title: Council Decision of 25 June 2013 appointing a member of the Court of Auditors

text:
               26.6.2013

               EN

               Official Journal of the European Union

               C 180/12

         COUNCIL DECISION
   of 25 June 2013
   appointing a member of the Court of Auditors
   2013/C 180/05
   THE COUNCIL OF THE EUROPEAN UNION,
   Having regard to the Treaty on the Functioning of the European Union, and in particular Article 286(2) thereof,
   Having regard to the opinion of the European Parliament (1),
   Whereas:

               (1)

               The term of office of Mr Ovidiu ISPIR is due to expire on 30 June 2013.

               (2)

               A new appointment should therefore be made,

         HAS ADOPTED THIS DECISION:
   Article 1
   Mr George PUFAN is hereby appointed member of the Court of Auditors for the period from 1 July 2013 to 30 June 2019.
   Article 2
   This Decision shall enter into force on the date of its adoption.

      Done at Luxembourg, 25 June 2013.

            For the Council

            The President

         E. GILMORE

      (1)  Opinion of 12 June 2013 (not yet published in the Official Journal).


title: Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission

text:
               11.1.2017

               EN

               Official Journal of the European Union

               L 6/40

         COMMISSION DECISION (EU, Euratom) 2017/46
   of 10 January 2017
   on the security of communication and information systems in the European Commission
   THE EUROPEAN COMMISSION,
   Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof,
   Having regard to the Treaty establishing the European Atomic Energy Community,
   Whereas:

               (1)

               The Commission's communication and information systems are an integral part of the functioning of the Commission and IT security incidents can have a serious impact on the Commission's operations as well as on third parties, including individuals, businesses and Member States.

               (2)

               There are many threats that can harm the confidentiality, integrity or availability of the Commission's communication and information systems and of the information processed therein. These threats include accidents, errors, deliberate attacks and natural events, and need to be recognised as operational risks.

               (3)

               Communication and information systems need to be provided with a level of protection commensurate with the likelihood, impact and nature of the risks to which they are exposed.

               (4)

               IT security in the Commission should ensure that the Commission's CISs protect the information they process and they function as they need to, when they need to, under the control of legitimate users.

               (5)

               The IT security policy of the Commission should be implemented in a manner which is consistent with the policies on security in the Commission.

               (6)

               The Security Directorate of the Directorate-General for Human Resources and Security has the general responsibility for security in the Commission under the authority and responsibility of the Member of the Commission responsible for security.

               (7)

               The Commission's approach should take into account EU policy initiatives and legislation on network and information security, industry standards and good practices, to comply with all relevant legislation and to allow interoperability and compatibility.

               (8)

               Appropriate measures should be developed and implemented by the Commission departments responsible for communication and information systems and IT security measures for protecting communication and information systems should be coordinated across the Commission to ensure efficiency and effectiveness.

               (9)

               Rules and procedures for access to information in the context of IT security, including IT security incident handling, should be proportionate to the threat to the Commission or its staff and compliant with the principles laid down in Regulation (EC) No 45/2001 of the European Parliament and of the Council (1), on the protection of individuals with regard to the processing of personal data by the Union institutions and bodies and on the free movement of such data and taking account of the principle of professional secrecy, as provided in Article 339 of the TFEU.

               (10)

               The policies and rules for communication and information systems processing EU classified information (EUCI), sensitive non-classified information, and unclassified information are to be fully in line with Commission Decisions (EU, Euratom) 2015/443 (2) and (EU, Euratom) 2015/444 (3).

               (11)

               There is a need for the Commission to review and update the provisions on the security of communication and information systems used by the Commission.

               (12)

               The Commission Decision C(2006) 3602 should therefore be repealed,

         HAS ADOPTED THIS DECISION:
   CHAPTER 1

      GENERAL PROVISIONS

   Article 1
   Subject matter and scope
   1.   This decision applies to all communication and information systems (CISs) which are owned, procured, managed or operated by or on behalf of the Commission and all usage of those CISs by the Commission.
   2.   This decision sets out the basic principles, objectives, organisation and responsibilities regarding the security of those CISs, and in particular for Commission departments owning, procuring, managing or operating CISs and including CISs provided by an internal IT service provider. When a CIS is provided, owned, managed or operated by an external party on the basis of a bilateral agreement or contract with the Commission, the terms of the agreement or contract shall comply with this decision.
   3.   This decision applies to all Commission departments and Executive Agencies. When a Commission CIS is used by other bodies and institutions on the basis of a bilateral agreement with the Commission, the terms of the agreement shall comply with this decision.
   4.   Notwithstanding any specific indications concerning particular groups of staff, this decision shall apply to the Members of the Commission, to Commission staff falling under the scope of the Staff Regulations of Officials of the European Union (the ‘Staff Regulations’) and the Conditions of Employment of Other Servants of the Union (the ‘CEOS’) (4), to national experts seconded to the Commission (‘SNEs’) (5), to external service providers and their staff, to trainees and to any individual with access to CIS in the scope of this decision.
   5.   This Decision shall apply to the European Anti-Fraud Office (OLAF) in so far as this is compatible with Union legislation and Commission Decision 1999/352/EC, ECSC, Euratom (6). In particular, measures provided for in this Decision, including instructions, inspections, inquiries and equivalent measures, may not apply to the CIS of the Office where this is not compatible with the independence of the Office's investigative function and/or the confidentiality of information obtained by the Office in the exercise of this function.
   Article 2
   Definitions
   For the purposes of this Decision the following definitions shall apply:

               (1)

               ‘Accountable’ means to be answerable for actions, decisions and performance.

               (2)

               ‘CERT-EU’ is the Computer Emergency Response Team for the EU institutions and agencies. Its mission is to support the European Institutions to protect themselves against intentional and malicious attacks that would hamper the integrity of their IT assets and harm the interests of the EU. The scope of CERT-EU's activities covers prevention, detection, response and recovery.

               (3)

               ‘Commission department’ means any Commission Directorate-General or service, or any Cabinet of a Member of the Commission.

               (4)

               ‘Commission Security Authority’ refers to the role laid down in Decision (EU, Euratom) 2015/444.

               (5)

               ‘Communication and information system’ or ‘CIS’ means any system enabling the handling of information in electronic form, including all assets required for its operation, as well as infrastructure, organisation, personnel and information resources. This definition includes business applications, shared IT services, outsourced systems, and end-user devices.

               (6)

               ‘Corporate Management Board’ (CMB) provides the highest level of corporate management oversight for operational and administrative issues in the Commission.

               (7)

               ‘Data owner’ means the individual responsible for ensuring the protection and use of a specific data set handled by a CIS.

               (8)

               ‘Data set’ means a set of information which serves a specific business process or activity of the Commission.

               (9)

               ‘Emergency procedure’ means a predefined set of methods and responsibilities for responding to urgent situations in order to prevent a major impact on the Commission.

               (10)

               ‘Information security policy’ means a set of information security objectives, which are or have to be established, implemented and checked. It comprises, but is not limited to, Decisions (EU, Euratom) 2015/444 and (EU, Euratom) 2015/443.

               (11)

               ‘Information Security Steering Board’ (ISSB) means the governance body that supports the Corporate Management Board in its IT-security-related tasks.

               (12)

               ‘Internal IT service provider’ means a Commission department providing shared IT services.

               (13)

               ‘IT security’ or ‘security of CIS’ means the preservation of confidentiality, integrity and availability of CISs and the data sets that they process.

               (14)

               ‘IT security guidelines’ consist of recommended but voluntary measures that help support IT security standards or serve as a reference when no applicable standard is in place.

               (15)

               ‘IT security incident’ means an event that could adversely affect the confidentiality, integrity or availability of a CIS.

               (16)

               ‘IT security measure’ means a technical or organisational measure aimed at mitigating IT security risks,

               (17)

               ‘IT security need’ means a precise and unambiguous definition of the levels of confidentiality, integrity and availability associated with a piece of information or an IT system with a view to determining the level of protection required.

               (18)

               ‘IT security objective’ means a statement of intent to counter specified threats and/or satisfy specified organisational security requirements or assumptions.

               (19)

               ‘IT security plan’ means the documentation of the IT security measures required to meet the IT security needs of a CIS.

               (20)

               ‘IT security policy’ means a set of IT security objectives, which are or have to be established, implemented and checked. It comprises this decision and its implementing rules.

               (21)

               ‘IT security requirement’ means a formalised IT security need through a predefined process.

               (22)

               ‘IT security risk’ means an effect that an IT security threat might induce on a CIS by exploiting a vulnerability. As such, an IT security risk is characterised by two factors: (1) uncertainty, i.e. the likelihood of an IT security threat to cause an unwanted event; and (2) impact, i.e. the consequences that such an unwanted event may have on a CIS.

               (23)

               ‘IT security standards’ means specific mandatory IT security measures that help enforce and support the IT security policy.

               (24)

               ‘IT security strategy’ means a set of projects and activities which are designed to achieve the objectives of the Commission and which have to be established, implemented and checked.

