CLASSIFICATION OF THE INFORMATION
ANNEX IISupplementary provisions
ANNEX II CLASSIFICATION OF THE INFORMATION Detailed definitions of the markings in accordance with Article 7(2) (a) PRIVACY is rated in accordance with the categories below: ID Privacy Rating Name Privacy Rating Description PRIV-2 Sensitive Personal Information Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership; processing of genetic data, biometric data for the purpose of uniquely identifying a natural person; data concerning health or data concerning a natural person’s sex life or sexual orientation; data concerning criminal convictions and offences PRIV-1 Non-Sensitive Personal Information Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity and as long as they do not reveal aspects of the data subject qualifying as sensitive personal information. PRIV-0 Non-Personal Information Information that does not relate to a natural person or which does not lead to the identification of a natural person such as anonymised personal data. (b) CONFIDENTIALITY is classified in accordance with the levels below: ID Classification Level Name Classification Level Description CONF-3 Catastrophic Information whose unauthorised disclosure would have one or several of the following consequences: — Financial impact of > EUR 10 million — Significant liability/damage compensation claims by the Aviation Repository authorised users and/or interested parties — Significant competitive disadvantage for the Aviation Repository authorised users and/or interested parties — Impossibility for the Aviation Repository authorised users’ to meet their objectives — Total loss of confidence by interested parties and public — Total loss of reputation — The Agency questioned as an organisation CONF-2 Significant Information whose unauthorised disclosure would have one or several of the following consequences: — Financial impact of EUR 1-10 million — Medium liability/damage compensation claims by the Aviation Repository authorised users and/or interested parties — Significantly damaged reputation in the specific business area, negative exposure in both specialised and general press — Loss of confidence by the by interested parties related to the specific business process — Breach of regulatory obligations — Breach of legal obligations — Breach of contractual requirements CONF-1 Limited Information whose unauthorised disclosure would have one or several of the following consequences: — Financial impact of < EUR 1 million — Minor liability/damage compensation claims by the Aviation Repository authorised users and/or interested parties — Reputation – limited negative exposure in specialised media — Loss of confidence by the internal stakeholders related to the specific business process CONF-0 No Impact Information whose unauthorised disclosure would cause the reputation the Aviation Repository authorised users to become inconsistent with desired image but: — No press coverage – Information is already public — No impact on interested parties — No financial impact (c) INTEGRITY is classified in accordance with the levels below: ID Integrity Level Name Classification Level Description INTGR-3 Catastrophic Information falling within this category is corrupted and/or compromised would have one or several of the following consequences: — Financial loss of > EUR 10 million — Significant liability/damage compensation claims by the Aviation Repository authorised users and/or interested parties — Significant competitive disadvantage for the Aviation Repository authorised users and/or interested parties Impossibility for the Aviation Repository authorised users to meet their objectives — Total loss of confidence by interested parties and public — Total loss of reputation — The Agency questioned as an organisation INTGR-2 Significant Information falling within this category is corrupted and/or compromised would have one or several of the following consequences: — Financial impact of EUR 1-10 million — Medium liability/damage compensation claims by the Aviation Repository authorised users and/or interested parties — Significantly damaged reputation in the specific business area, negative exposure in both specialised and general press — Loss of confidence by the by interested parties related to the specific business process — Breach of regulatory obligations — Breach of legal obligations — Breach of contractual requirements INTGR-1 Limited Information whose unauthorised disclosure would have one or several of the following consequences: — Financial impact of < EUR 1 million — Minor liability/damage compensation claims by the Aviation Repository authorised users and/or interested parties — Reputation – limited negative exposure in specialised media — Loss of confidence by the internal stakeholders related to the specific business process INTGR-0 No Impact Information whose unauthorised disclosure would cause the reputation the Aviation Repository authorised users to become inconsistent with desired image but: — No press coverage — Information is already public — No impact on interested parties — No financial impact (d) AVAILABILITY is classified in accordance with the levels below: ID Availability Level Name Classification Level Description AVAIL-3 Catastrophic In case of disruption, access to information needs to be re-established in a maximum period of time of 24 hours (incl. nights and week-ends) AVAIL-2 Significant In case of disruption, access to information needs to be re-established in a maximum period of time of 1 calendar week AVAIL-1 Limited In case of disruption, access to information needs to be re-established in a maximum period of time of 2 calendar weeks AVAIL-0 No Impact In case of disruption, access to information needs to be re-established in a maximum period of time of 1 month