Category: 1.1 News from the Area of Freedom, Security and Justice

Daily news from the Area of Freedom, Security and Justice.

Mostly Found via:
Statewatch – http://statewatch.org
Eu Logos Athena – http://eu-logos.org/
Euobserver – http://euobserver.com/
Presseurop – http://presseurop.eu
Euractiv – http://euractiv.com/
European Media Monitor – http://emm.newsbrief.eu/overview.html
Réseau Universitaire Européen Droit de l’Espace de Liberté, Sécurité et Justice – http://gdr-elsj.eu/

La Cour déclare invalide la décision de la Commission constatant que les États-Unis assurent un niveau de protection adéquat aux données à caractère personnel transférées

ORIGINAL PUBLISHED ON CJEU SITE
(EMPHASIZED BY ME)

COMMUNIQUE DE PRESSE n° 117/15 Luxembourg, le 6 octobre 2015 Arrêt dans l’affaire C-362/14 Maximillian Schrems / Data Protection Commissioner

Alors que la Cour est seule compétente pour déclarer l’invalidité d’un acte de l’Union, les autorités nationales de contrôle, saisies d’une demande, peuvent, même en présence d’une décision de la Commission constatant qu’un pays tiers offre un niveau de protection adéquat des données personnelles, examiner si le transfert des données d’une personne vers ce pays respecte les exigences de la législation de l’Union relative à la protection de ces données ainsi que saisir les juridictions nationales, au même titre que la personne concernée, afin qu’elles procèdent à un renvoi préjudiciel aux fins de l’examen de la validité de cette décision La directive sur le traitement des données à caractère personnel1 dispose que le transfert de telles données vers un pays tiers ne peut, en principe, avoir lieu que si le pays tiers en question assure un niveau de protection adéquat à ces données.

Toujours selon la directive, la Commission peut constater qu’un pays tiers assure, en raison de sa législation interne ou de ses engagements internationaux, un niveau de protection adéquat. Enfin, la directive prévoit que chaque État membre désigne une ou plusieurs autorités publiques chargées de surveiller l’application, sur son territoire, des dispositions nationales adoptées sur le fondement de la directive (« autorités nationales de contrôle »).

M. Maximillian Schrems, un citoyen autrichien, utilise Facebook depuis 2008. Comme pour les autres abonnés résidant dans l’Union, les données fournies par M. Schrems à Facebook sont transférées, en tout ou partie, à partir de la filiale irlandaise de Facebook sur des serveurs situés sur le territoire des États-Unis, où elles font l’objet d’un traitement. M. Schrems a déposé une plainte auprès de l’autorité irlandaise de contrôle, considérant qu’au vu des révélations faites en 2013 par M. Edward Snowden au sujet des activités des services de renseignement des ÉtatsUnis (en particulier la National Security Agency ou « NSA »), le droit et les pratiques des ÉtatsUnis n’offrent pas de protection suffisante contre la surveillance, par les autorités publiques, des données transférées vers ce pays.

L’autorité irlandaise a rejeté la plainte, au motif notamment que, dans sa décision du 26 juillet 20002 , la Commission a considéré que, dans le cadre du régime dit de la « sphère de sécurité » 3 , les États-Unis assurent un niveau adéquat de protection aux données à caractère personnel transférées. Saisie de l’affaire, la High Court of Ireland (Haute Cour de justice irlandaise) souhaite savoir si cette décision de la Commission a pour effet d’empêcher une autorité nationale de contrôle d’enquêter sur une plainte alléguant qu’un pays tiers n’assure pas un niveau de protection adéquat et, le cas échéant, de suspendre le transfert de données contesté.

Dans son arrêt de ce jour, la Cour estime que l’existence d’une décision de la Commission constatant qu’un pays tiers assure un niveau de protection adéquat aux données à caractère personnel transférées ne saurait annihiler ni même réduire les pouvoirs dont disposent les autorités nationales de contrôle en vertu de la Charte des droits fondamentaux de l’Union européenne et de la directive. La Cour souligne à cet égard le droit à la protection des données à caractère personnel garanti par la Charte ainsi que la mission dont sont investies les autorités nationales de contrôle en vertu de cette même Charte.

La Cour considère tout d’abord qu’aucune disposition de la directive n’empêche les autorités nationales de contrôler les transferts de données personnelles vers des pays tiers ayant fait l’objet d’une décision de la Commission. Ainsi, même en présence d’une décision de la Commission, les autorités nationales de contrôle, saisies d’une demande, doivent pouvoir examiner en toute indépendance si le transfert des données d’une personne vers un pays tiers respecte les exigences posées par la directive.

Néanmoins, la Cour rappelle qu’elle est seule compétente pour constater l’invalidité d’un acte de l’Union, tel qu’une décision de la Commission.

Par conséquent, lorsqu’une autorité nationale ou bien la personne ayant saisi l’autorité nationale estime qu’une décision de la Commission est invalide, cette autorité ou cette personne doit pouvoir saisir les juridictions nationales pour que, dans le cas où elles douteraient elles aussi de la validité de la décision de la Commission, elles puissent renvoyer l’affaire devant la Cour de justice.

C’est donc en dernier lieu à la Cour que revient la tâche de décider si une décision de la Commission est valide ou non. La Cour vérifie alors la validité de la décision de la Commission du 26 juillet 2000. À cet égard, la Cour rappelle que la Commission était tenue de constater que les États-Unis assurent effectivement, en raison de leur législation interne ou de leurs engagements internationaux, un niveau de protection des droits fondamentaux substantiellement équivalent à celui garanti au sein de l’Union en vertu de la directive lue à la lumière de la Charte.

La Cour relève que la Commission n’a pas opéré un tel constat, mais qu’elle s’est bornée à examiner le régime de la sphère de sécurité.

Or, sans qu’il y ait besoin, pour la Cour, de vérifier si ce régime assure un niveau de protection substantiellement équivalent à celui garanti au sein de l’Union, la Cour relève que celui-ci est uniquement applicable aux entreprises américaines qui y souscrivent, sans que les autorités publiques des États-Unis y soient elles-mêmes soumises.

En outre, les exigences relatives à la sécurité nationale, à l’intérêt public et au respect des lois des États-Unis l’emportent sur le régime de la sphère de sécurité, si bien que les entreprises américaines sont tenues d’écarter, sans limitation, les règles de protection prévues par ce régime, lorsqu’elles entrent en conflit avec de telles exigences. Le régime américain de la sphère de sécurité rend ainsi possible des ingérences, par les autorités publiques américaines, dans les droits fondamentaux des personnes, la décision de la Commission ne faisant état ni de l’existence, aux États-Unis, de règles destinées à limiter ces éventuelles ingérences ni de l’existence d’une protection juridique efficace contre ces ingérences.

La Cour considère que cette analyse du régime est corroborée par deux communications de la Commission4 , d’où il ressort notamment que les autorités des États-Unis pouvaient accéder aux données à caractère personnel transférées à partir des États membres vers ce pays et traiter celles-ci d’une manière incompatible, notamment, avec les finalités de leur transfert et au-delà de ce qui était strictement nécessaire et proportionné à la protection de la sécurité nationale.

De même, la Commission a constaté qu’il n’existait pas, pour les personnes concernées, de voies de droit administratives ou judiciaires permettant, notamment, d’accéder aux données les concernant et, le cas échéant, d’obtenir leur rectification ou leur suppression.

S’agissant du niveau de protection substantiellement équivalent avec les libertés et droits fondamentaux garanti au sein de l’Union, la Cour constate que, en droit de l’Union, une réglementation n’est pas limitée au strict nécessaire, dès lors qu’elle autorise de manière généralisée la conservation de toutes les données à caractère personnel de toutes les personnes dont les données sont transférées depuis l’Union vers les États-Unis sans qu’aucune différenciation, limitation ou exception ne soient opérées en fonction de l’objectif poursuivi et sans que des critères objectifs ne soient prévus en vue de délimiter l’accès des autorités publiques aux données et leur utilisation ultérieure.