               (25)

               ‘IT security threat’ means a factor that can potentially lead to an unwanted event which may result in harm to a CIS. Such threats may be accidental or deliberate and are characterised by threatening elements, potential targets and attack methods.

               (26)

               ‘Local Informatics Security Officer’ or ‘LISO’ means the officer who is responsible for IT security liaison for a Commission department.

               (27)

               ‘Personal data’, ‘processing of personal data’, ‘controller’ and ‘personal data filing system’ shall have the same meaning as in Regulation (EC) No 45/2001, and in particular Article 2 thereof.

               (28)

               ‘Processing of information’ means all functions of a CIS with respect to data sets, including creation, modification, display, storage, transmission, deletion and archiving of information. Processing of information can be provided by a CIS as a set of functionalities to users and as IT services to other CIS.

               (29)

               ‘Professional secrecy’ means the protection of business data information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their cost components as laid down in Article 339 of the TFEU.

               (30)

               ‘Responsible’ means having the obligation to act and take decisions to achieve required outcomes.

               (31)

               ‘Security in the Commission’ means the security of persons, assets and information in the Commission, and in particular the physical integrity of persons and assets, the integrity, confidentiality and availability of information and communication and information systems, as well as the unobstructed functioning of Commission operations.

               (32)

               ‘Shared IT service’ means the service a CIS provides to other CISs in the processing of information.

               (33)

               ‘System owner’ is the individual responsible for the overall procurement, development, integration, modification, operation, maintenance, and retirement of a CIS.

               (34)

               ‘User’ means any individual who uses functionality provided by a CIS, whether inside or outside the Commission.

         Article 3
   Principles for IT security in the Commission
   1.   IT security in the Commission shall be based on the principles of legality, transparency, proportionality and accountability.
   2.   IT security issues shall be taken into account from the start of the development and implementation of Commission CISs. In order to do so, the Directorate-General for Informatics and the Directorate-General for Human Resources and Security shall be involved for their respective areas of responsibility.
   3.   Effective IT security shall ensure appropriate levels of:

               (a)

               authenticity: the guarantee that information is genuine and from bona fide sources;

               (b)

               availability: the property of being accessible and usable upon request by an authorised entity;

               (c)

               confidentiality: the property that information is not disclosed to unauthorised individuals, entities or processes.

               (d)

               integrity: the property of safeguarding the accuracy and completeness of assets and information;

               (e)

               non-repudiation: the ability to prove an action or event has taken place, so that this event or action cannot subsequently be denied;

               (f)

               protection of personal data: the provision of appropriate safeguards in regard to personal data in full compliance with Regulation (EC) No 45/2001;

               (g)

               professional secrecy: the protection of information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their cost components as laid down in Article 339 of the TFEU.

         4.   IT security shall be based on a risk management process. This process shall aim at determining the levels of IT security risks and defining security measures to reduce such risks to an appropriate level and at a proportionate cost.
   5.   All CIS shall be identified, assigned to a system owner and recorded in an inventory.
   6.   The security requirements of all CIS shall be determined on the basis of their security needs and of the security needs of the information they process. CIS that provide services to other CIS may be designed to support specified levels of security needs.
   7.   IT security plans and IT security measures shall be proportionate to the security needs of the CIS.
   The processes related to these principles and activities shall be further detailed in implementing rules.
   CHAPTER 2

      ORGANISATION AND RESPONSIBILITIES

   Article 4
   Corporate Management Board
   The Corporate Management Board shall take the overall responsibility for the governance of IT security as a whole within the Commission.
   Article 5
   Information Security Steering Board (ISSB)
   1.   The ISSB shall be chaired by the Deputy Secretary-General responsible for IT security governance in the Commission. Its members shall represent business, technology and security interests across the Commission departments and include representatives of the Directorate-General for Informatics, the Directorate-General for Human Resources and Security, the Directorate-General for Budget, and, on a 2-year rotating basis, representatives of four other Commission departments involved where IT security is a major concern for their operations. Membership is at senior management level.
   2.   The ISSB shall support the Corporate Management Board in its IT-security-related tasks. The ISSB shall take the operational responsibility for the governance of IT security as a whole within the Commission.
   3.   The ISSB shall recommend the Commission's IT security policy for adoption by the Commission.
   4.   The ISSB shall review and report biannually to the Corporate Management Board on governance matters as well as on IT-security-related issues, including serious IT security incidents.
   5.   The ISSB shall monitor and review the overall implementation of this decision and report on it to the Corporate Management Board.
   6.   On the proposal of the Directorate-General for Informatics, the ISSB shall review, approve and monitor the implementation of the rolling IT security strategy. The ISSB shall report on it to the Corporate Management Board.
   7.   The ISSB shall monitor, evaluate and control the corporate information risk treatment landscape and shall have the power to issue formal requirements for improvements wherever necessary.
   The processes related to these responsibilities and activities shall be further detailed in implementing rules.
   Article 6
   The Directorate-General for Human Resources and Security
   In relation to IT security, the Directorate-General for Human Resources and Security has the following responsibilities. It shall:

               (1)

               assure alignment between the IT security policy and the Commission's information security policy;

               (2)

               establish a framework for the authorisation of the use of encrypting technologies for the storage and communication of information by CISs;

               (3)

               inform the Directorate-General for Informatics about specific threats which could have a significant impact on the security of CISs and the data sets that they process;

               (4)

               perform IT security inspections to assess the compliance of the Commission's CISs with the security policy, and report the results to the ISSB;

               (5)

               establish a framework for the authorisation of access and the associated appropriate security rules to Commission CISs from external networks and develop the related IT security standards and guidelines in close cooperation with the Directorate-General for Informatics;

               (6)

               propose principles and rules for the outsourcing of CISs in order to maintain appropriate control of security of the information;

               (7)

               develop the related IT security standards and guidelines in relation to Article 6, in close cooperation with the Directorate-General for Informatics.

         The processes related to these responsibilities and activities shall be further detailed in implementing rules.
   Article 7
   The Directorate-General for Informatics
   In relation to the overall IT security of the Commission, the Directorate-General for Informatics has the following responsibilities. It shall:

               (1)

               develop IT security standards and guidelines, except as provided in Article 6, in close cooperation with the Directorate-General for Human Resources and Security, in order to assure consistency between the IT security policy and the Commission's information security policy, and propose them to the ISSB;

               (2)

               assess the IT security risk management methods, processes and outcomes of all Commission departments and report on this regularly to the ISSB;

               (3)

               propose a rolling IT security strategy for revision and approval by the ISSB and further adoption by the Corporate Management Board, and propose a programme, including the planning of projects and activities implementing the IT security strategy;

               (4)

               monitor the execution of the Commission's IT security strategy and report on this regularly to the ISSB;

               (5)

               monitor the IT security risks and IT security measures implemented in CISs and report on this regularly to the ISSB;

               (6)

               report regularly on the overall implementation and compliance with this decision to the ISSB;

               (7)

               after consulting with the Directorate-General for Human Resources and Security, request system owners to take specific IT security measures in order to mitigate IT security risks to Commission's CISs;

               (8)

               ensure that there is an adequate catalogue of the Directorate-General for Informatics IT security services available for the system owners and data owners to fulfil their responsibilities for IT security and to comply with the IT security policy and standards;

               (9)

               provide adequate documentation to system and data owners and consult with them, as appropriate, on the IT security measures implemented for their IT services in order to facilitate compliance with the IT security policy and support the system owners in IT risk management;

               (10)

               organise regular meetings of the LISOs network and supporting LISOs in carrying out their duties;

               (11)

               define the training needs and coordinate training programmes on IT security in cooperation with the Commission departments, and develop, implement and coordinate awareness-raising campaigns on IT security in close cooperation with the Directorate-General for Human Resources;

               (12)

               ensure that system owners, data owners and other roles with IT security responsibilities in Commission departments are made aware of the IT security policy;

               (13)

               inform the Directorate-General for Human Resources and Security on specific IT security threats, incidents and exceptions to the Commission's IT security policy notified by the system owners which could have a significant impact on security in the Commission;

               (14)

               in respect of its role as an internal IT service provider, deliver to the Commission a catalogue of shared IT services that provide defined levels of security. This shall be done by systematically assessing, managing and monitoring IT security risks to implement the security measures in order to reach the defined security level.

         The related processes and more detailed responsibilities shall be further defined in implementing rules.
   Article 8
   Commission departments
   In relation to IT security in their department, each Head of Commission department shall:

               (1)

               formally appoint a system owner, who is an official or a temporary agent, for each CIS who will be responsible for IT security of that CIS and formally appoint a data owner for each data set handled in a CIS who should belong to the same administrative entity which is the Data Controller for data sets subject to Regulation (EC) No 45/2001;

               (2)

               formally designate a Local Informatics Security Officer (LISO) who can perform the responsibilities independently from system owners and data owners. A LISO can be designated for one or more Commission departments

               (3)

               ensure that appropriate IT security risk assessments and IT security plans have been made and implemented

               (4)

               ensure that a summary of IT security risks and measures is reported on a regular basis to the Directorate-General for Informatics;

               (5)

               ensure, with the support of the Directorate-General for Informatics, that appropriate processes, procedures and solutions are in place to ensure efficient detection, reporting and resolution of IT security incidents relating to their CISs;

               (6)

               launch an emergency procedure in case of IT security emergencies;

               (7)

               hold ultimate accountability for IT security including the responsibilities of the system owner and data owner;

               (8)

               own the risks relating to their CISs and data sets;

               (9)

               resolve any disagreements between data owners and system owners and in case of continued disagreement bring the issue before the ISSB for resolution;

               (10)

               ensure that IT security plans and IT security measures are implemented and the risks are adequately covered.

