SCHREMS CASE : The Essence of Privacy, and Varying Degrees of Intrusion

ORIGINAL PUBLISHED IN VERFASSUNGBLOG ON Wed 7 Oct 2015

This brief comment will address the 6 October 2015 CJEU Grand Chamber ruling inMax Schrems, asking what it tells us about the status of two fundamental rights in the EU legal order, namely the right to the respect for private life (privacy) and the right to the protection of personal data (EU Charter of Fundamental Rights, Articles 7 and 8, respectively). The ruling must be read together with the 8 April 2014 ruling inDigital Rights Ireland where Articles 7 and 8 were discussed side by side.

Although the Max Schrems ruling contains many references to personal data, it does not really discuss the right to the protection of personal data as a distinct fundamental right. Article 8 of the Charter is mentioned in the dispositive part of the ruling but not for instance in what I would call the main finding by the Court which refers only to Article 7:

In particular, legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life, as guaranteed by Article 7 of the Charter…

The outcome of the case – declaring Commission’s Safe Harbor Decision 2000/52 invalid – flows from this finding of a breach of the essence of the right to privacy when we are dealing with indiscriminate blanket access to data. In Digital Rights Ireland the CJEU had already indicated (paras. 39-40) that blanket access to ‘content’ would trigger the application of the essence clause in Article 52 (1.1) of the Charter, while surveillance, even indiscriminate mass surveillance, based on even complex use of various categories of metadata amounted to a “particularly serious interference” (Digital Rights Ireland, para. 65) with fundamental rights but did not trigger the application of the essence clause. The Court’s distinction between ‘content’ and ‘metadata’ can be criticized, and it was indeed relativised by the Court itself in Digital Rights Ireland (para. 27).

What is now remarkable in Max Schrems is that

a) the Court actually identified the intrusion in question as falling under the notion of the essence of privacy – something the European Court of Human Rights has never done under the privacy provision of ECHR Article 8, and

b) the identification of an intrusion as compromising the essence of privacy meant that there was no need for a proportionality assessment under Article 52 (1.2) of the Charter.

This can be contrasted with theDigital Rights Ireland judgment (para. 69) where the final outcome was based on the application of a proportionality test. For these reasons, the Max Schrems judgment is a pathbreaking development, a major contribution to the understanding of the structure and legal effect of fundamental rights under the Charter. Digital Rights Ireland indicated where the path would go, and now the Court actually went that way.

An equally important contribution is documented in the same paragraph, namely that mere “access” to communications by public authorities) constitutes an interference. Notably, Article 8 (2) of the Charter uses the notion of “processing” when defining the fundamental right to the protection of personal data. Surveillance advocates might have until the Max Schrems ruling enjoyed some credibility with their claims that mere access does not amount to processing, and therefore mere access to the flow of communications does not amount to an intrusion until the automated selectors and algorithms have made their job and the human eye starts to “process” a much more narrow set of data. Now we know, that mere access is an intrusion into privacy, and even into the essence of privacy when it provides for indiscriminate access to ‘content’.

This gives rise to the next question, whether the Max Schrems rationale will only apply to the “transfer” of data from Europe to “servers” in the United States. This was the factual basis of the case, as reflected in paragraphs 2 and 31. The CJEU was asked a question about data transfers from Europe to Facebook servers in the US under the Safe Harbor arrangement, and it responded to that question. It did not address the scenario of “upstream” access to data flows through the splitting of fiber-optic cables to obtain generic access to all data that passes through transatlantic cables just because the Internet is built in the way that a lot of traffic ends up going through those cables. It would indeed be difficult to bring a case to the CJEU that would address this scenario.

Nevertheless, paragraph 94 quoted above is formulated in a way that gives a generic answer concerning the contours of the right to privacy under Article 7 of the EU Charter: yes, also access through the upstream method of capturing the data flow in a fibre-optic cable is to be regarded as compromising the essence of privacy and therefore as prohibited under the Charter, without a need even to engage in a proportionality analysis. It may be hard to get a case to the CJEU but the content of the substantive norm under Article 7 of the Charter is now clear. One can on good grounds expect that the European Court of Human Rights will now be prepared to follow the lead of the CJEU and draw the same conclusion under ECHR Article 8.

In closing, I dare to present the view that the Digital Rights Ireland and Max Schremsrulings taken together provide verification and demonstration of the utility of the methodology we developed in the SURVEILLE project where we produced a general framework for the holistic assessment of surveillance technologies for their security benefit, cost efficiency, moral hazards and fundamental rights intrusion. In short, in our model an intrusion into the essence of privacy would by definition produce the highest possible fundamental rights intrusion score which is, again by definition, higher than the maximum usability score and would therefore make redundant any proportionality assessment. Other types of intrusion – even particularly serious ones – would be assessed through giving separate scores to the importance of a fundamental right in a given situation and the depth of the intrusion into the same right as created by surveillance, and by then comparing the resulting fundamental right intrusion score against the usability score based on technology assessment. Here, a proportionality assessment is needed, even if the highest possible intrusion scores will be so high that the benefits obtained through surveillance cannot in practice outweigh them. Similarly to the CJEU in the Digital Rights Ireland case, the outcome will be that crude methods of mass surveillance, even when not triggering the essence clause, will be assessed as unlawful.

Dieser Text steht unter der Lizenz CC BY NC ND

(http://creativecommons.org/licenses/by-nc-nd/4.0/legalcode)

Angela Merkel au Parlement européen, des paroles aux actes ?

ORIGINAL PUBLISHED ON CDRE (12 OCTOBER 2015)

 par Henri Labayle,

Le discours prononcé par Angela Merkel devant le Parlement européen, 7 octobre 2015 aux cotés de François Hollande, est remarquable en tous points. Au delà du symbole d’une intervention du couple franco-allemand, qui n’était d’ailleurs peut être pas le meilleur signal à envoyer à ceux que l’on tentait de convaincre, cette prise de parole publique devant les représentants des peuples européens ne manque pas de sens.

Il était donc naturel  d’en souligner l’impact, partageant le sentiment d’un Jürgen Habermas « aussi surpris que réjoui » par le positionnement allemand face à la crise des réfugiés dans l’Union.

L’intervention de la chancelière allemande traduit en effet une constance politique qui mérite le respect et elle annonce des évolutions techniques qui suscitent l’interrogation.

1. La constance

Angela Merkel persiste et signe, est-on obligé de souligner. Malgré une vague grandissante de critiques, confrontée à une fronde plus ou moins larvée au sein de sa propre majorité et à une crispation évidente de l’opinion publique allemande que traduisent des sondages récents, la chancelière n’a pas dévié d’un pouce quant au terrain sur lequel elle entendait se placer et entraîner à sa suite l’Union européenne.

Ce dernier est le seul concevable, il est celui des valeurs de l’Union européenne qui, aux termes des traités, la « fondent » et « sont communes aux Etats membres » et dont l’Union doit assurer la« promotion ». C’est à ces valeurs et à la dignité de l’être humain que s’est référée explicitement la chancelière allemande le 31 aout lorsque la crise matérielle de l’asile s’est transportée sur le terrain institutionnel.

Aussi, tenir le cap politique en faisant valoir qu’à l’inverse de ce que l’on entend ici et là, le débat ne se pose pas en termes d’opportunité mais d’obligation morale autant que juridique est un discours responsable. Tout autant que l’est le propos répétant qu’isolément les Etats sont impuissants et que la réponse collective est la seule envisageable. Effectivement, « céder à la tentation de rétrograder, d’agir à une échelle nationale » serait une erreur historique et il convient politiquement « d’assumer l’attrait de l’Europe ».

Tel est le bon angle d’attaque du débat public. Faut-il en effet rappeler que, depuis le traité de Maastricht qui la considérait comme une « question d’intérêt commun » jusqu’à l’affirmation d’une « politique commune d’asile » à Amsterdam, l’accueil des demandeurs de protection internationale s’est européanisé au point de nécessiter une seconde génération des textes composant le régime d’asile commun ? Les articles 18 et 19 de la Charte se bornent à en tirer les conséquences.

Du reste, et à supposer que le niveau européen de cette protection du droit d’asile soit discutable, comment oublier les contraintes pesant sur la totalité des Etats membres de l’Union en raison de leur adhésion à la Convention de Genève comme à celle des droits de l’Homme ? Enfin et au delà de la France et de la République fédérale et pour n’en rester qu’aux Etats membres récalcitrants, comment nier l’autorité de la proclamation de ce même droit d’asile par les textes constitutionnels en Hongrie (article 14), en Pologne (article 56) ou en Slovaquie (article 53) ?

Aussi, prétendre mener la contestation des mesures arrêtées dans l’Union en matière de relocalisation des réfugiés au nom du respect de la légalité, comme semble vouloir le faire la Slovaquie, témoigne d’une curieuse vision de la Communauté de droit à laquelle on appartient, par delà les arguments techniques ou procéduraux fondés ou non.

Cette constance avait également animé auparavant le propos remarquable du Président de la Commission, le 9 septembre dans son discours sur l’état de l’Union prononcé lui aussi devant le Parlement européen.

Rappelant le poids de l’Histoire du continent européen, avant, pendant comme après le second conflit mondial, le chef de l’exécutif communautaire a choisi de mettre l’accent sur « le respect de nos valeurs communes et de notre histoire » après avoir resitué l’ampleur de l’effort à accomplir. Soulignant l’impact du contexte international autant que les enjeux d’une sous-estimation des besoins de protection, Jean Claude Juncker a ainsi redonné sa signification politique à la fonction qu’il exerce, enfin.

Ce faisant, l’alliance des deux acteurs principaux de l’Union n’aurait pu produire d’effet sans le relais efficace d’une présidence luxembourgeoise renouant avec la tradition qui veut qu’une présidence assurée par un petit Etat membre soit souvent des plus productives. Là encore, la brusque accélération du dossier législatif « relocalisation » en a tiré le bénéfice, les deux décisions de relocalisation ayant été publiées et commençant à prendre effet.

Pour autant, la constance du discours est-elle annonciatrice de véritables changements dans la politique d’asile de l’Union européenne ou bien faut-il en douter, à l’image de certains commentaires médiatiques au lendemain de ce discours regrettant l’absence de mesures concrètes ?

2. Le changement

D’ores et déjà, il est en marche. La conduite du dossier législatif de la relocalisation en est précisément une manifestation douloureuse pour les partisans de la méthode intergouvernementale.

On sait en effet la grande relativité de la communautarisation des procédures législatives. Malgré l’appellation des traités, la « procédure législative ordinaire » qui voudrait que la majorité qualifiée et l’accord du Parlement soient la règle en matière d’asile et d’immigration est passablement différente dans la pratique décisionnelle. La culture du consensus qui anime les diplomates qui se prétendent législateurs les amène ainsi à préférer les pratiques anciennes, celles qui consistent à ne pas forcer les Etats membres, conduits au pire à se réfugier dans l’abstention.