La Cour ajoute qu’une règlementation permettant aux autorités publiques d’accéder de manière généralisée au contenu de communications électroniques doit être considérée comme portant atteinte au contenu essentiel du droit fondamental au respect de la vie privé.

De même, la Cour relève qu’une règlementation ne prévoyant aucune possibilité pour le justiciable d’exercer des voies de droit afin d’avoir accès à des données à caractère personnel le concernant, ou d’obtenir la rectification ou la suppression de telles données, porte atteinte au contenu essentiel du droit fondamental à une protection juridictionnelle effective, une telle possibilité étant inhérente à l’existence d’un État de droit.

Enfin, la Cour constate que la décision de la Commission du 26 juillet 2000 prive les autorités nationales de contrôle de leurs pouvoirs, dans le cas où une personne remet en cause la compatibilité de la décision avec la protection de la vie privée et des libertés et droits fondamentaux des personnes. La Cour considère que la Commission n’avait pas la compétence de restreindre ainsi les pouvoirs des autorités nationales de contrôle.

Pour toutes ces raisons, la Cour déclare la décision de la Commission du 26 juillet 2000 invalide.

Cet arrêt a pour conséquence que l’autorité irlandaise de contrôle est tenue d’examiner la plainte de M. Schrems avec toute la diligence requise et qu’il lui appartient, au terme de son enquête, de décider s’il convient, en vertu de la directive, de suspendre le transfert des données des abonnés européens de Facebook vers les États-Unis au motif que ce pays n’offre pas un niveau de protection adéquat des données personnelles.

Notes

1 Directive 95/46/CE du Parlement européen et du Conseil, du 24 octobre 1995, relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données (JO L 281, p. 31).

2 Décision 2000/520/CE de la Commission, du 26 juillet 2000, conformément à la directive 95/46/CE du Parlement européen et du Conseil relative à la pertinence de la protection assurée par les principes de la « sphère de sécurité » et par les questions souvent posées y afférentes, publiés par le ministère du commerce des États-Unis d’Amérique (JO 2000, L 215, p. 7).

3 Le régime de la sphère de sécurité comprend une série de principes relatifs à la protection des données à caractère personnel auxquels les entreprises américaines peuvent souscrire volontairement.

4 Communication de la Commission au Parlement européen et au Conseil, intitulée « Rétablir la confiance dans les flux des données entre l’Union européenne et les États-Unis d’Amérique » (COM(2013) 846 final, 27 novembre 2013) et communication de la Commission au Parlement et au Conseil relative au fonctionnement de la sphère de sécurité du point de vue des citoyens de l’Union et des entreprises établies sur son territoire (COM(2013) 847 final, 27 novembre 2013).

Meijers Committee : EU list of safe countries of origin

ORIGINAL PUBLISHED ON THE MEIJERS COMMITEE PAGE

Summary of recommendations

As part of the response to the unfolding refugee crisis in Europe, the European Commission recently proposed a Regulation establishing a common EU list of safe countries of origin.¹ In this note the Meijers Committee submits a number of observations and recommendations to the Union legislator. In particular, the Meijers Committee

i) welcomes the Commission’s decision to opt for legislation rather than intergovernmental cooperation;
ii) expresses doubts whether a common list of safe countries of origin will have the desired effect of arriving at common procedural practices;
iii) advises that designations of countries as safe should as a rule take into account the position of vulnerable minority groups within the country;
iv) recommends to apply the concept of safe country of origin only after an individual examination involving a personal interview and a right to legal assistance;
v) recommends to obtain external expert advice before adopting or amending the list, for example from UNHCR;
vi) advises to codify the right to appeal against negative decisions for reason of a person coming from a safe country with automatic suspensive effect, as guaranteed by the EU Charter on Fundamental Rights and the ECHR.

At the end of this note, the Meijers Committee proposes to insert three amendments into the Regulation to bring the level of legal protection in conformity with relevant human rights law.
The amendments concern:
i) the right to an individual interview;
ii) suspensive effect of appeals with regard to removal;
iii) Position of minorities in the designation criteria.

Legislation as the chosen instrument

The European Commission introduced a Regulation which directly creates a list of safe countries of origin. Any changes to the list can be made through a legislative act only. The regulation also amends articles in the Procedures Directive pertaining to the safe country of origin concept. The Meijers Committee welcomes that the Commission proposes to establish this list through a Regulation. Establishing the list in an informal, intergovernmental manner would have left out co-decision of the European Parliament and judicial oversight of the Court of Justice.² Given the serious ramifications of a common list of safe countries of origin, it is important that it is adopted in a transparent and democratic accountable manner.

The “safe country of origin” concept Continue reading “Meijers Committee : EU list of safe countries of origin”

Safe Harbor – No Future? How the General Data Protection Regulation and the rulings of the Court of Justice of the European Union (CJEU) will influence transatlantic data transfers

(ORIGINAL Posted on 1. Oktober 2015 in PETER SCHAAR. Der Blog. )

by Peter Schaar (*)

Ladies and gentlemen,

One week ago, the Advocate General at the Court of Justice of the European Union (CJEU) issued his vote on the Safe Harbor case of Max Schrems vs. the Irish Data Protection Commissioner.

Since 1995 when the General European Directive on Data Protection came into force, data transfers from the European Union and its member states to non-EU countries have been subject to specific privacy and security restrictions. Such restrictions do not exist only in Europe.

For example in the US several legal acts and decisions of regulatory authorities constitute the obligation to store specific data in the own country, in particular data, which have been generated by public bodies and providers of critical infrastructures. The US Federal Trade Commission has stated that a company subject to privacy obligations under US law is not allowed to avoid such obligations by outsourcing their data processing activities to offshore service providers.

The key message of Art. 25 of the 1995 GD is that transfer of personal data to a third country may take place only if the recipient in question ensures an adequate level of data protection. The adequacy shall be assessed in the light of all the circumstances surrounding the data transfer operation.

The main road to adequacy are the so-called adequacy decisions of the European Commission, that the said country ensures an adequate level of data protection. These decisions are binding for the member states. They shall take the measures necessary to comply with the Commission’s decision.

One of the most discussed adequacy decisions concerns the United States – the decision on Safe Harbor, although the Commission was of the opinion, that the US in general failed to provide an adequate level of data protection for the private sector, because of the lack of any comprehensive data protection legislation.

The Safe Harbor principles, negotiated between the Commission and the US government in the late 1990s should bridge this obstacle. The SH arrangement has been aimed at guaranteeing the adequate level of protection required by EU law for those companies, committing themselves to comply with the SH principles.

From the beginning, since the Safe Harbor was agreed in the year 2000 there has been some criticism against it. The main critical argument was that the principles do not meet the high EU data protection standards defined by the General Directive.

A scientific implementation study on SH done 2004 on behalf of the Commission came to the result that „Key concepts such as ‚US organization‘, ’personal data’,’deceptive practices’ lack clarity. Moreover, the jurisdiction of the FTC with regard to certain types of data transfers is dubious.“

It also has been criticized, that companies which declare compliance with the principles at once may profit from the Safe Harbor privileges, even if their privacy practices were not yet subject to an independent audit.

These issues remain important until our days. But after the vote the Advocate General at the CJEU (GA) issued recently, the focus lays on another question: How far practices and powers of US authorities have been ignored in the adequacy assessments.

At the first glance, law enforcement authorities, police and intelligence do not fall within the scope of the Safe Harbor agreement and therefore they do not have to be subject to the assessment. But this first impression is wrong.

As Art. 25 of the GD is pointing out, the assessment is to be done in the light of „all circumstances“ surrounding a data transfer to the third country. Even activities of authorities in the third country have to be examined. It is unclear how far this happened during the Safe Harbor assessment in the late 1990s.

But even if such assessment once took place, the result may be invalid today, because things changed dramatically after 9/11 2001. As we have learnt from Edward Snowden and other whistleblowers, US government has obtained broad access to private companies’ databases, telecommunications and Internet services.

