Principles for the protection of exchanged information
Article 46
1. The entities listed in Article 2(1) shall ensure that information provided, received, exchanged or transmitted under this Regulation is accessible only on a need-to-know basis and in accordance with relevant Union and national rules on security of information. 2. The entities listed in Article 2(1) shall ensure that information provided, received, exchanged or transmitted under this Regulation is handled and tracked during the entire life-cycle of that information and that it may be released at the end of its life-cycle only after being anonymised. 3. The entities listed in Article 2(1) shall ensure that all necessary protection measures of organisational and technical nature are in place to safeguard and protect the confidentiality, integrity, availability and non-repudiation of information provided, received, exchanged or transmitted under this Regulation, independently from the means used. The protection measures shall: (a) be proportionate; (b) take into consideration cybersecurity risks related to known past and emerging threats to which such information may be subject in the context of this Regulation; (c) to the extent possible, be based on national, European or international standards and best practices; (d) be documented. 4. The entities listed in Article 2(1) shall ensure that any individual who is granted access to information provided, received, exchanged or transmitted under this Regulation is briefed on the security rules applicable at entity level and on the measures and procedures relevant to the protection of information. Those entities shall ensure that the concerned individual acknowledges the responsibility to protect the information as instructed during the briefing. 5. The entities listed in Article 2(1) shall ensure that access to information provided, received, exchanged or transmitted under this Regulation is limited to individuals: (a) who are authorised to access that information based on their functions and limited to the execution of the tasks assigned; (b) for whom the entity was able to assess ethical and integrity principles, as well as for whom there is no evidence of negative outcome from a background verification check to evaluate reliability of the individual in accordance with the best practices and standard security requirements of the entity, and, where necessary, with the national laws and regulations. 6. The entities listed in Article 2(1) shall have the written agreement of the natural or legal person that originally created or provided the information, prior to providing that information to a third party that falls outside the scope of this Regulation. 7. An entity listed in Article 2(1) may consider that this information shall be shared without complying with paragraphs 1 and 4 of this Article in order to prevent a simultaneous electricity crisis with a cybersecurity root cause or any cross-border crisis within the Union in another sector. In that case, it shall: (a) consult and be authorised by the competent authority to share such information; (b) anonymise such information without losing the elements necessary to inform the public of an imminent and serious risk to cross-border electricity flows and the possible mitigation measures; (c) safeguard the identity of the originator and of the entities that have been processing such information under this Regulation. 8. By derogation from paragraph 6 of this Article, the competent authorities may provide information provided, received, exchanged or transmitted under this Regulation to a third party not listed in Article 2(1) without a written prior consent of the originator of the information but informing the latter at the earliest time possible. Before disclosing any information provided, received, exchanged or transmitted under this Regulation to a third party not listed in Article 2(1), the concerned competent authority shall reasonably ensure that the concerned third party is aware of the security rules in force and shall receive reasonable assurance that the concerned third party can protect the received information in compliance with paragraphs 1 to 5 of this Article. The competent authority shall anonymise such information without losing the elements necessary to inform the public of an imminent and serious risk to cross-border electricity flows and possible mitigations measures and safeguard the identity of the originator of the information. In this case, the third party not listed in Article 2(1) shall protect the received information in accordance with provisions already in force at entity level, or where this is not possible, with the provisions and instructions provided by the relevant competent authority. 9. This Article does not apply to entities not listed in Article 2(1) that are provided with information pursuant to paragraph 6 of this Article. In this case paragraph 7 of this Article shall be applied, or the competent authority may provide that entity with written provisions to apply in cases where information is received pursuant to this Regulation.