         The processes related to these responsibilities and activities shall be further detailed in implementing rules.
   Article 9
   System owners
   1.   The system owner is responsible for the IT security of the CIS, and reports to the Head of the Commission department.
   2.   In relation to IT security, the system owner shall:

               (a)

               ensure the compliance of the CIS with the IT security policy;

               (b)

               ensure that the CIS is accurately recorded in the relevant inventory;

               (c)

               assess IT security risks and determine the IT security needs for each CIS, in collaboration with the data owners and in consultation with the Directorate-General for Informatics;

               (d)

               prepare a security plan, including, where appropriate, details of the assessed risks and any additional security measures required;

               (e)

               implement appropriate IT security measures, proportionate to the IT security risks identified and follow recommendations endorsed by the ISSB;

               (f)

               identify any dependencies on other CISs or shared IT services and implement security measures as appropriate based on the security levels proposed by those CISs or shared IT services;

               (g)

               manage and monitor IT security risks;

               (h)

               report regularly to the head of the Commission department on the IT security risk profile of their CIS and report to the Directorate-General for Informatics on the related risks, risk management activities and security measures taken;

               (i)

               consult the LISO of the relevant Commission department(s) on aspects of IT Security;

               (j)

               issue instructions for users on the use of the CIS and associated data as well as on the responsibilities of users related to CIS;

               (k)

               request authorisation from the Directorate-General for Human Resources and Security, acting as the Crypto Authority, for any CIS that uses encrypting technology.

               (l)

               consult the Commission Security Authority in advance concerning any system processing EU classified information;

               (m)

               ensure that back-ups of any decryption keys are stored in an escrow account. The recovery of encrypted data shall be carried out only when authorised in accordance with the framework defined by the Directorate-General for Human Resources and Security;

               (n)

               respect any instructions from the relevant Data Controller(s) concerning the protection of personal data and the application of data protection rules on security of the processing;

               (o)

               notify the Directorate-General for Informatics of any exceptions to the Commission's IT security policy including relevant justifications;

               (p)

               report any unresolvable disagreements between the data owner and the system owner to the head of the Commission department, communicate IT security incidents to the relevant stakeholders in a timely manner as appropriate according to their severity as laid down in Article 15;

               (q)

               for outsourced systems, ensure that appropriate IT security provisions are included in the outsourcing contracts and that IT security incidents occurring in the outsourced CIS are reported in accordance with Article 15;

               (r)

               for CIS providing shared IT services, ensure that a defined security level is provided, clearly documented and security measures are implemented for that CIS in order to reach the defined security level.

         3.   System owners may formally delegate some or all of their IT security tasks but they remain responsible for the IT security of their CIS
   The processes related to these responsibilities and activities shall be further detailed in implementing rules.
   Article 10
   Data owners
   1.   The data owner is responsible for the IT security of a specific data set to the Head of the Commission department and is accountable for the confidentiality, integrity and availability of the data set.
   2.   In relation to this data set, the data owner shall:

               (a)

               ensure that all data sets under his or her responsibility are appropriately classified in accordance with Decision (EU, Euratom) 2015/443 and (EU, Euratom) 2015/444;

               (b)

               define the information security needs and inform the relevant system owners of these needs;

               (c)

               participate in the CIS risk assessment;

               (d)

               report any unresolvable disagreements between the data owner and the system owner to the head of the Commission department;

               (e)

               communicate IT security incidents as provided for in Article 15.

         3.   Data owners may formally delegate some or all of their IT security tasks but they maintain their responsibilities as defined in this Article.
   The processes related to these responsibilities and activities shall be further detailed in implementing rules.
   Article 11
   Local Informatics Security Officers (LISOs)
   In relation to IT security, the LISO shall:

               (a)

               proactively identify and inform system owners, data owners and other roles with IT security responsibilities in Commission department(s) about the IT security policy;

               (b)

               liaise on IT-security-related issues in Commission department(s) with the Directorate-General for Informatics as part of the LISO network;

               (c)

               attend the regular LISO meetings;

               (d)

               maintain an overview of the information security risk management process and of the development and implementation of information system security plans;

               (e)

               advise data owners, system owners and heads of Commission departments on IT-security-related issues;

               (f)

               cooperate with the Directorate-General for Informatics in disseminating good IT security practices and propose specific awareness-raising and training programmes;

               (g)

               report on IT security, identify shortfalls and improvements to the Head of the Commission department(s).

         The processes related to these responsibilities and activities shall be further detailed in implementing rules.
   Article 12
   Users
   1.   In relation to IT security, users shall:

               (a)

               comply with the IT security policy and the instructions issued by the system owner on the use of each CIS;

               (b)

               communicate IT security incidents as provided for in Article 15.

         2.   Use of the Commission's CIS in breach of the IT security policy or instructions issued by the system owner may give rise to disciplinary proceedings.
   The processes related to these responsibilities and activities shall be further detailed in implementing rules
   CHAPTER 3

      SECURITY REQUIREMENTS AND OBLIGATIONS

   Article 13
   Implementation of this Decision
   1.   The adoption of the implementing rules on Article 6, and of the related standards and guidelines, will be subject to an empowerment decision by the Commission in favour of the Member of the Commission responsible for security matters.
   2.   The adoption of all other implementing rules in relation to this decision, and of the related IT security standards and guidelines, will be subject to an empowerment decision by the Commission in favour of the Member of the Commission responsible for informatics.
   3.   The ISSB shall approve the implementing rules, standards and guidelines mentioned under paragraphs 1 and 2 above prior to their adoption.
   Article 14
   Obligation to comply
   1.   Compliance with the provisions outlined in the IT security policy and standards is mandatory.
   2.   Non-compliance with the IT security policy and standards may trigger liability to disciplinary action in accordance with the Treaties, the Staff Regulations and the CEOS, to contractual sanctions and/or to legal action under national laws and regulations.
   3.   The Directorate-General for Informatics shall be notified of any exceptions to the IT security policy.
   4.   In the event the ISSB decides there is a persistent unacceptable risk to a CIS of the Commission, the Directorate-General for Informatics in cooperation with the system owner shall propose mitigating measures to the ISSB for approval. These measures may, amongst others, include reinforced monitoring and reporting, service limitations and disconnection.
   5.   The ISSB shall impose the implementation of approved mitigating measures wherever necessary. The ISSB may also recommend to the Director-General of the Directorate-General for Human Resources and Security to open an administrative enquiry. The Directorate-General for Informatics shall report to the ISSB on every situation when mitigating measures are imposed.
   The processes related to these responsibilities and activities shall be further detailed in implementing rules
   Article 15
   IT security incident handling
   1.   The Directorate-General for Informatics is responsible for providing the principal operational IT security incident response capability within the European Commission.
   2.   The Directorate-General for Human Resources and Security as contributing stakeholders to the IT security incident response shall:

               (a)

               have the right to access summary information for all incident records and full records upon request;

               (b)

               participate in IT security incidents crisis management groups and IT security emergency procedures;

               (c)

               be in charge of relations with law enforcement and intelligence services;

               (d)

               perform forensic analysis regarding cyber-security in accordance with Article 11 of Decision (EU, Euratom) 2015/443;

               (e)

               decide on the need to launch a formal inquiry;

               (f)

               inform the Directorate-General for Informatics of any IT security incidents that may present a risk to other CISs.

         3.   Regular communications shall take place between the Directorate-General for Informatics and the Directorate-General for Human Resources and Security to exchange information and coordinate the handling of security incidents, in particular any IT security incident that may require a formal inquiry.
   4.   The incident coordination services of Computer Emergency Response Team for the European institutions, bodies and agencies (‘CERT-EU’) may be used to support the incident handling process when appropriate and for knowledge sharing with other EU institutions and agencies that may be affected.
   5.   System owners involved in an IT security incident shall:

               (a)

               immediately notify their Head of Commission Departments, the Directorate-General for Informatics, the Directorate-General for Human Resources, the LISO and, where appropriate, the data owner of any major IT security incidents, in particular those involving a breach of data confidentiality;

               (b)

               cooperate and follow the instructions of the relevant Commission authorities on incident communication, response and remediation.

