New ECJ ruling on data retention: Preservation of civil rights even in difficult times!

Original published here on 22. Dezember 2016

by

Translation – German version see here.

The European Court of Justice has made a Christmas present to more than 500 million EU citizens. With its new judgment on data retention (C-203/15 of 21 December 2016) – the highest court of the European Union stresses the importance of fundamental rights. All Member States are required to respect the rights represented in the European Charter of Fundamental Rights in their national legislation. The ECJ issued an important signal that can hardly be surmounted taking into account the current political discussions on internal and external threats and the strengthening of authoritarian political currents providing the public with simplistic answers to difficult questions.

The ECJ remains true to itself

The ruling of the European Court of Justice is in line with its judgment of 8 April 2014, by which the Court annulled Directive 2006/24/EC on the retention of data. The general obligation to retain traffic and location data required by this Directive was not limited to the absolutely necessary and thus disproportionate to the fundamental rights of respect for private life and the protection of personal data (Articles 7 and 8 of the European Charter of Fundamental Rights).

Despite the annulment of the Data Retention Directive by the ECJ, several Member States have continued or even broadened their practice of data retention. The latter took place in Great Britain, where shortly after the ECJ ruling – in July 2014 – a new legal basis for data retention was passed, which even went beyond the abolished EC directive. According to the British Parliament’s intention to implement the so-called „Investigatory Powers Act“, the major current commitments to compulsory data storage and the supervisory powers of the security authorities are to be extended in the short term and will include web services, in particular transactions on social networks. On November 29, 2016, the upper and lower house agreed on a corresponding legal text, which is to enter into force soon after its formal approval by the Queen. In other Member States, too, there are – differently broad-ranging – legal requirements which oblige providers of telecommunications and internet services to reserve traffic and location data whose conservation is not necessary for the provision or the billing of the respective service.

European Charter of Fundamental Rights binding for national legislature

A Swedish and a British court had asked the ECJ to clarify whether the respective national regulations on the retention of data corresponded to the European legal requirements.

In its new ruling the ECJ answered this question by stating that national regulations which provide a general and indiscriminate storage of data are not in line with the EU law. A national regulation providing for the storage of traffic and location data, is to be regarded as serious interference in fundamental rights. Member States must not maintain or re-adopt rules which are based on, or even go beyond, an EU act which has been annulled on grounds of its fundamental illegality.

The provisions of EU law bind the national legislature. The EU Directive 2002/58/EC on data protection in electronic communications (the ePrivacy Directive) has to be interpreted in the light of the Charter of Fundamental Rights. Exceptions to the protection of personal data should be limited to the absolutely necessary. This applies not only to the rules on data retention, but also to the access of authorities to the stored data. A national provision providing for general and indiscriminate data retention which does not require a link between the data for which it is originally intended to be stored and a threat to public security, and in particular is not limiting the data on a period and / or a geographical area and / or of a group of persons which could be involved in a serious criminal act, transcends the limits of the absolutely necessary and can not be regarded as justified in a democratic society. Laws of Member States that do not meet these requirements must be abolished or amended accordingly.

With regard to the contested British and Swedish laws, the competent national courts which had appealed to the ECJ are now required to enforce the ECJ ruling in substance. However, even the parliaments and governments of the Member States are, too, responsible for reviewing and, where appropriate, correcting the relevant provisions of national law.

What happens to German data retention?

The implications of the ECJ ruling for the German data retention recently reintroduced must also be urgently examined. The retention obligations of the new German Data Retention Act remain behind the predecessor regulation, which was repealed by the Federal Constitutional Court in 2010. However, it is highly doubtful whether the provisions of the ECJ will be fulfilled by the new data retention act, since it obliges the telecommunications providers to store the data without any material restriction on a specific area or a particular risk situation.

The fact that the Federal Government or the parliamentary fractions backing them will now carry out this examination in an objective manner appears to be highly unlikely in the light of the additional powers which they have recently decided to hand over to the security authorities. In the end, the Federal Constitutional Court will probably have to ensure clarity again.

Peter Schaar (21 December 2016)

The EU’s future trade policy starts to take shape: the Opinion on the EU/Singapore FTA

ORIGINAL PUBLISHED ON EU LAW ANALYSIS

by Professor Steve Peers

What is the scope of the EU’s powers over trade agreements? The issue has been disputed for decades in the case law of the ECJ, for it has a significant impact on the allocation of powers between the EU and its Member States as regards external economic policies. A number of Treaty amendments over the years – in particular the Treaty of Lisbon – have amended the rules.

The issue has gained added salience given the controversies surrounding some EU trade negotiations (in particular with Canada and the USA), and the trade talks between the UK and EU in light of Brexit. Today’s opinion of an ECJ Advocate-General is not binding, but is very thorough and will likely have a significant impact on the Court’s final judgment, expected in the spring.

This post will summarise the lengthy opinion succinctly and suggest its likely implications for the FTAs with Canada, the USA and the UK in particular. For further reading, see the earlier posts on this blog on the background to the Opinion and on the hearing before the ECJ.

Background

The Court has been asked to rule on whether the various provisions of the EU’s draft trade deal with Singapore fall within the scope of the EU’s exclusive powers, or whether powers are shared with the Member States, or whether only Member States can conclude them. If the EU only can conclude them, there can be no national ratification and also probably (depending on the exact content of the agreement) the EU will approve the deal by qualified majority, ie Member States will not have a veto.

If both the EU and its Member States can conclude the provisions, the agreement is ‘mixed’, but the EU has a choice to conclude the agreement without the Member States, if a qualified majority (assuming, again, that no veto applies due to the subject matter) agree to this.