Many companies which have co-operated with the NSA – voluntarily or based on legal obligations – have been safe harborists and there is no doubt that NSA and other services have got access to big amounts of data stemming from Europe or related to EU citizens.

The PATRIOT ACT and secret Presidential Orders, issued after 9/11 provided intelligence and law enforcement agencies with a lot of new powers and simultaneously demolished many safeguards which have been introduced in the 1970s to protect civil rights and privacy.

For years it seemed that many of these changes were not on the screen of the European Commission and other European stakeholders. The implementation study on SH of 2004 came to the conclusion: „Since the new US legislation only rarely contradicts the SH principles for data covered by SH, these conflicts do not appear to undermine the level of protection for any significant flows of personal data to the United States. The controversial provisions of the USA PATRIOT Act are essentially irrelevant for SH data flows.“ (p. 101)

But 2013, after the the beginning of the Snowdon revelations, nobody can ignore any more, that the practices of NSA, CIA and FBI introduced after 9/11 have impact on the level of data protection in the United States: The legal provisions on Government access to personal information, especially the Foreign Intelligence Surveillance Act (FISA), do not meet the basic standards of the rule of law at least so far data of non-US-persons are concerned. The practices disclosed in the last two years and the commitments of US officials on mass surveillance provided the public with loads of evidence that the NSA and others are involved in bulk collection of personal data coming from Europe. Therefore it seems evident, that these practices have to be taken into account by the CJEU.

Another change happened in Europe: The Lisbon Treaty came into force in 2009, and at least since then privacy and data protection, including the independent oversight, have been fundamental rights of the European Union, as parts of the European primary law. European secondary law and European Commission’s decisions have to fulfill these requirements. Even older legislation, agreements with third countries as to PNR or TFTP and Commission’s decisions have to be reviewed in the light of Art. 7 and 8 of the EU Charter of Fundamental Rights.

Acknowledging this, the vote of Advocate General Bot (AG) in the case of Maximilian Schrems versus the Irish Data Protection Commissioner, issued last week, is not really surprising. The vote touches two big points:

Even if the Commission decides that the level of data protection in a country is adequate, this does not prevent national data protection authorities from suspending the transfer of the data, it they are of the opinion, that in the concrete case adequacy criteria are not met by the recipient. As we have learnt from the Snowden revelations, Facebook and other Internet companies cooperated closely with the NSA and provided them with broad access to personal data stored on their servers.
The AG is of the opinion that the Safe Harbor arrangement itself is invalid, because the US, especially the intelligence services, do not provide adequate protection for the personal data coming from Europe. Therefore he proposes to suspend the Safe Harbor.

Nobody knows how the European Court of Justice will decide the case. The ruling is expected on 6 October. Perhaps you know the sentence „How the judge decides depends what he ate for breakfast“. It is correct: The vote of the advocate general is only an opinion and it does not bind anybody.

But for me it seems likely that the judges will acknowledge the vote, at least in the result. In two earlier cases, the court decided last year, on data retention and on the right to be forgotten, the judges underlined the high importance of European fundamental rights on privacy and data protection. In these cases the court went beyond the Advocate general’s vote. In the Schrems’ case the AG adapted this recent orientation of the judges.

If the CJEU will decide as proposed by the AG, this does not mean automatically the end of Safe Harbor. But the Safe Harbor arrangement must be renegotiated and at the end there might be a better safe Harbor System, meeting the principles of fundamental rights and complying with the new EU Data Protection Regulation.

Art. 41 of the Commissions proposal contains criteria, conditions and procedures for adequacy assessments, more specific than the current Art. 25 of the GD from 1995: The criteria which shall be taken into account for the Commission’s assessment of an adequate or not adequate level of protection include expressly the rule of law, judicial redress and independent supervision. The new article confirms explicitly the possibility for the Commission to assess the level of protection afforded by a territory or a processing sector within a third country.

My conclusion for today: Safe Harbor will be possible even in the future. But such a „happy end“ requires changes in the SH arrangement. And it requires effective legal guarantees for EU citizens in the US.

Also necessary is a new thinking in Europe, in particular on the fields of law enforcement and intelligence. If we urge the US to respect our privacy, European secret services have to respect fundamental rights of all EU citizens and citizens of third countries as well.

(*) Keynote on the conference „New Directions in Cyber Security“ Berlin, 1 October 2015

HOMAGE TO CATALONIA? EU LAW AND INDEPENDENCE MOVEMENTS

ORIGINAL PUBLISHED ON EU LAW ANALYSIS on Tuesday, 29 September 2015

by Steve Peers

The recent vote supporting pro-independence parties in Catalonia has restarted discussion about the relationship between EU law and independence movements within Member States. I blogged last year on this issue in the run-up to the Scottish independence referendum, but now is a good time to revisit the topic. There are three linked issues: a) what happens if part of a Member State issues a unilateral declaration of independence (UDI), which seems to be a possible development in Catalonia; b) what happens if a newly independent State which was formerly part of a Member State seeks to remain in the EU; and c) whether the EU should adopt a policy on this issue, and if so what that policy should be. This is purely an assessment of the EU law implications; I am not commenting here on the (un)desirability of secession of Scotland, Catalonia or any other part of a Member State as such.

The impact of a UDI

The possibility of a UDI in Catalonia distinguishes that situation clearly from the position in Scotland last year, since the referendum there was agreed with the UK government, which had promised to respect the outcome. However, it is conceivable that Scotland might in future contemplate a UDI, or that other parts of Member States would too. As we’ll see, it’s also necessary to distinguish between cases where the ‘parent’ Member State (for lack of a better term) is itself leaving the EU, and cases where it’s not.

The basic starting point of EU law is set out in Article 4 TEU: the EU must respect Member States’ ‘national identities’, which are ‘inherent in their fundamental structures, political and constitutional, inclusive of regional and local self-government’. The EU must also respect Member States’ role ensuring their ‘territorial integrity’. There is no counter-balancing reference to self-determination at the sub-national level, and indeed regional government is described as an aspect of existing Member States’ national identities, not as a prototype for a separate demos.

It must follow that the EU has no legal authority to recognize a UDI until and unless the parent State has come to some arrangement with the seceding authorities to recognise their nascent statehood. The process and details of that arrangement are left entirely to national law. Doubtless independence-minded Catalans are disappointed that the Spanish government did not follow the British government’s lead and expressly contemplate potential independence; but it is entirely for the Spanish legal and political system to resolve what should happen on this point. Indeed, the rule works both ways: the EU should not interfere with the UK’s willingness to contemplate Scottish independence, even if some Member States are worried about their own independence movements.

I’m assuming here that Catalonia would wish to stay in EU following a UDI, although in fact the reasoning on this first point applies equally to any self-proclaimed new state that would want to leave the EU after a UDI.

There are, however, different considerations if a Member State is leaving the EU, and a part of that Member State seeks to break away and remain part of the EU. (This is a well-known possible development in Scotland following the upcoming ‘Brexit’ referendum). In that case, the withdrawing Member State will shortly lose the protection of EU law regarding its national identity and territorial integrity, and so the normal self-determination rule of public international law (whatever it means exactly) would apply. Legally speaking, it would therefore be open to the EU to recognise any UDI. But this would only be an option; politically, it is obviously possible that some Member States would not want the EU to recognise the UDI because of a risk that this would encourage separatism within their own State, despite the different legal framework.

Recognition of the new State

What happens if the parent Member State is willing (as the UK was last year) to accept the independence of part of its territory? This is mainly relevant if the new State wishes to remain in the EU; if it wishes to leave, then (for the following reasons, by analogy) it could do so without invoking the formal process of withdrawal set out in Article 50 TEU (discussed further here).

I’ll summarise my argument in the previous blog post regarding Scotland (although there are other points of view on these issues, which I refer to there). The new State does not become a Member State automatically, since the Member States are listed in the Treaties. A Treaty amendment is therefore necessary to add new Member States, even if they previously formed part of existing Member States. The process of adding new Member States is set out in Article 49 TEU on accession to the EU (requiring negotiation of an Accession Treaty between the old Member States and the incoming Member State). However, the accession process could be speeded up (given that EU law applies already in the new State), or the Accession Treaty could be applied provisionally. Or the existing Member States could circumvent the use of Article 49 by amending the Treaties via the usual process (set out in Article 48 TEU) to amend Article 49 to make a special case for accelerated EU membership for the new State.

