significantly affected by these infrastructures.
See to be annexed to the Law of 1^er July 2011 on security and protection of critical infrastructure.
ALBERT
By the King:
The Prime Minister,
Y. LETERME
The Minister of the Interior,
Ms. A. TURTELBOOM
Minister of Finance,
D. REYNDERS
Minister of Justice,
S. DE CLERCK
Minister of Climate and Energy,
P. MAGNETTE
Minister for Business and Simplification,
VAN QUICKENBORNE
The Secretary of State for Mobility,
E. SCHOUPPE