Ainsi, le 20 juillet 2015, une « décision des représentants des gouvernements des Etats membres réunis au sein du Conseil» c’est-à-dire un acte non pas de l’Union mais un acte engageant simplement les Etats collectivement (CJUE, 30 juin 1993, Parlement c. Conseil et Commission, C-181/91 et C-248/91, point 25) a permis de surmonter, par consensus, les désaccords entre Etats et d’adopter la décision2015/1523 procédant à la relocalisation de 40 000 personnes à partir de la Grèce et de l’Italie.

En revanche, le retour à l’orthodoxie communautaire s’est avéré bien plus pratique lorsqu’il a fallu surmonter l’opposition résolue de quatre Etats membres : la décision 2015/1601 du 22 septembre 2015 a donc été adoptée selon les voies classiques du traité et même en utilisant la procédure de vote à la majorité qualifiée … Signe de l’ampleur des désaccords, les conclusions de cette réunion ont été présentées par le ministre luxembourgeois comme « celles de la Présidence » et non du Conseil …

La seconde marque de changement a frappé l’espace Schengen. Improprement présenté comme relevant des « accords de Schengen », présentation ambiguë qui pourrait laisser penser que ces accords peuvent être dénoncés, le droit de l’espace Schengen repose d’une part sur les articles 67 et 77 TFUE qui garantissent l’absence de contrôles aux frontières intérieures et, d’autre part, sur le règlement 562/2006 dit « Code Frontières Schengen » tel que modifié en 2013.

Ce dispositif de près de trente ans n’avait pas été conçu pour résister à une pression de l’ampleur de celle traversée par l’Union en cet été 2015. Il a donc volé en éclats tant à propos de la capacité des Etats membres à assumer leurs responsabilités de contrôles des frontières extérieures qu’en ce qui concerne l’interdiction d’exercer des contrôles nationaux aux frontières intérieures. Le rétablissement temporaire des contrôles aux frontières intérieures décidé par plusieurs Etats membres, de la Slovénie et l’Autriche avec l’aval de la Commission, conformément à l’article 25 du Code, a fait clairement ressortir la réalité.

Elle est double : d’une part, l’absence de modification substantielle d’un mécanisme conçu à 5 pour s’appliquer à 30 Etats est devenue clairement problématique, d’autre part, le maintien d’un espace de libre circulation intérieure dépend évidemment d’un renforcement effectif des contrôles aux frontières extérieures. Ce second constat ne connaît qu’une issue, à espace européen constant en tous cas : une gestion plus intégrée de ces frontières. Là encore, dès le début septembre comme au Parlement européen, la chancelière allemande n’a pas masqué la gravité de cet enjeu.

Troisième signe de changement, le plus lourd de signification sans doute, la remise en question du système dit de Dublin. Mal dénommé car né en réalité dans le chapitre VII de la convention d’application des accords de Schengen de 1990, ce système pose le principe du traitement unique de la demande d’asile. Critiqué à juste titre, d’une efficacité pour le moins douteuse comme en témoigne le dernier rapport d’AIDA, mis en cause jusqu’au Conseil de l’Europe, le système Dublin a connu diverses réformes mais n’a jamais été remis en question par principe.

La raison en est simple : il fait peser l’essentiel de la charge sur les Etats que le hasard de la géographie a mis au contact de la pression migratoire extérieure. Ceci sans aucune mesure avec leurs capacités de réponse, la Grèce étant un exemple caricatural de cette situation. Les Etats de seconde ligne, malgré ces dysfonctionnements, y trouvaient bon gré mal gré un certain confort et même si, dans les faits, le système n’a pas fonctionné comme on l’a vu en Italie ou en Grèce.

D’où une difficulté à accepter l’idée d’un changement, malgré le coup de tonnerre provoqué par l’ouverture des frontières allemandes, clairement en contradiction avec cet état du droit.

Cet attachement au dispositif Dublin s’est manifesté jusqu’au dernier moment. Ainsi, la réunion informelle des chefs d’Etat et de gouvernement du 23 septembre rappelait-elle que « nous devons tous respecter, appliquer et mettre en œuvre nos règles existantes, y compris le règlement de Dublin et l’acquis de Schengen ». De même, le dispositif de relocalisation adopté comme en préparation est-il présenté comme une « dérogation » au mécanisme de Dublin. Enfin, et sans que l’on voie exactement où elle entend se diriger, la Commission promet d’ouvrir le chantier de la réforme de Dublin en « mars 2016 ».

Sans tir de sommation, la salve de la chancelière allemande fait mouche et semble ouvrir un nouveau chapitre de la politique d’asile : « soyons francs, le processus de Dublin, dans sa forme actuelle, est obsolète » a-t-elle asséné aux parlementaires européens.

Dès lors, faut-il croire que la conclusion de la chancelière fera office de feuille de route ? Consciente de l’impasse dans laquelle sa politique l’a engagée, l’Union sera-t-elle capable d’une part d’ouvrir des voies légales d’accès à la protection et, d’autre part, de s’accorder sur une répartition équitable des charges telle que ses traités l’y invitent ?

(Amnesty International Briefing ) FENCED OUT : HUNGARY’S VIOLATIONS OF THE RIGHTS OF REFUGEES AND MIGRANTS

ORIGINAL PUBLISHED HERE 

INTRODUCTION

“[W]e would like Europe to be preserved for the Europeans. But there is something we would not just like but we want because it only depends on us: we want to preserve a Hungarian Hungary” Viktor Orbán, Prime Minister of Hungary, 25 July 20151

“We are also humans. Before we lived in peace and we have had our lives and dreams torn apart by wars and greed of the governments.” Hiba Almashhadani, an Iraqi refugee, 21 September 20152

In the first eight months of 2015, 161,000 people claimed asylum in Hungary. The Office for Immigration and Nationality has estimated that two thirds of those arriving3 were asylum-seekers from Syria, Afghanistan and Iraq who entered the country irregularly.4 These are, unquestionably, large numbers and they have presented Hungary with considerable, if not entirely unforeseeable, challenges. Hungary’s response to these challenges has, however, been hugely problematic. While Hungary is bearing much of the brunt of the EU’s structurally unbalanced asylum regime, it has also shown a singular unwillingness to engage in collective EU efforts to address these shortcomings and participate in initiatives designed to redistribute the responsibility for receiving and processing asylum seekers, notably the relocation and “hotspot” processing schemes that the European Commission and Council have been proposing.

Instead, Hungary has moved in recent months to construct fences along its southern borders, criminalise irregular entry to its territory and expedite the return of asylum seekers and refugees to Serbia, through its inclusion on a list of safe countries of transit. The cumulative effect, and desired consequence, of these measures will be to render Hungary a refugee protection free zone. Ultimately, Hungary’s attempts to insulate itself against a regional, and wider global, refugee crisis can only be achieved at the expense of the respect its international human rights and refugee law obligations. In fact, this is already happening; only the completion of a fence along the Croatian border is preventing Hungary’s isolationist migration policies from reaching fruition.

Hungary’s determination to avoid its responsibilities towards refugees is not just a Hungarian problem. It is also an EU problem. Hungary’s policies are not preventing entry to the EU, they are merely displacing the routes refugees and migrants are taking to reach it. Hungary’s policies also represent a structural threat to the rule of law and the respect for human rights that other member states and EU institutions cannot afford to ignore. The EU should therefore engage Hungary in a formal discussion, as foreseen by Article 7 of the Treaty of the European Union, with a view to bringing its migration and asylum policies in line with EU and other international law obligations and ensuring that Hungary participates fully in collective EU initiatives and reforms designed to address the current refugee crisis, while receiving the considerable support it needs to do so.

THE UNFOLDING OF THE “CRISIS”

On 15 September 2015 the Hungarian government declared a “crisis situation caused by mass immigration”.5 On the same day, the construction of a fence on the border with Serbia was finished and amendments to the Criminal Code and Asylum Law, making it an offence to enter the country through the border fence and establishing “transit zones” at the border, entered into effect.

On 21 September, the Hungarian Parliament adopted further amendments to the Police Act and the Act on National Defence. These extend the powers of the police in situations of “crisis caused by mass immigration” to block roads, ban or restrain the operation of public institutions, shut down areas and buildings and restrain or ban the entering and leaving of such places. The new measures authorise the army to support the police securing the border in the crisis situation and to use rubber bullets, tear gas grenades and pyrotechnical devices.6

On 22 September, the Hungarian Parliament adopted a resolution which stated, among other things, that Hungary should defend its borders by “every necessary means” against “waves of illegal immigration”. The resolution stated: “[W]e cannot allow illegal migrants to endanger the jobs and social security of the Hungarian people. We have the right to defend our culture, language, and values.”7

The number of asylum seekers in Hungary in 2015, represents a significant increase on the 42,777 applications registered in 2014. 8 The Hungarian government had, however, long been received signals of an expected increase in asylum applications. As early as 2012 the United Nations High Commissioner for Refugees (UNHCR, the UN Refugee Agency) as well as NGOs were calling for an improvement of the reception facilities for asylum-seekers in Hungary and the need to bring them in line with the EU reception standards.9

Instead of introducing measures in line with these calls, the government started to work on measures to keep refugees and migrants out of the country. In 2015 it spent 3.2 million Euros10 on a “national consultation on immigration and terrorism”11 in the course of which it distributed a questionnaire to over eight million citizens seeking answers to questions such as whether or not those who cross the borders illegally should be detained for a period longer than 24 hours.12 Another 1.3 million Euros was spent on an anti-refugee billboard campaign that included messages such as “If you come to Hungary, don’t take the jobs of Hungarians” or “If you come to Hungary, you have to respect our culture!”.13 98 million Euros was spent on the construction of the border fence with Serbia.14 The 2015 budget of the Office of Immigration and Nationality responsible for reception of asylum seekers and processing applications was 27.5 million Euros.15

The government did however move swiftly with the adoption of measures aiming at keeping refugees and migrants out and facilitating their return. On 1 August 2015, an amendment of the Asylum Law16 entered into force which authorized the government to issue a lists of safe countries of origin and safe third countries of transit. Serbia, Macedonia and EU member states, including Greece, are considered safe by the Hungarian authorities as a result of these changes, meaning that asylum applications by people transiting through from these countries can be sent back to them following expedited proceedings.17 On 15 September another set of amendments came into effect. They criminalized “illegal entry” through the border fence and introduced “transit zones” for asylum-seekers at the border and other changes.18

On 17 September, the Minister of Interior ordered a “partial border closure” of the border crossings at the Röszke/Horgoš motorway and at the express road for a period of 30 days. It justified it as a measure “in the interest of the protection of public security”.19 During the period of the partial border closure, it was not possible for passengers, vehicles and cargo to cross the state border between Hungary and Serbia. The border was re-opened on 20 September after the Hungarian and Serbian Ministries of Interior “succeeded in finding a solution to opening the border crossing station and ensuring the continued flow of passenger and cargo traffic.”20

Following the effective sealing off of the border with Serbia in mid-September, refugees and migrants started entering Hungary through the border with Croatia through the crossings at Beremend21 and Zakány.22 By the beginning of October an average of about 4,000 people were entering on a daily basis according to the Hungarian police.23 The measures taken by the Hungarian government have therefore served primarily to redirect the flow of refugees and migrants, not stop it. However, Hungary has already begun constructing a similar fence along the Croatian border, and has already almost completed the laying of barbed wire along its entirety.24 Once a full-scale fence has been constructed, asylum-seekers will effectively no longer be able to access Hungarian territory and protection proceedings. Those that do succeed in crossing the fence will be liable to prosecution – and return to Serbia or Croatia.25

INTERNATIONAL CRITICISM OF HUNGARY’S MIGRATION POLICIES

Hungary’s draconian response to the increase of the number of refugees and migrants entering the country has been roundly criticised by international human rights bodies.

