DETAILS OF REGISTER

Head of the Legal Office, Legal Advisor / Data Protection Mr Pedro ROSA PLAZA

dataprotection@eda.europa.eu

Personal data are processed by EDA in the context of concluding classified contracts. Contractors who are required to access, handle or store EU classified information (EUCI) within their facilities, either during the pre-contractual stage or during the performance of the classified contract itself, must hold a valid Facility Security Clearance (FSC) at the required level, and as requested by national rules, the appropriate Personnel Security Clearance (PSC) for the personnel concerned.

As defined in the EDA Security Instructions (CE Dec. 18/24), an FSC is an administrative determination by a National Security Authority (NSA) or Designated Security Authority (DSA) that, from the security viewpoint, a facility can afford an adequate level of protection to EUCI of a specified security classification level.

In order to obtain confirmation of the FSC, the Security Unit processes the personal data of the Facility Security Officers (FSO) and of the personnel concerned of potential contractors/subcontractors:

• Surname, First name(s),
• Date of Birth, Place of Birth, Nationalit(y)(ies),
• Phone number
• Email address,
• Type and level of clearance, issuing national authority of the clearance, validity date;

No personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and of data concerning health or sex life, are processed by EDA.

Internal recipients: Procurement and Contracting Unit and Security Unit

• PCU Unit receives a filled-in form (Security Information Sheet - related to the security clearance status) of the potential contractor/subcontractor of EDA in the context of a classified project and transfers it to the Security Unit.
• Based on the information provided in the Security Information Sheet, the Security Unit submits a request (Facility Security Clearance Information Sheet – FSCIS) to the NSA of the contractor’s location. The Security Unit acts as an intermediary between the NSA and the contractor, hence transferring information to and from them.

External recipients: NSA / DSA, in charge of a specific FSC request.

Electronic Facility Security Clearance Information Sheets and Security Information Sheets are stored in the EDA IT Server and/or in the locked safes of the Security Office (if printed).

The controller has implemented appropriate technical and organisational measures to ensure a high level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected. Such measures have been taken in particular to prevent any unauthorised disclosure or access, accidental destruction or loss. Data are processed in specific administrative areas both in the Security and Contracting units, the access to which is very limited and only made possible with prior authorisation on a need-to-know basis.