Agreement between the European Union and the European Space Agency on the security and exchange of classified information

Official Journal EN of the European Union L series 2024/1543 31.5.2024 Agreement between the European Union and the European Space Agency on the security and exchange of classified information THE EUROPEAN UNION, hereinafter referred to as the ‘Union’, and THE EUROPEAN SPACE AGENCY, hereinafter referred to as ‘ESA’, hereinafter jointly referred to as the ‘Parties’, HAVING REGARD to the Treaty on European Union, HAVING REGARD to the Convention for the Establishment of a European Space Agency, done at Paris on 30 May 1975 and which entered into force on 30 October 1980, HAVING REGARD to the Agreement between the States Parties to the Convention for the Establishment of a European Space Agency and the European Space Agency concerning the protection and exchange of classified information, done at Paris on 19 August 2002 and which entered into force on 23 June 2003, CONSIDERING that the Parties share the objectives of strengthening their own security in all ways, CONSIDERING that the Parties agree that cooperation should be developed between them on questions of common interest relating to security and that a resolution on the European Space Policy was approved by both the Council of the European Union and the Council of ESA on 22 May 2007 which emphasises, inter alia, the need to improve synergies in the domain of security, CONSIDERING that, in this context, a permanent need therefore exists to exchange classified information between the Parties, RECOGNISING that full and effective consultation and cooperation may require access to and exchange of classified information of the Parties, RECOGNISING that ESA may need to create EU classified information in the context of certain Union programmes, AWARE that such access to, exchange of and creation of classified information require appropriate security measures, HAVE AGREED AS FOLLOWS: Article 1 Purpose In order to fulfil the objectives of strengthening the security of each of the Parties in all ways, this Agreement between the Union and ESA on the security and exchange of classified information shall apply to classified information as defined in Article 2 provided by one Party (the ‘providing Party’) to the other Party (the ‘receiving Party’) or exchanged between the Parties. Article 2 Definition of classified information For the purposes of this Agreement, ‘classified information’ means any information or material, in any form, which is: (a) determined by either Party to require protection as its loss or unauthorised disclosure could cause varying degrees of prejudice to the interests of ESA or of one or more of its Member States or to the interests of the Union or of one or more of its Member States; and (b) marked in accordance with the table of equivalence set out in the implementing arrangement referred to in Article 4(2). ELI: http://data.europa.eu/eli/agree/2024/1543/oj 1/6EN OJ L, 31.5.2024 Article 3 Parties to the Agreement 1. This Agreement applies to the Union and to ESA. 2. For the purposes of this Agreement, the Union shall mean the European Council, the Council of the European Union (the ‘Council’), the General Secretariat of the Council, the European Commission, the High Representative of the Union for Foreign Affairs and Security Policy (the ‘High Representative’) and the European External Action Service (the ‘EEAS’). Article 4 Competent security authorities 1. For the purposes of this Agreement, the competent security authorities shall be: (a) for ESA, the ESA Security Office, under the authority of the Director-General of ESA; (b) for the Union: (i) the Directorate of Safety and Security of the General Secretariat of the Council, under the direction and on behalf of the Secretary-General of the Council, acting in the name of the Council and under its authority; (ii) the Security Directorate of the Directorate-General Human Resources and Security of the European Commission, under the authority of the Member of the Commission responsible for security matters; and (iii) the Directorate for Security and Corporate Services of the EEAS, under the authority of the Secretary-General of the EEAS. 2. The competent security authorities referred to in paragraph 1 shall establish an implementing arrangement in order to lay down the standards for reciprocal protection and safeguarding of classified information provided or exchanged under this Agreement (the ‘Implementing Arrangement’), including EU classified information (‘EUCI’) created by ESA in accordance with Article 6. 3. For ESA, the Implementing Arrangement shall be subject to approval by the ESA Council. 4. For the Union, the Implementing Arrangement shall be subject to approval by the Council Security Committee. Article 5 Security principles Each Party shall: (a) protect and safeguard classified information of the other Party subject to this Agreement in accordance with this Agreement and with its own applicable rules and regulations; (b) ensure that classified information provided by or exchanged with the other Party under this Agreement keeps the security classification given to it by the providing Party and that it is not downgraded or declassified without the prior written consent of the providing Party; the receiving Party shall protect and safeguard such classified information in accordance with its own security rules and regulations for classified information holding an equivalent security classification; (c) not use classified information subject to this Agreement for purposes