On 15 September, the Secretary General of the Council of Europe, Thorbjørn Jagland wrote to the Hungarian Prime Minister, Viktor Orbán, expressing concerns over the legislation adopted “in the context of the migration crisis“. He asked for assurances that Hungary is still committed to its obligations under the European Convention on Human Rights. The Secretary General also warned that Hungary cannot derogate from its obligation to protect the right to life, prohibition of torture and other rights.26

On 17 September, the UN Human Rights Commissioner Zeid Ra’ad Al Hussein said that amendments of the Criminal Code and the Asylum Law which entered into force on 15 September are incompatible with the human rights commitments binding on Hungary. “This is an entirely unacceptable infringement of the human rights of refugees and migrants. Seeking asylum is not a crime, and neither is entering a country irregularly.” The UN Human Rights Commissioner further observed that some of the actions carried out by the Hungarian authorities, such as denying entry, arresting, summarily rejecting and returning refugees, using disproportionate force on migrants and refugees, as well as reportedly assaulting journalists and seizing video documentation, amounted to clear violations of international law.27 He also noted “the xenophobic and anti-Muslim views that appear to lie at the heart of current Hungarian Government policy”.

The response of the EU institutions has been less unequivocal. The EU Commissioner for Migration, Home Affairs and Citizenship, Dimitris Avramopolous, declared during his visit to Hungary on 17 September that “[The EU] will work collectively to protect the Union’s external borders.” Hungary, he noted, “is doing part in this work… [although the EC does] not always agree with the means used.” Commissioner Avramopolous expressed a commitment “to work with [EU’s] neighbours – establishing a common list of safe countries of origin and intensifying cooperation with the Western Balkan countries and Turkey.” At the same time, however, he acknowledged a “moral duty… inscribed in international and European laws” to offer protection to those who need it.28

METHODOLOGY AND PURPOSE OF THIS BRIEFING Continue reading “(Amnesty International Briefing ) FENCED OUT : HUNGARY’S VIOLATIONS OF THE RIGHTS OF REFUGEES AND MIGRANTS”

AN INSUBSTANTIAL PAGEANT FADING: A VISION OF EU CITIZENSHIP UNDER THE AG’S OPINION IN C-308/14 COMMISSION V UK

PUBLISHED ON EU LAW ANALYSIS on Wednesday, 7 October 2015

by Charlotte O’Brien,

Senior Lecturer, York Law School

The political message being sent by irate governments to ‘back off’ from national welfare systems’ assumed prerogative to discriminate between home nationals and EU nationals is being received and applied with alacrity by the Court of Justice. The current direction of travel resiles from earlier progressive visions of EU citizenship, and in C-140/12 Brey, C-333/13 Dano and C-67/14 Alimanovic we see that which was once ‘destined to be [our] fundamental status’ receding ever further from view. Advocate General Cruz Villalón’s Opinion in Commission v UK continues the retreat, arguing that the Commission’s action challenging the UK right to reside test for family benefits should be dismissed. The result may, in the current environment, be unsurprising. But getting there with existing legal tools is problematic.

The Opinion contains a number of uncomfortable contortions to give undue deference to the national rules, and avoid tackling the underlying conflict of rules and approaches. It represents quite startling judicial activism in embroidering the legislation with unwritten limitations as to personal scope, tinkering with the subject matter, and asserting an unwritten licence to discriminate whenever something smells like a welfare benefit. The effect is as though the Court’s new teleological guiding principle should be that the legislature would have wanted at all costs to avoid offending the UK government.

The UK right to reside (RTR) test prevents any EU national who does not meet the criteria in Art 7 Directive 2004/38 from receiving Child Benefit or Child Tax Credit, both of which were accepted as being ‘family benefits’, so ‘pure social security’ (rather than special non-contributory benefits in Brey, Dano and Alimanovic) under Regulation 883/2004. The Commission challenged the test’s lawfulness on two grounds – that it imported extra conditions into the ‘habitual residence’ test, to undermine the effects of Regulation 883/2004, and that it is discriminatory since it only applies to non-UK citizens. The AG’s Opinion is remarkable, in its ability to reject both without engaging with either. This analysis deals with four key issues arising from the Opinion: (i) stitching, splicing and embroidering Reg 883/2004; (ii) the ‘inherent’, ‘inevitable’ and ex ante discrimination fudge; (iii) the parallel reality in which the UK does not presume unlawful residence; and (iv) the failure to notice that the UK automatically refuses social assistance to those reliant on ‘sufficient resources’.

(i) stitching, splicing and embroidering Regulation 883/2004

The AG is at some pains to determine whether the ‘right to reside’ test is part of the habitual residence test (HRT), or a separate test added on, suggesting that it is only if it is presented as the former, does the Commission have a case. As the UK government ‘distanced’ itself during proceedings from the combined test approach, and argued that it was a separate test of lawful residence, so the AG commented that the Commission’s case was ‘weakening over the course of the dispute’. Indeed, on the basis that the test was ‘independent’ of the HRT, the AG argued that the first ground should be dismissed. This is perplexing. It seems to be a matter of regulatory semantics whether the RTR is part of the HRT, or is applied as well as the HRT, if the effect – to undermine Regulation 883/2004 – is the same.

For the record, the conclusion that they are separate tests is unconvincing anyway. For all benefits with an official ‘habitual residence test’ the regulations provide that a claimant cannot be habitually resident unless she has the right to reside in the CTA (Income Support (General) Regulations 1987, reg 21AA; Jobseeker Allowance Regulations 1996, reg 85A; Employment and Support Allowance Regulations 2008, reg 70(2); State Pension Credit Regulations, reg 2; see DWP, DMG, 072771). For CB and CTC the terminology is slightly different – the words ‘habitually resident’ are not used, but a person must be treated as being in the UK. And to be treated as being in the UK, you have to have a right to reside (Child Benefit Regulations 2006, Reg 23(4)(a); Tax Credits (Residence) Regulations 2003, Reg. 3(5); CBTM10010 – Residence and immigration: residence – introduction).

However, whether we treat the RTR as part of habitual residence, or as an extra test, the effect in both cases is to add conditions onto the circumstances in which a person is treated as meeting the ‘residence’ criteria of Regulation 883/2004. That Regulation offers a clear, exhaustive list for allocating ‘competence’ of Member States for benefits, providing a residual category for the economically inactive, at Art 11(3)(e) in which the Member State of residence is competent. Once competence has been established, that State is then responsible for the payment of family benefits, subject to the non-discrimination provision.

The scheme of the Regulation is intentionally broader than that of Directive 2004/38 – applying a different personal scope for a start (covering all those who ‘are or have been subject to the legislation of one or more Member States’), and covering pensioners, those between jobs, those who might fall outside of the Dir 2004/38 Article 7(3) retention provisions – essentially, those who should be covered by social security provisions. To apply the right to reside test is to hack down the rationae personae of the Regulation to emulate that of Directive 2004/38 – an approach not endorsed, implied or merited in the Regulation. The AG’s assertion that law should not exist in ‘separate compartments’ as justification for splicing the instruments together and embroidering an extra condition into the Regulation rather too easily ignores the different purposes and scopes of the instruments. Similarly, the different material issues – the restriction of social assistance now embodied in Directive 2004/38, versus award of social security, are inappropriately assimilated. The AG notes, apparently approvingly, the UK’s assertion that ‘the two benefits at issue in the present case have some characteristics of social assistance’. This goes unexamined, and helps form the context in which the different nature of social security, and different subject matter of the Regulation, is effectively ignored. In sum, we have an approach in which if a benefit is a ‘bit like’ social assistance, and a legal instrument is in roughly the same area as Directive 2004/38, then unwritten restrictions kick in.

In the specific case of family benefits, the Regulation’s residual category should provide a guarantee that families do not fall through the cracks and find themselves disentitled to any family benefits, since many Child Benefits are tied to residence. This also serves the ‘bonus’ purpose of protecting children, who are not the agents of migration, and who the legislature and the Court have hitherto taken pains to protect from suffering the penalties of their parents’ choices and/or misfortunes – either out of an interest in child welfare, or as an instrumental way of avoiding disincentives (risks to their children’s welfare) for workers to migrate.

Here it is worth emphasising that when we speak of falling through the cracks, we mostly speak of people who have been working (rather than those who have never worked). The right to reside test results in a strict bifurcation between those ‘working’ and those not. The rules on retention of worker status are stringent and exclusionary, so that people can be working and contributing for many years and still fall over welfare cliff edges. Regulation 883/2004 should offer some protection to their pre-school children in such cases, even where Directive 2004/38 is (according to emerging case law) rather harsher to the parents.

However, in the AG’s approach we can see the Directive, having already been transformed from an instrument to promote free movement into a instrument to prevent benefit tourism (Dano); being promoted to the status of a fundamental principle of limitation, to be (retrospectively) mainstreamed into other (higher) legislative instruments – exerting restrictions that are not there written.

(ii) the ‘inherent’, ‘inevitable’ and ex ante discrimination fudge;

The AG avoided dealing with the question of whether the RTR test discriminates contrary to Regulation 883/2004, by finding that the RTR prevented the Regulation from being applicable at all – apparently treating ex ante discrimination as de facto lawful. This conceptual approach is deeply problematic – can Member States really avoid the non-discrimination obligations contained in legislation by applying discriminatory gateways to access that legislation?

As noted above, once competence of a Member State has been established for the purposes of Regulation 883/2004, it is then – according to that instrument, bound by non-discrimination duties (Article 4). However, under the proposed approach, there will be people for whom no Member State has competence, because competence is to be determined according to a set of restrictions in a completely different instrument which apply a different concept to a different set of people for a different set of benefits. And if they are in this way found not be within any State’s competence, the question of discrimination is avoided.

