Description of Rules and Procedures for Applying for Access to Foreign Classified Information

As provided in Article 3 (2) of the State Secrets and Classified Information of Foreign States Act, “foreign classified information” means information originating from a foreign state, the European Union (EU), NATO or other international organisation or an institution established under an international agreement (hereinafter collectively referred to as ‘originator`) which is communicated to Estonia on the basis of an international agreement, and that has been classified by its originator, and information created for the purposes of performance of an international agreement by the Republic of Estonia that is to be classified, as provided by the international agreement. According to the Procedure for the Protection of State Secrets and Classified Information of Foreign States, a Personnel Security Clearance Certificate (PSCC) is required in addition to a national security clearance in order to obtain access to foreign classified information; the National Security Authority issues such PSCCs. Some foreign agreements also allow exceptions to this rule. For example, with regard to NATO and EU information, the PSCC is required also for the domestic use of such information, while access for example to Finnish and Latvian information is regulated by national security clearances and need-to-know requirements. A review of the originators of information that require an additional PSCC for access to their classified information, in addition to the national security clearance, is given in the Table below:

Originator

Demand for a Certificate, issued by the National Security Authority, before the access rights are granted

NATO and the EU

A Certificate of access, issued by the National Security Authority, is required in addition to national personnel security clearance in order to be granted access to information of NATO and the EU classified as CONFIDENTIAL and above.

If required, Attestation of Personnel Security Clearance, verifying the availability of a Certificate, is issued for the participation in work-related meetings in foreign countries or at international organisations where classified information is being discussed.

Foreign states and other international organisations

A national security clearance and need-to-know requirement, attributable to work-related functions, is required for individuals in order to gain access to and to process classified information.

For legal entities, a national facility security clearance issued by the Estonian Internal Security Service is required for gaining access to and to process classified information.

If required by a foreign agreement, the National Security Authority shall also issue Certificates to legal entities and individuals, verifying the granting of rights to foreign classified information.

A Personnel Security Clearance Certificate for access to foreign classified information is granted to individuals who:

  • hold a valid national security clearance;
  • have a justified need-to-know;
  • not been subject to the circumstances specified in Article 32 of the State Secrets and Classified Information of Foreign States Act, in the case of NATO information, circumstances listed in Article 9 of the Directive on Personnel Security AC/35-D/2000-REV7 and in the case of EU information, circumstances listed in Articles 7-12 of Annex I of the Council Security Rules 2013/488/EU;
  • are not denied access to the respective classified information by foreign states or international organisations.

The process for applying for a Personnel Security Clearance Certificate for an individual

The agency applying for a PSCC is required to provide the National Security Authority Department of the Estonian Foreign Intelligence Service with the following documents in order to apply for the PSCC for an individual:

  • a written application that justifies the employee’s requirement to gain access to foreign classified information, defining:
    • the originator and classification level that the access is required for;
    • required term of validity of the applied Personnel Security Clearance Certificate;
    • name of the person;
    • personal ID code (date of birth);
    • place of birth;
    • citizenship;
    • contact information;
  • a copy of the page of the applicant’s passport that contains the personal information and photo of the applicant or both sides of the applicant’s ID-card;
  • a copy of a national security clearance;
  • an invitation to a meeting must be supplied for the issue of an Attestation of a Personnel Security Clearance, required for participation in international meetings.

Documents required for the application of a PSCC must be submitted at least one (1) month before the expected commencement date of the PSCC. Documents necessary for the issue of an Attestation of a Personnel Security Clearance must be submitted at least one (1) week before the expected commencement date of the Certificate.

Security briefing

The National Security Authority shall notify the applicant before the PSCC has been issued, inviting him/her to a briefing explaining the safety requirements governing the processing of foreign classified information.

After the briefing, the applicant is required to complete a form, acknowledging that he/she is aware of the safety requirements imposed on the protection of foreign classified information and is aware of liabilities arising from the violation of such requirements.

The PSCC shall be sent to the agency that has applied for a PSCC within five working days as of the adoption of the decision and following the briefing.

Term of the Personnel Security Clearance Certificate

The term of the PSCC must not exceed the term of the person’s national security clearance.

The PSCC shall not be issued for a classification level higher than the level of the national security clearance, granted to the person applying for the Certificate. Should the person’s national security clearance expire before the term given on the PSCC, the PSCC shall be revoked.

The PSCC shall be revoked in the case of a lapse in the justified need to know of a person to process classified information of a foreign state; if a new PSCC is issued to a person before the expiry of the previous Certificate; if personal information, entered on the PSCC, shall change and if circumstances, excluding the issue of the PSCC, become obvious during the term of the issued Certificate.

In the case of a right for access to foreign classified information of a person who holds the PSCC lapsing before the term of the PSCC or expiry of national security clearance, that has applied for the PSCC must notify the NSA of the fact and return the PSCC.

The process for applying for an access only to RESTRICTED level foreign classified information

The PSCC is not issued to grant a right for access only to RESTRICTED level foreign classified information. Access shall be granted to RESTRICTED level foreign classified information upon the acquisition of a right for access to national RESTRICTED level information, submission of an application and other required documents to the NSA, after a briefing and upon signing an acknowledgement confirming that the person concerned is aware of his/her security responsibilities and obligations. The aforementioned right for access is granted upon the issue of an appropriate notice by the NSA.

The process for applying for access for legal persons

A legal person in public law of Estonia and a legal person in private law registered in Estonia and individuals who wish to process foreign classified information outside the immovable or a movable possessed by a state agency or Bank of Estonia must apply for a Facility Security Certificate from the NSA. The following documents must be submitted when applying for the FSC:

  • written application of the legal entity, setting out the originator of the foreign classified information and the desired level of classification that the access is required for and justification for requesting access to foreign classified information ;
  • written application from the supporting government agency, setting out the originator of the foreign classified information and the desired level of classification that the access is required for and the justification for requesting access to foreign classified information;
  • copy of a national facility security clearance issued by the Estonian Internal Security Service;
  • copy of an in-house regulation for the protection of classified information;
  • copy of a document that defines the person organising the protection of classified information within a legal entity and a list of persons to process foreign classified information.

It should be noted that in the case of legal persons, the FSC, issued to a legal person, is not sufficient to allow the processing of foreign classified information; all the employees, who are expected to process foreign classified information in the concerned agency are expected to hold the PSCCs.