As a matter of politics, of course, again some Member States might be unwilling to contemplate a new Member State in this scenario, or at least would be reluctant to speed up the membership process, for fear that doing so would encourage separatists in that State.

Does the EU need a policy on independence movements?

The EU has to address declarations of independence by breakaway (purported) States as part of its external relations policy, as regards places like Kosovo, East Timor and South Sudan. It doesn’t necessarily follow that it is wise for the EU to get involved in such issues within Member States. As discussed above, there is a legal rule that the EU cannot support secession in cases of UDI; but it would also be a bad policy move for the EU to get involved. Even where separation from the parent Member State is agreed, it would be unwise for the EU to get involved until the key domestic issues concerning independence have been agreed internally.

This is the quintessential example of an issue which should be left as a matter of principle entirely to each Member State to determine. Any legitimacy gain for the EU for supporting one side in the independence dispute would be lost as regards the other side in the argument. While separatists may wish the EU to help them, the EU should maintain its neutrality and leave it to them to win their argument (if they can) at the national level.

While EU law creates a legal bias (for the reasons described above) towards the status quo in independence situations, it would be necessary to develop a policy if secession from a Member State happened with its consent. In such cases, the EU should in principle respect both the willingness of the Member State to accept the secession from its territory (as an aspect of respect for national identity), and the view of the citizens in the new State to secede and join the EU (as an aspect of respect for democracy). As a consequence, it would be appropriate (although there would be no legal obligation) to facilitate EU entry for the new State (if it sought to become a Member State) as quickly and smoothly as possible. While it would be better for the EU to insist that this was a case-by-case policy, to avoid any perception that it was interfering in other Member States’ domestic politics by encouraging other separatists, they would likely be encouraged anyway. For that reason, despite the strong argument in principle that EU membership for newly independent parts of Member States should be fast-tracked, it’s entirely possible that it wouldn’t be a smooth process in practice.

Photo credit: http://designseye.blogspot.co.uk/2013/06/happy-161-antoni-gaudi.html

Repetita Juvant ? The EDPS 2nd Opinion on the EU system of collection of passenger name records (PNR)

Foreword:
The systematic collection for prevention of terrorism of Air traveller’s personal data (PNR) from Airlines, Travel Agencies and Computer Reservation Systems started in the US, Australia, Canada after 9/11 and was considered illegal by the European Data Protection authorities as well by the European Parliament who challenged in 2004 before the Court of Justice the first EU-US agreement in this matter as well as the Commission Declaration (“Adequacy Finding”) which considered the adequate the condition of treatment of EU passengers data on the other side of the Atlantic.

The Court of Justice Judgment recognized in 2006 that the Commission’s “Adequacy Finding” and the EU-US Agreement were not founded on the correct legal basis but did not examined the EP plea on the fact that the agreement could had infringed the fundamental right to protection of personal data because of lack of clarity and of its incompatibility with a democratic society (at the time required by art.8 of the ECHR)

Therefore it has to be noted that already in 2004 the Commission considered that also the EU should develop its own PNR system for security purposes and after the CJ ruling decided to renegotiate with the US (on a security related legal basis) a new PNR agreements which explicitly made reference to the possibility of exchanging PNR data as soon as the EU would had has its own PNR related System.
In the absence of an EU internal legal framework for PNR data some EU Countries started building their own national systems with a more or less open support by the Commission notwithstanding the (vocal) opposition of the European Parliament.

Quite surprisingly it is after the entry into force of the LISBON Treaty and of the Charter of Fundamental Rights which recognize a self-standing fundamental right of protection of personal data that the Gericho Walls have fallen and the European Parliament has approved a transatlantic agreement in this matter (even if there was not yet an internal EU legal framework in this matter and the level of protection of Personal data in the agreement was much lower than the one that the same Parliament challenged before the Court of Justice in 2004…).

This change of strategy (due to an clear change of political majority) was seized by the Commission as the right signal to create an EU internal PNR system. After a first badly written proposal the Bruxelles Executive came back with a legislative proposal to authorise the collection of PNR data also by the EU Member States.

Needless to say this move was contested by the national data protection authorities and less convincingly by the European Parliament. Even if it blocked in the last legislature the legislative procedure it has finally decided to reopen the negotiations this year. This is probably due to the converging pressure of the European Council, of the Council Interior Ministers as well as by the convergence of the two biggest political groups (also thanks to the good offices of the EP President..).

From a procedural point of view, the legislative proposal is still in its first phase (parliamentary first reading) but the new majority (covering also the ALDE and ECR) has decided to try to obtain an early agreement with the Council in the framework of the so called “first reading agreements”.
As usual the informal (secret) dialogue has started and there is a clear political will to reach an agreement in the coming months (still under the Luxembourg Presidency).

This being the case both the National Data Protection Authorities and the European Data Protection Supervisor EDPS) are trying to slow down the process by repeating the constitutional, legislative and operational reservations which have also been summarized in the EDPS opinion adopted last week and published below.

Most of these arguments have been raised hundred of times (even by the European Parliament since its first resolution in march 2003) but quite paradoxically the new political majority in the EP, notwithstanding the stronger post-Lisbon constitutional framework of data protection, has decided to change its mind and is giving up the points which has defended in the previous legislatures.

Under such a new political situation it is more than likely that the very well drafted EDPS considerations will not be taken in account. But even if in this case REPETITA (will not) JUVANT other obstacles can arise before the adoption by the European Parliament of the EU PNR legislative proposal.

“There are still judges in Berlin”?

Like the humble miller who facing an unjust decision the Prussian King Frederick II, the Great exclaimed that “There are still judges in Berlin” our “Berlin” judges can be the European Court of Justice which will give an important judgment partially related to this matter on October 6.

The judgment deals with a case raised by Max SCHREMS, an Austrian Student who has considered that his personal data accessible via Facebook were not adequately protected in the US territory (because they can be too easily accessed by the US Security Services).

It will be interesting to see if the Court of Justice meeting as Grand Chamber (as it happens for “big” judgments) will follow the recent Conclusions of Advocate General Yves BOT who has raised strong concerns on the compatibility with the EU Charter of the current US data protection standards in the security domain.

If this was the case the same doubts could be extended on the envisaged EU PNR system which (badly) mirror the US PNR system… Will the determination of one European Citizen be more effective for the rights of each one of us of the hundred pages and countless debates of the European Parliament in the last twelve years? We will know it very soon and in the meantime let’s …fasten our seat belts.

Emilio De Capitani

EDPS SECOND OPINION ON EU PNR – ORIGINAL PUBLISHED HERE Continue reading “Repetita Juvant ? The EDPS 2nd Opinion on the EU system of collection of passenger name records (PNR)”

(MEIJERS COMMITTEE) Military action against human smugglers: legal questions concerning the EUNAVFOR Med operation

ORIGINAL PUBLISHED HERE ON 23 September 2015

The EUNAVFOR Med operation

On 22 June 2015, the Council of Ministers of the European Union adopted a Common Foreign Security Policy (CFSP) Decision establishing a military crisis management operation with the aim of combatting fighting people smuggling: EUNAVFOR Med.¹ This mission is currently in its first phase, focusing on intelligence gathering, i.e. surveillance and the assessment of existing smuggling networks.

A second phase would involve searching and possibly diverting vessels on the high seas and territorial waters, either under a mandate of the UN Security Council or with the consent of the appropriate coastal state. The Foreign Affairs Council has recently established that the conditions for the second phase have been met insofar as operations in international waters are concerned.² During the third phase, vessels and related assets of human smugglers would be destroyed and smugglers apprehended.

The mission will operate in a complex legal environment of overlapping rules of refugee law, international human rights law, the law of the sea, and international rules on the use of force. This note discusses some of the most pressing legal questions raised by this operation.

