On the proposal for a regulation of the European Parliament and of the Council on information security in the institutions, bodies, offices and agencies of the Union
AFCO-AD-730186
Committee on Constitutional Affairs · Rapporteur: Maite Pagazaurtundúa
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
The Committee on Constitutional Affairs gives its opinion on the proposed regulation on information security in the Union's institutions, bodies, offices and agencies. It proposes 52 amendments to the Commission proposal.¶¶¶ The amendments add common minimum standards, an interinstitutional approach to sharing EUCI and sensitive non-classified information, and a Coordination Group that can adopt recommendations and monitor compliance.¶¶¶ They require institutions to safeguard the integrity of EU democratic processes, vet contractors and terminate relationships that pose a risk to democratic processes.¶¶ They set deadlines of one week for reporting breaches, require EUCI documents to go to the Historical Archives after 30 years, and require SNC information to be stored and processed exclusively in the Union.¶¶¶
Committee position. The Committee on Constitutional Affairs welcomes the proposal and proposes 52 amendments to strengthen common minimum standards, interinstitutional cooperation, monitoring by the Coordination Group, and protection against foreign interference.¶¶
Key points
- The committee calls on the Committee on Civil Liberties, Justice and Home Affairs, as committee responsible, to take into account its amendments.¶
- The amendments require an interinstitutional approach to sharing EUCI and sensitive non-classified information, with common categories and key handling principles, and simplified procedures.¶
- They state it is high time that effective rules ensuring a common level of information security in all Union institutions and bodies be laid down, with common minimum standards.¶
- They delete the recital excluding Euratom Classified Information from the regulation's scope.¶
- They require the Coordination Group to adopt recommendations and provisions to enhance policy coherence, set up subgroups, and take account of training for personnel.¶¶
- They require institutions to safeguard the integrity of EU democratic processes and adopt provisions in tender procedures to curb foreign interference, covering security infrastructure, vetting and staff clearance.¶
- They require the Coordination Group to monitor compliance through a yearly evaluation report and carry out risk assessments on foreign interference in EUCI.¶¶
- They require institutions to mark information 'PUBLIC USE', establish streamlined incident reporting procedures, and store and process SNC information exclusively in the Union.¶¶¶
- They set a consultation procedure between Parliament and the Commission when there is doubt about the confidential nature of information or its classification level.¶
- They require holders of EUCI to be legally responsible for its protection, including under the Treaties, relevant criminal law and the Staff Regulations.¶
- They require notification of breaches to the originator and competent authorities no later than one week after the Security Authority is informed.¶¶
- They require EUCI documents to be transferred to the Historical Archives after 30 years, with effective measures to protect them from unauthorised access prior to declassification.¶
Who is affected
- Union institutions and bodies: must apply common minimum information security rules and safeguard EU democratic processes.¶¶
- Contractors and third parties: subject to vetting in tender procedures and possible termination of relationships posing risks.¶
- National Security Authorities of member states: benefit from a common glossary and procedures in personnel security.¶
- European Parliament and Commission: must consult each other on classification doubts before transmitting documents.¶