17.5.2019 EN Official Journal of the European Union LI 129/1 COUNCIL REGULATION (EU) 2019/796 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 215 thereof, Having regard to Council Decision (CFSP) 2019/797 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (1), Having regard to the joint proposal of the High Representative of the Union for Foreign Affairs and Security Policy and of the European Commission, Whereas: (1) On 18 October 2018 the European Council adopted conclusions which called for the work on the capacity to respond to and deter cyber-attacks through Union restrictive measures to be taken forward, further to the Council conclusions of 19 June 2017. (2) On 17 May 2019 the Council adopted Decision (CFSP) 2019/797. Decision (CFSP) 2019/797 establishes a framework for targeted restrictive measures to deter and respond to cyber-attacks with a significant effect which constitute an external threat to the Union or its Member States. Persons, entities and bodies subject to the restrictive measures are listed in the Annex to that Decision. (3) This Regulation respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, in particular the right to an effective remedy and to a fair trial and the right to the protection of personal data. This Regulation should be applied in accordance with those rights. (4) The power to establish and amend the list in Annex I to this Regulation should be exercised by the Council in order to ensure consistency with the process for establishing, amending and reviewing the Annex to Decision (CFSP) 2019/797. (5) For the implementation of this Regulation, and in order to ensure maximum legal certainty within the Union, the names and other relevant data concerning natural and legal persons, entities and bodies whose funds and economic resources are to be frozen in accordance with this Regulation should be made public. Any processing of personal data should comply with Regulations (EU) 2016/679 (2) and (EU) 2018/1725 (3) of the European Parliament and of the Council. (6) Member States and the Commission should inform each other of the measures taken pursuant to this Regulation and of other relevant information at their disposal in connection with this Regulation. (7) Member States should lay down rules on sanctions applicable to infringements of the provisions of this Regulation and make sure that they are implemented. Those sanctions should be effective, proportionate and dissuasive, HAS ADOPTED THIS REGULATION: Article 1 1. This Regulation applies to cyber-attacks with a significant effect, including attempted cyber-attacks with a potentially significant effect, which constitute an external threat to the Union or its Member States. 2. Cyber-attacks constituting an external threat include those which: (a) originate, or are carried out, from outside the Union; (b) use infrastructure outside the Union; (c) are carried out by any natural or legal person, entity or body established or operating outside the Union; or (d) are carried out with the support, at the direction or under the control of any natural or legal person, entity or body operating outside the Union. 3. For this purpose, cyber-attacks are actions involving any of the following: (a) access to information systems; (b) information system interference; (c) data interference; or (d) data interception, where such actions are not duly authorised by the owner or by another right holder of the system or data or part of it, or are not permitted under the law of the Union or of the Member State concerned. 4. Cyber-attacks constituting a threat to Member States include those affecting information systems relating to, inter alia: (a) critical infrastructure, including submarine cables and objects launched into outer space, which is essential for the maintenance of vital functions of society, or the health, safety, security, and economic or social well-being of people; (b) services necessary for the maintenance of essential social and/or economic activities, in particular in the sectors of: energy (electricity, oil and gas); transport (air, rail, water and road); banking; financial market infrastructures; health (healthcare providers, hospitals and private clinics); drinking water supply and distribution; digital infrastructure; and any other sector which is essential to the Member State concerned; (c) critical State functions, in particular in the areas of defence, governance and the functioning of institutions, including for public elections or the voting process, the functioning of economic and civil infrastructure, internal security, and external relations, including through diplomatic missions; (d) the storage or processing of classified information; or (e) government emergency response teams. 5. Cyber-attacks constituting a threat to the Union include those carried out against its institutions, bodies, offices and agencies, its delegations to third countries or to international organisations, its common security and defence policy (CSDP) operations and missions and its special representatives. 6. Where deemed necessary to achieve common foreign and security policy (CFSP) objectives in the relevant provisions of Article 21 of the Treaty on European Union, restrictive measures under this Regulation may also be applied in response to cyber-attacks with a significant effect against third States or international organisations. 