Decision of the High Representative of the Union for Foreign Affairs and Security Policy of 19 June 2023 on the security rules for the European External Action Service 2023/C 263/04

• 11.The EEAS as contracting authority shall request the NSA/DSA or any other competent security authority which has issued an FSC to notify it of any adverse information affecting the FSC. In the case of a sub-contract, the NSA/DSA or any other competent security authority shall be informed accordingly.

• 12.Withdrawal of an FSC by the relevant NSA/DSA or any other competent security authority shall constitute sufficient grounds for the EEAS, as the contracting authority, to terminate a classified contract or exclude a bidder from the competition.

IV.   Personnel Security Clearances (PSCs) for Contractors’ personnel

• 13.All personnel working for contractors requiring access to EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or above shall have been appropriately security cleared and have a need-to-know to access the information. Although a PSC is not required for access to EUCI at the level of RESTREINT UE/EU RESTRICTED, the need-to-know for such access shall exist.

• 14.Applications for the PSCs for contractor personnel shall be made to the NSA/DSA responsible for the entity.

• 15.The EEAS shall point out to contractors wishing to employ a national of a third State in a position that requires access to EUCI, that it is the responsibility of the NSA/DSA of the Member State in which the hiring entity is located and incorporated to determine whether the individual can be granted access to such information, in accordance with this Decision, and to confirm that the originator’s consent must have been provided before such access is given.

V. CLASSIFIED CONTRACTS AND SUB-CONTRACTS

• 16.Where EUCI is provided to a bidder at the pre-contractual stage, the invitation to tender shall contain a provision obliging a bidder which fails to submit a bid or which is not selected to return all classified documents within a specified period of time.

• 17.Once a classified contract or sub-contract has been awarded, the EEAS, as the contracting authority, shall notify the contractor’s or subcontractor’s NSA/DSA or any other competent security authority about the security provisions of the classified contract.

• 18.When such contracts are terminated or they end, the EEAS, as the contracting authority (and/or the NSA/DSA or any other competent security authority, as appropriate, in the case of a sub-contract) shall promptly notify the NSA/DSA or any other competent security authority of the Member State in which the contractor or subcontractor is registered.

• 19.As a general rule, the contractor or subcontractor shall be required to return to the contracting authority, upon termination or ending of the classified contract or sub-contract, any EUCI held by it.

• 20.Specific provisions for the disposal of EUCI during the performance of the contract or upon its termination or ending shall be laid down in the SAL.

• 21.Where the contractor or subcontractor is authorised to retain EUCI after termination or ending of a contract, the minimum standards contained in this Decision shall continue to be complied with and the confidentiality of EUCI shall be protected by the contractor or subcontractor.

• 22.The conditions under which the contractor may subcontract shall be defined in the invitation to tender and in the contract.

• 23.A contractor shall obtain permission from the EEAS, as the contracting authority, before sub-contracting any parts of a classified contract. No subcontract may be awarded to industrial or other entities registered in a non-EU Member State which has not concluded a security of information Agreement with the EU.

• 24.The contractor shall be responsible for ensuring that all sub-contracting activities are undertaken in accordance with the minimum standards laid down in this Decision and shall not provide EUCI to a subcontractor without the prior written consent of the contracting authority.

• 25.With regard to EUCI created or handled by the contractor or subcontractor, the rights incumbent on the originator shall be exercised by the contracting authority.

VI.   VISITS IN CONNECTION WITH CLASSIFIED CONTRACTS

• 26.Where the EEAS, contractors or subcontractors require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in each other’s premises for the performance of a classified contract, visits shall be arranged by liaison with the NSAs/DSAs or any other competent security authority concerned. This is without prejudice to the prerogative of the NSAs/DSAs, in the context of specific projects, to agree on a procedure whereby such visits can be arranged directly.

• 27.All visitors shall hold an appropriate PSC and have a ‘need-to-know’ for access to the EUCI related to the EEAS contract.

• 28.Visitors shall be given access only to EUCI related to the purpose of the visit.

VII.   TRANSMISSION AND CARRIAGE OF EUCI

• 29.With regard to the transmission of EUCI by electronic means, the relevant provisions of Article 8 of Annex A, and of Annex A IV shall apply.

