DECISION No 1104/2011/EU OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 25 October 2011

on the rules for access to the public regulated service provided by the global navigation satellite system established under the Galileo programme

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 172 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee(1),

After consulting the Committee of the Regions,

Acting in accordance with the ordinary legislative procedure(2),

Whereas:

(1) Regulation (EC) No 683/2008 of the European Parliament and of the Council of 9 July 2008 on the further implementation of the European satellite navigation programmes (EGNOS and Galileo)(3) provides in the Annex thereto that the specific objectives of the Galileo programme are to ensure that the signals emitted by the system established under that programme can be used in particular to offer a public regulated service (‧PRS‧) restricted to government-authorised users, for sensitive applications which require effective access control and a high level of service continuity.

(2) While relevant provisions of Regulation (EC) No 683/2008 also apply to the services, including the PRS, listed in the Annex thereto, considering the inter-linkage between the system established under the Galileo programme and the PRS from a legal, technical, operational, financial and ownership perspective, it is appropriate to reproduce the relevant rules on the application of security regulations for the purpose of this Decision.

(3) The European Parliament and the Council have recalled on several occasions that the system established under the Galileo programme is a civilian system under civilian control, that is, it was created in accordance with civilian standards based on civilian requirements and under the control of the Union institutions.

(4) The Galileo programme is of strategic importance for the independence of the Union in terms of satellite navigation, positioning and timing services and offers an important contribution to the implementation of the ‧Europe 2020‧ strategy for smart, sustainable and inclusive growth.

(5) Of the various services offered by European satellite navigation systems, the PRS is both the most secure and the most sensitive and is therefore suitable for services where robustness and complete reliability must be ensured. It must ensure service continuity for its participants, even in the most serious crisis situations. The consequences of infringing the security rules when using this service are not restricted to the user concerned, but could potentially extend to other users. Use and management of the PRS is therefore the joint responsibility of Member States in order to protect the security of the Union and their own security. Consequently, access to the PRS must be strictly limited to certain categories of user which are subject to continuous monitoring.

(6) It is therefore necessary to define the rules for access to the PRS and the rules for managing it, in particular by specifying the general principles relating to access, the functions of the various management and supervisory bodies, the conditions relating to receiver manufacturing and security, and the export monitoring system.

(7) With regard to the general principles of access to the PRS, given the actual purpose of the service and its characteristics, its use must be strictly limited, with Member States, the Council, the Commission and the European External Action Service (‧EEAS‧) being granted discretionary, unlimited and uninterrupted access worldwide. Furthermore, each Member State must be in a position to take its own sovereign decision on which PRS users to authorise and which uses may be made of the PRS, including uses relating to security, in accordance with the common minimum standards.

(8) In order to promote the use of European technology worldwide, it should be possible for certain third countries and international organisations to become PRS participants through separate agreements concluded with them. For secure government satellite radio-navigation applications, the terms and conditions under which third countries and international organisations may use the PRS should be laid down in international agreements, it being understood that compliance with security requirements should always be compulsory. In the context of such agreements, it should be possible to allow the manufacturing of PRS receivers under specific conditions and requirements, provided that these are of a level that is at least equivalent to the conditions and requirements applying to Member States. However, such agreements should not include particularly security-sensitive matters such as the manufacturing of security modules.

(9) Agreements with third countries or international organisations should be negotiated taking full account of the importance of ensuring respect for democracy, the rule of law, the universality and indivisibility of human rights and fundamental freedoms, and freedom of thought, conscience and religion, as well as freedom of expression and information, human dignity, the principles of equality and solidarity, and respect for the principles of the United Nations Charter and international law.

(10) The security regulations of the European Space Agency should offer a degree of protection at least equivalent to that provided by the rules on security set out in the Annex to Commission Decision 2001/844/EC, ECSC, Euratom(4) and by Council Decision 2011/292/EU of 31 March 2011 on the security rules for protecting EU classified information(5).

(11) The Union and the Member States must do their utmost to ensure that both the system established under the Galileo programme and PRS technology and equipment are safe and secure, to prevent signals emitted for the PRS from being used by non-authorised natural or legal persons, and to prevent any hostile use of the PRS against them.

(12) It is important in this connection that Member States determine the system of penalties applicable in the event of non-compliance with the obligations stemming from this Decision, and that they ensure that those penalties are applied. The penalties must be effective, proportionate and dissuasive.

