Ref. Ares(2020)5494075 - 14/10/2020
Ref. Ares(2022)6623349 - 26/09/2022
DECISION OF THE ADMINISTRATIVE BOARD on Records Management and
Archives at EMSA
THE ADMINISTRATIVE BOARD OF THE EUROPEAN MARITIME SAFETY AGENCY,
Having regard to Regulation (EC) No 1406/2002 of the European Parliament and of the Council
establishing a European Maritime Safety Agency, as amended,
Having regard to Council Regulation (EEC, Euratom) No 354/831 as amended , and in particular
Article 9(1) thereof,
Whereas:
1) Under the terms of Council Regulation (EEC, Euratom) No 354/83, each EU institution, body
and agency has to establish its historical archives and open them to the public after thirty
years.
2) Article 9(1) of Regulation (EEC, Euratom) No 354/83 provides that each institution shall adopt
internal rules for the application of that Regulation These rules shall include rules for the
preservation and opening to the public of historical archives and on the protection of personal
data contained therein.
3) The records held by EMSA form the basis of its operation and daily work. They are part of
EMSA’s assets and fulfil the functions of facilitating the exchange of information, providing
evidence of action taken, meeting the institution’s legal obligations and preserving its memory.
They must therefore be managed in accordance with effective rules applicable to all
departments and units.
4) EMSA keeps records that are created, received and managed in the course of its activities All
records, regardless of format and the technological environment in which they are collected,
created or generated, are captured and maintained in an official electronic repository of
records.
5) EMSA operates and monitors maritime information systems which collect data from Member
States or other sources The management and archiving of these data are regulated by
specific rules/decisions and are out of the scope of this Decision. Information of the reporting
activity produced by EMSA concerning these systems are subject to be registered and
archived under the terms of this Decision.
6) Provisions on records management and archiving set out principles to ensure: the
creation, receipt and proper preservation or elimination of records and their consultation
and communication; the authenticity, reliability, integrity and readability over time of records
and the metadata accompanying them; the identification of each record together with the
extraction and allocation of metadata, so that it can be filed, searched and is easily traceable;
the development, maintenance and updating of the structure of the EMSA’s records and
archiving management systems, its electronic repositories and its repositories for analogue
media
7) These principles are intended to cover the lifecycle of the EMSA’s records, whatever their
medium, making available, exchanging, sharing, reusing and disseminating data, information
and records, in line with implementing rules, governance arrangements and practice of the
EMSA’s records management.
1 Council Regulation (EEC, Euratom) No 354/83 concerning the opening to the public of the historical archives of the European
Economic Community and the European Atomic Energy Community (OJ L 43, 15.2.1983, p. 1) as amended.
1
8) Effective and proper records management and archiving help meet the EMSA's transparency
obligations, in particular by facilitating public access to documents and implementing the
principle of accountability of public actions.
9) Provisions on records management and archiving should be aligned with the obligation to
provide access to documents held by EMSA in accordance with the principles, arrangements
and limits set out in Regulation (EC) No 1049/2001 of the European Parliament and of the
Council
2
10) Article 9(1) of Regulation (EEC, Euratom) No 354/83 provides that the institutions shall make
their archives available to the public by electronic means and facilitate their consultation on the
internet In order to fulfil this requirement, the principle of the creation of records only in
electronic format should be strongly emphasised, although exceptions to this principle should
nevertheless be possible
11) The Union institutions, bodies, offices and agencies are encouraged to recognise
electronic identification and trust services covered by Regulation (EU) No 910/2014 of the
European Parliament and of the Council 3 for the purpose of administrative cooperation
capitalising, in particular, on existing good practice and the results of ongoing projects in the
areas covered by this Regulation
12) The EMSA’s rules and procedures on records management and archiving should be regularly
updated, taking account of developments in and the results of academic and scientific
research, including the emergence of relevant standards and developments in information and
communication technologies.
13) A records management system does not only register records, but more broadly captures them
to clearly and reliably identify them, ensure their traceability and make them available to other
users through filing or other means of aggregation of records throughout their life cycle.