If an issue is within exclusive Member State competence, then Member States must be parties to the treaty in order to conclude it. National ratification, and a de facto national veto for each Member State, therefore applies.

When is a power exclusive to the EU? Article 3(1) of the Treaty on the Functioning of the European Union (TFEU) lists a number of powers that are inherently exclusive, including the common commercial (ie trade) policy (CCP) and fisheries conservation. The CCP is further defined in Article 207 TFEU: it particularly applies to ‘goods and services’, the commercial aspects of intellectual property’ and ‘foreign direct investment.’ The EU/Singapore case concerns the interpretation of each of these aspects.

Besides Article 3(1), Article 3(2) TFEU goes on to provide that exclusive EU powers over an international treaty can also derive from the exercise of EU internal powers, in three cases: (a) ‘its conclusion is provided for in a legislative act of the Union’ or (b) it ‘is necessary to enable the Union to exercise its internal competence’, or (c) ‘in so far as its conclusion may affect common rules or alter their scope.’ The EU/Singapore case concerns the interpretation of both (a) and (c), which I will refer to as the ‘legislative authorisation’ ground and the ‘affect common rules’ ground.  (Note that ground (b) is rarely applied, as the ECJ case law interprets it very narrowly).

Summary of the opinion

The Commission argues that the EU has exclusive competence to conclude the deal. It’s supported by the European Parliament, which will have the power to consent to the deal as long as part of it relates to the CCP, or indeed to most other EU powers. Member States argue for mixed competence of much of the agreement, and exclusive national competence for some parts of it.

In general, the Advocate-General argues that much of the agreement is solely within the EU’s exclusive powers, mostly (but not entirely) as part of the CCP. A significant part falls within the EU’s mixed competence, while a small part is purely national competence.

First of all, she makes some general points about the scope of the CCP. She restates prior ECJ case law: the CCP applies to a measure which regulates and has direct effect on trade; mere implications for trade are not sufficient. She also interprets the exceptions in Article 207(6) TFEU, which states that the CCP ‘shall not affect the delimitation of competences between the Union and the Member States, and shall not lead to harmonisation of legislative or regulatory provisions of the Member States in so far as the Treaties exclude such harmonisation.’ In her view, this clause must be narrowly interpreted and has limited effect: for instance, it does not restrict the EU from agreeing measures on trade in culture and health services, as long as it does not harmonise the laws on those issues within the EU.

The opinion does not address the potentially important exceptions in Article 207(4) TFEU, which call for unanimous voting where ‘unanimity is required for the adoption of internal rules’ or ‘(a) in the field of trade in cultural and audiovisual services, where these agreements risk prejudicing the Union’s cultural and linguistic diversity’, or ‘(b) in the field of trade in social, education and health services, where these agreements risk seriously disturbing the national organisation of such services and prejudicing the responsibility of Member States to deliver them.’

On the other hand, the opinion does discuss the exception in Article 207(5) TFEU, which states that the CCP does not apply to agreements concerning transport. As a general rule, the Advocate-General argues that this exception applies whenever a treaty has rules ‘specifically concerning transport’. The further implications of this are discussed below.

The Opinion then examines the specific provisions of the EU/Singapore deal. First of all, the opening provisions of the FTA, referring to the creation of a free trade area, fall within the scope of the CCP. Next, following pre-Lisbon case law, the Opinion concludes that the FTA provisions on trade in goods are also within the scope of the CCP (Paras 144-155).

Thirdly, the Opinion examines the FTA provisions on services, establishment and e-commerce (paras 195-269). In general, other than transport issues, these fall within the scope of the CCP powers over services. In particular, immigration of service providers falls within the scope of the services powers, and therefore not under the immigration powers of the EU, where the UK and some other Member States have an opt-out (para 203). Financial services are covered by the CCP (para 204), since its scope is not dependent on prior harmonisation of the relevant law by the EU (unlike Article 3(2) TFEU). Professional qualifications are also covered (para 205).

As for the transport exception from the CCP, it applies not just to the services themselves, but those indissolubly linked to those services – ie cargo handling, transport repair, and computer reservation – but not to customs clearance, since that applies also to trade in goods.  But does the EU have exclusive power over the transport issues, by applying Article 3(2) TFEU instead? As regards aircraft repair, the ‘legislative authorisation’ ground doesn’t apply, since the EU legislation creating an aircraft safety agency doesn’t address this issue in detail. As for the ‘affect common rules’ ground, there is insufficient internal harmonisation as maritime transport, air transport (other than computer reservation systems), and inland waterways – but sufficient internal harmonisation as regards road and rail transport for the powers to become exclusive as regards the EU/Singapore FTA. Other aspects of transport remain a shared competence.

Fourthly, on the issue of investment (paras 305-398), the opinion again examines both the CCP and Article 3(2) TFEU. The opinion offers a definition of the EU’s CCP powers over foreign direct investment: investments ‘which serve to establish or maintain lasting and direct links, in the form of effective participation in the company’s management and control, between the person providing the investment and the company to which that investment is made available in order to carry out an economic activity. In applying that definition, I consider that the fact that the direct investor owns at least 10% of the voting power of the direct investment enterprise may offer evidentiary guidance but is certainly not determinative’. Crucially, the opinion argues (paras 324-342) that the CCP power covers the issue of investor protection.