To the extent that the AG does engage with non-discrimination duties, it is part of an imprecise discussion about the likelihood of the lawfulness of curbing benefits from non-nationals (benefit restrictions are ‘traditionally associated’ with requirements of legal residence). In drawing upon Dano and Brey, the fact that those cases dealt with benefits therein defined as social assistance is swept aside somewhat as the AG finds ‘there is nothing in those judgments to indicate that such findings apply exclusively to the social assistance benefits or the special non-contributory cash benefits with which those cases were concerned and not to other social benefits’. But there is plenty to indicate that social security benefits should be treated differently in their coverage in a different piece of legislation. It is surely very odd to suggest that the Court should list those instruments on which it was not ruling.

Recognising that the rules do treat UK nationals and non nationals differently, the Opinion makes some rhetorical points about discrimination as part of the natural ecosystem of free movement – ‘one way of looking at it is that this difference in treatment as regards the right of residence is inherent in the system and, to a certain extent, inevitable… In other words, the difference in treatment between UK nationals and nationals of other Member States stems from the very nature of the system.’ None of this does anything to address the question of the problem of direct versus indirect discrimination – the latter being rather easier to justify. It almost suggests that some degree of direct discrimination has to be accepted as a matter of pragmatism. Indeed, the characterisation of the rules asindirectly discriminating on the grounds of nationality is one of the most contentious issues in the case. Much as in C-184/99 Grzelczyk, an extra condition is imposed only upon non-nationals. Hiding behind the banner of indirect discrimination seems unconvincing if we posit a brief thought experiment. Imagine all EU national men automatically had an RTR, but all EU national women had to pass the RTR test; that could not be described asindirectly discriminating on the grounds of sex. While it could be argued that nationality is a different type of ground to sex, and so different differences are acceptable, the fact that we are dealing with direct discrimination remains. And this is not explored. The only thing that needs justification, under this analysis, is not the test, but the procedural checking, which we look at next.

(iii) the parallel reality in which the UK does not presume unlawful residence

The AG states that it cannot be inferred that the UK presumes that claimants are unlawfully resident, adding that European citizenship would preclude such a presumption, and that claimants should not systematically be required to prove they are not unlawfully resident.

However, the whole claims process in the UK does systematically require proof of claimants that they are (not un)lawfully resident. The right to reside test takes the limitations of Directive 2004/38 and makes them a priori conditions of the existence of the right to move and reside. There is no general citizenship-based right to reside that can be modified by limitations, with some discretion. The conditions come first, and must be demonstrably met, in each and every case. The UK’s assertion that ‘In cases in which there is doubt as to whether the claimant has a right of residence, an individual assessment of the claimant’s personal circumstances is carried out’ rather masks the process of assessment that decision makers are required to undertake according to the decision maker guidance on establishing whether a claimant really is or was a worker – using the UK’s own definition. That definition is flawed in itself, requiring evidence to meet a higher threshold than set in EU law, and the evidential hurdles can be considerable. Even for the most straightforward cases of worker, proof is required that earnings have been at or above the Minimum Earnings Threshold for a continuous period of at least three months. Those with variable earnings are expected to provide considerable evidence if they wish to ‘prove’ their right to reside. In cases where HMRC have reason to doubt conditions continue to be met for tax credit awards, they issue further, penetrating compliance checks, and in the UK government’s Budget Policy costings document, the government announced that the restrictions on benefits ‘will be augmented by additional HMRC compliance checks to improve detection of when EEA migrants cease to be entitled to these benefits. The checks will apply to all EEA migrant claims’. The system is set up to make the conditions constitutive of the right to free movement, effectively requiring all claimants to prove that they are not unlawfully resident, notwithstanding the apparent ‘background’ of EU citizenship, and claims are subject to systematic checking, notwithstanding Article 14(2) of Directive 2004/38.

The AG however, took the position that such checks are not systematic, but may be indirectly discriminatory, but that they were lawful, with the briefest of nods to justification – as though the mere mention of the UK’s public finances is sufficient to provoke a reverential hush, genuflection and swift retreat from the subject:

without any need to pursue the argument further, I consider that the necessity of protecting the host Member State’s public finances, (75) an argument relied on by the United Kingdom, (76) is in principle sufficient justification for a Member State to check the lawfulness of residence at that point.’

No data, it seems, is required.

Nor is any engagement with the question as to whether purely economic aims are legitimate aims for the purpose of justifying discrimination or restricting a fundamental freedom – on this, see AG Sharpston’s Opinion in C-73/08 Bressol.

(iv) the failure to notice that the UK automatically refuses social assistance to those reliant on ‘sufficient resources’.

The AG rounds up the Opinion by noting that in any case, the economically inactive are not completely hung out to dry – they should have their circumstances examined to determine whether they have sufficient resources not to become a burden on the public purse. Here, the AG emphasises that mere recourse to public funds should not bar a claimant from having a right to reside based on sufficient resources, and that their case should be assessed as to whether they are an ‘excessive’ burden. This is all very well, but speaks to a rather different reality to that experienced in the UK, in which the economically inactive are automatically barred from claiming social assistance because they are automatically treated as not having sufficient resources at the point of claim. Moreover, the Upper Tribunal has suggested that ‘sufficient resources’ means sufficient to provide for the migrant’s family for five years; a migrant cannot claim to have had sufficient resources for a short period of time between jobs if those resources would not have lasted for five years.

In short, the Court should be wary of following the AG’s lead in backing off from the apparently prohibited area of UK welfare benefits quite so hastily. The Regulation’s personal and material scope, and purpose, cannot simply be ignored or modified, nor can the Directive be transformed into an all-encompassing, higher principle, through pro-Member State judicial activism. The right to reside test adds conditions to the application of the Regulation’s provisions, and it does so in a directly discriminatory way. The Court must address these points honestly; if it is prevented from doing so by the political wind – or if it too conjures up a default forcefield around benefits regardless of type, and gives licence to ‘inevitable’ discrimination – the ramifications will tell not only upon claimants, their children, the vanishing strands of EU citizenship and the obstructed freedom to move, but also upon the Court’s credibility.

A comparison between US and EU data protection legislation for law enforcement purposes

by  Franziska      Boehm (Prof. Dr.,University of Münster, Institute for Information, Telecommunication and Media Law,  Germany)

NOTA BENE THIS STUDY COMPLEMENT ANOTHER PREVIOUS STUDY ON THE SAME SUBJECT  (Bignami, The US legal system on data protection in the field of law enforcement. Safeguards, rights and remedies for EU citizens)

THE FULL  VERSION OF THE NEW STUDY FOR THE EP CIVIL LIBERTIES COMMITEE IS ACCESSIBLE HERE.

EXECUTIVE SUMMARY : This study compares EU and US data protection guarantees in the field of law enforcement. The legal approaches to regulate data protection guarantees in law enforcement, in both the EU and the US legal order, vary from their very outset, leading to structural, legal and in  particular  constitutional  differences.

Generally, it can be concluded that the EU data protection framework in the law enforcement sector is shaped by comprehensive data protection guarantees, which are codified in EU primary and secondary law and are accompanied by EU and ECtHR case law. In contrast, US data protection guarantees in the law enforcement and national security contexts are sector specific and are therefore contained within the specific instruments which empower US agencies to process personal data. They vary according to the instruments in  place and  are  far  less  comprehensive.

Above all, constitutional protection is limited. US citizens may invoke protection through the Fourth Amendment and the Privacy Act, but the data protection rights granted in the law enforcement sector are limitedly interpreted with a general tendency to privilege law enforcement and national security interests. Moreover, restrictions to data protection in the law enforcement sector are typically not restricted by proportionality considerations, reinforcing the structural and regular preference of law enforcement and national security interests over the interests of individuals. Regarding the scope and applicability of rights, non-US persons are usually not protected by the existing, already narrowly interpreted, guarantees. The same is true with regards to other US law. When data protection guarantees do exist in federal law, they usually do not include protection for non-US persons.

A majority of the EU data protection standards cannot be found in US law. For instance, rules limiting inter-agency data exchange, exchanges with other third parties, completely independent oversight, strict proportionality rules and effective judicial review possibilities and information requirements for non-US persons on surveillance or data breaches or effective access, and correction and deletion rights simply do not exist at all or are, at best, very limited. These shortcomings are also visible regarding existing data exchange agreements between the US and the EU, such as, for instance, the Safe Harbor regime. Its principles do not  necessarily comply  with the current  EU  data  protection standards.

In particular, the approach to data sharing is fundamentally different. Whereas in EU law every transfer of data to other agencies interferes with fundamental rights and requires specific justification, data sharing in the US between law enforcement authorities and the intelligence community  seems to  be the rule rather  than  the  exception.

Recently introduced US laws such as the Draft Judicial Redress Act or the FREEDOM Act do not fundamentally alter these findings. Whilst the Draft Judicial Redress Act is limited in scope and requires some clarification, the FREEDOM Act is mainly designed to improve the protection of US citizens in the framework of intelligence collection activities. Furthermore, only three out of the four remedies of the Privacy Act are available to EU individuals in the framework of the Draft Judicial Review Act, leaving an individual with no judicial review possibilities in case an agency fails to provide an accurate, relevant, timely and complete treatment  of  the individual’s data. (EMPHASIS ADDED EDC)

Nonetheless, the introduction of stricter access requirements in the FREEDOM Act using a specific selection term for the collection of tangible things and metadata for foreign intelligence   purposes    is    an   improvement    compared    to   the   former   provisions.    Regrettably, this newly introduced restriction does not affect Section 702 of the FISA Amendment Act or Executive Order 12333, which still authorize far-reaching surveillance of foreign intelligence information, including the accessing of communications, content, metadata or other records by governmental agencies. A future instrument regulating EU-US data exchange should address the mentioned issues, as serious concerns about their compatibility with EU fundamental   rights arise.

It can be also deduced, from the comparison, that even if all existing US data protection guarantees in the law enforcement and national security framework were applicable to EU citizens, there would still remain a considerable shortcoming regarding the level of privacy and personal data protection compared to the protection through EU law. Recent proposals and changes through the Draft Judicial Redress Act of 2015 and the FREEDOM Act only partially improve the current situation. The recently initialized “Umbrella Agreement” could lead to changes with regards to data protection guarantees in the law enforcement and national security sectors, but it remains to be seen which specific material rights and guarantees will be included in such an agreement. A leaked version of the Umbrella Agreement was published after the finalization of this study. A brief analysis of the agreement’s  text  is therefore added  in  the  end.

(EMPHASIS ADDED – EDC) 

CONTINUE READING FROM PAGE 9

Alternatives to detention for asylum seekers and people in return procedures

EU FUNDAMENTAL RIGHTS AGENCY (full document accessible here)

Alternatives to detention for asylum seekers and people in return procedures

For asylum and return (i.e. expulsion) procedures to be implemented effectively, people need to be at the disposal of the authorities so that any measure requiring their presence can be taken without delay. To achieve this, EU Member States may decide to hold people in closed facilities. Less intrusive measures, which are usually referred to as alternatives to detention, reduce the risk that deprivation of liberty is resorted to excessively.