• 30.With regard to the carriage of EUCI, the relevant provisions of Annex A III shall apply, in accordance with national laws and regulations.

• 31.For the transport of classified material as freight, the following principles shall be applied when determining security arrangements:

• (a) security shall be assured at all stages during transportation from the point of origin to the final destination;

• (b) the degree of protection afforded to a consignment shall be determined by the highest classification level of material contained within it;

• (c) an FSC at the appropriate level shall be obtained for companies providing transportation, if it also implies that classified information is stored in contractors' facilities. In any case, personnel handling the consignment shall be appropriately security cleared in accordance with Annex A I;

• (d) prior to any cross-border movement of material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET, a transportation plan shall be drawn up by the consignor and approved by the EEAS when appropriate in liaison with the NSA/DSAs of both the consignor and the consignee or any other competent security authority concerned;

• (e) journeys shall be point to point to the extent possible, and shall be completed as quickly as circumstances permit;

• (f) whenever possible, routes should be only through Member States. Routes through States other than Member States should only be undertaken when authorised by the EEAS or any other competent security authority of the States of both the consignor and the consignee.

VIII.   TRANSFER OF EUCI TO CONTRACTORS LOCATED IN THIRD STATES

• 32.EUCI shall be transferred to contractors and subcontractors located in third States that have a valid security agreement with the EU in accordance with security measures agreed between the EEAS, as the contracting authority, and the NSA/DSA of the third State concerned where the contractor is registered.

IX.   HANDLING AND STORAGE OF INFORMATION CLASSIFIED RESTREINT UE/EU RESTRICTED

• 33.In liaison, as appropriate, with the NSA/DSA of the Member State the EEAS, as the contracting authority, shall be entitled to conduct visits to contractors’/subcontractors’ facilities on the basis of contractual provisions in order to verify that the relevant security measures for the protection of EUCI at the level RESTREINT UE/EU RESTRICTED as required under the contract have been put in place.

• 34.To the extent necessary under national laws and regulations, NSAs/DSAs or any other competent security authority shall be notified by the EEAS as the contracting authority of contracts or sub-contracts containing information classified RESTREINT UE/EU RESTRICTED.

• 35.An FSC or a PSC for contractors or subcontractors and their personnel shall not be required for contracts let by the EEAS containing information classified RESTREINT UE/EU RESTRICTED.

• 36.The EEAS, as the contracting authority, shall examine the responses to invitations to tender for contracts which require access to information classified RESTREINT UE/EU RESTRICTED, notwithstanding any requirement relating to FSC or PSC which may exist under national laws and regulations.

• 37.The conditions under which the contractor may subcontract shall be in accordance with paragraphs 22-24.

• 38.Where a contract involves handling information classified RESTREINT UE/EU RESTRICTED in a CIS operated by a contractor, the EEAS as contracting authority shall ensure that the contract or any sub-contract specifies the necessary technical and administrative requirements regarding accreditation of the CIS commensurate with the assessed risk, taking account of all relevant factors. The scope of accreditation of such CIS shall be agreed between the contracting authority and the relevant NSA/DSA.

ANNEX A VI

EXCHANGE OF CLASSIFIED INFORMATION WITH THIRD STATES AND INTERNATIONAL ORGANISATIONS

I. INTRODUCTION

• 1.This Annex sets out provisions for implementing Article 10 of Annex A.

II.   FRAMEWORKS GOVERNING THE EXCHANGE OF CLASSIFIED INFORMATION

• 2.The EEAS may exchange EUCI with third States or international organisations in accordance with Article 10(1) of Annex A.

• To support the HR in performing the responsibilities set out in Article 218 TFEU:

• (a) the relevant EEAS geographical or thematic department, in consultation with the Directorate responsible for HQ security and EEAS information security, shall, when appropriate, identify the need for a long term exchange of EUCI with the third State or international organisation concerned;

• (b) the Directorate responsible for HQ security and EEAS information security, in consultation with the relevant EEAS geographical department, shall, where appropriate, submit to the HR the draft texts to be proposed to the Council by virtue of Article 218(3),(5), and (6) of TFEU;

• (c) the Directorate responsible for HQ security and EEAS information security shall support the HR in conducting negotiations;

• (d) in relation to Agreements or Arrangements with third States for their participation in CSDP crisis management operations as referred to in Article 10(1)(c) of Annex A, the EEAS shall assist the HR for the proposals to be submitted to the Council in accordance with Article 218(3), (5) and (6) of TFEU, and shall support the HR in conducting negotiations.