As for other forms of investment – referred to as ‘portfolio investment’, it was agreed that the CCP didn’t apply. Could Article 3(2) TFEU apply, though? Here, there was no legislation on the issue, but there are EU Treaty provisions on capital movements to non-EU countries, which the Commission believes fall within the scope of the ‘affect common rules’ ground. However, the Opinion argues in principle that this ground for exclusive competence can only apply where the prior EU harmonisation results from legislation, not the Treaty. But the EU and its Member States still shared competence on most investment issues, except for the termination of bilateral investment treaties.

Fifth, on the issue of government procurement, previous prior case law said that the CCP only applied to procurement relating to goods and limited aspects of services. The Opinion concludes that in light of the Lisbon Treaty provisions made to the scope of the CCP, that EU power now fully applies to government procurement issues – other than those within the scope of the transport exception (paras 401-408).

Sixth, the Opinion examines the scope of the CCP power relating to intellectual property (paras 424-456). Although prior case law had concluded that the CCP fully applied to the ‘TRIPS’ (ie the intellectual property deal forming part of the World Trade Organisation system), the Opinion argues that this ruling did not necessarily apply by analogy to intellectual property rules in the EU’s FTAs (IP rules found in FTAs are often called ‘TRIPS+’ clauses).

To determine if a TRIPS+ clause falls within the scope of the CCP, the test (para 435) is not based on the remedy which applies, but rather whether: the substantive obligation governs trade rather than harmonises IP law; there is a direct and immediate effect on trade; and if the measure aims to avoid distortions to trade caused by monopolies. Again, application of the CCP does not depend on whether the EU has harmonised an IP issue internally. The Opinion also argues that rules on court procedures do not necessarily fall outside the scope of the CCP.

Appling this test to the facts: enforcement and plant variety rights are part of the CCP, but some parts of the draft EU/Singapore are not: namely moral rights, which also are not covered by Article 3(2) because the EU has not harmonised them internally. But the EU does have shared competence over this issue, since it could harmonise them on the basis of its internal market powers.

Seventh, the Opinion looks at competition law (paras 459-466). The FTA rules on this issue fall within the scope of the CCP, since they extend EU rules to Singapore and there is a a strong link with trade in goods and services.

Eighth, the Opinion looks at the FTA provisions on environment and sustainable development (from para 478). Here the rules on renewable energy fall within the scope of the CCP, since there is a strong link to trade and investment. However, the rules on labour and environmental standards are not closely linked with trade, so the EU shares competence with its Member States (no one had made an argument that Article 3(2) applied). The rules on fish stocks fell within the scope of another EU exclusive competence: fisheries conservation.

Finally, the rules on transparency and judicial review were ancillary to the substantive provisions of the FTA (paras 508-13). So were the rules on dispute settlement and mediation (paras 523-44); here the Opinion points out that the controversial rules on investor-state dispute settlement were not at issue in this case (para 536). (Note that Belgium has promised to ask the Court about the relevant provisions in the EU/Canada FTA). And the final provisions are either accessory or minor, so change none of the legal assessment (paras 548-553).

Comments

The Advocate-General’s analysis as regards goods, services and intellectual property is unsurprising in light of prior case law. However, the analysis as regards the fresh issue of investment is more disputable. Her case that investor protection falls within the scope of the CCP is convincing, on the grounds that people might not invest in the first place without adequate protection (ie, there is a link back to market access). On the other hand, the analysis relating to portfolio investment puts form over substance: why should it matter that ‘common rules’ derive from the Treaties, rather than EU legislation? Also, the termination of bilateral investment treaties should more logically be seen as the corollary of the exercise of the EU’s other (exclusive or shared) competence, rather than a purely national competence. And it is unfortunate that the Commission missed this opportunity to ask the Court to rule already on the controversial investor-state dispute settlement rules.

What are the implications for other FTAs, and for Brexit? That depends in part on the exact commitments in those other treaties, since this Opinion analyses the commitments that would be made under the EU/Singapore FTA, and commitments under other treaties might differ. In particular, it’s conceivable that other FTAs might arguably require unanimity on the basis of Article 207(4) TFEU, discussed above, which was not at issue in this case.

In general, for other FTAs it seems likely that a mixed agreement may be necessary, in light of the interpretation here relating to the transport exception, portfolio investment, and labour and environmental standards. Apart from the question of termination of investment treaties, then, it will be a purely political question whether Member States are content to agree those trade treaties on behalf of the EU alone, or will continue to insist (as they traditionally have done) on Member States being parties as well.

As for a post-Brexit FTA in particular, different issues may arise. The UK and the EU might not have any interest in negotiating measures relating to investment or intellectual property, at least in the form that EU FTAs now address them. So if the UK and EU want to focus on goods and services only, then the EU’s exclusive CCP competence would apply except as regards transport – and the EU often signs separate transport agreements with non-Member States.  It could be argued that a deal might need unanimity on the basis of Article 207(4) TFEU, but the counter-argument is that a post-Brexit trade deal would simply be preserving (some of?) the existing UK market access into the EU, so could not threaten health or audiovisual services.

Even on transport issues, or as regards labour and environmental standards, case law suggests that exclusive competence on the basis of Article 3(2) applies where the EU seeks to extend its own laws to non-EU states. If the UK is willing to sign up to a treaty that preserves market access in return for compliance with EU rules, it would follow that today’s opinion – if followed by the ECJ – has possibly drawn a road map for the negotiation of an agreement based on free trade in goods and services and compliance with selected EU legislation which could avoid national ratification and (depending on the subject matter) national vetoes.