General remarks

At the outset, the Meijers Committee would like to raise a general point regarding the focus on people smuggling as a response to the loss of life at sea. In the absence of safe and legal access to the right to seek asylum in Europe, together with routes for legal migration, people will turn to human smugglers as a last resort. Increased border controls have resulted in higher casualties as people are forced to take more dangerous routes.

The Meijers Committee questions the appropriateness of the approach taken under EUNAVFOR Med to stop the loss of life at sea. The Committee would like to point to the shift from saving lives at sea under the Italian-led Mare Nostrum Operation, to border management (Triton), to military action (EUNAVFOR Med). The Meijers Committee emphasizes that the legal obligation to save lives at sea should have primacy in all Union action at sea and that a long-term solution must also involve improving legal access to asylum and legal employment.

Human smuggling as a threat to international peace and
security

The Meijers Committee notes that the decision establishing the EUNAVFOR Med operation refers explicitly to the need for a UN Security Council Resolution or consent of the coastal states concerned before the second phase of the operation can enter into force.

In this respect the Meijers Committee notes a fundamental difference from the EUNAVFOR operation Atalanta against piracy off the Somalian coast, which was taken as a model for EUNAVFOR Med. The Atalanta operation was explicitly supported by a UN Security Council Resolution, and had the consent of the coastal state involved.³

Articles 39 and 42 UN Charter stipulate that the Security Council shall only authorize the use of force if ‘necessary to maintain or restore international peace and security’. The Meijers Committee is not convinced that the EUNAVFOR MED mission meets this standard. Although the humanitarian crisis may meet this standard, the activities of human smugglers – unlike piracy – do not qualify. Although the Security Council has previously adopted resolutions in response to refugee crises in Iraq and Haiti, these were intended to stabilize the countries of origin and not to prevent persons from seeking refuge elsewhere.

Phase 2: search and diversion of ships

The Second Phase of the operation would involve the search and diversion of ships in third-country territorial waters, which requires the consent of the flag state or a UN Security Council Resolution.

The Meijers Committee recalls that on the high seas, Article 87 UN Convention on the Law of the Sea (UNCLOS) ensures the right to freedom of navigation. Article 110 permits a warship to board and inspect a vessel if, inter alia, it has no nationality. As regards the vessel, a finding of statelessness should allow states to exercise jurisdiction in order to ensure compliance with the ‘minimum public order on the high seas’, namely, the duties that normally fall on the flag state (Art. 94 UNCLOS).⁴ This could include a state’s power to escort the vessel into harbor for inspection. As regards the people on board, UNCLOS does not seem to provide a basis for the exercise of jurisdiction.

Although Article 110(1) UNCLOS expressly allows that grounds of interference may be established by Treaty, the UN Smuggling Protocol seems to impose a duty of cooperation only on the contracting parties, while maintaining the requirement of flag state authorization. Article 8(7) of the Smuggling Protocol provides a firmer legal basis for interference with stateless vessels than Article 110 UNCLOS. The wording ‘suppressing the use of the vessel’ or ‘take appropriate measures’ implies the possible use of force. Nevertheless, such force should be used as a means of last resort and will be subject to the requirement of necessity and proportionality. It is noted, however, that the Migrant Smuggling Protocol lacks the precision of, for instance, the UN drug trafficking regime, which explicitly sets out the measures that an intercepting power may take against a drug transport.⁵ Accordingly, no clear legal basis for action is provided in international law.

Diversions on the high seas may not result in the refoulement of people on board. It is important to stress that States cannot relieve themselves of this obligation by labelling an operation as ‘search and rescue’. The IMO Guidelines on the treatment of persons rescued at sea state that ‘[disembarkation of asylum-seekers and refugees recovered at sea, in territories where their lives and freedom would be threatened should be avoided.’ This approach has been confirmed by the European Court of Human Rights in the Hirsi case.⁶ Member States remain bound by their obligations under international human rights law, independently of the nature and location of their intervention. In this regard it is particularly problematic that Libya – one of the most important coastal states whose cooperation is sought – is currently a notoriously dangerous and unstable country.

It is unclear how the EU intends to give practical effect to these obligations in the course of the EUNAVFOR Med mission. The Meijers Committee would recommend that clear guidelines be put in place, comparable to the rules applicable in the framework of Frontex coordinated operations at sea.⁷

Phase 3: destruction of vessels and apprehension of smugglers

The Third Phase of the Operation would entail the destruction of vessels and related assets, and the apprehension of smugglers. The Meijers Committee argues that clear, binding, publicly available rules should be adopted prior to the commencement of Phase 3.

As regards the smugglers it must be noted that unlike piracy and international crimes, international law does not establish universal criminal jurisdiction over human smuggling. As with diversions, the interference with vessels believed to be engaged in human smuggling requires the consent of the flag state (or a UN SC Resolution). In case the ship is sailing without a flag, Article 8 of the Protocol allows a party to take ‘appropriate measures in accordance with relevant domestic and international law’. The extent to which this includes the exercise of criminal jurisdiction over human smugglers is not clear, however.

The Council decision establishing EUNAVFOR Med is silent about the possible detention and prosecution of smugglers. The Meijers Committee points out that even though EUNAVFOR Med is executed by military forces, the EU is not acting as party to an armed conflict and thus normal peacetime law applies. This means that after arrest, those suspected of migrant smuggling should be brought promptly before a judge⁸. In the case of subsequent criminal prosecution, jurisdiction should be established in one of the Member States. In this respect it is noted that not all Member States have established universal jurisdiction over human smuggling. If smugglers are to be extradited or released to third countries, their fundamental rights should be guaranteed.

The Meijers Committee notes that EUNAVFOR Med is aimed at the destruction of vessels used or suspected of being used for migrant smuggling, possibly even inside third-country territory, yet it remains unclear what legal standard is applied to identify such vessels. The Meijers Committee cautions that the destruction of vessels cannot be arbitrary. Unlike UNCLOS, which provides for clear rules on the seizure and liability for seizure of pirate ships, there is no explicit legal basis in international law for the seizure of migrant smuggling boats. The right to property as enshrined in Article 1 of Protocol 1 ECHR, which will apply to the Member States acting extra-territorially, prescribes that any destruction of property must be provided for by law and must be necessary and proportionate.

Unclear division of responsibility between the EU and its
Member States

The Meijers Committee recalls that Article 21 TEU requires CFSP actions to be based on human rights. This includes respect for human dignity, including the prohibition of torture and inhuman treatment; personal security and liberty; and protection from arbitrary detention and arrest.⁹ It also notes, however, that the Court of Justice of the EU has no authority to ensure this respect for fundamental rights as it lack jurisdiction over the CFSP.¹⁰ This means that legal remedies would have to be provided under the national law of the participating Member States.

The experience with joint operations under the coordination of Frontex shows that in case of violations of fundamental rights, it is unclear to whom wrongful conduct must be attributed. Although the operation is coordinated by the EU, it is the Member States that provide the assets and personnel, over which they maintain operational command.

Case law issuing from the European Court of Human Rights on the obligations of the Member States as contracting parties to the European Convention on Human Rights clearly indicates with regard to the Member States that they cannot escape their responsibilities under the Convention by acting outside the Convention’s territorial scope. The situation is more complicated, however, when Member States act as agents for the European Union (Bosphorus) or within the context of UN Peace Keeping Operations (Al Jeddah, Behrami, and Saramati). The Meijers Committee therefore stresses that it is fundamentally important that questions of international responsibility and responsibility under the European Convention for Human Rights are addressed prior to commencement of Phases 2 and 3.