other than those established by the providing Party, except where the providing Party has given its prior written consent; (d) not disclose classified information subject to this Agreement to third parties, or to any Union institution or entity not referred to in Article 3(2), except where the providing Party has given its prior written consent; (e) not allow access to classified information subject to this Agreement by individuals unless they have a need to know and, where applicable, have been security-cleared to the necessary level; 2/6 ELI: http://data.europa.eu/eli/agree/2024/1543/ojEN OJ L, 31.5.2024 (f) ensure that all individuals with access to classified information subject to this Agreement are informed of their responsibility to protect it in accordance with the applicable rules and regulations; (g) ensure that classified information subject to this Agreement is handled and stored in facilities which are appropriately secured, controlled and protected in accordance with the applicable rules and regulations. Article 6 Creation of EU classified information by ESA 1. Where the implementation of a Union programme requires the creation of EUCI by ESA, ESA shall create EUCI in accordance with the conditions specified in the Implementing Arrangement. 2. For the purposes of this Agreement, EUCI created by ESA pursuant to paragraph 1 shall be protected by ESA, acting as the receiving Party, in accordance with the security principles set out in Article 5. Article 7 Release and disclosure of classified information 1. Classified information shall only be released or disclosed by the providing Party to the receiving Party in accordance with the principle of originator control. 2. Release or disclosure of classified information to recipients other than those referred to in Article 3 shall require a decision by the receiving Party after obtaining the written consent of the providing Party, in accordance with the principle of originator control as defined in the Parties' respective security rules and regulations. 3. No generic release of classified information shall be possible for the purposes of paragraphs 1 or 2 unless procedures are agreed upon and established between the Parties regarding certain categories of information. 4. Nothing in this Agreement shall be considered as a basis for mandatory release of classified information between the Parties. 5. Classified information subject to this Agreement shall only be provided to a contractor or prospective contractor with the prior written consent of the providing Party or following instructions issued to that effect by the providing Party. Before disclosing any classified information to a contractor or prospective contractor, the receiving Party shall verify that the contractor or prospective contractor has the required facility security clearance, where applicable, for itself and has the appropriate security clearances for its personnel who need access to classified information. Article 8 Personnel security 1. The Parties shall ensure that all persons who, in the conduct of their official duties, require access, or whose duties or functions may afford them access, to classified information provided or exchanged under this Agreement are security-cleared, where required, before they are granted access to such information. 2. Security clearance procedures shall be implemented in accordance with the respective security rules and regulations, including as regards whether an individual may, taking into account his or her loyalty, trustworthiness and reliability, have access to classified information. Article 9 Security cooperation 1. The Parties shall provide mutual assistance with regard to the security of classified information subject to this Agreement and matters of common security interest. Reciprocal security consultations and assessment visits shall be conducted by the competent security authorities referred to in Article 4(1) to assess the effectiveness of the Implementing Arrangement. ELI: http://data.europa.eu/eli/agree/2024/1543/oj 3/6EN OJ L, 31.5.2024 2. Prior to the Parties providing or exchanging classified information under this Agreement, the competent security authorities referred to in Article 4(1) shall confirm that the receiving Party is able to protect and safeguard such information in a manner consistent with the Implementing Arrangement. Article 10 Transmission of classified information 1. For the purposes of this Agreement: (a) all classified information released to the Union under this Agreement shall be sent through: (i) the Central Registry of the General Secretariat of the Council, if addressed to the European Council, the Council or the General Secretariat of the Council; (ii) the Secretariat-General Registry of the European Commission, if addressed to the European Commission; (iii) the EEAS EUCI Central Registry, if addressed to the High Representative or the EEAS; (b) all classified information released to ESA under this Agreement shall be sent to: ESA Security Office Largo Galileo Galilei, 1 I-00044 Frascati Italy. 2. If necessary for specific operational reasons, correspondence from one Party, including in electronic form, may be directly addressed to the other Party. The corresponding procedures shall be set out in the Implementing Arrangement. 