14) Information systems, networks and transmission facilities that feed the EMSA’s records system
should be protected by appropriate security measures in accordance with the applicable
security rules for protecting information.
15) Data and information should be available and shared as widely as possible within EMSA in
order to facilitate the collaborative working of its staff and the retrievability and reuse of data
and information and to promote the synergy of its resources and improve efficiency.
16) Under Regulation (EU) 2018/1725 of the European Parliament and of the Council4, EMSA is
required to provide information to data subjects on the processing of personal data concerning
them and to respect their rights as data subjects. However, EMSA should balance these rights
with the objectives of archiving in the public interest in accordance with data protection law
17) Articles 16(5) and 19(3) of Regulation (EU) 2018/1725 provide for exceptions to data subjects’
right to information and right to erasure in respect of processing data for archiving purposes in
the public interest Those rights should not apply in principle in the particular context of the
EMSA’s historical archives, taking into account the size of the institution and its records and
the nature of archiving in the public interest. The erasure of personal data contained in such
records, in particular, would undermine the validity, integrity and authenticity of the EMSA’s
2 Regulation (EC) No 1049/2001 of the European Parliament and of the Council regarding public access to European
Parliament, Council and Commission documents (OJL 145, 31 5 2001, pp 43-48)
3 Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and
trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (OJ L 257, 28 8 2014, pp
73-114).
4 Regulation (EU) 2018/1725 of the European Parliament and of the Council on the protection of natural persons with regard to
the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data
and repealing Regulation (EC) No 45/2001 and Decision 1247/2002/EC (OJ L 295, 21.11.2018, pp. 39-98).
2
archives and is therefore likely to seriously impair the achievement of the objectives of
archiving in the public interest
18) EMSA may be unable or would be required to make a disproportionate effort to provide
information on processing once its files and records selected for permanent preservation have
been transferred to its historical archives Data subjects should be informed that records
containing their personal data may become part of the EMSA’s historical archives at the end of
the retention period identified for those records as part of the information referred to in Articles
15 and 16 of Regulation (EU) 2018/1725. That information is provided in relation to the original
processing operations for which the personal data were initially collected
19) Article 25(4) of Regulation (EU) 2018/1725 gives EMSA the possibility of providing for
derogations from the rights referred to in Articles 17, 18, 20, 21, 22 and 23 of that Regulation,
insofar as those rights are likely to render impossible or seriously impair the achievement
of archiving purposes in the public interest and derogations are necessary for the fulfilment of
those purposes Unless derogations are provided for in a legal act adopted on the basis of the
Treaties, internal rules must be adopted under which EMSA is entitled to derogate from those
rights
20) Granting access to personal data in case of a data subject request which does not provide
specific information regarding the processing to which the request relates may involve a
disproportionate administrative effort or be practically impossible, given the size and nature of
the EMSA’s historical archive.
21) The rectification of personal data would undermine the integrity and authenticity of the EMSA’s
archives and defeat the purpose of archiving in the public interest This is without prejudice to
the possibility that EMSA, in duly justified cases of inaccurate personal data, may decide to
include a supplementary statement or annotation to the relevant record
22) Personal data form an integral and indispensable part of records selected for permanent
preservation. Therefore, granting the right to object to the processing of personal data
contained in such records would render impossible the achievement of the purposes of
archiving in the public interest.
23) EMSA should provide for derogations subject to the conditions and safeguards referred to in
Article 13 of Regulation (EU) 2018/1725
24) In applying the principle of accountability, EMSA should keep a record of its application of
derogations.
25) To guarantee the utmost protection of the rights and freedoms of data subjects and in
accordance with Article 44(1) of Regulation (EU) 2018/1725, the Data Protection Officer of
EMSA should be informed as soon as possible of the application of derogations under this
Decision
26) EMSA staff should be accountable for the creation and correct management of records relating
to policies, process and procedures for which they are responsible,
HAS DECIDED AS FOLLOWS:
SECTION 1. GENERAL PRINCIPLES
Article 1: Subject matter and scope
1.