In light of the significant number of asylum seekers and migrants reaching the EU’s external borders and moving onward to other EU Member States, there is a danger that deprivation of liberty may be resorted to excessively and in cases where it is not necessary. With this compilation of legal instruments and other resources, FRA seeks to provide guidance to policy makers and practitioners on the use of non-custodial measures for asylum seekers and people in return procedures.

According to EU law, as well as Article 5 of the European Convention of Human Rights, deprivation of liberty for immigration-related reasons can only be used as a measure of last resort. An assessment needs to be made in each individual case to determine whether all the preconditions required to prevent arbitrary detention are fulfilled. Under Article 8 of the Reception Conditions Directive 2013/33/EU and Article 15 of the Return Directive 2008/115/EC, detention must not be used when less intrusive measures are sufficient to achieve the legitimate objective pursued.

Most of the wide array of alternatives to detention imply some restrictions on freedom of movement and/or other fundamental rights. Any restrictions to these rights must be in conformity with Article 52 (1) of the EU Charter of Fundamental Rights. This means that limitations must be provided for by law, must genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others, respect the essence of the right, and be proportionate. Alternatives to detention must, therefore, be distinguished from unconditional release from detention or unrestricted placement in open facilities.

The alternatives, many of which can be used in combination with each other, can be broadly grouped under the following categories:

Obligation to surrender passports or travel documents
This obligation may be imposed alone or together with other alternatives, such as the duty to stay in a particular location or area. It is a soft measure that essentially serves to ensure that valid identity and travel documents are not lost or destroyed during the time required to prepare the return and removal process.

Residence restrictions
Such restrictions impose the duty of remaining at a particular address or residing within a specific geographical area, often combined with regular reporting requirements. The designated places can be open or semi-open facilities run by the government or NGOs, as well as hotels, hostels or private addresses. The regime imposed can vary, but people generally have to be present at the designated location at certain times, while absences are usually only allowed with a well-founded justification.

Release on bail and provision of sureties by third parties
In the context of criminal law, it is not uncommon to allow the release of a detained person on condition of bail, which will be forfeited if the person does not report to the authorities. Release based on financial guarantees is infrequently used in asylum and pre-removal proceedings, partly because it is assumed that many asylum seekers or third-country nationals in return procedures would not have the necessary means to put up bail.

Regular reporting to the authorities
This alternative obliges people to report to the police or immigration authorities at regular intervals, and is one of the more frequent alternatives to detention found in national legislation. Reporting duties on a daily, bi-weekly, weekly or even less frequent basis may also be imposed as an additional requirement to the obligation to reside in a specified area or location.

Placement in open facilities with caseworker support
This is an innovative alternative to detention that combines classical social work with time spent at designated places. Asylum seekers or people in return procedures are placed in open facilities and provided with individual coaches or counsellors to inform and advise them about their situation and options. This form of alternative was established following evidence that compliance with a return decision depends on the level of trust the person affected by the decision has in the authorities of the host country. Such trust is created through individual counselling and contacts with external actors, such as NGOs.

Electronic monitoring
Electronic monitoring or tagging is primarily used in the context of criminal law. Its use as a substitute for immigration detention is limited. Electronic monitoring is the most intrusive of the various alternatives to detention, as it substantially interferes with a person’s right to privacy, restricts freedom of movement and can have a negative impact on their dignity. It can also lead to discrimination through the potential association of people wearing an electronic device with criminals.

AlternativeDetention

Source: FRA (2015)

Significant attention has been devoted to alternatives to immigration detention in recent years. This has resulted both in a great deal of comparative research and in the developments of tools and other guidance to promote the use of alternatives. This compilation is aimed at policy makers and practitioners entrusted with the task of promoting the use of alternatives to detention and seeks to facilitate the usage of existing materials. It presents various instruments and research material, together with the general human rights and EU legal framework. The first section covers the international framework that safeguards the right to liberty, while those that follow focus specifically on alternatives to detention. The compilation sets out selected:

  • instruments on the right to liberty
  • non-binding United Nations instruments on alternatives to detention
  • non-binding Council of Europe instruments on alternatives to detention
  • European Union law provisions relating to alternatives to detention
  • case law from the European Court of Human Rights, the Court of Justice of the EU and the United Nations Human Rights Committee on alternatives to detention
  • recently developed tools
  • research publications.

The selected instruments are presented by category, beginning with legal instruments (binding and non-binding), and then continuing to case law, expert guidelines and research papers. The left column of each table lists the documents in question with an embedded hyperlink to the full text. The right column reproduces key excerpts from these documents, with additional explanations in italics where relevant. A short introduction precedes each table.

Using alternatives to detention benefits both the state and migrants, as on the one hand they are more cost-effective and on the other they are less intrusive and more respectful of fundamental right than deprivation of liberty. Although virtually all EU Member States provide for the possibility of alternatives to detention (current reforms in Malta are expected to introduce fully-fledged alternatives in the near future), they are still too little applied and when they are, it is primarily in cases involving particularly vulnerable people. Several EU Member States do not yet collect statistics on alternatives to detention, which makes it difficult to assess the extent to which they are used in reality.

Compilation of key resources to promote the use of alternatives to immigration detention in practice
1. Right to liberty: selected instruments
2. Alternatives to detention: selected instruments
2.1.  Selected non-binding United Nations (UN) instruments relating to alternatives to detention
– United Nations General Assembly
– General comments by UN treaty bodies
– Executive Committee of the High Commissioner’s Programme (ExCom)
– UN Working Group on Arbitrary Detention
– Special Rapporteur on the human rights of migrants
– Special Rapporteur on torture and other cruel, inhuman or degrading treatment or punishment…
– Selected non-binding Council of Europe instruments relating to alternatives to detention
– Selected European Union law on alternatives to detention
3. Alternatives to detention: selected case law
– European Court of Human Rights (ECtHR)
– Court of Justice of the European Union (CJEU)
– United Nations Human Rights Committee (HRC)
4. Alternatives to detention: tools
5.Selected research documents
Useful links CONTINUE READING (from page 6 of the FRA Study…)

The European citizens’ initiative and the new (and surprising) routes of EU competence litigation

REBLOGGED FROM “DESPITE OUR DIFFERENCES” (October 5, 2015)
by Daniel Sarmiento, * 

EU competence is a touchy area of EU law. It has become very complex, together with the also intricate case-law on legal bases, which, after several decades of case-law, is not always easy to follow. After the entry into force of the Lisbon Treaty, EU competence has become a major domain for EU constitutional lawyers and it deserves very careful attention. The fact that the Treaties now include a typology and enumerate EU competences is a sign that many future battles in EU law will be fought in this terrain.

Furthermore, cases like Pringle, Gauweiler or Vodafone prove that issues of competence and legal bases are not the exclusive domain of institutional litigation, but areas that can be brought to the courts by private parties too. The Court has always been sensitive to these cases and it has dealt with them with utmost care, mostly in Grand Chamber formation.

Last week a rather surprising route for EU competence litigation came under the radar. In the case of Anagnostakis (no English version available, I’m afraid), the General Court ruled on an action of annulment brought by a private party against the decision of the Commission to reject, on the grounds of lack of competence, a European citizens’ initiative. Mr. Anagnostakis, together with more than a million supporters, brought a proposal pursuant to article 11.4 TEU and Regulation 211/2011, demanding the Commission to introduce in EU legislation “the principle of state of necessity, according to which, when the financial and political subsistence of a State is at stake due to its duty to comply with an odious debt, the refusal of payment is necessary and justified”. According to the promoters, the legal base of the initiative was to be found in articles 119 TFEU and 144 TFEU.

The Commission did not seem very impressed and, pursuant to articles 4.2,b and 3 of Regulation 211/2011, it refused to register the proposal, based on a lack of competence.

Mr. Anagnostakis introduced an action of annulment before the General Court, attacking the Commission’s Decision for breach of articles 122.1 and 2 TFEU, 136.1 TFEU and rules of international law.

The General Court dismissed the action, but it did not limit itself to scrutinize the Commission’s duty to state reasons. The General Court went into some detail in order to ascertain if haircuts in government debt are not only a competence of the EU, but also in conformity with EU Law. In a rather surprising format and procedural context, the General Court dealt quite openly with one of the Union’s hottest potato at the time: the Greek unsustainable public debt.

It is true that the judgment is quite laconic in its reasoning, but it relies several times on Pringle and Gauweiler when interpreting articles 122 and 136 TFEU. But no matter how laconic it may be, the judgment makes an assertion that will probably not go unnoticed when the Greek public debt becomes politically toxic again. In paragraph 58 of the judgment, the General Court states that “the adoption of a legislative act authorizing a member State to not reimburse its debt, far from being a part of the concept of economic policy guidelines in the sense of article 136.1.b) TFEU […] it would have the effect of substituting the free will of the contracting parties by a legislative instrument allowing for a unilateral abandonment of public debt, which is clearly not what the provision allows” (free translation).

The assertion might be formally correct in light of the limited scope of article 136.1.b) TFEU, but the language of the judgment is politically explosive. Even in legal terms, one wonders if Pringle was openly precluding any kind of haircut of government debt by any means. After reading the General Court’s decision in Anagnostakis, it seems that haircuts will be mission impossible in the future, despite the circumstances, the consensus among Member States (the IMF has been explicitly positive about a future Greek haircut) and, above all, the terms and scope of the haircut.

But of course, this judgment could be just a superficial decision undertaking a superficial degree of scrutiny due to the peculiar procedural context of the case. It could be argued that highly contested issues such as the EU’s competence in the area of EMU is something should be left to the Court of Justice, but not to the General Court in the circumstances of a case like Anagnostakis. The General Court might be aware of this and thus the brief and straight-forward reasoning of the decision. However, after reading the judgment several times, the more I read it the more explosive it sounds to me.

(*) Professor of EU Law at the University Complutense of Madrid

THE PARTY’S OVER: EU DATA PROTECTION LAW AFTER THE SCHREMS SAFE HARBOUR JUDGMEN

ORIGINAL PUBLISHED ON EU LAW ANALYSIS (on Wednesday, 7 October 2015)

by Steve Peers

The relationship between intelligence and law enforcement agencies (and companies like Google and Facebook) and personal data is much like the relationship between children and sweets at a birthday party. Imagine you’re a parent bringing out a huge bowl full of sweets (the personal data) during the birthday party – and then telling the children (the agencies and companies) thatthey can’t have any. But how can you enforce this rule? If you leave the room, even for a moment, the sweets will be gone within seconds, no matter how fervently you insist that the children leave them alone while you’re out. If you stay in the room, you will face incessant and increasingly shrill demands for access to the sweets, based on every conceivable self-interested and guilt-trippy argument. If you try to hide the sweets, the children will overturn everything to find them again.