3. Electronic transmission of classified information between the Union and ESA and between ESA and the Union shall be encrypted in accordance with the providing Party's requirements as set out in its applicable rules and regulations. The Implementing Arrangement shall set out the corresponding conditions under which each Party may transmit, store or process classified information, provided by the other Party, in their internal networks. Article 11 Security incidents 1. The competent security authority of a Party referred to in Article 4(1) shall inform without delay the competent security authority of the other Party of any proven or suspected cases of unauthorised disclosure or loss of classified information provided by the other Party. The competent security authority of the relevant Party shall conduct an investigation, with assistance from the other Party if required, and shall report the results to the other Party. 2. The competent security authorities referred to in Article 4(1) shall establish procedures to be followed in the event of a proven or suspected compromise of classified information subject to this Agreement, including notification to the other Party of the circumstances and action taken to prevent a recurrence. Article 12 Costs Each Party shall bear its own costs incurred in implementing this Agreement. Article 13 Other agreements This Agreement shall not preclude the Parties from concluding other agreements relating to the provision or exchange of classified information subject to this Agreement, provided that those agreements do not conflict with the provisions of this Agreement. 4/6 ELI: http://data.europa.eu/eli/agree/2024/1543/ojEN OJ L, 31.5.2024 Article 14 Oversight The Director-General of ESA, the Secretary-General of the Council, the Member of the European Commission responsible for security matters and the High Representative shall oversee the implementation of this Agreement. Article 15 Resolution of disputes Any differences between the Parties arising from the interpretation or application of this Agreement shall be addressed by negotiation between the Parties. During such negotiation, the Parties shall continue to fulfil their obligations under this Agreement. Article 16 Denunciation Either Party may denounce this Agreement by giving written notification to the other Party. This Agreement shall cease to be in force six months after the other Party receives such written notification, but shall not affect obligations already entered into under this Agreement. In particular, all classified information provided or exchanged under this Agreement shall continue to be handled in such a way that it is protected in accordance with the provisions of this Agreement. Article 17 Final provisions 1. This Agreement shall enter into force on the first day of the month following that during which the Parties have notified each other of the completion of the internal procedures necessary for that purpose. 2. Each Party shall notify the other Party of any changes in its rules and regulations that could affect the protection of classified information subject to this Agreement. 3. This Agreement may be reviewed for consideration of possible amendments at the request of either Party. 4. Any amendment to this Agreement shall be made in writing only and by common agreement of the Parties. Such amendment shall enter into force on the first day of the month following that during which the Parties have notified each other of the completion of the internal procedures necessary for that purpose. 5. The notifications by ESA referred to in Article 16 and in this Article shall be addressed, as far as the Union is concerned, to the Secretary-General of the Council. This Agreement shall be drawn up in duplicate in the English language. IN WITNESS WHEREOF, the undersigned, duly authorised to this effect, have signed this Agreement. Done at Brussels, this twenty-second day of May in the year two thousand and twenty-four. For the European Union For the European Space Agency ELI: http://data.europa.eu/eli/agree/2024/1543/oj 5/6EN OJ L, 31.5.2024 ANNEX JOINT DECLARATION BY THE EUROPEAN UNION AND THE EUROPEAN SPACE AGENCY ON THE AGREEMENT BETWEEN THE EUROPEAN UNION AND THE EUROPEAN SPACE AGENCY ON THE SECURITY AND EXCHANGE OF CLASSIFIED INFORMATION The adoption of Regulation (EU) 2021/696 (1) establishing the Union Space Programme and the European Union (EU) Agency for the Space Programme entrusted the European Space Agency (ESA) with a number of tasks given its expertise in the space domain. This, together with the numerous changes that have occurred over the last years on both EU and ESA sides, necessitated the revision of the Agreement between the European Space Agency and the European Union on the security and exchange of classified information (2), concluded in 2008. To that effect, the text of a new Agreement was negotiated and finalised by the two Parties. This Agreement lays down the standards for reciprocal protection and safeguarding of classified information provided or exchanged between ESA and the EU. At the time of the signature of this Agreement today, the two Parties hereby declare that this Agreement replaces the Agreement between ESA and the EU on the security and exchange of classified information signed in Brussels on 18 July 2008, which shall cease to apply as of the entry into force of this Agreement. (1) Regulation (EU) 2021/696 of the European Parliament and of the Council of 28 April 2021 establishing the Union Space Programme and the European Union Agency for the Space Programme and repealing Regulations (EU) No 912/2010, (EU) No 1285/2013 and (EU) No 377/2014 and Decision No 541/2014/EU (Official Journal of the European Union, L 170, 12.5.2021, p. 69) (2) Official Journal of the European Union, L 219, 14.8.2008, p. 59. 6/6 ELI: http://data.europa.eu/eli/agree/2024/1543/oj