This Decision lays down rules concerning:
3
(a)
the management of EMSA’s records and the archiving of the records5
(b)
the preservation and opening to the public of the EMSA’s archives and the deposit of
the EMSA’ historical archive at the Historical Archives of the European University
Institute (EUI) in Florence
2
This Decision applies to records held by EMSA and to its archives, irrespective of their form,
medium, age and location.
Article 2: Definitions
For the purpose of this Decision, the following definitions shall apply:
(1)
‘record’ means information, received and created in the form of a document, a collection of
data or other form in a digital or analogue medium that is captured in an official repository
and managed and maintained as evidence and as an asset;
(2)
‘metadata’ means any information describing the context, content and structure of records
and their management over time for the purposes of, inter alia, retrieval, accessibility and
reuse;
(3)
‘digitisation’ means the process of transforming a record on paper or any other traditional
medium into an electronic rendition;
(4)
‘official repository of records’ means a system, recognised and approved by the Executive
Director, in which records held by EMSA are collected, organised and categorised to
facilitate records retrieval, distribution, use, disposal or preservation;
(5)
‘capture’ means the insertion of a document into an official electronic repository by
combining a unique identifier and metadata;
(6)
‘unique identifier’ means a sequence of digits or letters, or both, unambiguously assigned to
a record by a machine or person and which identifies that record as unique and distinct from
all other records;
(7)
‘registration’ means capturing a record into a register, establishing that it is complete and
properly constituted from an administrative and/or legal standpoint and certifying that it has
been sent by an author to an addressee on a given date, as incoming or outgoing mail, or
has been incorporated into the EMSA’s official repositories;
(8)
‘file’ means an aggregation of records organised in line with the EMSA’s activities, for
reasons of proof, justification or information and to guarantee efficiency in the work; the
group of records making up the file is organised in such a way as to form a coherent and
relevant unit in terms of the activities conducted by EMSA;
(9)
‘filing plan’ means an instrument with a hierarchical and logical structure, in the form of a
tree structure with a number of interlinked headings, which enables files (or other
aggregations of records) to be intellectually organised and linked to the context in which
they were drawn up, on the basis of the functions, activities and working processes;
(10)
‘authenticity’ means the fact that a record can be proved to be what it purports to be, to have
been created or sent by the person purported to have created or sent it and to have been
created or sent when purported;
(11)
‘reliability’ means the fact that the content of a record can be trusted as a full and accurate
representation of the transactions, activities or facts to which they attest and that the record
can be depended upon in the course of subsequent transactions or activities;
(12)
‘integrity’ means the fact that a record is complete and unaltered;
5 EMSA operates and monitors maritime information systems which collect data from Member States or other sources. The
management and archiving of these data are regulated by specific rules/decisions and are out of the scope of this Decision
4
(13)
‘validity’ means the fact that a document has al the intrinsic and extrinsic characteristics
required by its production context, necessary in order to be accepted as an expression of its
author with all its legal consequences;
(14)
‘admissibility’ means the fact that a document has al the intrinsic and extrinsic
characteristics required by its reception context, necessary for it to be accepted as an
expression of its author with all its legal consequences;
(15)
‘preservation’ means all technical processes and operations which make it possible to keep
records over time, to maintain their integrity and authenticity and to guarantee access to
their content.
SECTION 2. RECORDS MANAGEMENT
Article 3: Creation
1
Records shall be created in accordance with the formal requirements set out for the relevant
type of records6.
2.
EMSA’s records shall be created as electronic records and shall be kept in its official
electronic repositories
However, in the following situations records may be created in a different medium or kept in
a different manner as instructed by the Executive Director and, in particular for the following
reasons:
(a) where a provision of Union or national law so requires,
(b) where protocol convenience imposes paper medium,
(c) where practical reasons impede digitisation of the document,
(d) where the preservation of the original analogue document has an added value because
of its form or the material from which it is made or for historical reasons
Article 4: Digitisation
1.
Information in analogue media created or received by EMSA shall be systematically
digitised The resulting electronic renditions, when captured by the official electronic register
or by specific electronic register, shall replace the corresponding original analogue
documents, unless a handwritten signature is required by a provision of Union law or the law
of the Member State or third country concerned.