Data retention and national law: the ECJ ruling in Joined Cases C-203/15 and C-698/15 Tele2 and Watson (Grand Chamber)

ORIGINAL PUBLISHED ON EU LAW ANALYSIS

Lorna Woods, Professor of Internet Law, University of Essex

Introduction

Today’s judgment in these important cases concerns the acceptability from a human rights perspective of national data retention legislation maintained even after the striking down of the Data Retention Directive in Digital Rights Ireland (Case C-293/12 and 594/12) (“DRI”) for being a disproportionate interference with the rights contained in Articles 7 and 8 EU Charter of Fundamental Rights (EUCFR).  While situated in the context of the Privacy and Electronic Communications Directive (Directive 2002/58), the judgment sets down principles regarding the interpretation of Articles 7 and 8 EUCFR which will be applicable generally within the scope of EU law. It also has possible implications for the UK’s post-Brexit relationship with the EU.

Background and Facts

The Privacy and Electronic Communications Directive requires the confidentiality of communications, including the data about communications to be ensured through national law. As an exception it permits, under Article 15, Member States to take measures for certain public interest objectives such as the fight against terrorism and crime, which include requiring public electronic communications service providers to retain data about communications activity. Member States took very different approaches, which led to the enactment of the Data Retention Directive (Directive 2006/24) within the space for Member State action envisaged by Article 15.  With that directive struck down, Article 15 remained the governing provision for exceptions to communications confidentiality within the field harmonised by the Privacy and Electronic Communications Directive.  This left questions as to what action in respect of requiring the retention of data could be permissible under Article 15, as understood in the light of the EUCFR.

The cases in today’s judgment derive from two separate national regimes. The first, concerning Tele2, arose when – following the DRI judgment – Tele2 proposed to stop retaining the data specified under Swedish implementing legislation in relation to the Data Retention Directive. The second arose from a challenge to the Data Retention and Investigatory Powers Act 2014 (DRIPA) which had been enacted to provide a legal basis in the UK for data retention when the domestic regime implementing the Data Retention Directive fell as a consequence of the invalidity of that directive.  Both sets of questions referred essentially asked about the impact of the DRI reasoning on national regimes, and whether Articles 7 and 8 EUCFR constrained the States’ regimes.

The Advocate General handed down an opinion in July (noted here) in which he opined that while mass retention of data may be possible, it would only be so when adequate safeguards were in place.  In both instances, the conditions – in particular those identified in DRI – were not satisfied.

Judgment

Scope of EU Law

A preliminary question is whether the data retention, or the access of such data by police and security authorities, falls within EU law.  While the Privacy and Electronic Communications Directive regulated the behaviour of communications providers generally, Article 1(3) of that Directive specifies that matters covered by Titles V and VI of the TEU at that time (e.g. public security, defence, State security) fall outside the scope of the directive, which the Court described as relating to “activities of the State” . Further Article 15(1) permits the State to take some measures resulting in the infringement of the principle of confidentiality found in Art 5(1) which again “concern activities characteristic of States or State authorities, and are unrelated to fields in which individuals are active” [para 72]. While there seems to be overlap between Article 1(3) and Article 15(1), this does not mean that matters permitted on the basis of Article 15(1) fall outside the scope of the directive as “otherwise that provision would be deprived of any purpose” [para 73].

In the course of submissions to the Court, a distinction was made between the retention of data (by the communications providers) and access to the data (by police and security services).  Accepting this distinction would allow a line to be drawn between the two, with retention as an activity of the commercial operator regulated by the Privacy and Electronic Communications Directive within its scope and the access, as an activity of the State lying outside it. The Court rejected this analysis and held that both retention and access lay within the field of the Privacy and Electronic Communications Directive [para 76]. It argued that Article 5(1) guarantees confidentiality of communications from the activities of third parties whether they be private actors or state authorities. Moreover, the effect of the national legislation is to require the communications providers to give access to the state authorities which in itself is an act of processing regulated by the Privacy and Electronic Communications Directive [para 78]. The Court also noted that the sole purpose of the retention is to be able to give such access.

Interpretation of Article 15(1)

The Court noted that the aim of the Privacy and Electronic Communications Directive is to ensure a high level of protection for data protection and privacy. Article 5(1) established the principle of confidentiality and that “as a general rule, any person other than the user is prohibited from storing, without the consent of the users concerned, the traffic data”, subject only to technical necessity and the terms of Article 15(1) (citing Promusicae) [para 85].  This requirement of confidentiality is backed up by the obligations in Article 6 and 9 specifically dealing with restrictions on the use of traffic and location data. Moreover, Recital 30 points to the need for data minimisation in this regard [para 87]. So, while Article 15(1) permits exceptions, they must be interpreted strictly so that the exception does not displace the rule; otherwise the rule would be “rendered largely meaningless” [para 89].

As a result of this general orientation, the Court held that Member States may only adopt measures for the purposes listed in the first sentence of Article 15(1) and those measures must comply with the requirements of the EUCFR.  The Court, citing DRI (at paras 25 and 70), noted that in addition to Articles 7 and 8 EUCFR, Article 11 EUCFR – protecting freedom of expression – was also in issue. The Court noted the need for such measures to be necessary and proportionate and highlighted that Article 15 provided further detail in the context of communications whilst Recital 11 to the Privacy and Electronic Communications Directive requires measures to be “strictly proportionate” [para 95].