• 3.Where Security of Information Agreements provide for technical Implementing Arrangements to be agreed between the Directorate responsible for HQ security and EEAS information security and the competent security authority of the third State or international organisation in question, such arrangements shall take account of the level of protection provided by the security regulations, structures and procedures in place in the third State or international organisation concerned. The Directorate responsible for HQ security and EEAS information security shall coordinate with the Security Directorate of the Directorate General for Human Resources and Security of the Commission and the Security Office of the General Secretariat of the Council with respect to such arrangements.

• 4.Where a long-term need exists for the EEAS to exchange information classified in principle no higher than RESTREINT UE/EU RESTRICTED with a third State or international organisation, and where it has been established that the party in question does not have a sufficiently developed security system for it to be possible to enter into a security of information agreement, the HR may, after having obtained the unanimous favourable opinion of the EEAS Security Committee in accordance with Article 15(5) of this Decision, enter into an Administrative Arrangement with the competent security authorities of the third State or international organisation in question.

• 5.No EUCI shall be exchanged by electronic means with a third State or international organisation unless explicitly provided for in the Security of Information Agreement or Administrative Arrangement.

• 6.Under an Administrative Arrangement on the exchange of classified information, the EEAS and the third State or International Organisation shall each designate a registry as the main point of entry and exit for classified information exchanged. For the EEAS, this will be the EEAS central registry.

• 7.Administrative Arrangements shall as a general rule take the form of an exchange of letters.

III   ASSESSMENT VISITS

• 8.Assessment visits referred to in Article 17 of this Decision shall be conducted by mutual agreement with the third State or international organisation concerned, and shall evaluate:

• (a) the regulatory framework applicable for protecting classified information;

• (b) any specific features of the third State or international organisation's security laws, regulations, policies or procedures which may have an impact on the maximum level of classified information that may be exchanged;

• (c) the security measures and procedures currently in place for the protection of classified information; and

• (d) security clearance procedures for the level of EUCI to be released.

• 9.No EUCI shall be exchanged before an assessment visit has been conducted and the level at which classified information may be exchanged between the parties has been determined, based on the equivalency of the level of protection that will be afforded to it.

• If, pending such an assessment visit, the HR is made aware of any exceptional or urgent reasons for exchanging classified information, the EEAS Security Authority shall:

• (a) first seek the originator's written consent to establish that there are no objections to release.

• (b) may decide to release, provided that the unanimous favourable opinion of the Member States as represented in the EEAS Security Committee has been obtained.

• If the EEAS cannot establish the originator, the EEAS Security Authority shall assume the originator's responsibility after having obtained the unanimous favourable opinion of the EEAS Security Committee.

IV.   AUTHORITY TO RELEASE EUCI TO THIRD STATES OR INTERNATIONAL ORGANISATIONS

• 10.Where a framework exists in accordance with Article 10(1) of Annex A for exchanging classified information with a third State or international organisation, the decision to release EUCI by the EEAS to a third State or international organisation shall be taken by the EEAS Security Authority.

• 11.If the originator of the classified information to be released, including the originators of source material it may contain, is not the EEAS, the EEAS Security Authority shall first seek the originator’s written consent to establish that there are no objections to release. If the EEAS cannot establish the originator, the EEAS Security Authority shall assume the originator’s responsibility after having obtained the unanimous favourable opinion of the Member States as represented in the EEAS Security Committee.

V. EXCEPTIONAL AD HOC RELEASE OF EUCI

• 12.In the absence of one of the frameworks referred to in Article 10(1) of Annex A, and when the interests of the EU or of one or more of its Member States require the release of EUCI for political, operational or urgent reasons, EUCI may exceptionally be released to a third State or international organisation once the following actions have been taken.