         6.   Users shall report all actual or suspected IT security incidents to the relevant IT helpdesk in a timely manner.
   7.   Data owners shall report all actual or suspected IT security incidents to the relevant IT security incident response team in a timely manner.
   8.   The Directorate-General for Informatics, with support from the other contributing stakeholders, is responsible for handling any IT security incident detected in relation to Commission CISs that are not outsourced systems.
   9.   The Directorate-General for Informatics shall inform affected Commission departments about IT security incidents, the relevant LISOs and, where appropriate, the CERT-EU on a need-to-know basis.
   10.   The Directorate-General for Informatics shall regularly report on major IT security incidents affecting the Commission's CIS to the ISSB.
   11.   The relevant LISO shall, upon request, have access to IT security incident records concerning the CIS of the Commission department.
   12.   In case of a major IT security incident, the Directorate-General for Informatics shall be the contact point for the management of the crisis situations by coordinating the IT security incidents crisis management groups.
   13.   In case of an emergency the Director-General of the Directorate-General for Informatics can decide to launch an IT security emergency procedure. The Directorate-General for Informatics shall develop emergency procedures to be approved by the ISSB.
   14.   The Directorate-General for Informatics shall report on the execution of emergency procedures to the ISSB and the heads of Commission departments affected.
   The processes related to these responsibilities and activities shall be further detailed in implementing rules.
   CHAPTER 4

      FINAL PROVISIONS

   Article 16
   Transparency
   This Decision shall be brought to the attention of Commission staff and to all individuals to whom it applies, and published in the Official Journal of the European Union.
   Article 17
   Relation to other acts
   The provisions of this decision are without prejudice to Decision (EU, Euratom) 2015/443, Decision (EU, Euratom) 2015/444, Regulation (EC) No 45/2001, Regulation (EC) No 1049/2001 of the European Parliament and of the Council (7), Commission Decision 2002/47/EC, ECSC, Euratom (8), Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council (9), Decision 1999/352/EC, ECSC, Euratom.
   Article 18
   Repeal and transitional measures
   Decision C(2006) 3602 of 16 August 2006 is repealed.
   The implementing rules and IT security standards adopted pursuant to Article 10 of Decision C(2006) 3602 shall remain in effect insofar as they do not conflict with this decision, until they are replaced by the implementing rules and standards to be adopted under Article 13 of this decision. Any reference to Article 10 of Decision C(2006)3602 shall be read as a reference to Article 13 of this decision.
   Article 19
   Entry into force
   This decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

      Done at Brussels, 10 January 2017.

            For the Commission

            The president

         Jean-Claude JUNCKER

      (1)  Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

      (2)  Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (OJ L 72, 17.3.2015, p. 41).

      (3)  Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information (OJ L 72, 17.3.2015, p. 53).

      (4)  Laid down by Council Regulation (EEC, Euratom, ECSC) No 259/68 of 29 February 1968 laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Communities and instituting special measures temporarily applicable to officials of the Commission (Conditions of Employment of Other Servants) (OJ L 56, 4.3.1968, p. 1).

      (5)  Commission Decision of 12 November 2008 laying down rules on the secondment to the Commission of national experts and national experts in professional training (C(2008) 6866 final).

      (6)  Commission Decision 1999/352/EC, ECSC, Euratom of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (OJ L 136, 31.5.1999, p. 20).

      (7)  Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).

      (8)  Commission Decision 2002/47/EC, ECSC, Euratom of 23 January 2002 amending its Rules of Procedure (OJ L 21, 24.1.2002, p. 23).

      (9)  Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1).


title: European Parliament decision on the request for waiver of the immunity of Mr Johannes Voggenhuber (2000/2238(IMM))

text:
C 27 E/32                                   Official Journal of the European Communities                        EN      31.1.2002
Thursday 3 May 2001
                                                        TEXTS ADOPTED
            1. Request for waiver of immunity of Mr Sichrovsky
            A5-0123/2001
            European Parliament decision on the request for waiver of the immunity of Mr Peter Sichrovsky
                                                          (2000/2237(IMM))
            The European Parliament,
                having received a request for waiver of the immunity of Mr Peter Sichrovsky, forwarded by Mr Weis,
                 Judge at the Vienna Criminal Court, on 12 September 2000 and announced in plenary sitting on
                 5 October 2000,
                having heard Mr Sichrovsky, in accordance with Rule 6(3) of its Rules of Procedure,
                having regard to Articles 9 and 10 of the Protocol on the Privileges and Immunities of the European
                 Communities of 8 April 1965, and to Article 4(2) of the Act concerning the Election of Represen-
                 tatives to the European Parliament by direct universal suffrage of 20 September 1976,
                having regard to the judgments of the Court of Justice of the European Communities of 12 May 1964
                 and 10 July 1986 (1),
                having regard to Article 57 of the Austrian Constitution,
                having regard to Rule 6 of its Rules of Procedure,
                having regard to the report of the Committee on Legal Affairs and the Internal Market (A5-0123/
                 2001),
            1.    Decides not to waive the parliamentary immunity of Mr Sichrovsky;
            2.    Instructs its President immediately to forward this decision and the report of its committee to the
            appropriate authority of the Republic of Austria.
            (1) See Case 101/63: Wagner v. Fohrmann and Krier [1964] ECR 397 and Case 149/85: Wybot v. Faure [1986] ECR
                2403.
            2. Request for waiver of immunity of Mr Voggenhuber
            A5-0124/2001
            European Parliament decision on the request for waiver of the immunity of Mr Johannes Voggen-
                                                       huber (2000/2238(IMM))
            The European Parliament,
                having received a request for waiver of the immunity of Mr Johannes Voggenhuber, forwarded by
                 Judge Bruno Weis of the Vienna Criminal Court, on 12 September 2000 and announced in plenary
                 sitting on 5 October 2000,
                having heard Mr Johannes Voggenhuber pursuant to Rule 6(3) of its Rules of Procedure, which
                 requested the waiver of his parliamentary immunity,
 ---pagebreak--- 31.1.2002      EN                         Official Journal of the European Communities                                   C 27 E/33
                                                                                Thursday 3 May 2001
              having regard to Articles 9 and 10 of the Protocol on the Privileges and Immunities of the European
               Communities of 8 April 1965, and to Article 4(2) of the Act concerning the Election of Represen-
               tatives to the European Parliament by direct universal suffrage of 20 September 1976,
              having regard to the judgments of the Court of Justice of the European Communities of 12 May 1964
               and 10 July 1986 (1),
              having regard to Article 57 of the Austrian Constitution,
              having regard to Rule 6 of its Rules of Procedure,
              having regard to the report of the Committee on Legal Affairs and the Internal Market (A5-0124/
               2001),
          1.    Decides not to waive the immunity of Mr Johannes Voggenhuber;
          2.    Instructs its President immediately to forward this decision and the report of its committee to the
          appropriate authority of the Republic of Austria.
          (1) See Case 101/63: Wagner v. Fohrmann and Krier [1964] ECR 397 and Case 149/85: Wybot v. Faure [1986] ECR
              2403.
          3. Request for waiver of immunity of Mrs Elisabeth Jeggle
          A5-0126/2001
          European Parliament decision on the request for waiver of the immunity of Mrs Elisabeth Jeggle
                                                        (2001/2031(IMM))
          The European Parliament,
              having received a request from Münsingen District Court for waiver of the immunity of Mrs Elisabeth
               Jeggle, forwarded by the German Federal Ministry of Justice on 12 January 2001 and announced in
               plenary sitting on 12 February 2001,
              having heard Mrs Elisabeth Jeggle pursuant to Rule 6(3) of its Rules of Procedure, who has requested
               waiver of her parliamentary immunity,
              having regard to Article 10 of the Protocol on the Privileges and Immunities of the European Com-
               munities of 8 April 1965, and to Article 4(2) of the Act concerning the election of the representatives
               of the European Parliament by direct universal suffrage of 20 September 1976,
              having regard to the judgments of the Court of Justice of the European Communities of 12 May 1964
               and 10 July 1986 (1),
              having regard to Article 46 of the German Basic Law,
              having regard to Rule 6 of its Rules of Procedure,
              having regard to the report of the Committee on Legal Affairs and the Internal Market (A5-0126/
               2001),
          (1) See Case 101/63: Wagner v. Fohrmann and Krier [1964] ECR 397 and Case 149/85: Wybot v. Faure [1986] ECR
              2403.


title: 2014/46/EU: Council Decision of 28 January 2014 appointing three United Kingdom alternate members of the Committee of the Regions

text:
               30.1.2014

               EN

               Official Journal of the European Union

               L 27/59

         COUNCIL DECISION
   of 28 January 2014
   appointing three United Kingdom alternate members of the Committee of the Regions
   (2014/46/EU)
   THE COUNCIL OF THE EUROPEAN UNION,
   Having regard to the Treaty on the Functioning of the European Union, and in particular Article 305 thereof,
   Having regard to the proposal of the United Kingdom Government,
   Whereas:

               (1)

               On 22 December 2009 and on 18 January 2010, the Council adopted Decisions 2009/1014/EU (1) and 2010/29/EU (2) appointing the members and alternate members of the Committee of the Regions for the period from 26 January 2010 to 25 January 2015.