2.
Implementing rules adopted pursuant to Article 19 shall set out the procedural and technical
details of digitisation, the applicable exceptions and the elimination of analogue records
following their digitisation.
Article 5: Capture
1
Each Department and Unit shall regularly review the types of information created or
received in the course of its activities to identify which ones are to be captured in the official
electronic repository and, taking account of the context in which they were produced, to
organise the management of these throughout their life cycle.
6 The author of any newly created information shall analyse it in order to determine the electronic management
system by which the information is to be managed, if it is to be captured and in which repository system it is to
be preserved This is applicable for classified documents (EUCI information)
5
2.
The captured records shall not be altered. They may be removed or replaced by subsequent
versions until the file they belong to is closed
Article 6: Registration
1
Documents shall be registered if they contain important information which is not short-lived
or if they may involve action or follow-up by EMSA or if the document need to be kept as
evidence
2.
Registers shall be set up to generate unique identifiers for the registered records. Each
register shall be connected to one or more electronic repositories Exceptions may be made
for security reasons.
Article 7: Filing plan
EMSA’s filing plan shall use a common file classification across all EMSA departments That
classification shall form part of the EMSA’s activity-based management.
Article 8: Legal effects of electronic signatures, seals, timestamps and registered delivery services
1.
A qualified electronic signature 7 shall have the equivalent legal effect of a handwritten
signature
2.
A qualified electronic seal 8 shall enjoy the presumption of integrity of the data and of
correctness of the origin of that data to which the qualified electronic seal is linked
3.
A qualified electronic time stamp9 shall enjoy the presumption of accuracy of the date and
the time it indicates and the integrity of the data to which the date and time are bound
4.
Data sent and received using a qualified electronic registered delivery service10 shall enjoy
the presumption of the integrity of the data, the sending of that data by the identified sender,
its receipt by the identified addressee and the accuracy of the date and time of sending and
receipt indicated by the qulaified electornic registered delivery service,
Article 9: Validity of documents and procedures
1
A document created or received by EMSA shall be considered to satisfy the validity or
admissibility criteria where the following conditions are met:
(a) the person from whom it originates is identified;
(b) the context in which the document was produced is reliable and the document meets the
conditions that guarantee its integrity;
(c) the document complies with the formal requirements set out in the applicable Union or
national law;
7 “electronic signature” is understood within the meaning of Article 3(10) to (12) of Regulation (EU) No
910/2014.
8 “electronic seal” is understood within the meaning of Article 3(25) to (27) of Regulation (EU) No 910/2014.
9 “electronic stamp” is understood within the meaning of Article 3(23) to (34) of Regulation (EU) No 910/2014.
10 “electronic registered delivery service” is understood within the meaning of Article 3(36) and (37) of
Regulation
(EU) No 910/2014
6
(d) in the case of an electronic document, the document is created in a way that guarantees
the integrity, reliability and usability of its content and the accompanying metadata
2
An electronic rendition created by digitising an analogue document created or received by
EMSA shall be considered to satisfy the validity or admissibility criteria where the following
conditions are fulfilled:
(a) no signature is required by a provision of Union law or the law of a Member State or third
country concerned;
(b) its format offers guarantees of integrity, reliability, durability, readability over time and
ease of access to the information it contains
Where a signed analogue document is not required, such an electronic rendition may be
used for any exchange of information and for any internal procedure within EMSA.
3.
Where a provision of Union or national law requires a signed original of a document, a
document drawn up or received by EMSA shall satisfy that requirement if the document
contains any of the following:
(a) one or more handwritten or qualified electronic signatures,
(b) one or more electronic signatures, other than qualified, providing sufficient guarantees
about the identification of the signatory and the expression of their will in the signed
document.
4.
Where a procedure specific to EMSA requires the signature of an authorised person or the
approval of a person at one or more stages of the procedure, the procedure may be
managed by computer systems, provided that each person is clearly and unambiguously
identified and that the system in question provides guarantees that the content is not altered
during
the
procedure.
5.