7. For the purposes of this Regulation, the following definitions apply: (a) ‘information systems’ means a device or group of interconnected or related devices, one or more of which, pursuant to a programme, automatically processes digital data, as well as digital data stored, processed, retrieved or transmitted by that device or group of devices for the purposes of its or their operation, use, protection and maintenance; (b) ‘information system interference’ means hindering or interrupting the functioning of an information system by inputting digital data, by transmitting, damaging, deleting, deteriorating, altering or suppressing such data, or by rendering such data inaccessible; (c) ‘data interference’ means deleting, damaging, deteriorating, altering or suppressing digital data on an information system, or rendering such data inaccessible; it also includes theft of data, funds, economic resources or intellectual property; (d) ‘data interception’ means intercepting, by technical means, non-public transmissions of digital data to, from or within an information system, including electromagnetic emissions from an information system carrying such digital data. 8. For the purposes of this Regulation, the following additional definitions apply: (a) ‘claim’ means any claim, whether asserted by legal proceedings or not, made before or after the date of entry into force of this Regulation, under or in connection with a contract or transaction, and includes in particular: (i) a claim for performance of any obligation arising under or in connection with a contract or transaction; (ii) a claim for extension or payment of a bond, financial guarantee or indemnity of whatever form; (iii) a claim for compensation in respect of a contract or transaction; (iv) a counterclaim; (v) a claim for the recognition or enforcement, including by the procedure of exequatur, of a judgment, an arbitration award or an equivalent decision, wherever made or given; (b) ‘contract or transaction’ means any transaction of whatever form and whatever the applicable law, whether comprising one or more contracts or similar obligations made between the same or different parties; for this purpose, ‘contract’ includes a bond, guarantee or indemnity, particularly a financial guarantee or financial indemnity, and credit, whether legally independent or not, as well as any related provision arising under, or in connection with, the transaction; (c) ‘competent authorities’ refers to the competent authorities of the Member States as identified on the websites listed in Annex II; (d) ‘economic resources’ means assets of every kind, whether tangible or intangible, movable or immovable, which are not funds, but may be used to obtain funds, goods or services; (e) ‘freezing of economic resources’ means preventing the use of economic resources to obtain funds, goods or services in any way, including, but not limited to, by selling, hiring or mortgaging them; (f) ‘freezing of funds’ means preventing any move, transfer, alteration, use of, access to, or dealing with funds in any way that would result in any change in their volume, amount, location, ownership, possession, character or destination or any other change that would enable the funds to be used, including portfolio management; (g) ‘funds’ means financial assets and benefit of every kind, including, but not limited to: (i) cash, cheques, claims on money, drafts, money orders and other payment instruments; (ii) deposits with financial institutions or other entities, balances on accounts, debts and debt obligations; (iii) publicly-and privately-traded securities and debt instruments, including stocks and shares, certificates representing securities, bonds, notes, warrants, debentures and derivatives contracts; (iv) interest, dividends or other income on or value accruing from or generated by assets; (v) credit, right of set-off, guarantees, performance bonds or other financial commitments; (vi) letters of credit, bills of lading and bills of sale; and (vii) documents showing evidence of an interest in funds or financial resources; (h) ‘territory of the Union’ means the territories of the Member States to which the Treaty is applicable, under the conditions laid down in the Treaty, including their airspace. Article 2 The factors determining whether a cyber-attack has a significant effect as referred to in Article 1(1) include any of the following: (a) the scope, scale, impact or severity of disruption caused, including to economic and societal activities, essential services, critical State functions, public order or public safety; (b) the number of natural or legal persons, entities or bodies affected; (c) the number of Member States concerned; (d) the amount of economic loss caused, such as through large-scale theft of funds, economic resources or intellectual property; (e) the economic benefit gained by the perpetrator, for himself or for others; (f) the amount or nature of data stolen or the scale of data breaches; or (g) the nature of commercially sensitive data accessed. Article 3 1. All funds and economic resources belonging to, owned, held or controlled by any natural or legal person, entity or body listed in Annex I shall be frozen. 2. No funds or economic resources shall be made available, directly or indirectly, to or for the benefit of natural or legal persons, entities or bodies listed in Annex I. 3. Annex I shall include, as identified by the Council in accordance with Article 5(1) of Decision (CFSP) 2019/797: (a) natural or legal persons, entities or bodies who are responsible for cyber-attacks or attempted cyber-attacks; (b) natural persons or legal persons, entities or bodies that provide financial, technical or material support for or are otherwise involved in cyber-attacks or attempted cyber-attacks, including by planning, preparing, participating in, directing, assisting or encouraging such attacks, or facilitating them whether by action or omission; (c) natural or legal persons, entities or bodies associated with the natural or legal persons, entities or bodies covered by points (a) and (b) of this paragraph. Article 4 1. By way of derogation from Article 3, the competent authorities of the Member States may authorise the release of certain frozen funds or economic resources, or the making available of certain funds or economic resources, under such conditions as they deem appropriate, after having determined that the funds or economic resources concerned are: (a) necessary to satisfy the basic needs of the natural persons listed in Annex I and dependent family members of such natural persons, including payments for foodstuffs, rent or mortgage, medicines and medical treatment, taxes, insurance premiums, and public utility charges; (b) intended exclusively for the payment of reasonable professional fees or the reimbursement of incurred expenses associated with the provision of legal services; (c) intended exclusively for the payment of fees or service charges for the routine holding or maintenance of frozen funds or economic resources; (d) necessary for extraordinary expenses, provided that the relevant competent authority has notified the competent authorities of the other Member States and the Commission of the grounds on which it considers that a specific authorisation should be granted, at least two weeks prior to the authorisation; or (e) to be paid into or from an account of a diplomatic or consular mission or an international organisation enjoying immunities in accordance with international law, insofar as such payments are intended to be used for official purposes of the diplomatic or consular mission or international organisation. 