               (2)

               Three alternate members’ seats on the Committee of the Regions have become vacant following the end of the terms of office of Ms Kathy POLLARD, Ms Mary ROBINSON and Ms Sharon TAYLOR,

         HAS ADOPTED THIS DECISION:
   Article 1
   The following are hereby appointed as alternate members to the Committee of the Regions for the remainder of the current term of office, which runs until 25 January 2015:

               —

               Ms Sherma BATSON, Councillor, Stevenage Borough Council,

               —

               Ms Gillian FORD, Councillor, London Borough of Havering,

               —

               Ms Kathy POLLARD, Councillor, Babergh District Council.

         Article 2
   This Decision shall enter into force on the day of its adoption.

      Done at Brussels, 28 January 2014.

            For the Council

            The President

         G. STOURNARAS

      (1)  OJ L 348, 29.12.2009, p. 22.

      (2)  OJ L 12, 19.1.2010, p. 11.


title: Council Decision 2008/666/CFSP of 24 July 2008 concerning the conclusion of an Agreement between the European Union and the Swiss Confederation on the participation of the Swiss Confederation in the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO

text:
               13.8.2008

               EN

               Official Journal of the European Union

               L 217/23

         COUNCIL DECISION 2008/666/CFSP
   of 24 July 2008
   concerning the conclusion of an Agreement between the European Union and the Swiss Confederation on the participation of the Swiss Confederation in the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO
   THE COUNCIL OF THE EUROPEAN UNION,
   Having regard to the Treaty on European Union, and in particular Article 24 thereof,
   Having regard to the recommendation from the Presidency,
   Whereas:

               (1)

               On 4 February 2008, the Council adopted Joint Action 2008/124/CFSP on the European Union Rule of Law Mission in Kosovo (EULEX KOSOVO) (1).

               (2)

               Article 13(4) of that Joint Action provides that detailed arrangements regarding the participation of third States shall be laid down in an agreement to be concluded in accordance with Article 24 of the Treaty on European Union.

               (3)

               On 13 December 2004, the Council authorised the Presidency, assisted where necessary by the Secretary-General/High Representative, in case of future EU civilian crisis management operations, to open negotiations with third States with a view to concluding an agreement on the basis of a model agreement between the European Union and a third State on the participation of a third State in a European Union civilian crisis management operation. On that basis, the Presidency negotiated an Agreement with the Swiss Confederation on the participation of the Swiss Confederation in the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO.

               (4)

               The Agreement should be approved,

         HAS DECIDED AS FOLLOWS:
   Article 1
   The Agreement between the European Union and the Swiss Confederation on the participation of the Swiss Confederation in the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO, is hereby approved on behalf of the European Union.
   The text of the Agreement is attached to this Decision.
   Article 2
   The President of the Council is hereby authorised to designate the person(s) empowered to sign the Agreement in order to bind the European Union.
   Article 3
   This Decision shall take effect on the day of its adoption.
   Article 4
   This Decision shall be published in the Official Journal of the European Union.

      Done at Brussels, 24 July 2008.

            For the Council

            The President

         B. HORTEFEUX

      (1)  OJ L 42, 16.2.2008, p. 92.
    ---documentbreak---

               13.8.2008

               EN

               Official Journal of the European Union

               L 217/24

         AGREEMENT
   between the European Union and the Swiss Confederation on the participation of the Swiss Confederation in the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO
   THE EUROPEAN UNION (EU),
   of the one part, and
   THE SWISS CONFEDERATION,
   of the other part,
   hereinafter referred to as the ‘Parties’,
   TAKING INTO ACCOUNT:
   the adoption by the Council of the European Union of Joint Action 2008/124/CFSP of 4 February 2008 on the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO,
   the invitation to the Swiss Confederation to participate in the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO,
   the successful completion of the Force Generation process and the recommendation by the EU Civilian Operation Commander and the Committee for Civilian Aspects of Crisis Management to agree on the participation of the Swiss Confederation in the EU-led operation,
   the Political and Security Committee Decision EULEX/2/2008 of 22 April 2008 on the acceptance of the Swiss Confederation’s contribution to the EU Rule of Law Mission in Kosovo, EULEX KOSOVO,
   HAVE AGREED AS FOLLOWS:
   Article 1
   Participation in the operation
   1.   The Swiss Confederation shall associate itself with the Joint Action 2008/124/CFSP of 4 February 2008 on the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO (hereinafter ‘EULEX KOSOVO’), and with any Joint Action or Decision by which the Council of the European Union decides to extend EULEX KOSOVO, in accordance with the provisions of this Agreement and any required implementing arrangements.
   2.   The contribution of the Swiss Confederation to EULEX KOSOVO is without prejudice to the decision-making autonomy of the European Union.
   3.   The Swiss Confederation shall ensure that its personnel participating in the EULEX KOSOVO undertake their mission in conformity with:

               —

               the Joint Action 2008/124/CFSP on European Union Rule of Law Mission in Kosovo, EULEX KOSOVO and possible subsequent amendments,

               —

               the Operation Plan,

               —

               implementing measures.

         4.   Personnel seconded to EULEX KOSOVO by the Swiss Confederation shall carry out their duties and conduct themselves solely with the interest of EULEX KOSOVO in mind.
   5.   The Swiss Confederation shall inform in due time the Civilian Operation Commander and the Head of Mission of EULEX KOSOVO (hereinafter ‘Head of Mission’) of any change to its contribution to EULEX KOSOVO.
   6.   Personnel seconded to EULEX KOSOVO shall undergo a medical examination, vaccination and be certified medically fit for duty by a competent authority from the Swiss Confederation. Personnel seconded to EULEX KOSOVO shall produce a copy of this certification.
   Article 2
   Status of personnel
   1.   The status of the personnel contributed to EULEX KOSOVO by the Swiss Confederation shall be governed by the provisions on the status of mission, as provided by Article 10(1) of the Joint Action 2008/124/CFSP of 4 February on the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO.
   2.   The status of personnel contributed to headquarters or command elements located outside Kosovo, shall be governed by arrangements between the headquarters and command elements concerned and the Swiss Confederation.
   3.   Without prejudice to the agreement on the status of mission referred to in paragraph 1 of this Article, if available, the Swiss Confederation shall exercise jurisdiction over its personnel participating in EULEX KOSOVO.
   4.   The Swiss Confederation shall be responsible for answering any claims, from or concerning any of its personnel, linked to the participation in EULEX KOSOVO. The Swiss Confederation shall be responsible for bringing any action, in particular legal or disciplinary, against any of its personnel, in accordance with its laws and regulations.
   5.   The Swiss Confederation undertakes to make a declaration as regards the waiver of claims against any State participating in EULEX KOSOVO, and to do so when signing this Agreement. A model for such a declaration is annexed to this Agreement.
   6.   The European Union Member States undertake to make a declaration as regards the waiver of claims, for the participation of the Swiss Confederation in EULEX KOSOVO, and to do so when signing this Agreement. A model for such a declaration is annexed to this Agreement.
   Article 3
   Classified information
   1.   The Swiss Confederation shall take appropriate measures to ensure that EU classified information is protected in accordance with the European Union Council’s security regulations, contained in Council Decision 2001/264/EC of 19 March 2001, and in accordance with further guidance issued by competent authorities, including the Head of Mission.
   2.   Where the EU and the Swiss Confederation have concluded an agreement on security procedures for the exchange of classified information, the provisions of such an agreement shall apply in the context of EULEX KOSOVO.
   Article 4
   Chain of command
   1.   All personnel participating in EULEX KOSOVO shall remain under the full command of their national authorities.
   2.   National authorities shall transfer operational control to the Civilian Operations Commander, who shall exercise command and control at the strategic level.
   3.   The Head of Mission shall assume responsibility and exercise command and control of EULEX KOSOVO at theatre level.
   4.   The Head of Mission shall exercise command and control over personnel, teams and units from contributing States as assigned by the Civilian Operation Commander together with administrative and logistic responsibility including over assets, resources and information placed at the disposal of EULEX KOSOVO.
   5.   The Swiss Confederation shall have the same rights and obligations in terms of the day-to-day management of the operation as participating European Union Member States taking part in the operation, in accordance with the legal instruments referred to in Article 1, paragraph 1, of this Agreement.
   6.   The Head of Mission shall be responsible for disciplinary control over the personnel of EULEX KOSOVO. Where required, disciplinary action shall be taken by the national authority concerned.
   7.   A National Contingent Leader (NCL) shall be appointed by the Swiss Confederation to represent its national contingent in EULEX KOSOVO. The NCL shall report to the Head of Mission on national matters and shall be responsible for day-to-day contingent discipline.
   8.   The decision to end the operation shall be taken by the European Union, following consultation with the Swiss Confederation, provided that the Swiss Confederation is still contributing to EULEX KOSOVO at the date of termination of the operation.
   Article 5
   Financial aspects
   1.   The Swiss Confederation shall assume all the costs associated with its participation in the operation apart from the costs which are subject to common funding, as set out in the operational budget of the operation.
   2.   In case of death, injury, loss or damage to natural or legal persons from the territory where the operation is conducted, the Swiss Confederation shall, when its liability has been established, pay compensation under the conditions foreseen in the agreement on the status of mission, if available, as referred to in Article 2(1) of this Agreement.
   Article 6
   Arrangements to implement the Agreement
   Any necessary technical and administrative arrangements in pursuance of the implementation of this Agreement shall be concluded between the Secretary-General of the Council of the European Union/High Representative for the Common Foreign and Security Policy, and the appropriate authorities of the Swiss Confederation.
   Article 7
   Non-compliance
   Should one of the Parties fail to comply with its obligations laid down in the previous Articles, the other Party shall have the right to terminate this Agreement by serving a notice of one month.
   Article 8
   Dispute settlement
   Disputes concerning the interpretation or application of this Agreement shall be settled by diplomatic means between the Parties.
   Article 9
   Entry into force
   1.   This Agreement shall enter into force on the first day of the first month after the Parties have notified each other of the completion of the internal procedures necessary for this purpose.
   2.   This Agreement shall be provisionally applied from the date of signature.
   3.   This Agreement shall remain in force for the duration of the Swiss Confederation’s contribution to the operation.