When children find their demands thwarted by a strict parent, they have a time-honoured circumvention strategy: “When Mummy says No, ask Daddy”. But in the Safe Harbour case, things have happened the other way around. Mummy (the Commission) barely even resisted the children’s demands. In fact, she said Yes hours ago, and retired to the bath with an enormous glass of wine, occasionally shouting out feeble admonitions for the children to tone down their sugar-fuelled rampage. Now Daddy (the CJEU) is home, shocked at the chaos that results from lax parenting. He has immediately stopped the supply of further sweets. But the house is full of other sugary treats, and all the children are now crying. What now?

In this post, I’ll examine the reasons why the Court put its foot down, and invalidated the Commission’s ‘Safe Harbour’ decision which allows transfers of personal data to the USA, in the recent judgment in Schrems. Then I will examine the consequences of the Court’s ruling. But I should probably admit for the record that my parenting is more like Mummy’s than Daddy’s in the above example.

Background

For more on the background to the Schrems case, see here; on the hearing, see Simon McGarr’s summary here; and on the Advocate-General’s opinion, seehere. But I’ll summarise the basics of the case again briefly.

Max Schrems is an Austrian Facebook user who was disturbed by Edward Snowden’s revelations about mass surveillance by US intelligence agencies. Since he believed that transfers of his data to Facebook were subject to such mass surveillance, he complained to the Irish data protection authority, which regulates Facebook’s transfers of personal data from the EU to the USA.

The substantive law governing these transfers of personal data was the ‘Safe Harbour’ agreement between the EU and the USA, agreed back in 2000. This agreement was put into effect in the EU by a decision of the Commission, which was adopted pursuant to powers conferred upon the Commission by the EU’s current data protection Directive. The latter law gives the Commission the power to decide that transfers of personal data outside the EU receive an ‘adequate level of protection’ in particular countries.

The ‘Safe Harbour’ agreement was enforced by self-certification of the companies that have signed up for it (note that not all transfers to the USA fell within the scope of the Safe Harbour decision, since not all American companies signed up). Those promises were in turn meant to be enforced by the US authorities. But it was also possible (not mandatory) for the national data protection authorities which enforce EU data protection law to suspend transfers of personal data under the agreement, if the US authorities or enforcement system found a breach of the rules, or on a list of limited grounds set out in the decision.

The Irish data protection authority refused to consider Schrems’ complaint, so he challenged that decision before the Irish High Court, which doubted that this system was compatible with EU law (or indeed the Irish constitution). So that court asked the CJEU to rule on whether national data protection authorities (DPAs) should have the power to prevent data transfers in cases like these.

The judgment

The CJEU first of all answers the question which the Irish court asks about DPA jurisdiction over data transfers (the procedural point), and then goes on to rule that the Safe Harbour decision is invalid (the substantive point).

Following the Advocate-General’s view, the Court ruled that national data protection authorities have to be able to consider claims that flows of personal data to third countries are not compatible with EU data protection laws if there is an inadequate level of data protection in those countries, even if the Commission has adopted a decision (such as the Safe Harbour decision) declaring that the level of protection is adequate. Like the Advocate-General, the Court based this conclusion on the powers and independence of those authorities, read in light of the EU Charter of Fundamental Rights, which expressly refers to DPAs’ role and independence. (On the recent CJEU case law on DPA independence, see discussion here). In fact, the new EU data protection law currently under negotiation (the data protection Regulation) will likely confirm and even enhance the powers and independence of DPAs. (More on that aspect of the proposed Regulation here).

The Court then elaborates upon the ‘architecture’ of the EU’s data protection system as regards external transfers. It points out that either the Commission or Member States can decide that a third country has an ‘adequate’ level of data protection, although it focusses its analysis upon what happens if (as in this case) there is a Commission decision to this effect. In that case, national authorities (including DPAs) are bound by the Commission decision, and cannot issue a contrary ruling.

However, individuals like Max Schrems can still complain to the DPAs about alleged breaches of their data protection rights, despite the adoption of the Commission decision. If they do so, the Court implies that the validity of the Commission’s decision is therefore being called into question. While all EU acts must be subject to judicial review, the Court reiterates the usual rule that national courts can’t declare EU acts invalid, since that would fragment EU law: only the CJEU can do that. This restriction applies equally to national DPAs.

So how can a Commission decision on the adequacy of third countries’ data protection law be effectively challenged? The Court explains that DPAs must consider such claims seriously. If the DPA thinks that the claim is unfounded, the disgruntled complainant can challenge the DPA’s decision before the national courts, who must in turn refer the issue of the validity of the decision to the CJEU if they think it may be well founded. If, on the other hand, the DPA thinks the complaint is well-founded, there must be rules in national law allowing the DPA to go before the national courts in order to get the issue referred to the CJEU.

The Court then moves on to the substantive validity of the Safe Harbour decision. Although the national court didn’t ask it to examine this issue, the Court justifies its decision to do this by reference to its overall analysis of the architecture of EU data protection law, as well as the national court’s doubts about the Safe Harbour decision. Indeed, the Court is effectively putting its new architecture into use for the first time, and it’s quite an understatement to say that the national court had doubts about Safe Harbour (it had compared surveillance in the USA to that of Communist-era East Germany).

So what is an ‘adequate level of protection’ for personal data in third countries? The Court admits that the Directive is not clear on this point, so it has to interpret the rules. In the Court’s view, there must be a ‘high’ level of protection in the third country; this does not have to be ‘identical’ to the EU standard, but must be ‘substantially equivalent’ to it.  Otherwise, the objective of ensuring a high level of protection would not be met, and the EU’s internal standards for domestic data protection could easily be circumvented. Also, the means used in the third State to ensure data protection rights must be ‘effective…in practice’, although they ‘may differ’ from that in the EU. Furthermore, the assessment of adequacy must be dynamic, with regular automatic reviews and an obligation for a further review if evidence suggests that there are ‘doubts’ on this score; and the general changes in circumstances since the decision was adopted must be taken into account.

The Court then establishes that in light of the importance of privacy and data protection, and the large number of persons whose rights will be affected if data is transferred to a third country with an inadequate level of data protection, the Commission has reduced discretion, and is subject to ‘strict’ standards of judicial review. Applying this test, two provisions of the ‘Safe Harbour’ decision were invalid.

First of all, the basic decision declaring adequate data protection in the USA (in the context of Safe Harbour) was invalid. While such a decision could, in principle, be based on self-certification, this had to be accompanied by ‘effective detection and supervision mechanisms’ ensuring that infringements of fundamental rights had to be ‘identified and punished in practice’. Self-certification under the Safe Harbour rules did not apply to US public authorities; there was not a sufficient finding that the US law or commitments met EU standards; and the rules could be overridden by national security requirements set out in US law.

Data protection rules apply regardless of whether the information is sensitive, or whether there were adverse consequences for the persons concerned. The Decision had no finding concerning human rights protections as regards the national security exceptions under US law (although the CJEU acknowledged that such rules pursued a legitimate objective), or effective legal protection in that context. This was confirmed by the Commission’s review of the Safe Harbour decision, which found (a) that US authorities could access personal data transferred from the EU, and then process it for purposes incompatible with the original transfer ‘beyond what was strictly necessary and proportionate for the purposes of national security’, and (b) that there was no administrative or judicial means to ensure access to the data and its rectification or erasure.

Within the EU, interference with privacy and data protection rights requires ‘clear and precise rules’ which set out minimum safeguards, as well as strict application of derogations and limitations.  Those principles were breached where, ‘on a generalised basis’, legislation authorises ‘storage of all the personal data of all the persons whose data has been transferred’ to the US ‘without any differentiation, limitation or exception being made in light of the objective pursued’ and without any objective test limiting access of the public authorities for specific purposes. General access to the content of communications compromises the ‘essence’ of the right to privacy. On these points, the Court expressly reiterated the limits on mass surveillance set out in last year’s Digital Rights judgment (discussed here) on the validity of the EU’s data retention Directive. Furthermore, the absence of legal remedies in this regard compromises the essence of the right to judicial protection set out in the EU Charter. But the Commission made no findings to this effect.

Secondly, the restriction upon DPAs taking action to prevent data transfers in the event of an inadequate level of data protection in the USA (in the context of Safe Harbour) was also invalid. The Commission did not have the power under the data protection Directive (read in light of the Charter) to restrict DPA competence in that way. Since these two provisions were inseparable from the rest of the Safe Harbour decision, the entire Decision is invalid. The Court did not limit the effect of its ruling.

Comments

The Court’s judgment comes to the same conclusion as the Advocate-General’s opinion, but with subtle differences that I’ll examine as we go along. On the first issue, the Court’s finding that DPAs must be able to stop data flows if there is a breach of EU data protection laws in a third country, despite an adequacy Decision by the Commission, is clearly the correct result. Otherwise it would be too easy for the standards in the Directive to be undercut by means of transfers to third countries, which the Commission or national authorities might be willing to accept as a trade-off for a trade agreement or some other quid pro quowith the country concerned.

As for the Court’s discussion of the architecture of the data protection rules, the idea of the data protection authorities having to go to a national court if they agree with the complainant that the Commission’s adequacy decision is legally suspect is rather convoluted, since it’s not clear who the parties would be: it’s awkward that the Commission itself would probably not be a party.  It’s unfortunate that the Court did not consider the alternative route of the national DPA calling on the Commission to amend its decision, and bringing a ‘failure to act’ proceeding directly in the EU courts if it did not do so. In the medium term, it would be better for the future so-called ‘one-stop shop’ system under the new data protection Regulation (see discussion here) to address this issue, and provide for a centralised process of challenging the Commission directly.

It’s interesting that the CJEU finds that there can be a national decision on adequacy of data flows to third States, since there’s no express reference to this possibility in the Directive. If such a decision is adopted, or if Member States apply the various mandatory and optional exceptions from the general external data protection rules set out in Article 26 of the data protection Directive, much of the Court’s Schrems ruling would apply in the same way by analogy. In particular, national DPAs must surely have the jurisdiction to examine complaints about the validity of such decisions too. But EU law does not prohibit the DPAs from finding the national decisions invalid; the interesting question is whether it obliges national law to confer such power upon the DPAs. Arguably it does, to ensure the effectiveness of the EU rules. Any decisions on these issues could still be appealed to the national courts, which would have the option (though not the obligation, except for final courts) to ask the CJEU to interpret the EU rules.

As for the validity of the Safe Harbour Decision, the Court’s interpretation of the meaning of ‘adequate’ protection in third States should probably be sung out loud, to the tune of ‘We are the World’. The global reach of the EU’s general data protection rules was already strengthened by last year’s Google Spain judgment (discussed here); now the Court declares that even the separate regime for external transfers is very similar to the domestic regime anyway. There must be almost identical degrees of protection, although the Court does hint that modest differences are permissible: accepting the idea of self-certification, and avoiding the issue of whether third States need an independent DPA (the Advocate-General had argued that they did).

