As provided in Article 3 (2) of the State Secrets and Classified Information of Foreign States Act, “foreign classified information” means information originating from a foreign state, the European Union (EU), NATO or other international organisation or an institution established under an international agreement (hereinafter collectively referred to as ‘originator`) which is communicated to Estonia on the basis of an international agreement, and that has been classified by its originator, and information created for the purposes of performance of an international agreement by the Republic of Estonia that is to be classified, as provided by the international agreement. According to the Procedure for the Protection of State Secrets and Classified Information of Foreign States, a Personnel Security Clearance Certificate (PSCC) is required in addition to a national security clearance in order to obtain access to foreign classified information; the National Security Authority issues such PSCCs. Some foreign agreements also allow exceptions to this rule. For example, with regard to NATO and EU information, the PSCC is required also for the domestic use of such information, while access for example to Finnish and Latvian information is regulated by national security clearances and need-to-know requirements. A review of the originators of information that require an additional PSCC for access to their classified information, in addition to the national security clearance, is given in the Table below:
Demand for a Certificate, issued by the National Security Authority, before the access rights are granted
|NATO and the EU||
A Certificate of access, issued by the National Security Authority, is required in addition to national personnel security clearance in order to be granted access to information of NATO and the EU classified as CONFIDENTIAL and above.
If required, Attestation of Personnel Security Clearance, verifying the availability of a Certificate, is issued for the participation in work-related meetings in foreign countries or at international organisations where classified information is being discussed.
|Foreign states and other international organisations||
A national security clearance and need-to-know requirement, attributable to work-related functions, is required for individuals in order to gain access to and to process classified information.
For legal entities, a national facility security clearance issued by the Estonian Internal Security Service is required for gaining access to and to process classified information.
If required by a foreign agreement, the National Security Authority shall also issue Certificates to legal entities and individuals, verifying the granting of rights to foreign classified information.
A Personnel Security Clearance Certificate for access to foreign classified information is granted to individuals who:
The agency applying for a PSCC is required to provide the National Security Authority Department of the Estonian Information Board with the following documents in order to apply for the PSCC for an individual:
Documents required for the application of a PSCC must be submitted at least one (1) month before the expected commencement date of the PSCC. Documents necessary for the issue of an Attestation of a Personnel Security Clearance must be submitted at least one (1) week before the expected commencement date of the Certificate.
The National Security Authority shall notify the applicant before the PSCC has been issued, inviting him/her to a briefing explaining the safety requirements governing the processing of foreign classified information.
After the briefing, the applicant is required to complete a form, acknowledging that he/she is aware of the safety requirements imposed on the protection of foreign classified information and is aware of liabilities arising from the violation of such requirements.
The PSCC shall be sent to the agency that has applied for a PSCC within five working days as of the adoption of the decision and following the briefing.
The term of the PSCC must not exceed the term of the person’s national security clearance.
The PSCC shall not be issued for a classification level higher than the level of the national security clearance, granted to the person applying for the Certificate. Should the person’s national security clearance expire before the term given on the PSCC, the PSCC shall be revoked.
The PSCC shall be revoked in the case of a lapse in the justified need to know of a person to process classified information of a foreign state; if a new PSCC is issued to a person before the expiry of the previous Certificate; if personal information, entered on the PSCC, shall change and if circumstances, excluding the issue of the PSCC, become obvious during the term of the issued Certificate.
In the case of a right for access to foreign classified information of a person who holds the PSCC lapsing before the term of the PSCC or expiry of national security clearance, that has applied for the PSCC must notify the NSA of the fact and return the PSCC.
The PSCC is not issued to grant a right for access only to RESTRICTED level foreign classified information. Access shall be granted to RESTRICTED level foreign classified information upon the acquisition of a right for access to national RESTRICTED level information, submission of an application and other required documents to the NSA, after a briefing and upon signing an acknowledgement confirming that the person concerned is aware of his/her security responsibilities and obligations. The aforementioned right for access is granted upon the issue of an appropriate notice by the NSA.
A legal person in public law of Estonia and a legal person in private law registered in Estonia and individuals who wish to process foreign classified information outside the immovable or a movable possessed by a state agency or Bank of Estonia must apply for a Facility Security Certificate from the NSA. The following documents must be submitted when applying for the FSC:
It should be noted that in the case of legal persons, the FSC, issued to a legal person, is not sufficient to allow the processing of foreign classified information; all the employees, who are expected to process foreign classified information in the concerned agency are expected to hold the PSCCs.