The Court then considered these principles in the light of the reference in Tele2 at paras 97 et seq of its judgment. Approving expressly the approach of the Advocate General on this point, it  underlined that communications “data, taken as a whole, is liable to allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained” and that such data is no less sensitive that content [para 99]. The interference in the view of the Court was serious and far-reaching in relation to Articles 7, 8 and 11.  While Article 15 identifies combatting crime as a legitimate objective, the Court – citing DRI – limited this so that only the fight against serious crime could be capable of justifying such intrusion.  Even the fight against terrorism “cannot in itself justify that national legislation providing for the general and indiscriminate retention of all traffic and location data should be considered necessary” [para 103].  The Court stressed that the regime provides for “no differentiation, limitation or exception according to objectives pursued” [para 105].  The Court did confirm that some measures would be permissible:

… Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not prevent a Member State from adopting legislation permitting, as a preventive measure, the targeted retention of traffic and location data, for the purpose of fighting serious crime, provided that the retention of data is limited, with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted, to what is strictly necessary. [para 108]

It then set down some relevant conditions:

Clear and precise rules “governing the scope and application of such a data retention measure and imposing minimum safeguards, so that the persons whose data has been retained have sufficient guarantees of the effective protection of their personal data against the risk of misuse” [para 109].

while “conditions may vary according to the nature of the measures taken for the purposes of prevention, investigation, detection and prosecution of serious crime, the retention of data must continue nonetheless to meet objective criteria, that establish a connection between the data to be retained and the objective pursued” [110].

The Court then emphasised that there should be objective evidence supporting the public whose data is to be collected on the basis that it is likely to reveal a link, even an indirect one, with serious criminal offences, and thereby contribute in one way or another to fighting serious crime or to preventing a serious risk to public security. The Court accepted that geographical factors could be one such ground, on the basis that “that there exists, in one or more geographical areas, a high risk of preparation for or commission of such offences” [para 111].

Conversely,

…Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation which, for the purpose of fighting crime, provides for the general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication [para 112].

Acceptability of legislation where (1) the measure is not limited to serious crime; (2) where there is no prior review; and (3) where there is no requirement that the data stays in the EU.

This next section deals with the first question referred in the Watson case, as well as the Tele 2 reference.

As regards the first point, the answer following the Court’s approach at paragraphs 90 and 102 is clear: only measures justified by reference to serious crime would be justifiable.  As regards the second element, the Court noted that it is for national law to law conditions of access so as to ensure that the measure does not exceed what is strictly necessary.  The conditions must be clear and legally binding. The Court argued that since general access could not be considered strictly necessary, national legislation must set out by reference to objective criteria the circumstances in which access would be permissible.  Referring to the European Court of Human Rights (ECtHR) judgment in Zakharov, the Court specified:

access can, as a general rule, be granted, in relation to the objective of fighting crime, only to the data of individuals suspected of planning, committing or having committed a serious crime or of being implicated in one way or another in such a crime [para 119].

It then distinguished the general fight against crime from the fight against terrorism to suggest that in the latter case:

access to the data of other persons might also be granted where there is objective evidence from which it can be deduced that that data might, in a specific case, make an effective contribution to combating such activities [para 119].

The conditions set down must be respected. The Court therefore held that, save in cases of genuine emergency, prior review by an independent body must be carried out on the basis of a reasoned request by the investigating bodies. In making this point, the Court referred to the ECtHR judgment in Szabó and Vissy v. Hungary, as well as its own previous ruling in DRI. Furthermore, once there was no danger to the investigation by so doing, individuals affected should be notified, so as to those affected people the possibility to exercise their right to a remedy as specified in Article 15(2) read with Article 22 of the Data Protection Directive (Directive 95/46).

Article 15(1) permits derogation only in relation to specified provisions in the directive; it does not permit derogation with regard to the security obligations contained in Article 4(1) and 4(1a). the Court noted the quantity of data as well as its sensitivity to suggest that a high level of security measures would be required on the part of the electronic communications providers. Following this, the Court then stated:

…, the national legislation must make provision for the data to be retained within the European Union and for the irreversible destruction of the data at the end of the data retention period (see, by analogy, in relation to Directive 2006/24, the Digital Rights judgment, paragraphs 66 to 68) [para 122].

The Court noted that as a separate obligation from the approval of access to data, that States should ensure that independent review of compliance with the required regulatory framework was carried out by an independent body. In the view of the Court, this followed from Article 8(3) EUCFR. This is an essential element of individuals’ ability to make claims in respect of infringements of their data protection rights, as noted previously in DRI and Schrems.

The Court then summarised the outcome of this reasoning, that Article 15 and the EUCFR:

must be interpreted as precluding national legislation governing the protection and security of traffic and location data and, in particular, access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, is not restricted solely to fighting serious crime, where access is not subject to prior review by a court or an independent administrative authority, and where there is no requirement that the data concerned should be retained within the European Union. [para 125]

Relationship between the EUCFR, EU law and the ECHR

The English Court of Appeal had referred a question about the impact of the ECHR on the scope of the EUCFR in the light of Article 52 EUCFR. While the Court declared the question inadmissible, it –like the Advocate General – took the time to point out that the ECHR is not part of EU law, so the key issue is the scope of the EUCFR; and in any event Article 52(3) does not preclude Union law from providing protection that is more extensive than the ECHR. As a further point, the Court added that Article 8 EUCFR, which provides a separate right to data protection, does not have an exact equivalent in the ECHR and that there is therefore a difference between the two regimes.

Comment

Given the trend of recent case law, the outcome in this case is not surprising.  There are some points that are worth emphasising.

The first relates to the scope of EU law, which is a threshold barrier to any claim based on the EUCFR.  The Advocate General seemed prepared to accept a distinction between the retention of data and the access thereto (although conditions relating to the latter could bear on the proportionality of the former).  The Court took a different approach and held that the access also fell within the scope of the Directive/EU law, because the national regime imposed an obligation on the communications service provider to provide access to the relevant authorities. Given this was an obligation on the service provider, it fell within the regulatory schema.  This approach thus avoids the slightly unconvincing reasoning which the Advocate General adopted.  It also possibly enlarges the scope of EU law.