It’s a long way from the judgment in Lindqvist over a decade ago, when the Court anxiously insisted that the external regime should not be turned into a copy of the internal rules; now it’s insistent that there should be as little a gap as possible between them. With respect, the Court’s interpretation is not convincing, since the word ‘adequate’ suggests something less than ‘essentially equivalent’, and the EU Charter does not bind third States.

But having said that, the American rules on mass surveillance would violate even a far more generous interpretation of the meaning of the word ‘adequate’. It’s striking that (unlike the Advocate-General), the Court does not engage in a detailed interpretation of the grounds for limiting Charter rights, but rather states that general mass surveillance of the content of communications affects the ‘essence’ of the right to privacy. That is enough to find an unjustifiable violation of the Charter.

So where does the judgment leave us in practice? Since the Court refers frequently to the primary law rules in the Charter, there’s no real chance to escape what it says by signing new treaties (even the planned TTIP or TiSA), by adopting new decisions, or by amending the data protection Directive. In particular, the Safe Harbour decision is invalid, and the Commission could only replace it with a decision that meets the standards set out in this judgment. While the Court refers at some points to the inadequacy or non-existence of the Commission’s findings in the Decision, it’s hard to believe that a new Decision which purports to claim that the American system now meets the Court’s standards would be valid if the Commission were not telling the truth (or if circumstances subsequently changed).

What standards does the US have to meet? The Court reiterates even more clearly that mass surveillance is inherently a problem, regardless of the safeguards in place to limit its abuse. Indeed, as noted already, the Court ruled that mass surveillance of the content of communications breaches the essence of the right to privacy and so cannot be justified at all. (Surveillance of content which is targeted on suspected criminal activities or security threats is clearly justifiable, however). In addition to a ban on mass surveillance, there must also be detailed safeguards in place. The US might soon be reluctantly willing to address the latter, but it will be even more unwilling to address the former.

Are there other routes which could guarantee that external transfers to the USA take place, at least until the US law is changed? In principle, yes, since (as noted above) there are derogations from the general rule that transfers can only take place to countries with an ‘adequate’ level of data protection. A first set of derogations is mandatory (though Member States can have exceptions in ‘domestic law governing particular cases’): where the data subject gives ‘consent unambiguously’; where the transfer is necessary to perform a contract with (or in the interest of) the data subject, or for pre-contractual relations; where it’s ‘necessary or legally required on important public interest grounds’, or related to legal claims; where it’s ‘necessary to protect the vital interests of the data subject’; or where it’s made from a public register. A second derogation is optional: a Member State may authorise transfers where the controller offers sufficient safeguards, possibly in the form of contractual clauses. The use of the latter derogation can be controlled by the Commission.

It’s hard to see how the second derogation can be relevant, in light of the Court’s concerns about the sufficiency of safeguards under the current law. US access to the data is not necessary in relation to a contract, to protect the data subject, or related to legal claims.  An imaginative lawyer might argue that a search engine (though not a social network) is a modern form of public register; but the record of an individual’s use of a search engine is not.

This leaves us with consent and public interest grounds. Undoubtedly (as the CJEU accepted) national security interests are legitimate, but in the context of defining adequacy, they do not justify mass surveillance or insufficient safeguards. Would the Court’s ruling in Schrems still apply fully to the derogation regarding inadequate protection? Or would it apply in a modified way, or not at all?

As for consent, the CJEU ruled last year in a very different context (credibility assessment in LGBT asylum claims) that the rights to privacy and dignity could not be waived in certain situations (see discussion here). Is that also true to some extent in the context of data protection? And what does unambiguous consent mean exactly? Most people believe they are consenting only to (selected) people seeing what they post on Facebook, and are dimly aware that Facebook might do something with their data to earn money. They may be more aware of mass surveillance since the Snowden revelations; some don’t care, but some (like Max Schrems) would like to use Facebook without such surveillance. Would people have to consent separately to mass surveillance? In that case, would Facebook have to be accessible for those who did not want to sign that separate form? Or could a ‘spy on me’ clause be added at the end of a long (and unread) consent form?  Consent is a crucial issue also in the context of the purely domestic EU data protection rules.

The Court’s ruling has addressed some important points, but leaves an enormous number of issues open. It’s clear that it will take a long time to clear up the mess left from this particular poorly supervised party.

Barnard and Peers: chapter 9

THE CJEU’S RULING IN CELAJ: CRIMINAL PENALTIES, ENTRY BANS AND THE RETURNS DIRECTIVE

ORIGINAL PUBLISHED ON EU LAW ANALYSIS (Tuesday, 6 October 2015)

By Izabella Majcher, Associate Researcher at Global Detention Project and PhD candidate in International Law at the Graduate Institute of International and Development Studies is Geneva.

In its ruling in the Skerdjan Celaj case (C-290/14), rendered on 1st October 2015, the Court of Justice of the European Union (CJEU) addressed once again the relation between immigration and criminal law and in particular the compatibility of national penal measures imposed as a punishment for irregular migration with the EU Returns Directive. In the previous cases touching upon this issue, the Court assessed whether the Directive allowed states to penalize non-compliance with a return order or irregular stay itself with imprisonment (El Dridi andAchughbabian, respectively) and with home detention (Sagor) as a criminal law penalty (as distinct from administrative law detention, which is expressly regulated by the Directive). In turn, in Celaj the Luxembourg judges were requested to consider whether a criminal law sentence of imprisonment imposed for a breach of a re-entry ban was compatible with the Returns Directive.

As defined in Article 3(6) of the Directive, an “entry ban” means an “administrative or judicial decision or act prohibiting entry into and stay on the territory of the Member States for a specified period, accompanying a return decision.”

The Case

Mr Celaj was arrested by Italian police in August 2011 for attempted robbery. In April 2012 he was issued a removal order accompanied by a three-year entry ban and left Italian territory some five months later. Subsequently Mr Celaj re-entered Italy and was apprehended by the police in February 2014. The public prosecutor then brought criminal law proceedings against him and sought a term of imprisonment of eight months for the breach of the entry-ban. The District Florence Court, before whom the proceedings were brought, decided to stay the proceedings and refer the question to the Luxembourg Court for a preliminary ruling. The referring court asked the CJEU whether the Returns Directive precludes domestic legislation penalizing re-entry in breach of an entry ban with a prison sentence up to four years. The Court found that it does not.

The Court did not follow the Opinion of Advocate General (AG) Szpunar, issued in April 2015. The AG based his Opinion on the effectiveness and the main objective of the Returns Directive, which is the return of undocumented non-EU citizens. These arguments had been developed by the Court in a line of case-law addressing the relation between domestic penal sanctions and the Directive. Indeed, in El Dridi (§ 58) the Court ruled that imprisonment as a criminal law penalty for the failure to leave the country during the voluntary departure period was not compatible with the Returns Directive. In Achughbabian (§ 45) it found that the Directive also precluded imprisonment as a criminal law penalty for irregular stay itself if ordered prior to starting removal proceedings or during such proceedings. The underlying justification of the Court’s conclusions in both cases was that a term of imprisonment as a criminal law penalty would delay the removal of the person concerned and thus jeopardize the objective pursued by the Directive (El Dridi, § 59; Achughbabian, § 45). The ruling in Sagor (§ 45) shows that not only prison sentences but even home detention during return proceedings as a criminal law penalty risks delaying deportation and thus should not be imposed. The AG thus invited the Court to follow its well-established case-law and declare that imprisonment for a breach of entry ban as a criminal law penalty is incompatible with the Directive because it would delay return of the person concerned (§ 6).

Yet, the Court ruled that the Returns Directive does not preclude domestic legislation which provides for a prison sentence as a criminal law penalty for non-EU citizens who unlawfully re-enter the country in breach of an entry ban (§25 and 33). The CJEU did reiterate that the objective of the Directive would be undermined if removal would be delayed by a criminal prosecution leading to a term of imprisonment, as ruled in El Dridi, Achughbabian, and Sagor (§ 26). However, it found that the circumstances in the Celaj case were “clearly distinct” from those inEl Dridi and Achughbabian. This distinction, in the Court’s opinion, was due to the fact that, unlike Mr Celaj, the non-citizens concerned in El Dridi and Achughbabianwere subject to a first return procedure (§ 28). The Court also added that, in line with the second indent of its ruling in Achughbabian, the Directive does not preclude penal sanctions as a criminal law penalty to be imposed on a migrant who has been subject to a return procedure but stays in an irregular manner in the member state (§ 29).

Comments

Were the circumstances in Celaj so “clearly distinct” from those in El Dridi andAchughbabian to justify such a different conclusion? Does it fundamentally matter that those cases dealt with a first return procedure? Every return procedure regulated by the Directive has essentially the same goal – the swift removal of the non-EU citizen concerned. It appears thus irrelevant whether return is pursued because of irregular entry or irregular re-entry.

Under Article 6(1) of the Directive member states are required to issue a return decision to every migrant in irregular situation, subject to some exceptions. As highlighted by the AG (§ 42, 49, and 50), this duty is persistent and continuous. This means that each time a non-EU citizen finds himself or herself on the State territory without permission, the authorities should start a return procedure by issuing a return decision. Thus, in line with the rules under the Directive, a non-EU citizen who has re-entered the Member State unlawfully should be liable to a new return decision rather than criminal proceedings which may postpone his or her ultimate removal. This finding is also supported by the Court’s ruling inAchughbabian (§ 45) where it held that the obligation incumbent on states to conduct removal shall be fulfilled as soon as possible and thus states should not carry out criminal proceedings involving custodial penalties not only prior to theimplementation of the return decision, but also prior to the adoption of such a decision.

Strikingly, the CJEU did not consider at all whether criminal proceedings against Mr Celaj would delay his return. This omission is hardly consistent with the Court’s well established case-law which attaches pivotal importance to the effectiveness of the procedures regulated under the Directive (El Dridi, § 55; Achughbabian, § 39;Sagor, § 32). It is easily foreseeable that after serving his prison sentence, Mr Celaj will be issued with a return decision. The term of imprisonment as a criminal law penalty will inevitably delay his return and thus jeopardize the very objective of the Returns Directive.

Likewise, the second, somehow auxiliary, argument advanced by the Luxembourg judges is not wholly convincing. True, in line with the second indent of the ruling inAchughbabian (§ 51) states may impose a criminal law prison sentence on a non-EU citizen to whom a return procedure has been applied but who stays in an irregular manner in the Member State. However, as pointed out by the AG (§ 61), to be compatible with the main part of the ruling, this conclusion should only cover situations where authorities did not succeed in returning the person concerned, who then continues to stay on the state’s territory. The second indent in the judgment in Achughbabian should thus have no bearing on Celaj where the non-EU citizen concerned left the country, thus return proceedings reached their goal. Following his irregular re-entry, he should be liable to a new return procedure.