Where a procedure involves EMSA and other entities and requires the signature of an
authorised person or the approval of a person at one or more stages of the procedure, the
procedure may be managed by computer systems meeting conditions and providing technical
assurances determined by mutual agreement
Article 10: Provision of data and information within EMSA
1.
Data and information shall be made available and shared as widely as possible within
EMSA, unless legal obligations require access to be limited
2.
In the interest of information sharing, Departments and Units shall ensure that their files are
as widely accessible as the sensitivity of their content allows
Article 11: Information security and protection
Records shall be managed in accordance with the EMSA’s security rules applicable to the protection
of information To this end, records, files, information systems and archives, including their networks
and means of transmission, shall be protected by appropriate security measures for the management
of classified information, sensitive non-classified information and personal data
Classified information shall be processed in accordance with the rules in force on security.
7
SECTION 3: PRESERVATION AND HISTORICAL ARCHIVES
Article 12: Storage and preservation
1
Storage and preservation shall take place under the following conditions:
(a)
records shall be stored in the form in which they were created, sent or received or in
a form which preserves the authenticity, reliability and the integrity of their content
and of the accompanying metadata;
(b)
the content of records and their relevant metadata must be readable throughout their
period of storage by any person authorised to have access to them;
(c)
where records are sent or received electronically, the information required to
determine the origin or destination of the record and the date and time of the capture
or registration, shall be part of the minimum metadata to be stored;
(d)
as regards electronic procedures managed by IT systems, information about the
formal stages of the procedure shall be stored under such conditions as to ensure
that those stages and the authors and participants can be identified.
2.
EMSA shall ensure the implementation of a digital preservation strategy to ensure long-term
access to electronic records on the basis of the retention list referred in Article 13(1) The
strategy shall ensure that processes, tools and resources are in place to ensure the
authenticity, reliability and integrity of records and their accessibility
Article 13: Retention, transfer and elimination
1.
The retention period for the various categories of files and, in certain cases, records, shall
be set for the whole EMSA by way of regulatory instruments, such as the retention list and
the existing legislation and EMSA’s legal obligations.
2
EMSA’s Departments and Units shall regularly conduct an appraisal of records and files
managed by them to assess whether they shall be part of the EMSA’s historical archive or
eliminated
A set of metadata on records and files shall be retained in the original electronic repository
as evidence of such records and files and their transfer or elimination
3.
EMSA
classified
information
with
a
classification
of
CONFIDENTIEL
UE/EU
CONFIDENTIAL or higher shall not be part of the EMSA’s historical archive
Article 14: Processing of personal data contained in the EMSA’s historical archive
1.
The following derogations from the rights of data subjects shall apply in accordance with
Article 25(4) of Regulation (EU) 2018/172511, as necessary to fulfil archiving purposes in the
public interest and to preserve the integrity of the EMSA’s historical archives, in particular:
(a)
the right of access, in so far as the request of the data subject does not allow for the
identification of specific records without involving disproportionate administrative
effort In assessing the action to be taken on the request of the data subject and the
administrative effort required, particular account shall be taken of the information
provided by the data subject and the nature, scope and size of the records potentially
concerned;
11 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural
persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free
movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC
8
(b)
the right to rectification, in so far as rectification renders it impossible to preserve the
integrity and authenticity of records selected for permanent preservation in the
EMSA’s historical archives, without prejudice to the possibility of a supplementary
statement or annotation to the record concerned, unless this proves impossible or
involves disproportionate effort;
(c)
the obligation to notify the rectification or erasure of personal data in so far as this
proves impossible or involves disproportionate effort;
(d)
the right to object to the processing, in so far as the personal data are
contained in records selected for permanent preservation in the Commission’s
historical archives as an integral and indispensable part of these records
2.