      Done at Brussels, 29 July 2008.

            For the European Union

            For the Swiss Confederation

   ANNEX
   DECLARATIONS
   Declaration by the EU Member States
   The EU Member States applying the EU Joint Action 2008/124/CFSP on the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO, will endeavour, insofar as their internal legal systems so permit, to waive as far as possible claims against the Swiss Confederation for injury, death of their personnel, or damage to, or loss of, any assets owned by themselves and used by EULEX KOSOVO if such injury, death, damage or loss was caused by personnel from the Swiss Confederation in the execution of their duties in connection with EULEX KOSOVO, except in case of gross negligence or wilful misconduct, or arose from the use of any assets owned by the Swiss Confederation, provided that the assets were used in connection with the operation and except in case of gross negligence or wilful misconduct of the personnel of EULEX KOSOVO from the Swiss Confederation using those assets.
   Declaration by the Swiss Confederation
   As a participant to the European Union Rule of Law Mission in Kosovo, EULEX KOSOVO, established by the EU Joint Action 2008/124/CFSP, the Swiss Confederation will endeavour, insofar as its internal legal system so permits, to waive as far as possible claims against any other State participating in EULEX KOSOVO for injury, death of its personnel, or damage to, or loss of, any assets owned by itself and used by EULEX KOSOVO if such injury, death, damage or loss was caused by personnel in the execution of their duties in connection with EULEX KOSOVO, except in case of gross negligence or wilful misconduct, or arose from the use of any assets owned by States participating in EULEX KOSOVO, provided that the assets were used in connection with the operation and except in case of gross negligence or wilful misconduct of the personnel of EULEX KOSOVO using those assets.


Avis juridique important

|

31998D1022(01)

Council Decision of 13 October 1998 appointing the members of the Scientific and Technical Committee

Official Journal C 324 , 22/10/1998 P. 0001 - 0001

COUNCIL DECISION of 13 October 1998 appointing the members of the Scientific and Technical Committee (98/C 324/01)THE COUNCIL OF THE EUROPEAN UNION,Having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 134 thereof,Having regard to the opinion of the Commission,Whereas, by its Decision of 7 February 1994 (1), as supplemented by its Decisions of 6 October 1997 (2), the Council appointed the members of the Scientific and Technical Committee for the period 1 April 1993 to 31 March 1998,HAS DECIDED AS FOLLOWS:Article 1 The following are hereby appointed members of the Scientific and Technical Committee for the period 1 April 1998 to 31 March 2003:Mr Th. VAN RENTERGEMMr Cl. A. TRUFFINMr H. B. MØLLERProfessor Dr A. BIRKHOFERProfessor Dr H.-H. HENNIESProfessor Dr Ch. STREFFERProfessor Dr M. KAUFMANNMr W. BÜRKLEMr A. KATSANOSMr R. CARO MANSOMr A. GRAU MALONDAMr J. M. MARTÍNEZ-VALMr B. BARRÉMr L. PATARINMr P. CASEAUMr J.-F. LACRONIQUEMr P. LALLEMANDDr F. J. MULLIGANMr C. MANCINIDr A. AIRAGHIMr R. ANDREANIDr G. DAMIANIMr R. DE FELICEMr H. WAGENERMr H. VAN DER LAANMr A. H. M. VERKOOIJENProfessor Dr M. HEINDLERProfessor Dr P. HILLEProfessor J. M. RIBEIRO MOREIRA DE ARAÚJOProfessor J. CARVALHO SOARESProfessor A. VUORINENMr L. HÖGBERGMr S. BJURSTRÖMDr D. POOLEYDr S. IONDr A. DUNCANDr S. A. HARBISONMr D. ANDERSONArticle 2 The appointment of each of the persons listed in Article 1 of this Decision shall take effect on the date on which the Council received acceptance of that person's appointment.Done at Brussels, 13 October 1998.For the CouncilThe PresidentC. EINEM(1) OJ C 48, 16.2.1994, p. 5.(2) OJ C 321, 22.10.1997, pp. 7 and 8.


Avis juridique important

|

31998D1017(02)

Council Decision of 12 October 1998 appointing a member of the Advisory Committee of the Euratom Supply Agency

Official Journal C 320 , 17/10/1998 P. 0002 - 0002

COUNCIL DECISION of 12 October 1998 appointing a member of the Advisory Committee of the Euratom Supply Agency (98/C 320/02)THE COUNCIL OF THE EUROPEAN UNION,Having regard to the Treaty establishing the European Atomic Energy Community, and in particular the second and third paragraphs of Article 54 thereof,Having regard to Article X of the Statutes of the Euratom Supply Agency (1), as last amended by Decision 95/1/EC/Euratom/ECSC of 1 January 1995 (2),Having regard to the Council Decision of 27 June 1997 appointing the members of the Advisory Committee of the Euratom Supply Agency (3),Having regard to the opinion of the Commission,Whereas a member's seat on the aforementioned Committee has become vacant following the resignation of Mr Thierry DUJARDIN, which was brought to the Council's attention on 30 June 1998;Whereas this vacancy should be filled;Having regard to the nomination submitted by the French Government on 30 June 1998,HAS DECIDED AS FOLLOWS:Sole Article Mr Eric PROUST is hereby appointed a member of the Advisory Committee of the Euratom Supply Agency for the remainder of the Committee's term of office, that is until 28 March 1999.Done at Luxembourg, 12 October 1998.For the CouncilThe PresidentR. EDLINGER(1) OJ 27, 6.12.1958, p. 534/58.(2) OJ L 1, 1.1.1995, p. 1.(3) OJ C 210, 11.7.1997, p. 3.


title: Council Decision (EU) 2015/904 of 17 December 2014 on the signing and provisional application, on behalf of the European Union, of the Protocol to the Euro-Mediterranean Agreement establishing an Association between the European Community and its Member States, of the one part, and the People's Democratic Republic of Algeria, of the other part, on a Framework Agreement between the European Union and the People's Democratic Republic of Algeria on the general principles for the participation of the People's Democratic Republic of Algeria in Union programmes

text:
               13.6.2015

               EN

               Official Journal of the European Union

               L 148/1

         COUNCIL DECISION (EU) 2015/904
   of 17 December 2014
   on the signing and provisional application, on behalf of the European Union, of the Protocol to the Euro-Mediterranean Agreement establishing an Association between the European Community and its Member States, of the one part, and the People's Democratic Republic of Algeria, of the other part, on a Framework Agreement between the European Union and the People's Democratic Republic of Algeria on the general principles for the participation of the People's Democratic Republic of Algeria in Union programmes
   THE COUNCIL OF THE EUROPEAN UNION,
   Having regard to the Treaty on the Functioning of the European Union, and in particular Article 212 in conjunction with Article 218(5) and (7) thereof,
   Having regard to the proposal from the European Commission,
   Whereas:

               (1)

               On 18 June 2007, the Council authorised the Commission to negotiate a Protocol to the Euro-Mediterranean Agreement establishing an Association between the European Community and its Member States, of the one part, and the People's Democratic Republic of Algeria, of the other part (1), on a Framework Agreement between the European Union and the People's Democratic Republic of Algeria on the general principles for the participation of the People's Democratic Republic of Algeria in Union programmes (‘the Protocol’).

               (2)

               The negotiations have been concluded.

               (3)

               The objective of the Protocol is to lay down the financial and technical rules enabling the People's Democratic Republic of Algeria to participate in certain Union programmes. The horizontal framework established by the Protocol constitutes an economic, financial and technical cooperation measure which allows for access to assistance, in particular financial assistance, to be provided by the Union pursuant to the Union programmes. This framework applies only to those Union programmes for which the relevant constitutive legal acts provide for the possibility of the participation of the People's Democratic Republic of Algeria. The signing and provisional application of the Protocol therefore does not entail the exercise of powers, under the various sectoral policies pursued by the programmes, which are exercised when establishing the programmes.