The judgment in Celaj appears not consistent with the CJEU’s well-established jurisprudence on the interplay between domestic penal sanctions and the effectiveness of return policy as laid down in the Returns Directive. The Court relied on an apparent clear distinction between return proceedings imposed for irregular entry and subsequent re-entry in breach of an entry ban. As discussed above, the wording of the provisions of the Returns Directive, supported by the underlying objective of the Directive repetitively stressed in the Court’s previous rulings, does not warrant finding such a distinction. The “distinction” argument had been advanced by the European Commission and intervening governments during the proceedings. They stressed that the circumstances in re-entry cases are distinct because penal sanctions could be imposed to dissuade migrants from breaching re-entry bans (AG’s Opinion, § 46). So the “distinction” argument – which was central to the Court’s conclusion – relies on states’ deterrence-oriented concerns rather than considerations based on the provisions and objective of the Returns Directive. The ruling in Celaj seems thus to compromise on the effectiveness of the Directive in order to accord discretion to states to apply their domestic criminal provisions to deter and punish migrants for breaching re-entry ban.

What is the nature of the entry ban whose breach states are now explicitly allowed to punish with criminal law imprisonment? As noted above, Article 3(6) of the Directive defines an entry ban as a prohibition of re-entry to the host state (or other Member States) for a specified period of time. In Article 11(1) the Directive obliges states to impose an entry ban on a non-EU citizen who has not been granted the possibility of voluntary departure or has not complied with a return decision. Since the Directive provides for broad circumstances for refusal of a voluntary departure period (Article 7(4); see discussion of the case law on this issue here) and does not explicitly prohibit states from issuing a return decision on non-refoulement and family or private life grounds (the Directive merely allows states grant a residence permit on humanitarian or other reasons, in Article 6(4)), in practice Article 11(1) may entail that entry bans are imposed in a systematic way. This risk is amplified by the same provision as it allows states to apply a ban on re-entry also in “other cases.”

In practice, as the Evaluation on the application of the Returns Directive, commissioned by the European Commission, shows, the legislation of almost 40 percent of the countries bound by the Directive provides for an automatic application of entry bans on all return decisions. A recent European Migration Network’s study Good Practices in the return and reintegration of irregular migrants demonstrates the scale of the use of entry bans. In 2013 more than 125,000 entry bans were imposed in the EU. Compared to the total number of return decisions that year (see Eurostat), these figures evince that the member states accompany a considerable proportion of return decisions with entry bans, including Greece (almost 100 %), Poland (80 %), or Sweden (70 %). It appears thus that entry bans are systematically applied in practice.

States are free not to impose or withdraw an entry ban for humanitarian or other reasons (article 11(3)). They are however not obligated to waive the entry ban requirement in such cases – it lies within their discretion. While the Directive clarifies that entry bans shall not prejudice the right to international protection (Article 11(5)), this assertion should be translated into a clear obligation on states not to impose the ban where the protection from non-refoulement could be impaired. The severity of this entry ban is further strengthened by its length. The Directive allows a five-year duration of an entry ban (article 11(2)). The above mentioned Commission study highlights that the majority of states issue entry bans for this maximum permitted period of time. In addition, states may apply a longer ban (the time period of which is not limited by the Directive), if they judge that the person concerned represents a serious threat to public policy or national security (Article 11(2)).

Thus, potentially the majority of non-EU citizens liable to return are prohibited for prolonged periods to re-enter the host state or even the whole EU, if the entry ban has been registered in the Schengen Information System (SIS). An entry ban is thus a harsh and coercive measure, which is a deterrent in itself and potentially conflicts with migrants’ fundamental rights. It cannot be ruled out that a non-EU citizen will be obliged to re-enter, where prompted by his family links, disrupted by deportation, or changes in the situation in his country of origin. While, as noted above, states may withdraw an entry ban, they are nevertheless not obliged to do so. Imposition of a criminal law prison sentence for breach of an entry ban, as permitted in Celaj, appears thus disproportionate and unnecessary. States may use other available methods to punish this breach, such as an extension of an existing ban. More generally, criminalization of breaches of (administrative) immigration law risks creating a conflation between (non-punitive) immigration law and criminal law, with negative consequences for migrants, and an undue overburden to the criminal justice system.

Barnard & Peers: chapter 26

The Court of Justice declares that the Commission’s US Safe Harbour Decision is invalid

Court of Justice of the European Union PRESS RELEASE No 117/15

SEE THE TEXT OF JUDGMENT HERE

Luxembourg, 6 October 2015

Judgment in Case C-362/14 Maximillian Schrems v Data Protection Commissioner

Whilst the Court of Justice alone has jurisdiction to declare an EU act invalid, where a claim is lodged with the national supervisory authorities they may, even where the Commission has adopted a decision finding that a third country affords an adequate level of protection of personal data, examine whether the transfer of a persons data to the third country complies with the requirements of the EU legislation on the protection of that data and, in the same way as the person concerned, bring the matter before the national courts, in order that the national courts make a reference for a preliminary ruling for the purpose of examination of that decisions validity

The Data Protection Directive1 provides that the transfer of personal data to a third country may, in principle, take place only if that third country ensures an adequate level of protection of the data. The directive also provides that the Commission may find that a third country ensures an adequate level of protection by reason of its domestic law or its international commitments. Finally, the directive provides that each Member State is to designate one or more public authorities responsible for monitoring the application within its territory of the national provisions adopted on the basis of the directive (‘national supervisory authorities’).

Maximillian Schrems, an Austrian citizen, has been a Facebook user since 2008. As is the case with other subscribers residing in the EU, some or all of the data provided by Mr Schrems to Facebook is transferred from Facebook’s Irish subsidiary to servers located in the United States, where it is processed. Mr Schrems lodged a complaint with the Irish supervisory authority (the Data Protection Commissioner), taking the view that, in the light of the revelations made in 2013 by Edward Snowden concerning the activities of the United States intelligence services (in particular the National Security Agency (‘the NSA’)), the law and practice of the United States do not offer sufficient protection against surveillance by the public authorities of the data transferred to that country. The Irish authority rejected the complaint, on the ground, in particular, that in a decision of 26 July 20002 the Commission considered that, under the ‘safe harbour’ scheme,3 the United States ensures an adequate level of protection of the personal data transferred (the Safe Harbour Decision).

The High Court of Ireland, before which the case has been brought, wishes to ascertain whether that Commission decision has the effect of preventing a national supervisory authority from investigating a complaint alleging that the third country does not ensure an adequate level of protection and, where appropriate, from suspending the contested transfer of data.

In today’s judgment, the Court of Justice holds that the existence of a Commission decision finding that a third country ensures an adequate level of protection of the personal data transferred cannot eliminate or even reduce the powers available to the national supervisory authorities under the Charter of Fundamental Rights of the European Union and the directive. The Court stresses in this regard the right, guaranteed by the Charter, to the protection of personal data and the task with which the national supervisory authorities are entrusted under the Charter.

The Court states, first of all, that no provision of the directive prevents oversight by the national supervisory authorities of transfers of personal data to third countries which have been the subject of a Commission decision. Thus, even if the Commission has adopted a decision, the national supervisory authorities, when dealing with a claim, must be able to examine, with complete independence, whether the transfer of a persons data to a third country complies with the requirements laid down by the directive. Nevertheless, the Court points out that it alone has jurisdiction to declare that an EU act, such as a Commission decision, is invalid. Consequently, where a national authority or the person who has brought the matter before the national authority considers that a Commission decision is invalid, that authority or person must be able to bring proceedings before the national courts so that they may refer the case to the Court of Justice if they too have doubts as to the validity of the Commission decision. It is thus ultimately the Court of Justice which has the task of deciding whether or not a Commission decision is valid.

The Court then investigates whether the Safe Harbour Decision is invalid. In this connection, the Court states that the Commission was required to find that the United States in fact ensures, by reason of its domestic law or its international commitments, a level of protection of fundamental rights essentially equivalent to that guaranteed within the EU under the directive read in the light of the Charter. The Court observes that the Commission did not make such a finding, but merely examined the safe harbour scheme.

Without needing to establish whether that scheme ensures a level of protection essentially equivalent to that guaranteed within the EU, the Court observes that the scheme is applicable solely to the United States undertakings which adhere to it, and United States public authorities are not themselves subject to it. Furthermore, national security, public interest and law enforcement requirements of the United States prevail over the safe harbour scheme, so that United States undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements. The United States safe harbour scheme thus enables interference, by United States public authorities, with the fundamental rights of persons, and the Commission decision does not refer either to the existence, in the United States, of rules intended to limit any such interference or to the existence of effective legal protection against the interference.

The Court considers that that analysis of the scheme is borne out by two Commission communications,4 according to which the United States authorities were able to access the personal data transferred from the Member States to the United States and process it in a way incompatible, in particular, with the purposes for which it was transferred, beyond what was strictly necessary and proportionate to the protection of national security. Also, the Commission noted that the persons concerned had no administrative or judicial means of redress enabling, in particular, the data relating to them to be accessed and, as the case may be, rectified or erased.

As regards a level of protection essentially equivalent to the fundamental rights and freedoms guaranteed within the EU, the Court finds that, under EU law, legislation is not limited to what is strictly necessary where it authorises, on a generalised basis, storage of all the personal data of all the persons whose data is transferred from the EU to the United States without any differentiation, limitation or exception being made in the light of the objective pursued and without an objective criterion being laid down for determining the limits of the access of the public authorities to the data and of its subsequent use. The Court adds that legislation permitting the public     authorities     to     have      access     on      a      generalised      basis     to      the     content      of      electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life.

Likewise, the Court observes that legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, compromises the essence of the fundamental right to effective judicial protection, the existence of such a possibility being inherent in the existence of the rule of law.

Finally, the Court finds that the Safe Harbour Decision denies the national supervisory authorities their powers where a person calls into question whether the decision is compatible with the protection of the privacy and of the fundamental rights and freedoms of individuals. The Court holds that the Commission did not have competence to restrict the national supervisory authorities powers in that way.

For all those reasons, the Court declares the Safe Harbour Decision invalid. This judgment has the consequence that the Irish supervisory authority is required to examine Mr Schremscomplaint with all due diligence and, at the conclusion of its investigation, is to decide whether, pursuant to the directive, transfer of the data of Facebooks European subscribers to the United States should be suspended on the ground that that country does not afford an adequate level of protection of personal data.

NOTES

1 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
2 Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (OJ 2000 L 215, p. 7).
3 The safe harbour scheme includes a series of principles concerning the protection of personal data to which United States undertakings may subscribe voluntarily.
4 Communication from the Commission to the European Parliament and the Council entitled ‘Rebuilding Trust in EU-US Data Flows’ (COM(2013) 846 final, 27 November 2013) and Communication from the Commission to the European Parliament and the Council on the Functioning of the Safe Harbour from the Perspective of EU Citizens and Companies Established in the EU (COM(2013) 847 final, 27 November 2013).

NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of European Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.

Unofficial document for media use, not binding on the Court of Justice. The full text of the judgment is published on the CURIA website on the day of delivery. Press contact: Christopher Fretwell S (+352) 4303 3355