(13) In the case of management and supervisory bodies, the arrangement whereby PRS participants designate a ‧competent PRS authority‧ responsible for managing and supervising users would appear to be the best way of effectively managing PRS use, by facilitating relations between the various stakeholders responsible for security and ensuring permanent supervision of users, in particular national users, in compliance with the common minimum standards. However, there should be flexibility in order to allow Member States to organise the responsibilities efficiently.

(14) In the implementation of this Decision, any processing of personal data should be carried out in accordance with Union law, as set out, in particular, in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(6) and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications)(7).

(15) Furthermore, one of the tasks of the Galileo Security Centre (the ‧Galileo Security Monitoring Centre‧ or the ‧GSMC‧) referred to in Article 16(a)(ii) of Regulation (EC) No 683/2008 should be to provide an operational interface between the various stakeholders responsible for the security of the PRS.

(16) The Council and the High Representative of the Union for Foreign Affairs and Security Policy should play a role in managing the PRS, through the application of Council Joint Action 2004/552/CFSP of 12 July 2004 on aspects of the operation of the European satellite radio-navigation system affecting the security of the European Union(8). The Council should approve international agreements authorising a third country or an international organisation to use the PRS.

(17) With regard to receiver manufacturing and security, security requirements make it necessary for this task to be entrusted only to a Member State which has designated a competent PRS authority or to undertakings established on the territory of a Member State which has designated a competent PRS authority. Furthermore, the receiver manufacturer must have been duly authorised by the Security Accreditation Board for European GNSS systems established by Regulation (EU) No 912/2010 of the European Parliament and of the Council(9) (the ‧Security Accreditation Board‧) and must comply with its decisions. It is the responsibility of the competent PRS authorities to continuously monitor compliance both with that authorisation requirement and those decisions and with specific technical requirements stemming from the common minimum standards.

(18) A Member State which has not designated a competent PRS authority should in any event designate a point of contact for the management of any detected harmful electromagnetic interference affecting the PRS. That point of contact should be a natural or legal person that has the role of reporting point, or an address, which the Commission can contact in the event of potentially harmful electromagnetic interference in order to remedy such interference.

(19) With regard to export restrictions, exports outside the Union of equipment or technology and software relating to PRS use and relating to the development of and manufacturing for the PRS, regardless of whether that equipment, software or technology is listed in Annex I to Council Regulation (EC) No 428/2009 of 5 May 2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items(10), must be restricted to those third countries which are duly authorised to access the PRS under an international agreement with the Union. A third country on whose territory a reference station housing PRS equipment and forming part of the system established under the Galileo programme is installed is not to be considered to be a PRS participant merely by virtue of that fact.

(20) The power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of the common minimum standards in the areas set out in the Annex and, if necessary, to update and amend it in order to take into account the developments in the Galileo programme. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level. The Commission, when preparing and drawing-up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

(21) In the light of their potential impact on the security of the system established under the Galileo programme, the Union and its Member States, both individually and collectively, it is essential that common rules concerning access to the PRS and manufacturing PRS receivers and security modules be applied uniformly in each Member State. It is therefore necessary that the Commission be empowered to adopt detailed requirements, guidelines and other measures in order to give effect to the common minimum standards. In order to ensure uniform conditions for the implementation of this Decision, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission's exercise of implementing powers(11).

(22) The audits and inspections to be carried out by the Commission with the assistance of the Member States should, as appropriate, be carried out in a manner similar to that provided for in Part VII of Annex III to Decision 2011/292/EU.

(23) Rules for access to the PRS offered by the system established under the Galileo programme are a prerequisite for the implementation of the PRS. The Commission should analyse whether a charging policy for the PRS should be put in place, including with regard to third countries and international organisations, and report to the European Parliament and the Council on the outcome of that analysis.

(24) Since the objective of this Decision — namely, to lay down the rules under which the Member States, the Council, the Commission, the EEAS, Union agencies, third countries and international organisations may access the PRS — cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale of the proposed action, be better achieved at the level of the Union, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality as set out in that Article, this Decision does not go beyond what is necessary in order to achieve that objective.

(25) As soon as the PRS is declared operational, a reporting and review mechanism should be set in place,

HAVE ADOPTED THIS DECISION:

Article 1

Subject matter

This Decision lays down the rules under which the Member States, the Council, the Commission, the EEAS, Union agencies, third countries and international organisations may access the public regulated service (PRS) provided by the global navigation satellite system established under the Galileo programme.