In general terms, the Court’s reasoning looks at certain provisions of the Privacy and Electronic Communications Directive.  While the reasoning is set in that context, it does not mean that the Court’s interpretation of the requirements deriving from the EUCFR is limited only to this set of surveillance measures.  The rules of interpretation of particularly Articles 7 and 8 could apply more generally – perhaps to PNR data (another form of mass surveillance) – and beyond.  It is also worth noting that according to a leaked Commission document, it is proposed to extend the scope of the Privacy and Electronic Communications Directive to other communications service providers not currently regulated by the directive, but who may be subject to some data retention requirements already.

Whilst the Court makes the point that Articles 7 and 8 EUCFR are separate and different, and that data retention implicates also Article 11 EUCFR, in its analysis of the impact of national measures providing for retention it does not deal with Articles 7 and 8 separately (contrast DRI where a limited consideration was given to this). Having flagged Article 11 EUCFR, it takes that analysis no further.  This is the leaves questions as to the scope of the rights, and particularly how Article 11 issues play out.

Note that the Court does not state that data retention itself is impermissible; indeed, it specifies circumstances when data retention would be acceptable. It challenges the compatibility of mass data retention with Articles 7 and 8 EUCFR, however, even in the context of the fight against terrorism.  In this, it is arguable that the Court has taken a tougher stance than its Advocate General on this point of principle.  In this we see a mirror of the approach in DRI, when the Court took a different approach to its Advocate General.  In that case too, the Advocate General focussed on safeguards and the quality of law, as has the Advocate General here. For the Court here, differentiation – between people and between types of offences and threats – based on objective, evidenced grounds is central to showing that national measures are proportionate and no more than – in the terms of the directive – strictly necessary. This seems to go close to disagreeing with the Opinion of the Advocate General that in DRI, the Court ‘did not, however, hold that that absence of differentiation meant that such obligations, in themselves, went beyond what was strictly necessary’ (Opinion, para 199). The Advocate General used this point to argue that DRI did not suggest that mass surveillance was per se unlawful (see Opinion, para 205). Certainly, in neither case did the Court expressly hold that mass surveillance was per so unlawful, so the question still remains. What is clear, however, is that the Court supports the retention of data following justified suspicion – even perhaps generalised suspicion – rather than using the analysis of retained data to justify suspicion.

In its reasoning, the Court did not –unlike the Advocate General – specifically make a ruling on whether or not the safeguards set down in DRI, paras 60-68, should be seen as mandatory – in effect creating a 6 point check list. Nonetheless, it repeatedly cited DRI approvingly. Within this framework, it highlighted specific aspects – such as the need for prior approval; the need for security and control over data; a prohibition on transferring data outside the EU; the need for subjects to be able to exercise their right to a remedy. Some of these points will be difficult to reconcile with the current regime in the United Kingdom regarding communications data.

It did not, however, touch on acceptable periods for retention (even though it – like its Advocate General – referred to Zakharov). More generally, the Court’s analysis – by comparison with that of the Advocate General – was less detailed and structured, particularly about the meaning of necessity and proportionality. It did not directly address the points the Advocate General made about lawfulness, with specific reference to reliance on codes (an essential feature of the UK arrangements); it did in passing note that the conditions for access to data should be binding within the domestic legal system. Is this implicit agreement with the Advocate General on this point? It certainly agreed with him that the seriousness of the interference meant that data retention of communications data should be restricted to ‘serious crime’ and not just any crime.

One final issue relates to the judicial relationship between Strasbourg and Luxembourg.  Despite emphasising that the ECHR is not part of EU law, the Court relies on two recent cases from the ECtHR, perhaps seeking to emphasis the consistency in this area between the two courts – or perhaps seeking to put pressure on Strasbourg to hold the line as it faces a number of state surveillance cases on its own docket, many against the UK. The position of Strasbourg is significant for the UK. While many assume that the UK will maintain the GDPR after Brexit in the interests of ensuring equivalence, it could be that the EUCFR will no longer be applicable in the UK post-Brexit. For UK citizens, the ECHR then is the only route to challenge state intrusion into privacy. For those in the EU, data transfers to the UK post-Brexit could be challenged on the basis that the UK’s law is not sufficiently adequate compared to EU standards. Today’s ruling – and the UK’s response to it, if any – could be a significant element in arguing that issue.

Brexit and the Future of Human Rights Law in the UK

Original published on EU LAW ANALYSIS

by Steve Peers

*The following is adapted from my comments at the launch of Conor Gearty’s book On Fantasy Island: Britain, Europe and Human Rights last week

What’s the future for human rights law in the UK after Brexit? The starting point in the debate is what happens to the Human Rights Act – the subject of Professor Gearty’s new book On Fantasy Island. It has a thorough grasp of detail, but also makes the case for the Act in its social, political and historical context. It has a command of the whole subject, but also demonstrates the importance of human rights cases to the individuals concerned.

In particular, On Fantasy Island demolishes the myth of a glorious past for human rights as part of the common law (see also his blog post on this theme). As Professor Gearty notes, it’s true that the Salvation Army had the right to march joylessly to demand that people endure grinding poverty with tedious sobriety. But many others were unsuccessful asserting such rights – or were subject to wrongful convictions which sometimes either turned into wrongful executions or would have done so if the death penalty were still applied.