2. The Member State concerned shall inform the other Member States and the Commission of any authorisation granted under paragraph 1 within two weeks of the authorisation. Article 5 1. By way of derogation from Article 3(1), the competent authorities of the Member States may authorise the release of certain frozen funds or economic resources provided that the following conditions are met: (a) the funds or economic resources are the subject of an arbitral decision rendered prior to the date on which the natural or legal person, entity or body referred to in Article 3 was listed in Annex I, or of a judicial or administrative decision rendered in the Union, or a judicial decision enforceable in the Member State concerned, prior to or after that date; (b) the funds or economic resources will be used exclusively to satisfy claims secured by such a decision or recognised as valid in such a decision, within the limits set by applicable laws and regulations governing the rights of persons having such claims; (c) the decision is not for the benefit of a natural or legal person, entity or body listed in Annex I; and (d) recognition of the decision is not contrary to public policy in the Member State concerned. 2. The Member State concerned shall inform the other Member States and the Commission of any authorisation granted under paragraph 1 within two weeks of the authorisation. Article 6 1. By way of derogation from Article 3(1) and provided that a payment by a natural or legal person, entity or body listed in Annex I is due under a contract or agreement that was concluded by, or an obligation that arose for, the natural or legal person, entity or body concerned before the date on which that natural or legal person, entity or body was included in Annex I, the competent authorities of the Member States may authorise, under such conditions as they deem appropriate, the release of certain frozen funds or economic resources, provided that the competent authority concerned has determined that: (a) the funds or economic resources will be used for a payment by a natural or legal person, entity or body listed in Annex I; and (b) the payment is not in breach of Article 3(2). 2. The Member State concerned shall inform the other Member States and the Commission of any authorisation granted under paragraph 1 within two weeks of the authorisation. Article 7 1. Article 3(2) shall not prevent the crediting of frozen accounts by financial or credit institutions that receive funds transferred by third parties onto the account of a listed natural or legal person, entity or body, provided that any additions to such accounts will also be frozen. The financial or credit institution shall inform the relevant competent authority about any such transaction without delay. 2. Article 3(2) shall not apply to the addition to frozen accounts of: (a) interest or other earnings on those accounts; (b) payments due under contracts, agreements or obligations that were concluded or arose before the date on which the natural or legal person, entity or body referred to in Article 3(1) was included in Annex I; or (c) payments due under judicial, administrative or arbitral decisions rendered in a Member State or enforceable in the Member State concerned, provided that any such interest, other earnings and payments remain subject to the measures provided for in Article 3(1). Article 8 1. Without prejudice to the applicable rules concerning reporting, confidentiality and professional secrecy, natural and legal persons, entities and bodies shall: (a) supply immediately any information which would facilitate compliance with this Regulation, such as information on accounts and amounts frozen in accordance with Article 3(1), to the competent authority of the Member State where they are resident or located, and transmit such information, directly or through the Member State, to the Commission; and (b) cooperate with the competent authority in any verification of the information referred to in point (a). 2. Any additional information received directly by the Commission shall be made available to the Member States. 3. Any information provided or received in accordance with this Article shall be used only for the purposes for which it was provided or received. Article 9 It shall be prohibited to participate, knowingly and intentionally, in activities the object or effect of which is to circumvent the measures referred to in Article 3. Article 10 1. The freezing of funds and economic resources or the refusal to make funds or economic resources available, carried out in good faith on the basis that such action is in accordance with this Regulation, shall not give rise to liability of any kind on the part of the natural or legal person or entity or body implementing it, or its directors or employees, unless it is proved that the funds and economic resources were frozen or withheld as a result of negligence. 