Article 2

Definitions

For the purposes of this Decision, the following definitions shall apply:

(a) ‧PRS participants‧ means the Member States, the Council, the Commission and the EEAS, as well as Union agencies, third countries and international organisations, in so far as such agencies, third countries and organisations have been duly authorised;

(b) ‧PRS users‧ means natural or legal persons duly authorised by a PRS participant to own or use a PRS receiver.

Article 3

General principles concerning PRS access

1. The Member States, the Council, the Commission and the EEAS shall have the right to unlimited and uninterrupted access to the PRS worldwide.

2. It shall be for each individual Member State, the Council, the Commission and the EEAS to decide whether to use the PRS within their respective competences.

3. Each Member State which uses the PRS shall decide independently which categories of natural persons residing on its territory or performing official duties abroad on behalf of that Member State and legal persons established on its territory are authorised to be PRS users, as well as the uses to which the PRS may be put, in accordance with Article 8 and point 1(i) and (ii) of the Annex. Such uses may include security-related uses.

The Council, the Commission and the EEAS shall decide which categories of their agents are authorised to be PRS users, in accordance with Article 8 and point 1(i) and (ii) of the Annex.

4. Union agencies may become PRS participants only in so far as necessary to fulfil their tasks and in accordance with the detailed rules laid down in an administrative agreement concluded between the Commission and the agency concerned.

5. Third countries or international organisations may become PRS participants only where, in accordance with the procedure provided for in Article 218 of the Treaty on the Functioning of the European Union, they enter into both of the following agreements between the Union and the third country or international organisation concerned:

(a) a security of information agreement defining the framework for exchanging and protecting classified information and providing a degree of protection at least equivalent to that of the Member States;

(b) an agreement laying down the terms and conditions of the detailed rules for access to the PRS by the third country or international organisation; such an agreement could include the manufacturing, under specific conditions, of PRS receivers, to the exclusion of security modules.

Article 4

Application of security regulations

1. Each Member State shall ensure that its national security regulations offer a degree of protection of classified information at least equivalent to that provided by the rules on security as set out in the Annex to Decision 2001/844/EC, ECSC, Euratom and by Decision 2011/292/EU and that those national security regulations apply to its PRS users and to all natural persons resident on its territory and all legal persons established on its territory which handle EU classified information relating to the PRS.

2. Member States shall inform the Commission without delay of the adoption of national security regulations as referred to in paragraph 1.

3. If it emerges that EU classified information relating to the PRS has been disclosed to any person not authorised to receive it, the Commission shall, in full consultation with the Member State concerned:

(a) inform the originator of the classified PRS data;

(b) assess the potential damage caused to the interests of the Union or of the Member States;

(c) notify the appropriate authorities of the results of that assessment accompanied by a recommendation to remedy the situation, in which case the appropriate authorities shall inform the Commission without delay of the action they intend to take or have already taken, including action aimed at preventing recurrence, as well as of the results of such action; and

(d) inform the European Parliament and the Council, as appropriate, of those results.

Article 5

Competent PRS authority

1. A competent PRS authority shall be designated by:

(a) each Member State which uses the PRS and each Member State on whose territory any of the bodies referred to in Article 7(1) are established; in such cases, the competent PRS authority shall be established on the territory of the Member State concerned, which shall notify the designation to the Commission without delay;

(b) the Council, the Commission and the EEAS, if they use the PRS. In such a case, the European GNSS Agency established by Regulation (EU) No 912/2010 (the ‧European GNSS Agency‧) may be designated as a competent PRS authority in accordance with appropriate arrangements;

(c) Union agencies and international organisations, in accordance with the provisions of the agreements referred to in Article 3(4) and (5); in such cases, the European GNSS Agency may be designated as a competent PRS authority;

(d) third countries, in accordance with the provisions of the agreements referred to in Article 3(5).

2. The costs of the functioning of a competent PRS authority shall be borne by the PRS participants who have designated it.

3. A Member State which has not designated a competent PRS authority in accordance with point (a) of paragraph 1 shall in any event designate a point of contact for assisting as necessary in the reporting of detected potentially harmful electromagnetic interference affecting the PRS. The Member State concerned shall notify such a designation to the Commission without delay.

4. A competent PRS authority shall ensure that the use of the PRS is in compliance with Article 8 and point 1 of the Annex and that:

(a) PRS users are grouped for the management of the PRS with the GSMC;

(b) the PRS access rights for each group or user are determined and managed;

(d) the PRS keys and other related classified information are distributed to the users;

(e) the security of the receivers and associated classified technology and information are managed and the risks assessed;

(f) a point of contact is established for assisting as necessary in the reporting of detected potentially harmful electromagnetic interference affecting the PRS.