Conclusions and recommendations

I. There are no indications that combating migrant smuggling contributes to the restoration of international peace and security or to ending the ongoing humanitarian crises;

II.      Without express consent from third states or authorization from the UN Security Council, the EU lacks jurisdiction over   vessels or assets in third-country territorial waters;
III.      Without express consent from third-country coastal states or   authorization from the UN Security Council, there is no clear legal basis for coercive measures against vessels or assets on the high seas;
IV Despite the unclear legal framework covering interdiction on the high seas, international human rights law does apply;
V.      Should a legal basis for action on the high seas and in territorial waters be provided, clear rules of engagement and proper safeguards should be in place to prevent indiscriminate destruction of civilian property; any undue loss should be compensated;
VI.      An unambiguous legal basis for the arrest and detention of suspected smugglers is needed, and also for the seizure and destruction of any personal property. Suspects should either be prosecuted, extradited or released, the last action having due regard to the right to asylum and the prohibition of refoulement;
VII.      Clear attribution rules and accountability mechanisms for human rights violations committed by EUNAVFOR assets should be in place;
VIII.      The right to apply for asylum, access to asylum procedures on land with proper language and legal assistance, and the prohibition of refoulement should be respected and subject to judicial oversight;
IX.       Outsourcing migration control to third countries, even though outside Member State jurisdiction, should take place with assurances and safeguards against human rights violations.

Notes

¹ Council Decision (CFSP) 2015/972 of 22 June 2015 launching the European Union military operation in the southern Central Mediterranean (EUNAVFOR MED), OJ 2015, L157/51.

² Council of the European Union, “EUNAVFOR Med: Council adopts a positive assessment on the conditions to move to the first step of phase 2 on the high seas”, Press Release, 14 September 2015, no. 643/15.
³ http://www.un.org/Depts/los/piracy/piracy_documents.htm
⁴ E. Papastavridis, ‘Enforcement Jurisdictions in the Mediterranean Sea: Illicit Activities and the Rule of Law on the High Seas’, International Journal of Marine and Coastal Law, Vol. 25, 2010, p. 585.
⁵ See Council of Europe Agreement on Illicit Traffic by Sea, implementing article 17 of the United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances.
⁶ ECHR, Hirsi Jamaa and others v. Italy, Grand Chamber, Judgment, 23 February 2012, Application no. 27765/09.
⁷ Regulation (EU) No 656/2014 of the European Parliament and of the Council of 15 May 2014 establishing rules for the surveillance of the external sea borders in the context of operational cooperation coordinated by the European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union, L 189, 27 June 2014.
⁸ ECHR, Medvedyev v France, 9 March 2010, appl. no. 3394/03.
⁹ The promotion and protection of human rights during common security and defence policy operations. In-between a spreading state of mind and an unsolved concern. M L Sánchez Barrueco, in The EU as a ”Global Player” in human rights?, J E Wetzel (edit.), 2011, pp. 158-160.
¹⁰ See also Case T-271/10, under appeal C-455/14 P.

About : The Meijers Committee is an independent group of legal scholars, judges and lawyers that advises on European and International Migration, Refugee, Criminal, Privacy, Anti-discrimination and Institutional Law. The Committee aims to promote the protection of fundamental rights, access to judicial remedies and democratic decision-making in EU legislation.

The Meijers Committee is funded by the Dutch Bar Association (NOvA), Foundation for Democracy and Media (Stichting Democratie en Media) the Dutch Refugee Council (VWN), Foundation for Migration Law Netherlands (Stichting Migratierecht Nederland), the Dutch Section of the International Commission of Jurists (NJCM), Art. 1 Anti-Discrimination Office, and the Dutch Foundation for Refugee Students UAF.

Contact info: Louis Middelkoop Executive secretary post@commissie-meijers.nl +31(0)20 362 0505

Please visit www.commissie-meijers.nl

IMPROVING THE LEGISLATION FOR LABOUR MIGRATION IN THE EUROPEAN UNION (a Study for the EP)

FULL STUDY ACCESSIBLE HERE

AUTHORS: Prof. Iván Martín Dr. Anna di Bartolomeo Prof. Philippe de Bruycker, Géraldine Renaudiere Dr. Justyna Salamońska Prof. Alessandra Venturini (Migration Policy Centre, Robert Shuman Centre for Advanced Studies, European University Institute)

The paradox between the need for international labour migration to counter the impending demographic crisis in Europe and the lack of commensurate policy instruments to attract and integrate labour migration from third countries into the EU is one of the key strategic issues for Europe. Upon request by the LIBE committee, this research paper reviews the social and economic context of EU international labour migration policy, the status of relevant EU legislation and the available policy options from a comprehensive labour market perspective, as well as their feasibility. These options for opening up legal labour migration channels to the EU should be considered in the framework of the ongoing discussion over the European Agenda on Migration.

EXECUTIVE SUMMARY

Attracting international labour over the medium- to long-term is a crucial strategic issue for the European Union: demographic challenges, enhanced European global competitiveness, sustained European growth and the survival of welfare systems over the next decades, all depend on it.

However, EU labour migration policy has received very little attention from policy-makers, media and the public in general, even in the framework of the recent proposal for a European Migration Agenda.

As a matter of fact, the EU has no comprehensive set of policy instruments to cope with the international labour required by its labour markets. There are several reasons to undertake the development of a more coherent and more comprehensive legal labour migration policy framework in the EU:

Non-economic migrants (family reunification, refugees and foreign students) amount to between two thirds and three quarters of all third-country nationals entering the EU labour market;
Labour migration policy is the only instrument allowing the selection of skilled migrants with the qualifications and skills required by European labour markets;
Effective legal labour migration channels are a necessary component of any strategy to fight irregular labour migration;
Legal migration is a key component of international bilateral migration policy dialogues between the EU and its partner countries, in particular Mobility Partnership with Neighbourhood countries. A coherent EU labour migration policy framework is required to integrate this issue into policy dialogues.

As a consequence, an EU labour migration policy framework should be an integral part of the emerging EU labour market and employment policies.

The political sensitiveness of immigration policy and the exclusive competence of Member States to decide the volume of admissions of third-country nationals seeking work are two major constraints on any policy initiative in this field.

Structure and main conclusions

This paper first reviews available evidence on the need for labour migration from third countries to the European Union. Today, in most Member States high unemployment and underemployment levels coexist with substantial labour shortages as perceived by employers. Whereas there is not an overall quantitative labour shortage for the whole EU, several studies find the existence of qualitative labour market shortages for specific skill levels, sectors or occupations, in particular for low-skilled occupations. Highly-skilled profiles are, instead, needed only in a limited number of occupations and countries. Accordingly, any strategy addressing labour needs in the EU – including highly-skilled migration schemes – should be geared to national labour markets’ needs and be strongly sector-oriented.

By looking at the different forecasts available, it can be seen that international migration is poised to play a major role in filling the EU’s labour market needs.

Accordingly, redesigning pro-immigration policies should be a complementary response to current and future European labour supply dynamics.

This paper, also, reviews the gradual development of an EU-wide legal framework on economic migration and its current status. After a 2001 attempt to adopt a comprehensive approach to economic migration to the EU, EU legislation has opted for a “category-by-category” approach. To date this has focused on students and researchers, highly-qualified migrants, seasonal workers and intra-corporate transferees. There is also a proposal recasting the Directives on foreign students and on researchers that has not yet been adopted. Assessments of the implementation of the Researchers Directive (2011) and the Blue Card Directive on highly-qualified migrants (2014) show low rates of use. In both cases, as with the Seasonal Workers Directive, the wide powers of discretion retained by Member States and insufficient promotion of the existence of new rules undermines the potential of directives.

Beyond the conditions of admission, the intra-EU mobility of third-country nationals remains a key component of EU labour migration policy and one of the biggest failures in European immigration policy. Overall, the EU labour migration system lacks effective coordination mechanisms between Member States for policy implementation at the EU level.

The paper, next, looks at the existing evidence for the impact of EU migration policies on migration flows in the labour market, as well as the integration challenges posed by the arrival of third-country nationals. Available data do not allow for a thorough assessment of the impact and effectiveness of immigration policies on migrant flows and – especially – on migrant composition in terms of reasons for entrance: family reunification beneficiaries, refugees, workers and students. Only very limited quantitative studies have been conducted in a systematic and comparative way at the EU level. This lack of data and research severely limits our ability to understand and design an evidence-based EU labour migration policy.