• The EEAS Security Authority, shall, after ensuring that conditions referred to in Paragraph 11 above are met:

• (a) to the extent possible, verify with the security authorities of the third State or international organisation concerned that its security regulations, structures and procedures are such that EUCI released to it will be protected in accordance with standards no less stringent than those laid down in this Decision;

• (b) invite the EEAS Security Committee to formulate an opinion, on the basis of the available information, regarding the confidence that can be placed on the security regulations, structures and procedures in the third State or international organisation to which the EUCI is to be released;

• (c) may decide to release, provided that the unanimous favourable opinion of the Member States as represented in the EEAS Security Committee has been obtained.

• 13.In the absence of one of the frameworks referred to in Article 10(1) of Annex A, the third party in question shall undertake in writing to protect the EUCI appropriately.

Appendix A

Definitions

For the purposes of this Decision, the following definitions apply:

• (a) ‘Accreditation’ means the process leading to a formal statement by the Security Accreditation Authority (SAA) that a system is approved to operate with a defined level of classification, in a particular security mode in its operational environment and at an acceptable level of risk, based on the premise that an approved set of technical, physical, organisational and procedural security measures has been implemented;

• (b) ‘Asset’ means anything that is of value to an organisation, its business operations and their continuity, including information resources that support the organisation’s mission;

• (c) ‘Authorisation to access EUCI’ means an authorisation by the EEAS Security Authority, which is taken in accordance with this Decision after a PSC has been issued by the competent authorities of a Member State, and which certifies that an individual may, provided his ‘need-to-know’ has been determined, be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date in accordance with Article 2 of Annex A I;

• (d) ‘Breach’ is an act or omission by an individual which is contrary to the security rules laid down in this Decision and/or to the security policies or guidelines setting out any measures necessary for its implementation;

• (e) ‘CIS life-cycle’ means the entire duration of existence of a CIS, which includes initiation, conception, planning, requirements analysis, design, development, testing, implementation, operation, maintenance and decommissioning;

• (f) ‘Classified contract’ means a contract entered into by the EEAS with a contractor for the supply of goods, execution of works or provision of services, the performance of which requires or involves access to or the creation of EUCI;

• (g) ‘Classified subcontract’ means a contract entered into by a contractor of the EEAS with another contractor (i.e. the subcontractor) for the supply of goods, execution of works or provision of services, the performance of which requires or involves access to or the creation of EUCI;

• (h) ‘Communication and information system’ (CIS) means any system enabling the handling of information in electronic form. A communication and information system shall comprise the entire assets required for it to operate, including the infrastructure, organisation, personnel and information resources;

• (i) ‘Compromise of EUCI’ means the total or partial disclosure of EUCI to unauthorised persons or entities – see Article 9(2);

• (j) ‘Contractor’ means an individual or legal entity possessing the legal capacity to undertake contracts;

• (k) ‘Cryptographic (Crypto) products’ are cryptographic algorithms, cryptographic hardware and software modules, and products including implementation details and associated documentation and keying material;

• (l) ‘CSDP operation’ means a military or civilian crisis management operation under Title V, Chapter 2, of the TEU;

• (m) ‘Declassification’ means the removal of any security classification;

• (n) ‘Defence in depth’ means the application of a range of security measures organised as multiple layers of defence;

• (o) ‘Designated Security Authority’ (DSA) means an authority responsible to the National Security Authority (NSA) of a Member State which is responsible for communicating to industrial or other entities national policy on all matters of industrial security and for providing direction and assistance in its implementation. The function of DSA may be carried out by the NSA or by any other competent authority;

• (p) ‘Document’ means any recorded information regardless of its physical form or characteristics;

• (q) ‘Downgrading’ means a reduction in the level of security classification;

• (r) ‘EU classified information’ (EUCI) means any information or material the unauthorized disclosure of which could cause varying degrees of prejudice to the interests of the European Union or of one or more of the Member States, designated by an EU security classification – see Article 2 (f);

• (s) ‘Facility Security Clearance’ (FSC) means an administrative determination by an NSA or DSA that, from the security viewpoint, a facility can afford an adequate level of protection to EUCI of a specified security classification level and its personnel who require access to EUCI have been appropriately security cleared and briefed on the relevant security requirements necessary to access and protect EUCI;