2. Actions by natural or legal persons, entities or bodies shall not give rise to any liability of any kind on their part if they did not know, and had no reasonable cause to suspect, that their actions would infringe the measures set out in this Regulation. Article 11 1. No claims in connection with any contract or transaction the performance of which has been affected, directly or indirectly, in whole or in part, by the measures imposed under this Regulation, including claims for indemnity or any other claim of this type, such as a claim for compensation or a claim under a guarantee, in particular a claim for extension or payment of a bond, guarantee or indemnity, in particular a financial guarantee or financial indemnity, of whatever form, shall be satisfied, if they are made by: (a) designated natural or legal persons, entities or bodies listed in Annex I; (b) any natural or legal person, entity or body acting through or on behalf of one of the natural or legal persons, entities or bodies referred to in point (a). 2. In any proceedings for the enforcement of a claim, the onus of proving that satisfying the claim is not prohibited by paragraph 1 shall be on the natural or legal person, entity or body seeking the enforcement of that claim. 3. This Article is without prejudice to the right of the natural or legal persons, entities and bodies referred to in paragraph 1 to judicial review of the legality of the non-performance of contractual obligations in accordance with this Regulation. Article 12 1. The Commission and Member States shall inform each other of the measures taken under this Regulation and share any other relevant information at their disposal in connection with this Regulation, in particular information in respect of: (a) funds frozen under Article 3 and authorisations granted under Articles 4, 5 and 6; (b) violation and enforcement problems and judgments handed down by national courts. 2. The Member States shall immediately inform each other and the Commission of any other relevant information at their disposal which might affect the effective implementation of this Regulation. Article 13 1. Where the Council decides to subject a natural or legal person, entity or body to the measures referred to in Article 3, it shall amend Annex I accordingly. 2. The Council shall communicate the decision referred to in paragraph 1, including the grounds for listing, to the natural or legal person, entity or body concerned, either directly, if the address is known, or through the publication of a notice, providing that natural or legal person, entity or body with an opportunity to present observations. 3. Where observations are submitted, or where substantial new evidence is presented, the Council shall review the decision referred to in paragraph 1 and inform the natural or legal person, entity or body concerned accordingly. 4. The list in Annex I shall be reviewed at regular intervals and at least every 12 months. 5. The Commission shall be empowered to amend Annex II on the basis of information supplied by Member States. Article 14 1. Annex I shall include the grounds for the listing of natural or legal persons, entities or bodies concerned. 2. Annex I shall contain, where available, the information necessary to identify the natural or legal persons, entities or bodies concerned. With regard to natural persons, such information may include: names and aliases; date and place of birth; nationality; passport and identity card numbers; gender; address, if known; and function or profession. With regard to legal persons, entities or bodies, such information may include names, place and date of registration, registration number and place of business. Article 15 1. Member States shall lay down the rules on penalties applicable to infringements of the provisions of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. 2. Member States shall notify the Commission of the rules referred to in paragraph 1 without delay after the entry into force of this Regulation and shall notify it of any subsequent amendment. Article 16 1. The Commission shall process personal data in order to carry out its tasks under this Regulation. These tasks include: (a) adding the contents of Annex I to the electronic, consolidated list of persons, groups and entities subject to Union financial sanctions and to the interactive sanctions map, both publicly available; (b) processing information on the impact of the measures of this Regulation such as the value of frozen funds and information on authorisations granted by the competent authorities. 2. For the purposes of this Regulation, the Commission service listed in Annex II is designated as ‘controller’ for the Commission within the meaning of Article 3(8) of Regulation (EU) 2018/1725, in order to ensure that the natural persons concerned can exercise their rights under that Regulation. Article 17 1. Member States shall designate the competent authorities referred to in this Regulation and identify them on the websites listed in Annex II. Member States shall notify the Commission of any changes in the addresses of their websites listed in Annex II. 2. Member States shall notify the Commission of their competent authorities, including the contact details of those competent authorities, without delay after the entry into force of this Regulation, and shall notify it of any subsequent amendment. 3. Where this Regulation sets out a requirement to notify, inform or otherwise communicate with the Commission, the address and other contact details to be used for such communication shall be those indicated in Annex II. Article 18 This Regulation shall apply: (a) within the territory of the Union, including its airspace; (b) on board any aircraft or vessel under the jurisdiction of a Member State; (c) to any natural person inside or outside the territory of the Union who is a national of a Member State; (d) to any legal person, entity or body, inside or outside the territory of the Union, which is incorporated or constituted under the law of a Member State; (e) to any legal person, entity or body in respect of any business done in whole or in part within the Union. Article 19 This Regulation shall enter into force on the day following that of its publication in the Official Journal of the European Union. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 17 May 2019. For the Council The President E.O. TEODOROVICI (1) See page 13 of this Official Journal. (2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). (3) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). ANNEX I List of natural and legal persons, entities and bodies referred to in Article 3 […] ANNEX II Websites for information on the competent authorities and address for notifications to the Commission BELGIUM https://diplomatie.belgium.be/nl/Beleid/beleidsthemas/vrede_en_veiligheid/sancties https://diplomatie.belgium.be/fr/politique/themes_politiques/paix_et_securite/sanctions https://diplomatie.belgium.be/en/policy/policy_areas/peace_and_security/sanctions BULGARIA https://www.mfa.bg/en/101 CZECHIA www.financnianalytickyurad.cz/mezinarodni-sankce.html DENMARK http://um.dk/da/Udenrigspolitik/folkeretten/sanktioner/ GERMANY http://www.bmwi.de/DE/Themen/Aussenwirtschaft/aussenwirtschaftsrecht,did=404888.html ESTONIA http://www.vm.ee/est/kat_622/ IRELAND http://www.dfa.ie/home/index.aspx?id=28519 GREECE http://www.mfa.gr/en/foreign-policy/global-issues/international-sanctions.html SPAIN http://www.exteriores.gob.es/Portal/en/PoliticaExteriorCooperacion/GlobalizacionOportunidadesRiesgos/Paginas/SancionesInternacionales.aspx FRANCE http://www.diplomatie.gouv.fr/fr/autorites-sanctions/ CROATIA http://www.mvep.hr/sankcije ITALY https://www.esteri.it/mae/it/politica_estera/politica_europea/misure_deroghe CYPRUS http://www.mfa.gov.cy/mfa/mfa2016.nsf/mfa35_en/mfa35_en?OpenDocument LATVIA http://www.mfa.gov.lv/en/security/4539 LITHUANIA http://www.urm.lt/sanctions LUXEMBOURG https://maee.gouvernement.lu/fr/directions-du-ministere/affaires-europeennes/mesures-restrictives.html HUNGARY http://www.kormany.hu/download/9/2a/f0000/EU%20szankci%C3%B3s%20t%C3%A1j%C3%A9koztat%C3%B3_20170214_final.pdf MALTA https://foreignaffairs.gov.mt/en/Government/SMB/Pages/Sanctions-Monitoring-Board.aspx NETHERLANDS https://www.rijksoverheid.nl/onderwerpen/internationale-sancties AUSTRIA http://www.bmeia.gv.at/view.php3?f_id=12750&LNG=en&version= POLAND https://www.gov.pl/web/dyplomacja PORTUGAL http://www.portugal.gov.pt/pt/ministerios/mne/quero-saber-mais/sobre-o-ministerio/medidas-restritivas/medidas-restritivas.aspx ROMANIA http://www.mae.ro/node/1548 SLOVENIA http://www.mzz.gov.si/si/omejevalni_ukrepi SLOVAKIA https://www.mzv.sk/europske_zalezitosti/europske_politiky-sankcie_eu FINLAND http://formin.finland.fi/kvyhteistyo/pakotteet SWEDEN http://www.ud.se/sanktioner UNITED KINGDOM https://www.gov.uk/sanctions-embargoes-and-restrictions Address for notifications to the European Commission: European Commission Service for Foreign Policy Instruments (FPI) EEAS 07/99 B-1049 Brussels, Belgium E-mail: relex-sanctions@ec.europa.eu

Summary: EU restrictive measures against cyber-attacks EU restrictive measures against cyber-attacks SUMMARY OF: Decision (CFSP) 2019/797 — restrictive measures against cyber-attacks threatening the EU or its Member States Regulation (EU) 2019/796 — restrictive measures against cyber-attacks threatening the EU or its Member States WHAT ARE THE AIMS OF THE DECISION AND THE REGULATION? They introduce a framework which allows the EU to impose sanctions to deter and respond to cyber-attacks* constituting an external threat to the EU or to EU countries. These cyber-attacks include those against non-EU countries or international organisations where action is considered necessary to achieve the EU’s common foreign and security policy objectives. KEY POINTS Sanctions for listed persons and entities This framework allows the EU to impose sanctions on persons or entities responsible for cyber-attacks or attempted cyber-attacks, who provide financial, technical or material support for such attacks or who are involved in other ways. Sanctions may also be imposed on persons or entities associated with them. Restrictive measures include bans on persons travelling to the EU, and asset freezing. Persons subject to such sanctions will be listed in Annex I of Decision CFSP 2019/797, as identified by the Council; all funds and economic resources belonging to, owned, held or controlled by any natural or legal person, entity or body listed in Annex I will be frozen. EU countries are responsible for setting out rules on penalties for infringements. Cyber-attacks The cyber-attacks falling within the scope of this new sanctions regime are those which have significant impact and which: originate or are carried out from outside the EU; or use infrastructure outside the EU; or are carried out by persons or entities established or operating outside the EU; or are carried out with the support of person or entities operating outside the EU. Cyber-attacks which are a threat to EU countries include those affecting information systems relating to: critical infrastructure essential to the vital functions of society, or citizens’ health, safety, security, and economic or social well-being; services necessary for essential social and economic activities, in particular energy, transport, banking; finance, healthcare, drinking water, digital infrastructure; critical state functions, in particular defence, the governance and functioning of institutions, public elections, economic and civil infrastructure, internal security, and external relations, including diplomatic missions; the storage or processing of classified information; or government emergency response teams. FROM WHEN DO THE DECISION AND THE REGULATION APPLY? They have applied since 18 May 2019. BACKGROUND A joint communication issued in June 2018 pointed out that activities by State and non-state actors such as cyber-attacks disrupting the economy and public services, through targeted disinformation campaigns, to hostile military actions continue to pose a serious and acute threat to the EU and to EU countries. It identified areas where action should be intensified to further deepen and strengthen the EU contribution to addressing these threats, and called upon EU countries and the Commission to ensure swift follow-up. In October 2018, in the wake of the cyber attacks on the