               (4)

               The Protocol should be signed on behalf of the Union and applied on a provisional basis, subject to the completion of the procedures necessary for its conclusion,

         HAS ADOPTED THIS DECISION:
   Article 1
   The signing, on behalf of the Union, of the Protocol to the Euro-Mediterranean Agreement establishing an Association between the European Community and its Member States, of the one part, and the People's Democratic Republic of Algeria, of the other part, on a Framework Agreement between the European Union and the People's Democratic Republic of Algeria on the general principles for the participation of the People's Democratic Republic of Algeria in Union programmes is hereby authorised, subject to its conclusion.
   The text of the Protocol is attached to this Decision.
   Article 2
   The President of the Council is hereby authorised to designate the person(s) empowered to sign the Protocol on behalf of the Union.
   Article 3
   The Protocol shall be applied on a provisional basis from the date of its signature (2), pending the completion of the procedures necessary for its conclusion.
   Article 4
   The Commission is authorised to determine, on behalf of the Union, the specific terms and conditions applicable to the participation of the People's Democratic Republic of Algeria in any given Union programme, including the financial contribution payable. The Commission will keep the relevant Council working party informed.
   Article 5
   This Decision shall enter into force on the day of its adoption.

      Done at Brussels, 17 December 2014.

            For the Council

            The President

         G. L. GALLETTI

      (1)  OJ L 265, 10.10.2005, p. 2.

      (2)  The date of signing the Protocol will be published in the Official Journal of the European Union by the General Secretariat of the Council.


title: 2009/237/EC: Decision of the European Parliament of 22 April 2008 on discharge in respect of the implementation of the budget of the European GNSS Supervisory Authority for the financial year 2006

text:
               31.3.2009

               EN

               Official Journal of the European Union

               L 88/262

         DECISION OF THE EUROPEAN PARLIAMENT
   of 22 April 2008
   on discharge in respect of the implementation of the budget of the European GNSS Supervisory Authority for the financial year 2006
   (2009/237/EC)
   THE EUROPEAN PARLIAMENT,
   having regard to the final annual accounts of the European GNSS Supervisory Authority for the financial year 2006 (1),
   having regard to the Court of Auditors' report on the final annual accounts of the European GNSS Supervisory Authority for the financial year 2006, together with the Authority's replies (2),
   having regard to the Council's recommendation of 12 February 2008 (5843/2008 — C6-0084/2008),
   having regard to the EC Treaty, and in particular Article 276 thereof,
   having regard to Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (3), and in particular Article 185 thereof,
   having regard to Council Regulation (EC) No 1321/2004 of 12 July 2004 on the establishment of structures for the management of the European satellite radio-navigation programmes (4), and in particular Article 12 thereof,
   having regard to Commission Regulation (EC, Euratom) No 2343/2002 of 19 November 2002 on the framework Financial Regulation for the bodies referred to in Article 185 of Council Regulation (EC, Euratom) No 1605/2002 (5), and in particular Article 94 thereof,
   having regard to Rule 71 of and Annex V to its Rules of Procedure,
   having regard to the report of the Committee on Budgetary Control (A6-0127/2008),

               1.

               Grants the Executive Director of the European GNSS Supervisory Authority discharge in respect of the implementation of the Authority's budget for the financial year 2006;

               2.

               Sets out its observations in the Resolution below;

               3.

               Instructs its President to forward this Decision and the Resolution that forms an integral part of it to the Executive Director of the European GNSS Supervisory Authority, the Council, the Commission and the Court of Auditors, and to arrange for their publication in the Official Journal of the European Union (L series).

            The President

         Hans-Gert PÖTTERING

            The Secretary-General

         Harald RØMER

      (1)  OJ C 261, 31.10.2007, p. 38.

      (2)  OJ C 309, 19.12.2007, p. 72.

      (3)  OJ L 248, 16.9.2002, p. 1.

      (4)  OJ L 246, 20.7.2004, p. 1.

      (5)  OJ L 357, 31.12.2002, p. 72.
    ---documentbreak---

               31.3.2009

               EN

               Official Journal of the European Union

               L 88/263

         RESOLUTION OF THE EUROPEAN PARLIAMENT
   of 22 April 2008
   with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of the European GNSS Supervisory Authority for the financial year 2006
   THE EUROPEAN PARLIAMENT,
   having regard to the final annual accounts of the European GNSS Supervisory Authority for the financial year 2006 (1),
   having regard to the Court of Auditors' report on the final annual accounts of the European GNSS Supervisory Authority for the financial year 2006, together with Authority's replies (2),
   having regard to the Council's recommendation of 12 February 2008 (5843/2008 — C6-0084/2008),
   having regard to the EC Treaty, and in particular Article 276 thereof,
   having regard to Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (3), and in particular Article 185 thereof,
   having regard to Council Regulation (EC) No 1321/2004 of 12 July 2004 on the establishment of structures for the management of the European satellite radio-navigation programmes (4), and in particular Article 12 thereof,
   having regard to Commission Regulation (EC, Euratom) No 2343/2002 of 19 November 2002 on the framework Financial Regulation for the bodies referred to in Article 185 of Council Regulation (EC, Euratom) No 1605/2002 (5), and in particular Article 94 thereof,
   having regard to Rule 71 of and Annex V to its Rules of Procedure,
   having regard to the report of the Committee on Budgetary Control (A6-0127/2008),

               A.

               whereas the Court of Auditors stated that it has obtained reasonable assurance that the annual accounts for the financial year 2006 are reliable, and the underlying transactions are legal and regular,

               B.

               whereas the Authority began operations in 2006, and, following installation of the necessary financial systems, took over responsibility for its financial operations from the Commission in September 2006,

         General points which relate to horizontal issues affecting the EU agencies and which therefore also have a bearing on the discharge procedure for each individual agency

               1.

               Notes that the budgets of the 24 agencies and other satellite bodies audited by the Court of Auditors totalled EUR 1 080,5 million in 2006 (the biggest being that of the European Agency for Reconstruction at EUR 271 million and the smallest being that of the European Police College (CEPOL) at EUR 5 million);

               2.

               Points out that the range of external EU bodies subject to audit and discharge now includes not only traditional regulatory agencies but also executive agencies set up to implement specific programmes, and will in the near future also extend to joint undertakings set up as public-private partnerships (joint technology initiatives);

               3.

               Observes as regards the Parliament that the number of agencies subject to the discharge procedure has evolved as follows: financial year 2000: 8; 2001: 10; 2002: 11; 2003: 14; 2004: 14; 2005: 16; 2006: 20 regulatory agencies and two executive agencies (not including two agencies which are audited by the Court of Auditors but subject to an internal discharge process);

               4.

               Concludes therefore that the auditing/discharge process has become cumbersome and disproportionate compared to the relative size of the agencies'/satellite bodies' budgets; instructs its competent committee to undertake a wide-ranging review of the discharge process as regards agencies and satellite bodies with a view to devising a simpler and more rational approach, bearing in mind the ever-growing number of bodies each requiring a separate discharge report in future years;

         Fundamental considerations

               5.

               Requests that the Commission provide clear explanations regarding the following elements before the creation of a new agency or reform of an existing agency: agency type, objectives of the agency, internal governance structure, products, services, key procedures, target group, clients and stakeholders of the agency, formal relationship with external actors, budget responsibility, financial planning, and personnel and staffing policy;

               6.

               Requests that each agency be governed by a yearly performance agreement which is formulated by the agency and the responsible DG and which should contain the main objectives for the coming year, a financial framework and clear indicators to measure performance;

               7.

               Requests that the performance of the agencies be regularly (and on an ad-hoc basis) audited by the Court of Auditors or another independent auditor; considers that this should not be limited to traditional elements of financial management and the proper use of public money, but should also cover administrative efficiency and effectiveness and should include a rating of the financial management of each agency;

               8.

               Takes the view that in the case of agencies which are continually overestimating their respective budget needs, technical abatement should be made on the basis of vacant posts; is of the opinion that this will lead in the long run to less assigned revenue for the agencies and therefore also to lower administrative costs;

               9.

               Notes that it is a serious problem that a number of agencies is criticised for not following rules on public procurement, the Financial Regulation, the Staff Regulations, etc.; considers that the principal reason for this is that most regulations and the Financial Regulation are designed for bigger institutions and that most of the small agencies do not have the critical mass to be able to cope with these regulatory requirements; therefore asks the Commission to look for a rapid solution in order to enhance the effectiveness by grouping the administrative functions of various agencies together, in order to achieve this critical mass (taking into consideration the necessary changes in the basic regulations governing the agencies and their budgetary independence), or urgently to draft specific rules for the agencies (in particular implementing rules for the agencies) which allow them to be in full compliance;

               10.

               Insists that the Commission, when drafting the Preliminary Draft Budget, take into consideration the results of budget implementation by the individual agencies in former years, in particular in year n-1, and revise the budget requested by the particular agency accordingly; invites its competent committee to respect this revision and, if not undertaken by the Commission, to revise itself the budget in question to a realistic level matching the absorption and implementation capacity of the agency in question;

               11.

               Recalls its decision on discharge in respect of the financial year 2005, in which it invited the Commission to present every five years a study on the added value of every existing agency; invites all relevant institutions in the case of a negative evaluation of the added value of an agency to take the necessary steps by reformulating the mandate of that agency or by closing it; notes that there has not been one single evaluation undertaken by the Commission in 2007; insists that the Commission should present at least five such evaluations before the decision on discharge in respect of the financial year 2007, starting with the oldest agencies;

               12.