The book also punctures the misunderstandings of the Human Rights Act (HRA) that portray it as entrenching excessive judicial power constraining elected politicians – pointing out that the courts (in the UK, or the European Court of Human Rights) cannot overturn Acts of Parliament on human rights grounds.

Indeed, in light of this conscious compromise between parliamentary sovereignty and human rights protection – comparable to that in ‘poster child’ common law Commonwealth states Canada and New Zealand – coupled with British involvement in drawing up the ECHR, it could be said that the UK’s human rights system is already so ‘red, white and blue’ that even Pavlov’s bulldogs should salivate at the mention of its name.

Of course, the public perception of the UK’s human rights system does not see it as closely linked to our legal heritage, despite several provisions of the ECHR and HRA that resemble Magna Carta. I’ll return to that problem below.

The Brexit context

There’s a substantive dimension to the links between Brexit and the Human Rights Act, as well as a broader political and advocacy dimension. Substantively, human rights are protected as a matter of EU law whenever the issue in the particular case is linked to EU law, for example in areas such as data protection, discrimination and asylum law. In that case, the EU Charter of Rights applies – with rights corresponding to the ECHR as well as some rights drawn from other sources. There’s also a stronger system for protecting those rights: UK courts at any level can set aside an Act of Parliament if necessary to that end, as seen in Vidal-Hall and Benkharbouche.

After Brexit, such protection will be governed by the detailed rules in the planned ‘Great Repeal Act’, which will convert EU law into UK law until individual measures are amended or repealed. This raises issues similar to the ‘post-HRA’ scenario discussed in On Fantasy Island. In particular: will CJEU case law still apply? Will the Charter of Rights still apply? What will the legal effect of the Act be, as a matter of domestic law? Will it be considered a ‘constitutional statute’, with a form of privileged status compared to other Acts of Parliament? How easy will be for the executive to repeal ex-EU laws (an issue discussed further here).

As for the political dimension, there is some overlap between the debate over the Human Rights Act and Brexit, but some differences too. Most notably, the dynamics of a referendum do not apply to the debate over the HRA.

And yet, the debate over HRA repeal will take place in Brexit Britain – a country which, to update Dean Acheson’s famous phrase, has now lost its post-war role but cannot refound its empire. Frustrated by this unavoidable fact, it is unlikely the critics of all things ‘European’ will feel full after Brexit. The Human Rights Act looks likely to be their next snack.

There is, however, a theoretical possibility – canvassed in Professor Gearty’s book – that a new British Bill of Rights or somesuch could be fashioned, while avoiding the weak points in the common law system for the protection of human rights. Frankly, while this might (with perfect hindsight) have been the best way to establish ‘constitutional patriotism’ for the Human Rights Act from the outset, this seems unlikely to happen in the current political context.

First of all, leaked government plans indicated the intention was to remove effective remedies while handing the constitutional equivalent of a ‘bung’ to tabloid newspaper editors.

More broadly, the level of public debate since the referendum vote has been diabolically poor. One side basically repeats ‘You lost. Shut up!’ while the other repeats ‘We won’t. You lied!’ ad infinitum. This ‘debate’ has been punctuated by political murder, escalating threats of violence, and a large part of government and media opinion showing visceral contempt for the rule of law and parliamentary democracy.

Towards a new defence of the Human Rights Act

So there’s a strong case for retaining the Human Rights Act; but if we want to retain it, we have to defend it. It’s important to think of the best way to defend it, however. As lawyers or law professors we have to teach and practice human rights law technically – to understand deadlines for filing better than the Home Secretary, for instance. I’ve been called ‘forensic’ so many times that I should probably have my own CSI spin-off.

Moreover, some of the argument in defence of the HRA is defensive. As I pointed out already, Professor Gearty’s book rightly argues that the Act doesn’t allow the Courts to overrule Parliament. But reading arguments like these reminds me of the EU referendum arguments that the UK can overrule major changes to the EU, or that ‘unelected bureaucrats’ do not make all EU laws. Perfectly accurate arguments – but they did not win the day.

It’s also necessary to focus on a more positive case for the Act (including the ECHR more broadly). Some claimants are undeniably hard to love. But human rights law also helped a gay man kicked out of his home because the love of his life died. It protected the elderly in care homes left in their own filth. It safeguards children beaten so badly by their parents that they need to visit the hospital. It offers justice to grieving family members trying to find out why their loved one died. And it exposed wrongdoing leading to the tragic fate of many children whose mothers took the thalidomide drug.

This is the rational but passionate, reasoned yet humane, case that we have to make for the preservation of the Act.

Bargaining Chips No More: The Status of EU and UK citizens after Brexit

ORIGINAL PUBLISHED ON EU LAW ANALYSIS 

by Steve Peers

Introduction

Today, the results of an inquiry into the status of EU citizens in the UK after Brexit, set up by the NGO British Future, are released. I was a member of the panel of that inquiry, which sought to bring together supporters of both the Leave and the Remain side, from different political parties and from outside Parliament as well.

This blog post has three related objectives: a) to set out and defend the main recommendations of the inquiry regarding EU citizens in the UK after Brexit; b) to set out my own recommendations for what should happen to UK citizens in the EU after Brexit; and c) to discuss the idea (floated recently) of ‘associate citizenship’ of the EU for UK citizens after Brexit. Just to make clear, the second and third points were outside the remit of the British Future inquiry – but I think it makes sense to look at those issues in parallel today. Obviously, the comments here on the latter two points are mine alone, and my views on them are not necessarily shared by any of the other people on the panel.