Organisation for the Prohibition of Chemical Weapons, the European Council adopted conclusions calling for measures to be drawn up to further strengthen the EU’s deterrence, resilience and response to hybrid, cyber as well as chemical, biological, radiological and nuclear threats. The Council was called upon to devise a sanctions regime specific to cyber-attacks. See also: Resilience, Deterrence and Defence: Building strong cybersecurity in Europe (European Commission) Reform of cybersecurity in Europe (European Council and Council of the European Union) Cyber-attacks: Council is now able to impose sanctions — Press release (European Council and Council of the European Union). KEY TERMS Cyber-attacks: unauthorised actions involving access to and interference with information systems, data interference or data interception. MAIN DOCUMENTS Council Decision (CFSP) 2019/797 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (OJ L 129I, 17.5.2019, pp. 13-19) Council Regulation (EU) 2019/796 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (OJ L 129I, 17.5.2019, pp. 1-12) RELATED DOCUMENTS Joint communication to the European Parliament, the European Council and the Council — Increasing resilience and bolstering capabilities to address hybrid threats (JOIN(2018) 16 final, 13.6.2018) last update 20.01.2020


1.3.2019 EN Official Journal of the European Union L 62/12 COUNCIL DECISION (CFSP) 2019/346 of 28 February 2019 appointing the European Union Special Representative for Human Rights THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on European Union, and in particular Article 33 and Article 31(2) thereof, Having regard to the proposal from the High Representative of the Union for Foreign Affairs and Security Policy, Whereas: (1) On 25 July 2012, the Council adopted Decision 2012/440/CFSP (1) appointing Mr Stavros LAMBRINIDIS as the European Union Special Representative (EUSR) for Human Rights. The EUSR's mandate is to expire on 28 February 2019. (2) A new EUSR for Human Rights should be appointed for a period of 24 months, HAS ADOPTED THIS DECISION: Article 1 European Union Special Representative Mr Eamon GILMORE is hereby appointed as the European Union Special Representative (EUSR) for Human Rights until 28 February 2021. The Council may decide that the EUSR's mandate be terminated earlier, based on an assessment by the Political and Security Committee (PSC) and a proposal from the High Representative of the Union for Foreign Affairs and Security Policy (HR). Article 2 Policy objectives The EUSR's mandate shall be based on the policy objectives of the Union regarding human rights as set out in the Treaty on European Union, the Charter of Fundamental Rights of the European Union as well as the EU Strategic Framework on Human Rights and Democracy and the EU Action Plan on Human Rights and Democracy: (a) enhancing the Union's effectiveness, presence and visibility in protecting and promoting human rights in the world and bringing forward a positive narrative on human rights, in particular by deepening Union cooperation and political dialogue with third countries, relevant partners, business, civil society and international and regional organisations, and through action in relevant international fora; (b) enhancing the Union's contribution to strengthening democracy and institution building, the rule of law, good governance, respect for human rights and fundamental freedoms worldwide; (c) improving the coherence of Union action on human rights and the integration of human rights in all areas of the Union's external action. Article 3 Mandate In order to achieve the policy objectives, the EUSR's mandate shall be to: (a) contribute to the implementation of the Union's policy on human rights, in particular the EU Strategic Framework on Human Rights and Democracy and the EU Action Plan on Human Rights and Democracy, as well as the implementation of Union Guidelines, toolkits and action plans on human rights, including by formulating recommendations in this regard; (b) contribute to the implementation of the Union's positions, as defined by the Council, on promoting compliance with international humanitarian law; (c) contribute to the implementation of the Union's positions, as defined by the Council, on promoting support for international criminal justice, in particular Council Decision 2011/168/CFSP (2) on the International Criminal Court; (d) help establish a stronger European voice through dialogues on human rights with governments in third countries and international and regional organisations, as well as with civil society organisations and other relevant actors in order to ensure the effectiveness and the visibility of the Union's human rights policy; lead important human rights dialogues with third countries; (e) contribute to better coherence and consistency of the Union's policies and actions in the areas of protection and promotion of human rights, in particular by providing input to the formulation of relevant policies of the Union; (f) contribute, in consultation with Member States, to the better coherence and consistency of the Union's positions referred to in points (b) and (c). Article 4 Implementation of the mandate 1. The EUSR shall be responsible for the implementation of the mandate, acting under the authority of the HR. 2. The PSC shall maintain a privileged link with the EUSR and shall be the EUSR's primary point of contact with the Council. The PSC shall provide the EUSR with strategic guidance and political direction within the framework of the mandate, without prejudice to the powers of the HR. 3. The EUSR shall work in close coordination with the European External Action Service (EEAS) and its relevant departments in order to ensure coherence and consistency in their respective work in the area of human rights. Article 5 Financing 1. The financial reference amount intended to cover the expenditure related to the EUSR's mandate for the period from 1 March 2019 to 28 February 2021 shall be EUR 2 100 270,50. 2. The expenditure shall be managed in accordance with the procedures and rules applicable to the general budget of the Union. 