• (t) ‘Handling’ of EUCI means all possible actions to which EUCI may be subject throughout its life-cycle. It comprises its creation, processing, carriage, downgrading, declassification and destruction. In relation to CIS it also comprises its collection, display, transmission and storage;

• (u) ‘Holder’ means a duly authorised individual with an established need-to-know who is in possession of an item of EUCI and is accordingly responsible for protecting it;

• (v) ‘Industrial or other entity’ means an entity involved in supplying goods, executing works or providing services; this may be an industrial, commercial, service, scientific, research, educational or development entity or a self-employed individual;

• (w) ‘Industrial security’ is the application of measures to ensure the protection of EUCI by contractors or subcontractors in pre-contract negotiations and throughout the life-cycle of classified contracts – see Article 9 (1) of Annex A;

• (x) ‘Information Assurance’ in the field of communication and information systems is the confidence that such systems will protect the information they handle and will function as they need to, when they need to, under the control of legitimate users. Effective IA shall ensure appropriate levels of confidentiality, integrity, availability, non-repudiation and authenticity. IA shall be based on a risk management process — see Article 8(1) of Annex A;

• (y) ‘Interconnection’ means, for the purposes of this Decision, the direct connection of two or more IT systems for the purpose of sharing data and other information resources (e.g. communication) in a unidirectional or multidirectional way— see Annex A IV, paragraph 31;

• (z) ‘Management of classified information’ is the application of administrative measures for controlling EUCI throughout its life-cycle to supplement the measures provided for in Articles 5, 6 and 8 and thereby help deter, detect and recover from deliberate or accidental compromise or loss of such information. Such measures relate in particular to the creation, registration, copying, translation, carriage, handling, storage and destruction of EUCI — see Article 7(1) of Annex A;

• (aa) ‘Material’ means any document or item of machinery or equipment, either manufactured or in the process of manufacture;

• (bb) ‘Originator’ means the EU institution, agency or body, Member State, third state or international organisation under whose authority classified information has been created and/or introduced into the EU"s structures;

• (cc) ‘Personnel security’ is the application of measures to ensure that access to EUCI is granted only to individuals who have:
• — a need-to-know;
• — for access to CONFIDENTIEL UE/EU CONFIDENTIAL information or above, been security cleared to the relevant level, or are otherwise duly authorised by virtue of their functions in accordance with national laws and regulations; and
• — been briefed on their responsibilities - in accordance with Article 5(1) of Annex A;

• (dd) ‘Personnel Security Clearance’ (PSC) for access to EUCI means a statement by a competent authority of a Member State which is made following completion of a security investigation conducted by the competent authorities of a Member State and which certifies that an individual may, provided his ‘need-to-know’ has been determined, be granted access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above) until a specified date; the individual thus described is said to be ‘security cleared’;

• (ee) ‘Personnel Security Clearance Certificate’ (PSCC) means a certificate issued by a competent authority establishing that an individual is security cleared and holds a valid PSC or Authorisation from Director for HQ security and EEAS information security for access to EUCI, and which shows the level of EUCI to which that individual may be granted access (CONFIDENTIEL UE/EU CONFIDENTIAL or above), the date of validity of the relevant PSC and the date of expiry of the certificate itself;

• (ff) ‘Physical security’ is the application of physical and technical protective measures to deter unauthorised access to EUCI - see Article 6 of Annex A;

• (gg) ‘Programme/Project Security Instruction’ (PSI) means a list of security procedures which are applied to a specific programme/project in order to standardise security procedures. It may be revised throughout the programme/project;

• (hh) ‘Registration’ means the application of procedures that record the life-cycle of information, including its dissemination and destruction - see Annex A III, paragraph 21;

• (ii) ‘Residual risk’ means the risk which remains after security measures have been implemented, given that not all threats are countered and not all vulnerabilities can be eliminated;

• (jj) ‘Risk’ means the potential that a given threat will exploit internal and external vulnerabilities of an organisation or of any of the systems it uses and thereby cause harm to the organisation and to its tangible or intangible assets. It is measured as a combination of the likelihood of threats occurring and their impact;

• (kk) ‘Risk acceptance’ is the decision to agree to the further existence of a residual risk after risk treatment.

• (ll) ‘Risk assessment’ consists of identifying threats and vulnerabilities and conducting the related risk analysis, i.e. the analysis of probability and impact.

