Description of Rules and Procedures for Applying for Access to Foreign Classified Information

As provided in Article 3 (2), “classified information of foreign states” means information originating from a foreign state, the European Union, NATO or other international organisation or an institution established under an international agreement (hereinafter collectively referred to as ‘originator of classified information of a foreign state’) which is communicated to Estonia on the basis of an international agreement, and that has been classified as secret by its originator and information created for the purposes of performance of an international agreement by the Republic of Estonia that is to be classified, as provided by the international agreement. According to the Procedure for the Protection of State Secrets and Classified Information of Foreign States, a personnel security certificate (PSC) is required in addition to a national security clearance in order to examine the aforementioned data; the National Security Authority issues such PSCs. Some foreign agreements also allow exceptions to this rule. For example, with regard to NATO and EU information, the PSC is required for the domestic use of such information, while access to Finnish and Latvian information is regulated by national security clearances and need-to-know requirements. A review of the originators of information that require an additional PSC for access to their respective classified information, in addition to the national security clearance, is given in the Table below: 

A Personnel Security Clearance Certificate for access to classified information of a foreign state is granted to individuals who:

• hold a valid national security clearance or to natural persons outside the services, having been granted the right for access only to a state secret classified as ‘restricted‘ under the decision of a head of agency;
• have a justified need-to-know for examining classified information of a foreign state or international organisation;
• not been subject to the circumstances, specified in Article 32 of the State Secrets and Classified Information of Foreign States Act and in the case of NATO information, circumstances listed in Annex AC/35-D/2000-REV1, article 9 of the NATO Security Directive;
• are not denied access to the respective classified information by foreign states or international organisations.

The process for applying for a Personnel Security Certificate for a natural person

The unit applying for a PSC is required to provide the National Security Authority Department of the Ministry of Defence with the following documents in order to apply for the PSC for a natural person:

• a written application that justifies the employee’s requirement to gain access to classified information of a foreign state, defining:
  • the originator of classified information of a foreign state and classification level that the access is required for;
  • validity of the applied Personnel Security Certificate;
  • name of the person;
  • personal ID code (date of birth);
  • exact place of birth;
  • citizenship;
  • contact information;
• a copy of the page of the applicant’s passport that contains the personal information and photo of the applicant or both sides of the applicant’s ID-card;
• a copy of a national security clearance; a copy of an appropriate document (e.g. a copy of the resolution of the appropriate minister), granting the applicant access to the state secret classified as ‘restricted’, if a PSC to ‘restricted’ classified information is being sought;
• an invitation to a meeting must be supplied for the issue of a certificate of a security clearance, required for participation in foreign meetings.

Documents required for the application of a PSC must be supplied at least one (1) month before the expected commencement date of the PSC. Documents necessary for the issue of a certificate of a security clearance must be submitted at least one (1) week before the expected commencement date of the certificate.

Notification of the requirements established for the protection of information of a foreign state

The National Security Authoruty Department shall notify the applicant after the PSC has been issued, inviting him/her to a briefing explaining the safety requirements governing the processing of classified information of foreign states at the Ministry of Defence. After the briefing, the applicant is required to complete a form, verifying that he/she has examined the safety requirements imposed on the protection of classified information of a foreign state and is aware of liabilities arising from the violation of such requirements.
The PSC shall be sent to the agency that has applied for a PSC within five working days as of the adoption of the decision and following the briefing.

Term of the Personnel Security Certificate

The term of the Personnel Security Certificate must not exceed the term of the person’s right for access to state secrets.

The PSC shall not be issued for a classification level higher than the level of the national security clearance, granted to the person applying for the certificate. Should the person’s right for access to state secrets expire before the term given on the PSC, the certificate shall be revoked.

The PSC shall be revoked in the case of a lapse in the justified need of a person to process classified information of a foreign country; if a new PSC is issued to a person before the expiry of the old certificate; if personal information, entered on the PSC, shall change and if circumstances, excluding the issue of the PSC, become obvious during the term of the issued certificate.

In the case of a right for access to classified information of a foreign state of a person who holds the PSC lapsing before the term of the PSC or expiry of national security clearance, the agency that has applied for the PSC must notify the NSA of the fact and return the PSC.

The process for applying for an access only to classified information of a foreign state, classified as “restricted”

The PSC is not issued to a civil servant to grant a right for access only to classified information of a foreign state, classified as “restricted”. A civil servant shall be granted access to a state secret classified as “restricted” upon the acquisition of a right for access, submission of an application and other required documents, after a briefing and upon signing a commitment, confirming that the person concerned will undertake to safeguard the classified information of a foreign state, becoming known to him/her in course of his/her duty or service. The aforementioned right for access is granted upon the issue of an appropriate notice by the NSA.

The other persons shall acquire the right for access to classified information of a foreign state upon the issue of the PSC.

The process for applying for access for legal persons

A legal person in public law of Estonia and a legal person in private law registered in Estonia and natural persons who wish to process classified information of a foreign state outside the immovable or a movable possessed by a state agency or Eesti Pank must apply for a personnel security certificate from the NSA. The following documents must be submitted when applying for the PSC:

• written application of the processing unit, setting out the originator of the classified information of a foreign state and the desired level of classification that the access is required for and justification for requesting access to classified information of a foreign state;
• written application from the supporting agency, setting out the originator of the classified information of a foreign state and the desired level of classification that the access is required for and the justification for requesting access to classified information of a foreign state;
• copy of a processing permit;
• copy of an in-house regulation for the protection of state secrets;
• copy of a document that defines the person organising the protection of state secret within a legal person and a list of persons to process classified information of a foreign state.

In the case of legal persons, the PSC, issued to a legal person, is not sufficient to allow the processing of classified information of a foreign state; all the natural persons, who are expected to process classified information of a foreign state in the concerned agency are expected to hold the PSCs.