EMSA shall implement appropiate safeguards to ensure compliance with Article 13 of
Regulation (EU) 2018/1725 Such safeguards shall include technical and organisational
measures, in particular, in order to ensure respect for the principle of data minimisation. The
safeguards shall include:
(a)
the files to be part of the EMSA’s historical archive shall be selected following a case-
by-case assessment according to the EMSA’s retention list All the other files,
including structured personal data files, such as personal and medical files, shall be
eliminated at the end of the administrative retention period;
(b)
the retention list shall provide for the administrative elimination of certain types of
records before the end of the administrative retention period Consequently, these
types of records shall not be processed for archiving purposes in the public interest;
(c)
prior to processing for archiving purposes in the public interest, the departments or
the units shall report the potential presence of records covered by Article 2(1) of
Regulation (EEC, Euratom) No 354/83 in the files to be part of the EMSA’s historical
archive;
(d)
before any EMSA file is opened to the public, the file shall be reviewed to verify
the possible presence of records covered by the exceptions indicated in Article
2(1) of Regulation (EEC, Euratom) No 354/83, including on the basis of the
signposting referred to in point (c) with the aim of protecting personal data.
3
EMSA shall record the reasons for derogations applied pursuant to this Decision The record
and, where applicable, the documents concerning the factual or legal context shall be
registered They shall be made available to the European Data Protection Supervisor on
request.
4
The EMSA’s Data Protection Officer shal be informed, as soon as possible of the
application of derogations from data subject rights in accordance with this Decision. Upon
request, the EMSA’s Data Protection Officer shall be provided with access to the associated
records and any documents setting out the factual or legal context.
Article 15: Deposit of the EMSA’s historical archive at the European University Institute (EUI)
1
EMSA shall provide the EUI, where possible, with access to digitised copies of records
held in an analogue medium that are part of its historical archive.
2
The EMSA site and the EUI shall be the main access point to the EMSA’s historical archive
that are open to the public.
3
EMSA shall send the EUI descriptions of the archives deposited In accordance with
international standards and to facilitate the exchange of metadata, EMSA will promote
interoperability between its archives systems and those of the EUI
4.
The EUI acts as a processor12 in accordance with Article 3 of Regulation (EU) 2018/1725,
under instructions from EMSA, which acts as the controller13 of personal data contained in
its historical archives, deposited at the EUI. EMSA provides the necessary instructions for
12 ‘processor’ is understood within the meaning of Article 3(12) of Regulation (EU) 2018/1725.
13 ‘controller’ is understood within the meaning of Article 3(8) of Regulation (EU) 2018/1725.
9
the processing of personal data contained in the EMSA’s deposited archives by the EUI and
monitors its performance
5.
Classified information shall not be deposited at the EUI.
SECTION 4 GOVERNANCE AND IMPLEMENTATION
Article 16: Governance at EMSA level
1
The Executive Director shall put in place the necessary organisational, administrative
and physical structure and provide the staff required to implement this Decision and its
implementing rules
2.
The unit responsible of Records Management and Archivesshall be responsible for ensuring
that this Decision and its implementing rules are applied
Article 17: Document Management Officer
The Document Management Officer designated by EMSA shall maintain a modern and efficient
records management system Its role shall be:
(a)
ensure the correct and uniform application of this Decision within the departments
and units;
(b)
deal with any issues which may arise from its application;
(c)
share the requirements of departments and units as regards training and support
measures;
Article 18: Information, training and support
The unit responsible of Records Management and Archives, in close cooperation with departments
and units of the Agency shall put in place the information, training and support measures necessary to
ensure the application of this Decision within the departments and units
Article 19: Implementing rules
The unit responsible of Records Management and Archiving shall draw up the implemeting rules for
adoption of the Executive Director and shall ensure their implemention
The implementing rules shall be regularly updated taking into account in particular of:
(a)
developments regarding records and archives management and results of academic and
scientific research, inluding the emergence of relevant standards;
(b)
developments in information and communication technologies;
(c)
the applicable rules on the probative value of electronic records;
(d)
EMSA’s obligations as regards transparency, public access to documents and the opening to
the public of archives;
(e)
any new obligations of which EMSA may be bound;
(f)
harmonisation in the presentation of records drawn up by the Commission.
10
Article 20: Final provision
This Decision shall take effect on the date of its adoption.
Done at Lisbon, on 12 November 2020.
Andreas Nordseth
Chairman of the Administrative Board
11