Results of the Inquiry: Recommendations on EU citizens in the UK

The basic starting point of the inquiry is that EU citizens who were in the UK exercising rights on the basis of EU law before a cut-off date should retain their rights after Brexit. This was the explicit position of many senior people on the Leave side during the referendum campaign, and necessarily also reflects the views of those on the Remain side, who were advocating the continued application of EU free movement law to the UK.

It is also consistent with the international law principle of ‘acquired rights’ in international law. It’s unlikely that this principle could, by itself, ensure enforceable protection of specific individual rights in British law, for the reasons explained by Professor Douglas-Scott. However, the UK certainly ought to act to give practical effect to this principle. Equally, the proposal takes account of the barriers to expelling many EU citizens imposed by human rights law, discussed by Matthew White here.

Quite apart from legal considerations and political promises, it would give effect to basic ethical principles of humanity and fairness: it would be morally wrong to disrupt the lives of people who came to the UK legally and have contributed a great deal to it. Their anxiety and uncertainty about the future should be alleviated as soon as possible.

Our recommendation would in effect create a special ‘ex-EU’ status for EU citizens who were resident in the UK before the cut-off date. Those who were already entitled topermanent residence status as of the cut-off date would keep that status (or their entitlement to apply for it). Those who were resident in the UK as of the cut-off date, but who had not yet earned entitlement to permanent residence status could still obtain it over the next five years. Those who first arrive after the cut-off date would be entitled to invoke EU free movement law in the UK until Brexit Day, after which point they would switch to ‘ordinary’ UK immigration law status, whatever that might be. (It remains to be seen whether the EU and the UK negotiate some agreement on immigration issues, which might entail a preferential status falling short of free movement of people, after Brexit).

Ex-EU status for EU citizens in the UK would entail keeping all the same rights they would have had if the UK had stayed in the EU, in terms of access to employment and equal treatment. There are several advantages to this approach.

First of all, this approach would be easy to reciprocate on the EU side, for UK citizens living in the EU (more on that below). Secondly, it would be easier to administer: forcing all EU citizens in the UK to apply for a completely new distinctly British status would cost a fortune, and it would take years to process all the applications. Having said that, there will be some difficulties of implementation in practice, although some complications are unavoidable no matter what approach is taken to this issue. The report of the inquiry makes some detailed suggestions about how implementation could work.

Thirdly, the proposed approach would come with built-in legal clarity, since the rules governing EU free movement law are already the subject of EU legislation and many court judgments. Finally, it would be consistent with the government’s plans for a ‘Great Repeal Act’, which will keep EU law on the British statute book until Parliament (or, if given power, the executive) decides to amend or repeal it.

We chose a cut-off date of the official start of the process of leaving the EU. This is earlier than Brexit Day, on the basis that people that come after the notification date cannot expect to enjoy EU free movement rights in the UK indefinitely after Brexit Day. However, it is later than the referendum date, on the basis that EU citizens who arrived before the process of leaving the EU officially began should not be prejudiced.

Finally, why recommend that the UK act unilaterally, before the EU guarantees the status of UK citizens in the EU? Firstly, because of the principles of humanity and fairness discussed above: EU citizens in the UK should be regarded as ends and not means, and certainly not as bargaining chips. Secondly, because a principled position taken unilaterally by the UK could reduce the political tension on this issue, and make it easier to reach a bilateral agreement once talks start. If it adopts our recommendations as regards the position of EU citizens in UK law, the UK government could and should point out that it expects the EU side to agree to the same principles, particularly given that our recommendation would be easy for them to reciprocate.

UK citizens in the EU

So far, the EU has refused to negotiate on the status of EU and UK citizens post-Brexit, because the UK has not yet officially notified its intention to leave the EU. While it is unfortunate that negotiations have not already started, those who condemn the EU for its position but who also voted Leave should reflect that it was their vote that threatened the status of the people concerned in the first place.

Once Brexit negotiations begin, hopefully the negotiators will tackle this issue first and aim to reach early agreement on it, so that the people affected can make firm decisions about their future and administrations can prepare to implement the rules in practice. In principle, it should be easy to reach agreement, if both sides aim for a reciprocal ‘ex-EU’ status. Since the issue logically falls within the scope of Article 50 TEU, as an issue to be agreed as part of the Brexit process, it should not be necessary to get unanimous agreement of Member States or to subject the deal to national ratification by Member States (the Article 50 deal can be approved by a qualified majority of Member States in the EU Council).

As I suggested on the day after the referendum, it would be best to have rules in the withdrawal treaty on this issue which are legally binding, define the exact scope of the rule, can be supplemented by further joint measures if needed, and must be fully applied in further detail in national law. I suggested some wording for the Article 50 treaty (now amended to make clear that non-EU family members of UK and EU citizens are covered):

  1. Any citizens of the UK residing in the EU as of [Brexit Day] and their family members, and any EU citizens residing in the UK as of that date and their family members, shall retain any rights which they acquired pursuant to EU free movement law before that date. They shall also continue to acquire rights which were in the process of acquisition as of that date.
  1. The parties shall give full effect to this principle in EU or national law, as the case may be.
  1. The EU/UK Joint Committee may adopt further measures to implement this rule.

The British Future report describes how the UK could implement such a legal obligation in its law. The EU side could best implement its corresponding legal obligation in the form of a short Regulation or Directive setting out general rules on ex-EU status, making consequential amendments to other EU laws. Later EU laws can then cross-refer to this basic law and/or the Article 50 deal.

Associate EU citizenship  Continue reading “Bargaining Chips No More: The Status of EU and UK citizens after Brexit”