3. The management of the expenditure shall be subject to a contract between the EUSR and the Commission. The EUSR shall be accountable to the Commission for all expenditure. Article 6 Constitution and composition of the team 1. Within the limits of the EUSR's mandate and the corresponding financial means made available, the EUSR shall be responsible for constituting a team. The team shall include the expertise on specific policy issues as required by the mandate. The EUSR shall keep the Council and the Commission promptly informed of the composition of the team. 2. Member States, the institutions of the Union and the EEAS may propose the secondment of staff to work with the EUSR. The salary of such seconded personnel shall be covered by the sending Member State, the sending institution of the Union or the EEAS, respectively. Experts seconded by Member States to the institutions of the Union or the EEAS may also be posted to work with the EUSR. International contracted staff shall have the nationality of a Member State. 3. All seconded personnel shall remain under the administrative authority of the sending Member State, the sending institution of the Union or the EEAS, respectively, and shall carry out their duties and act in the interest of the EUSR's mandate. 4. The EUSR's staff shall be co-located within the relevant EEAS departments or Union delegations in order to ensure coherence and consistency of their respective activities. Article 7 Security of EU classified information The EUSR and the members of the EUSR's team shall respect the security principles and minimum standards established by Council Decision 2013/488/EU (3). Article 8 Access to information and logistical support 1. Member States, the Commission, the EEAS and the General Secretariat of the Council shall ensure that the EUSR is given access to any relevant information. 2. The Union delegations and the diplomatic representations of Member States, as appropriate, shall provide logistical support to the EUSR. Article 9 Security In accordance with the Union's policy on the security of personnel deployed outside the Union in an operational capacity under Title V of the Treaty, the EUSR shall take all reasonably practicable measures, in accordance with the EUSR's mandate and on the basis of the security situation in the area of responsibility, for the security of all personnel under the EUSR's direct authority, in particular by: (a) establishing a specific security plan based on guidance from the EEAS, including specific physical, organisational and procedural security measures governing the management of the secure movement of personnel to, and within, the area of responsibility, as well as the management of security incidents and providing for a contingency and evacuation plan; (b) ensuring that all personnel deployed outside the Union are covered by high-risk insurance, as required by the conditions in the area of responsibility; (c) ensuring that all members of the EUSR's team to be deployed outside the Union, including locally contracted personnel, have received appropriate security training before or upon arriving in the area of responsibility, based on the risk ratings assigned to that area by the EEAS; (d) ensuring that all agreed recommendations made following regular security assessments are implemented, and providing the Council, the HR and the Commission with written reports on their implementation and on other security issues within the framework of the progress reports and the report on the implementation of the mandate. Article 10 Reporting The EUSR shall regularly provide the HR and the PSC with oral and written reports. The EUSR shall also report to Council working parties, in particular the Working Party on Human Rights, as necessary. Regular reports shall be circulated through the COREU network. The EUSR may provide the Foreign Affairs Council with reports. In accordance with Article 36 of the Treaty, the EUSR may be involved in briefing the European Parliament. Article 11 Coordination 1. The EUSR shall contribute to the unity, consistency and effectiveness of the Union's action and shall help ensure that all Union instruments and Member States' actions are engaged consistently, to attain the Union's policy objectives. The activities of the EUSR shall be coordinated with those of the Member States and the Commission, as well as other EUSRs, as appropriate. The EUSR shall provide regular briefings to Member States' missions and Union delegations. 2. In the field, close liaison shall be maintained with the relevant Member States' Heads of Mission, the Heads of the Union delegations, as well as with Heads or Commanders of Common Security and Defence Policy missions and operations and other EUSRs, as appropriate. They shall make every effort to assist the EUSR in the implementation of the mandate. 3. The EUSR shall also liaise and seek complementarity and synergies with other international and regional actors at Headquarters level and in the field. The EUSR shall seek regular contacts with civil society organisations both at Headquarters level and in the field. Article 12 Review The implementation of this Decision and its consistency with other contributions from the Union shall be kept under regular review. The EUSR shall present the Council, the HR and the Commission with regular progress reports and a comprehensive mandate implementation report by 30 November 2020. Article 13 Entry into force This Decision shall enter into force on the date of its adoption. It shall apply from 1 March 2019. Done at Brussels, 28 February 2019. For the Council The President G. CIAMBA (1) Council Decision 2012/440/CFSP of 25 July 2012 appointing the European Union Special Representative for Human Rights (OJ L 200, 27.7.2012, p. 21). (2) Council Decision 2011/168/CFSP of 21 March 2011 on the International Criminal Court and repealing Common Position 2003/444/CFSP (OJ L 76, 22.3.2011, p. 56). (3) Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information (OJ L 274, 15.10.2013, p. 1).