               Is of the opinion that recommendations of the Court of Auditors should be promptly implemented and the level of subsidies paid to the agencies should be aligned with their real cash requirements; considers further that the amendments to the general Financial Regulation should be incorporated into the agencies' framework financial regulation and into their various specific financial regulations;

         Presentation of reporting data

               13.

               Notes that there is no standard approach among the agencies with regard to the presentation of their activities during the financial year in question and of their accounts and reports on budgetary and financial management, nor to the question as to whether a declaration of assurance should be drawn up by the agency's director; observes that not all agencies clearly distinguish between (a) presenting the agency's work to the public; and (b) technical reporting on budgetary and financial management;

               14.

               Notes that while the Commission's standing instructions for the preparation of activity reports do not expressly require the agency to draw up a declaration of assurance, many directors have none the less done so for 2006, in one case including an important reservation;

               15.

               Recalls its resolution of 12 April 2005 (6), inviting the directors of the agencies from now on to accompany their annual activity report, which is presented together with financial and management information, with a declaration of assurance concerning the legality and regularity of operations, similar to the declarations signed by the Directors-General of the Commission;

               16.

               Asks the Commission to amend its standing instructions to the agencies accordingly;

               17.

               Suggests in addition that the Commission should work with the agencies towards producing a harmonised model applicable to all agencies and satellite bodies clearly distinguishing between:

                           —

                           an annual report intended for a general readership on the body's operations, work and achievements,

                           —

                           financial statements and a report on implementation of the budget,

                           —

                           an activity report along the lines of the activity reports of the Directors-General of the Commission,

                           —

                           a declaration of assurance signed by the body's director, together with any reservations or observations which he considers it appropriate to draw to the attention of the discharge authority;

         General findings by the Court of Auditors

               18.

               Notes the Court's finding (Annual Report, paragraph 10.29 (7)) that the disbursement of subsidies paid by the Commission from the Community budget is not based on sufficiently justified estimates of the agencies' cash requirements and that this, combined with the size of carry-overs, leads them to hold sizeable cash balances; notes further the Court's recommendation that the level of subsidies paid to the agencies should be in line with their real cash requirements;

               19.

               Notes that at the end of 2006 14 agencies had still to implement the ABAC accounting system (Annual Report, footnote to paragraph 10.31);

               20.

               Notes the Court's remark (Annual Report, paragraph 1.25) concerning accrued charges for untaken leave which are accounted for by some agencies; points out that the Court of Auditors has qualified its statement of assurance in the case of three agencies (European Centre for the Development of Vocational Training (Cedefop), CEPOL and the European Railway Agency) for the financial year 2006 (2005: Cedefop, European Food Safety Authority, European Agency for Reconstruction);

         Internal audit

               21.

               Recalls that in accordance with Article 185(3) of the Financial Regulation the Internal Auditor of the Commission is also the internal auditor of the regulatory agencies receiving grants charged to the EU budget; points out that the Internal Auditor reports to each agency's management board and director;

               22.

               Draws attention to the reservation entered in the Internal Auditor's Annual Activity Report for 2006 as follows:
               ‘The Internal Auditor of the Commission is not in a position to properly fulfil his obligation assigned by Article 185 of the Financial Regulation as internal auditor of the Community bodies due to a lack of staff resources.’;

               23.

               Notes, however, the Internal Auditor's remark in his activity report for 2006 that as from 2007, with the additional staff resources granted by the Commission to the Internal Audit Service (IAS), all regulatory agencies in operation will be subject to internal audit work on an annual basis;

               24.

               Notes the ever-growing number of regulatory and executive agencies and joint undertakings required to be audited by the IAS under Article 185 of the Financial Regulation; asks the Commission to inform its competent committee as to whether the staff resources at the IAS's disposal will be sufficient to conduct an annual audit of all such bodies in the coming years;

               25.

               Observes that Article 72(5) of Regulation (EC, Euratom) No 2343/2002 requires each agency to send each year to the discharge authority and the Commission a report drawn up by its director summarising the number and type of internal audits conducted by the internal auditor, the recommendations made and the action taken on these recommendations; asks the agencies to indicate whether this is done and, if so, how;

               26.

               Takes note, as regards internal audit capability, especially in relation to the smaller agencies, of a proposal made by the Internal Auditor before Parliament's competent committee on 14 September 2006 that smaller agencies should be authorised to buy in internal audit services from the private sector;

         Evaluation of agencies

               27.

               Recalls the joint statement by the Parliament, the Council and the Commission (8) negotiated at the conciliation before the Ecofin budget Council of 13 July 2007 calling for (i) a list of agencies which the Commission intends to assess; and (ii) a list of the agencies already assessed, together with a summary of the major findings;

         Disciplinary procedures

               28.

               Notes that, because of their size, individual agencies have difficulty in setting up ad-hoc disciplinary boards composed of staff at the appropriate career grade and that the Commission's IDOC (Investigation and Disciplinary Office) is not competent for agencies; calls on the agencies to consider an inter-agency disciplinary board;

         Draft Interinstitutional Agreement

               29.

               Recalls the draft Interinstitutional Agreement on the operating framework for the European regulatory agencies presented by the Commission (COM(2005) 59), which was intended to create a horizontal framework for the creation, structure, operation, evaluation and control of the European regulatory agencies; notes that the draft represents a useful initiative in the effort to rationalise the creation and running of agencies; notes the statement in the Commission's 2006 synthesis report (paragraph 3.1, COM(2007) 274) that although progress in negotiations stalled after publication of the draft, discussions on substance were relaunched in the Council at the end of 2006; regrets that it has not been possible to make further progress towards adoption;

               30.

               Welcomes therefore the Commission's commitment to bring forward a communication on the future of the regulatory agencies during the course of 2008;

         Self-financed agencies

               31.

               Recalls that for the two self-financing agencies, discharge is given to the director by the administrative board; notes that both have significant accumulated surpluses from fee income carried over from previous years figures, as follows:

                           —

                           Office for Harmonization of the Internal Market cash and cash equivalents: EUR 281 million (9),

                           —

                           Community Plant Variety Office cash and cash equivalents: EUR 18 million (10);

         Specific points

               32.

               Notes the Court of Auditors' observation in its 2006 report that its testing of a representative sample of 80 transactions identified weaknesses in the operation of the management and control systems involving the initiation of transactions without the necessary authority and entering into a legal commitment without a prior budgetary commitment, contrary to the requirements of the Financial Regulation;

               33.

               Takes note that, from 1 January 2007, the Authority has been the owner of all tangible and intangible assets created or developed during the development phase of the Galileo Programme;

               34.

               Recalls that the handover of activities from the Galileo Joint Undertaking to the Authority started in December 2006 with the transfer of EUR 70 million and the rights and obligations related to FP6, MEDA, Egnos and other contracts; therefore, although the Community subsidy and other revenue for the Authority in 2006 were just over EUR 7 million, the total assets of the Authority amounted to EUR 76,6 million at the end of 2006;

               35.

               Points out that, in addition, according to the Authority's replies, during 2007 97 % of a further amount of EUR 65 million was received by the Authority following an agreement between the GNSS and the three members of the Joint Undertaking (the European Space Agency, the National Remote Sensing Centre of China and the Matimop-Israeli Industry Centre for Research and Development); notes the Court's observation that this amount does not include the balance of funds resulting from the winding-up of the Galileo Joint Undertaking, which will only be transferred to the Authority at the end of the winding-up procedure;

               36.

               Understands from the Council conclusions adopted following its meeting of 3 December 2007 that the estimated cost for the GNSS programmes for the period 2007-2013 amounts to EUR 3,4 billion and that the project will be financed by public funds;

               37.

               Concludes therefore that, although an EU agency, the Authority as the owner of all the Galileo assets will carry out a role quite unlike that of any other regulatory agency, and that by virtue of the substantial amounts in its balance sheet will in future require particularly close scrutiny by those bodies whose task it is to monitor EU spending;

               38.

               Notes that the winding-up of the Galileo Joint Undertaking will be the subject of a specific report by the Court during 2008.

      (1)  OJ C 261, 31.10.2007, p. 38.

      (2)  OJ C 309, 19.12.2007, p. 72.

      (3)  OJ L 248, 16.9.2002, p. 1.

      (4)  OJ L 246, 20.7.2004, p. 1.

      (5)  OJ L 357, 31.12.2002, p. 72.

      (6)  All resolutions regarding the agencies were published in OJ L 196, 27.7.2005.

      (7)  OJ C 273, 15.11.2007, p. 1.

      (8)  Council document DS 605/1/07 Rev1.

      (9)  Source: report on the annual accounts of the Office for Harmonization in the Internal Market for the financial year 2006, together with the Office's replies (OJ C 309, 19.12.2007, p. 141).

      (10)  Source: report on the annual accounts of the Community Plant Variety Office for the financial year 2006, together with the Office's replies (OJ C 309, 19.12.2007, p. 135).