• (mm) ‘Risk communication’ consists of developing awareness of risks among CIS user communities, informing approval authorities such risks and reporting them to operating authorities.

• (nn) ‘Risk management process’ means the entire process of identifying, controlling and minimising uncertain events that may affect the security of an organisation or of any of the systems it uses. It covers the entirety of risk-related activities, including assessment, treatment, acceptance and communication;

• (oo) ‘Risk treatment’ consists of mitigating, removing, reducing (through an appropriate combination of technical, physical, organisational or procedural measures), transferring or monitoring the risk.

• (pp) ‘Security Aspects Letter’ (SAL) means a set of special contractual conditions issued by the contracting authority which forms an integral part of any classified contract involving access to or the creation of EUCI, that identifies the security requirements or those elements of the contract requiring security protection – see Annex A V, Section II;

• (qq) ‘Security Classification Guide’ (SCG) means a document which describes the elements of a programme or contract which are classified, specifying the applicable security classification levels. The SCG may be expanded throughout the life of the programme or contract and the elements of information may be re-classified or downgraded; where an SCG exists it shall be part of the SAL – see Annex A V, Section II;

• (rr) ‘Security investigation’ means the investigative procedures conducted by the competent authority of a Member State in accordance with its national laws and regulations in order to obtain an assurance that nothing adverse is known which would prevent an individual from being granted a national or EU PSC for access to EUCI up to a specified level (CONFIDENTIEL UE/EU CONFIDENTIAL or above);

• (ss) ‘Security Operating Procedures’ (SecOPs) means a description of the security policy implementation to be adopted, of the operating procedures to be followed and of the personnel responsibilities;

• (tt) ‘Sensitive non-classified information’ means information or material that the EEAS must protect because of legal obligations laid down in the Treaties or in acts adopted in implementation thereof, and/or because of its sensitivity. Sensitive non-classified information includes, but is not limited to, information or material covered by the obligation of professional secrecy, as referred to in Article 339 TFEU, information covered by the interests protected in Article 4 of Regulation (EC) No 1049/2001 ([^E0004]) read in conjunction with the relevant case-law of the Court of Justice of the European Union, or personal data within the scope of Regulation (EU) 2018/1725.

• (uu) ‘Specific Security Requirement Statement’ (SSRS) means a binding set of security principles to be observed and of detailed security requirements to be implemented, underlying the process of certification and accreditation of CIS;

• (vv) ‘TEMPEST’ means the investigation, study and control of compromising electromagnetic emanations and the measures to suppress them;

• (ww) ‘Threat’ means a potential cause of an unwanted incident which may result in harm to an organisation or any of the systems it uses; such threats may be accidental or deliberate (malicious) and are characterised by threatening elements, potential targets and attack methods;

• (xx) ‘Vulnerability’ means a weakness of any nature that can be exploited by one or more threats. Vulnerability may be an omission or it may relate to a weakness in controls in terms of their strength, completeness or consistency and may be of a technical, procedural, physical, organisational or operational nature.

Appendix B

Equivalence of security classification

Germany: VS = Verschlusssache.

Information generated by France before 1 July 2021 and classified ‘TRÈS SECRET DÉFENSE’, ‘SECRET DÉFENSE’ and ‘CONFIDENTIEL DÉFENSE’ continue to be handled and protected at the equivalent level of ‘TRÈS SECRET UE/EU TOP SECRET’, ‘SECRET UE/EU SECRET’ and ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ respectively.

France handles and protects ‘CONFIDENTIEL UE/EU CONFIDENTIAL’ information in accordance with the French security measures for protecting ‘SECRET’ information.

France does not use the classification ‘RESTREINT’ in its national system. France handles and protects ‘RESTREINT UE/EU RESTRICTED’ information in a manner no less stringent than the standards and procedures described in the security rules of the Council of the European Union.

The Maltese and English markings for Malta can be used interchangeably.

[^E0001]: Staff regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union, hereinafter referred to as ‘the Staff Regulations’

[^E0002]: Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (OJ L 295, 21.11.2018, p. 39).

[^E0003]: OJ C 126 10.4.2018, p. 1.

[^E0004]: Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).