Summary: The EU Special Representatives for Human Rights The EU Special Representatives for Human Rights SUMMARY OF: Decision (CFSP) 2019/346 appointing the European Union Special Representative for Human Rights WHAT IS THE AIM OF THIS DECISION? It appoints the European Union's Special Representative (EUSR) for Human Rights. KEY POINTS The EUSR’s role is to promote the European Union's (EU’s) human rights policy objectives as set out in the EU treaties, the Charter of Fundamental Rights and the EU Strategic Framework on Human Rights and Democracy. These include: increasing the EU’s effectiveness, presence and visibility in protecting and promoting human rights, in particular through action in relevant international forums and through cooperation and political dialogue with non-EU countries;relevant partners;businesses;civil society;international and regional organisations; boosting the EU’s contribution to strengthening democracy and institution-building, the rule of law, good governance and respect for human rights and fundamental freedoms worldwide; improving the coherence of EU action on human rights and the integration of human rights in all areas of its dealings with other countries. The EUSR is responsible for implementing these policy objectives and acts under the authority of the High Representative of the Union for Foreign Affairs and Security Policy (HR). The Council's Political and Security Committee (PSC) provides him or her with strategic guidance and political direction, and is his or her primary point of contact with the Council of the European Union. The EUSR also works closely with the European External Action Service (EEAS) to ensure coherence and consistency in their respective work in the area of human rights. The EUSR is responsible for appointing his or her team and ensuring that it possesses the necessary expertise to fulfil its tasks. Members of the team are seconded from EU institutions, EU countries and the EEAS, and must carry out their duties and act in the interest of the mandate of the EUSR. The EUSR must take all reasonably practicable measures for the security of all staff under its direct authority. The EUSR reports regularly to: the HR; the PSC; the Council Working Party on Human Rights. Reports are circulated via the COREU network. The original decision has been amended and extended several times, most recently in 2018. Decision (CFSP) 2018/225 provides the EUSR with a budget of €894.178 for the period up to 28 February 2019, when the EUSR’s mandate is due to expire. FROM WHEN DOES THE DECISION APPLY? It has applied since 1 March 2019. BACKGROUND For more information, see: EU Special Representatives (European External Action Service) EU Strategic Framework and Action Plan on Human Rights and Democracy (Council of the European Union). MAIN DOCUMENT Council Decision (CFSP) 2019/346 of 28 February 2019 appointing the European Union Special Representative for Human Rights (OJ L 62, 1.3.2019, pp. 12-15) RELATED DOCUMENTS Council Decision 2012/440/CFSP of 25 July 2012 appointing the European Union Special Representative for Human Rights (OJ L 200, 27.7.2012, pp. 21-23) Successive amendments to Decision 2012/440/CFSP have been incorporated in the basic text. This consolidated version is of documentary value only. Council Decision (CFSP) 2015/260 of 17 February 2015 extending the mandate of the European Union Special Representative for Human Rights (OJ L 43, 18.2.2015, pp. 29-32) See consolidated version. Council Decision (CFSP) 2017/346 of 27 February 2017 extending the mandate of the European Union Special Representative for Human Rights (OJ L 50, 28.2.2017, pp. 66-69) See consolidated version Council Decision (CFSP) 2018/225 of 15 February 2018 amending Decision (CFSP) 2017/346 extending the mandate of the European Union Special Representative for Human Rights (OJ L 43, 16.2.2018, p. 14) last update 24.08.2018