However, the low level of use of EU labour migration policy tools, such as the Researchers Directive or the Blue Card Directive, suggests that the impact of EU labour migration policy on migratory movements is very limited.

Empirical evidence reveals that migrants do not integrate into the labour market to the same extent as native workers. They have lower wages and are more likely to be unemployed than native workers with the same characteristics.

Regarding the proposal for a European Agenda on Migration presented by the European Commission on 13 May 2015, the chapter on “A new policy on legal migration” does not contain major novelties in relation to the current EU labour immigration regime. The proposals lack a clear vision of future EU labour migration policy and its integration with labour market and employment policy. They do not build a comprehensive and coherent policy set and they do not make up for the shortcomings of current EU labour migration policies. Overall, they are not suited to respond to the identified and projected labour needs of the European Union over the medium- to long-term. However, they open a unique opportunity to discuss EU labour migration policy: this opportunity should not be wasted.

Main recommendations

In this regard, the paper calls for a comprehensive labour market vision of EU economic migration regime. The current piecemeal, category-specific approach to legal labour migration at the EU-level does not respond to the needs of EU labour markets, which are subject to a process of gradual unification.

Indeed, EU labour migration policy should be an integral part of EU labour market policy. As such, it should incorporate measures facilitating the labour market integration of all flows of third-country nationals into the EU labour markets. This would include not only economic migrants entering the EU labour market with a work permit, but also all third-country nationals ultimately accessing European labour markets. Here there are, also, family reunification beneficiaries, asylum-seekers and foreign students.

An operationalization of the EU preference principle is crucial to ensuring the smooth implementation of any EU-wide labour migration scheme and the articulation between international migration and the intra-EU mobility of EU nationals.

Social partners and social dialogue mechanisms are a necessary component of any EU labour migration initiative. They both define an EU labour migration policy responding to the actual needs of the labour market and defuse misrepresentations of migrants in political discourse and public opinion.

A public information and communication strategy on the realities of migration and the need for a comprehensive labour migration policy at EU level should be an integral part of any policy debate in this field, given the strong anti-immigration attitudes in wide sectors of public opinion in many Member States.

Legal labour migration opportunities to the EU should be integrated into EU migration agreements with third countries (such as Mobility Partnerships), as well as mechanisms to facilitate the labour and skills matching for migrant workers from those countries. This would allow the articulation between EU labour migration policy and EU external cooperation in this field.

More precise and disaggregated migration statistics should be collected at the EU level, and the current Commission Annual Report on Immigration and Asylum could be transformed into a fully-fledged EU-wide migration policy review mechanism.

Last, but not least, more research and better production of data are crucial in any effective evidence-based labour migration policy at the EU level. More research is needed, in particular, in the following areas:

Labour market integration of non-economic migrants;
Patterns of intra-EU mobility of third-country nationals legally residing in the EU;
Mechanisms to better match the profile of labour migrants to the needs of the EU labour markets;
Foreign students graduating in EU education institutions should have some opportunity to access EU labour markets, enhancing thus the attractiveness of the EU destination, and an EU Traineeship Programme for third-country nationals could be a building block to facilitate the smooth integration into of third-country nationals with the required skills.
More generally, the recognition and certification of qualifications and skills obtained in third countries by third-country nationals should be made easier and progress towards an EU-wide recognition system should be envisaged.The actual implementation and working of labour market tests in different EU Member States.Policy options to open new avenues for legal labour migration to the EUThe paper briefly reviews a series of concrete policy options for widening the legal channels for access to the European labour market in response to identified labour market needs. The analysis of existing options allows some conclusions on the right mix of policy instruments to integrate into a comprehensive labour market approach. The main objectives would be the following: ensuring a more efficient international labour matching of migrant workers; optimizing the labour force already present in the EU; fitting legal migration channels to the needs of the European labour markets; and ensuring the availability of a sufficient pool of potential labour migrants for employers. In terms of policy instruments, an analysis of existing options suggests the following conclusions:
1. Improving labour matching within and outside the EU
- An EU-wide Labour Market Information System and an EU labour market needs a forecasting system integrating migration flows of non-economic migrants. Both are the basis of any effective, evidence-based labour migration policy at the EU level. The former can be used to facilitate international labour matching for third-country nationals and to operationalize the principle of EU preference and to ensure a better matching of labour migration policy outcomes to the actual needs of EU labour markets.
- Current EU and Member States job intermediation mechanisms (notably public employment services matching systems) could be extended to third country nationals, in particular through partnerships with public employment services in countries of origin. An obvious step there would be to extend the European Job Mobility Portal, EURES, to third countries, in particular Neigbourhood countries in the framework of Mobility Partnerships.
. The role of private placement agencies in international labour migration matching should be enhanced and regulated, for instance through the development of a system of certified international recruitment agencies.
1. Optimizing the labour force already present in the EU
- The labour market integration of non-economic migrants has to be
  supported, first by getting a better knowledge of their skills and facilitating
  changes in migratory status;
. The intra-EU mobility of third-country nationals legally working in EU Member States should be facilitated; and the targeted regularization of irregular migrants for whom there is labour market demand should be incentivized.
1. Fitting legal migration channels to the needs of the European labour markets
. The ongoing reform of the EU Blue Card should impose fewer costs on migrants and employers and grant more rights, in particular to intra-EU mobility, to Blue Card holders.
- Targeted and occupation-specific job search visas might be a more effective instrument to match EU labour migration policy to EU labour market needs than supply-driven “expression-of-interest” system, as suggested in the European Agenda on Migration.
1. Extending the pool of potential labour migrants for employers
  - Foreign students graduating in EU education institutions should have some opportunity to access EU labour markets, enhancing thus the attractiveness of the EU destination, and an EU Traineeship Programme for third-country nationals could be a building block to facilitate the smooth integration into of third-country nationals with the required skills.
  - More generally, the recognition and certification of qualifications and skills obtained in third countries by third-country nationals should be made easier and progress towards an EU-wide recognition system should be envisaged.

Schrems Versus Facebook: is the end of Safe Harbor approaching ?

by Emilio De Capitani

Today Advocate General Yves Bot has presented his long-awaited conclusions on the Case C‑362/14 Maximillian Schrems v Data Protection Commissioner. This case better described by the press as the “Schrems v Facebook” Case (why not “David V Goliath” ?) put in question the so called Safe harbor “agreement” which frame the conditions under which personal data of the people under the EU jurisdiction can be transferred or treated by servers of US Companies (such as Facebook, Google, E-Bay) on the US territory.
As the protection of personal data is a fundamental right under EU law (notably after the entry into force of the art.8 of the EU Charter) art. 25 of Directive 95/46 foresees that the transfer of these data to a third country is legitimate only if the data are “adequately” protected.
The problem is that in the US there is no comprehensive legal protection framework comparable to the one existing in the EU so that in 2000 the Commission negotiated with the US the establishment of a specific voluntary regime (the “Safe Harbor Principles”) which could had been considered granting an “adequate” protection of personal data having regard to the standard applicable in Europe.

At the time the European Parliament voted against this regime but was unable to obtain stronger safeguards because of the unwillingness of the US authorities and moreover by the Commission which was more interested to the transfer of data than of their protection.

Since then the transatlantic flow of data has grown every day and with them the economic benefices of the US Companies without any real re-assesment of the compliance of the Safe Harbor principles on the US side (by the Federal Trade Commission) or on the EU side (by the Commission) even after the entry into force of the Lisbon Treaty which changed the legal basis of EU policies linked with the protection of personal data.

However when the Snowden revelations made clear to everybody that all these EU personal data could be massively analyzed without judicial overview by the US Intelligence Services someone in the EU woke up.

Between the EU Institutions the European Parliament asked the suspension of the Safe Harbor agreement but its initiative was not followed by the Commission (as unfortunately happens more and more frequently); but it is thanks to the obstinacy of Maximilian Schrems, an Austrian law student that the case was finally been brought, first before to the Irish Data Protection Commissioner, then before the Irish High Court and now before the Court of Justice.