5. The competent PRS authority of a Member State shall ensure that a body established on the territory of that Member State may only develop or manufacture PRS receivers or security modules if such a body:

(a) has been duly authorised by the Security Accreditation Board in accordance with Article 11(2) of Regulation (EU) No 912/2010; and

(b) complies both with the decisions of the Security Accreditation Board and with Article 8 and point 2 of the Annex regarding the development and manufacture of PRS receivers or security modules, in so far as these relate to its activity.

Any equipment-manufacture authorisation provided for in this paragraph shall be reviewed at least every five years.

6. In the case of development or manufacturing referred to in paragraph 5 of this Article, or in the case of export outside the Union, the competent PRS authority of the Member State concerned shall act as an interface to the entities competent for export restrictions of relevant equipment, technology and software regarding the use and development of, and manufacturing for, the PRS, in order to ensure that the provisions of Article 9 are applied.

7. A competent PRS authority shall be connected to the GSMC in accordance with Article 8 and point 4 of the Annex.

8. Paragraphs 4 and 7 shall be without prejudice to the possibility for Member States to delegate certain specific tasks of their respective competent PRS authority, by mutual consent, to another Member State, excluding any tasks related to the exercise of their sovereignty over their respective territories. The tasks referred to in paragraphs 4 and 7, as well as tasks under paragraph 5, may be carried out jointly by Member States. The Member States concerned shall notify such measures to the Commission without delay.

9. A competent PRS authority may request the technical assistance of the European GNSS Agency in order to perform its tasks, subject to specific arrangements. The Member States concerned shall notify such arrangements to the Commission without delay.

10. Every three years the competent PRS authorities shall report to the Commission and to the European GNSS Agency on compliance with the common minimum standards.

11. Every three years the Commission shall, with the assistance of the European GNSS Agency, report to the European Parliament and the Council on the compliance by the competent PRS authorities with the common minimum standards, as well as in any cases of serious violation of those standards.

12. Where a competent PRS authority does not comply with the common minimum standards set out in Article 8, the Commission may, taking due account of the subsidiarity principle and in consultation with the Member State concerned and, if necessary, after obtaining further specific information, issue a recommendation. Within three months of the recommendation being issued, the competent PRS authority concerned shall either comply with the recommendation of the Commission or request or propose changes with a view to ensuring compliance with the common minimum standards and implement them in agreement with the Commission.

If, once that three-month period has expired, the competent PRS authority concerned still does not ensure compliance with the common minimum standards, the Commission shall inform the European Parliament and the Council and propose appropriate measures to be taken.

Article 6

Role of the GSMC

The GSMC shall provide the operational interface between the competent PRS authorities, the Council and the High Representative of the Union for Foreign Affairs and Security Policy acting under Joint Action 2004/552/CFSP and the control centres. It shall inform the Commission of any event that may affect the smooth running of the PRS.

Article 7

Manufacture and security of receivers and security modules

1. A Member State may, subject to the requirements set out in Article 5(5), assign the task of manufacturing PRS receivers or the associated security modules to bodies established on its territory or on the territory of another Member State. The Council, the Commission or the EEAS may assign the task of manufacturing PRS receivers or the associated security modules for their own use to bodies established on the territory of a Member State.

2. The Security Accreditation Board may at any time revoke the authorisation it has granted to a body referred to in paragraph 1 of this Article to manufacture PRS receivers or the associated security modules if the measures provided for in point (b) of Article 5(5) have not been complied with.

Article 8

Common minimum standards

1. The common minimum standards to be complied with by the competent PRS authorities referred to in Article 5 shall cover the areas set out in the Annex.

2. The Commission shall be empowered to adopt delegated acts in accordance with Article 11 concerning the adoption of the common minimum standards for the areas set out in the Annex and, if necessary, amendments updating the Annex to take account of developments in the Galileo programme, in particular with regard to technology and changes in security needs.

3. On the basis of the common minimum standards referred to in paragraph 2 of this Article, the Commission may adopt the necessary technical requirements, guidelines and other measures. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 12(2).

4. The Commission shall ensure that the necessary steps are taken to comply with the measures referred to in paragraphs 2 and 3 and that requirements relating to the security of the PRS and its users and related technology are met, taking full account of expert advice.

5. In order to assist compliance with this Article, the Commission shall facilitate a meeting of all competent PRS authorities at least once a year.

6. The Commission shall, with the assistance of the Member States and the European GNSS Agency, ensure that the competent PRS authorities comply with the common minimum standards, in particular by carrying out audits or inspections.

Article 9

Export restrictions

The export outside the Union of equipment, technology and software regarding the use and development of, and manufacturing for, the PRS shall not be authorised otherwise than in accordance with Article 8 and point 3 of the Annex and pursuant to the agreements referred to in Article 3(5) or under agreements regarding the detailed rules for hosting and operating reference stations.

Article 10

Application of Joint Action 2004/552/CFSP

This Decision shall be applied without prejudice to measures decided on pursuant to Joint Action 2004/552/CFSP.

Article 11

Exercise of delegation

1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2. The power to adopt delegated acts referred to in Article 8(2) shall be conferred on the Commission for a period of five years from 5 November 2011. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period.

3. The delegation of power referred to in Article 8(2) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the

Official Journal of the European Union

or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5. A delegated act adopted pursuant to Article 8(2) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 12

Committee procedure

1. The Commission shall be assisted by the Committee established by Regulation (EC) No 683/2008. That Committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.

Article 13

Review and report

At the latest two years after the PRS has been declared operational, the Commission shall report to the European Parliament and the Council on the adequate functioning and appropriateness of the rules established for access to the PRS and, if necessary, propose amendments to this Decision accordingly.

Article 14

Specific rules for the implementation of the Galileo programme

Notwithstanding the other provisions of this Decision, in order to ensure that the system established under the Galileo programme functions smoothly, access to PRS technology and the ownership or use of PRS receivers shall be authorised, subject to compliance with the principles laid down in Article 8 and the Annex, as regards the following:

(a) the Commission, when acting as manager of the Galileo programme;

(b) operators of the system established under the Galileo programme, strictly for the purposes of complying with their remit, as laid down in a specific arrangement with the Commission;

(c) the European GNSS Agency, in order to enable it to perform the tasks entrusted to it, as laid down in a specific arrangement with the Commission;

(d) the European Space Agency, strictly for the purposes of research, development and infrastructure roll–out, as laid down in a specific arrangement with the Commission.

Article 15

Penalties

Member States shall determine what penalties are applicable when national provisions enacted pursuant to this Decision are infringed. The penalties shall be effective, proportionate and dissuasive.

Article 16

Entry into force and application

1. This Decision shall enter into force on the day following its publication in the

Official Journal of the European Union

2. Member States shall apply Article 5 at the latest on 6 November 2013.

Article 17

Addressees

This Decision is addressed to the Member States.

Done at Strasbourg, 25 October 2011.

For the European Parliament

The President

J. BUZEK

For the Council

The President

M. DOWGIELEWICZ

(1)

OJ C 54, 19.2.2011, p. 36

(2) Position of the European Parliament of 13 September 2011 (not yet published in the Official Journal) and decision of the Council of 10 October 2011.

(3)

OJ L 196, 24.7.2008, p. 1

(4)

OJ L 317, 3.12.2001, p. 1

(5)

OJ L 141, 27.5.2011, p. 17

(6)

OJ L 281, 23.11.1995, p. 31

(7)

OJ L 201, 31.7.2002, p. 37

(8)

OJ L 246, 20.7.2004, p. 30

(9)

OJ L 276, 20.10.2010, p. 11

(10)

OJ L 134, 29.5.2009, p. 1

(11)

OJ L 55, 28.2.2011, p. 13

ANNEX

Common minimum standards

As regards Article 5(4), the common minimum standards for the use of the PRS cover the following areas:

(i) PRS user group organisation;

(ii) definition and management of access rights for PRS users and user groups of PRS participants;

(iii) distribution of PRS keys and related classified information between the GSMC and the competent PRS authorities;

(iv) distribution of PRS keys and related classified information to the users;

(v) security management, including security incidents, and risk assessment for PRS receivers and associated classified technology and information;

(vi) reporting of detected potentially harmful electromagnetic interference affecting the PRS;

(vii) operational concepts and procedures for PRS receivers.

As regards Article 5(5), the common minimum standards for the development and manufacture of PRS receivers or security modules cover the following areas:

(i) PRS user segment authorisation;

(ii) security of PRS receivers and PRS technology during research, development, and manufacturing phases;

(iii) PRS receiver and PRS technology integration;

(iv) protection profile for PRS receivers, security modules, and material using PRS technology.

As regards Article 5(6) and Article 9, the common minimum standards for export restrictions cover the following areas:

(i) authorised PRS participants;

(ii) export of PRS-related material and technology.

As regards Article 5(7), the common minimum standards for the links between the GSMC and the competent PRS authorities cover data and voice links.