This case is extremely interesting not only because it confirms that in a democracy someone has to …watch the watchers be they at national or European level (notably if they are sleeping or hiding behind each other…) but also because it shows that also an “ordinary” Citizen can dare to do in name of the EU law and of his rights what the EU Institutions are less and less willing to do.

Enjoy now the reading the instructive and very detailed Yves BOT arguments drawing him to declare that the Commission initial “adequacy finding” was not adequate at all (as also the EP wrote in its 2000 resolution) and that National Authorities should fully play their role and not hiding behind the Commission “Adequacy decisions”.

Such a strong reasoning if endorsed by the Luxembourg Judges should inspire

a re-assessment of other EU-US ‘executive’ agreements dealing with data protection (the draft “Umbrella agreement” included)
a revision of the Data Protection package at least as far as the regime of Commission “adequacy finding” is concerned (which due to its large marge of discretion could no more be considered a simple “implementing measure” but at least a “delegated” power …) and a stronger role of the Data Protection Board which should have a direct jurisdiction at least for Data controller “over the top” such as Facebook, Google, E-Bay and so on…

It is only unfortunate that the European Parliament which on these issues was on the right side between 1999 and 2004 is now slowly sliding away notwithstanding a much stronger constitutional framework and a binding Charter …

Anyway many thanks Max!! Hope that 10, 100, 1000 of European citizens could follow your example…

CONTINUE READING : OPINION OF ADVOCATE GENERAL BOT

delivered on 23 September 2015 (1) Case C‑362/14 Maximillian Schrems v Data Protection Commissioner

Continue reading “Schrems Versus Facebook: is the end of Safe Harbor approaching ?”

EP Study : Big Data and smart devices and their impact on privacy

FULL STUDY ACCESSIBLE HERE
AUTHORS : Dr Gloria González Fuster, (Research Professor at the Vrije Universiteit Brussel (VUB), Dr Amandine Scherrer, (European Studies Coordinator and Associate Researcher at the Centre d’Etudes sur les Conflits, Liberté et Sécurité -CCLS)

EXECUTIVE SUMMARY

EU citizens and residents and, more generally, all individuals deserving protection as ‘data subjects’ by EU law, are directly impacted by EU strategies in the field of Big Data. Indeed, the data-driven economy poses significant challenges to the EU Charter of Fundamental Rights, notably in the fields of privacy and personal data protection.

Big Data refers to the exponential growth both in the availability and automated use of information. Big Data comes from gigantic digital datasets held by corporations, governments and other large organisations; these are extensively analysed (hence the name ‘data analytics’) through computer algorithms. There are numerous applications of Big Data in various sectors, including healthcare, mobile communications, smart grids, traffic management, fraud detection, or marketing and retail (both on- and offline). The notion, primarily driven by economic concerns, has been largely promoted through market-led strategies and policies. Presented as an enabler of powerful analytical and predictive tools, the concept of Big Data has also raised numerous criticisms emphasising such risks as biased information, spurious correlations (associations that are statistically robust but happen only by chance), and statistical discrimination. Moreover, the promotion of Big Data as an economic driver raises significant challenges for privacy and digital rights in general. These challenges are even greater in a digital ecosystem with a proliferation of cheap sensors, numerous apps on mobile devices and an increasingly connected world that sometimes does not even require human intervention (as shown in the increasing development of the Internet of Things [IoT]). The flows of information on- and off line, shared and multiplied across computers, mobile devices, watches, SmartBands, glasses, etc., have dramatically increased the availability, storage, extraction and processing of data on a large scale. It has become increasingly difficult to track what is made of our data. This situation is complicated further by the wide variety of actors engaged in data collection and processing.

The numerous debates triggered by the increased collection and processing of personal data for various – and often unaccountable – purposes are particularly vivid at the EU level. Two interlinked, and to some extent conflicting, initiatives are relevant here: the development of EU strategies promoting a data-driven economy and the current reform of the EU personal data protection legal framework, in the context of the adoption of a General Data Protection Regulation (GDPR).

In order to address the issues at stake, the present Study provides an overview of Big Data and smart devices, outlining their technical components and uses (section 2). This section shows that many contemporary data processing activities are characterised by a high degree of opacity. This opacity directly affects the ability of individuals to know how data collected about them is used; it also hinders their capacity to assess and trust the manner in which choices are (automatically) made – whether, in other words, these choices are appropriate or fair. As regards smart devices, cheap sensors or the IoT, the pervasiveness of sensors and extensive routine data production might not be fully understood by individuals, who may be unaware of the presence of sensors and of the full spectrum of data they produce, as well as the data processing operations treating this diverse data. If Big Data, smart devices and IoT are often promoted as key enablers of market predictions and economic/social dynamics, data processing raises the question of who controls one’s data.

In this perspective, Section 3 presents the different EU approaches on the digital economy and the questions raised in terms of privacy and personal data protection (Section 3). This section argues that in the current context of the development of a Digital Single Market for Europe (DSM), the European Commission’s perspective is very much commercially and economically driven, with little attention to the key legal and social challenges regarding privacy and personal data protection. Even though the European Commission points out some of the key challenges of processing data for economic and market purposes (i.e., anonymisation, compatibility, minimisation), the complexity of these challenges is somehow under-estimated. These challenges can be grouped around the following questions any digital citizen may ask her/himself under EU law: which data about me are collected and for what purposes? Are data protected from unauthorised access and to what extent is control exercised upon the processing of my personal data?

Section 4 then considers these questions in the specific context of the Data Protection Reform package. Arguing that the digital citizen’s rights should be the main focus of the current debates around the GDPR, this Section underlines that Big Data, smart devices and the IoT reveal a series of potential gaps in the EU legal framework, in the following areas in particular: transparency and information obligations of data controllers; consent (including consent in case of repurposing); the need to balance public interest and the interests of data subjects for legitimising personal data processing; the regulation of profiling; and proper safeguarding of digital rights in case of data transfers to third parties and third countries.

In light of these findings, the Study concludes with key recommendations for the European Parliament and, in particular, the LIBE Committee responsible for the protection of natural persons with regards to the processing of personal data. These recommendations aim at ensuring that negotiations around the GDPR promote a strong and sustainable framework of transparency and responsibility in which the data subject’s rights are central.

In particular, the guiding principle of any exploitation of personal data should be driven by the requirement of guaranteeing respect for the Fundamental Rights (privacy and personal data protection) laid down in EU primary and secondary law (recommendations 1 & 2).

The role of data controllers in this perspective is central as they are legally required to observe a number of principles when they process personal data, compliance of which must be reinforced. The degree of information and awareness of data subjects must be of prime concern whenever personal data processing takes places, and the responsibility for protecting Fundamental Rights should be promoted along the data production chain and gather various stakeholders. Furthermore, the GDPR should ensure that individuals are granted complete and effective protection in the face of current and upcoming technological developments of Big Data and smart devices (recommendation 3).

The GDPR currently under discussion should in any case not offer less protection and guarantees than the 1995 Data Protection Directive, and users should remain in complete control of their personal data throughout the data lifecycle.

Finally, effective protection of individuals cannot be guaranteed solely by the adoption of a sound GDPR. It will also require a consistent review of the e-Privacy Directive (recommendation 4), an instrument that not only pursues the safeguarding of personal data protection but, more generally, aims to ensure this right and the right to respect for private life.

EU Provisional measures of Refugees Relocation: some progresses but still on a bumpy road…

by Emilio De Capitani

Yesterday, the Justice and Home Affairs Council thanks to Luxembourg Presidency endeavor has (finally!) taken an important decision to relocate 120,000 refugees from Greece, Italy and other Member States directly affected by the refugee crisis. From a political and Institutional point of view this is a big step forward and the Luxembourg Presidency should be praised to have asked for a vote notwithstanding the opposition of Hungary, the Czech Republic, Slovakia and Romania (and the abstention of Finland). The show down has become inevitable for several reasons. First and foremost because of the dimension of the migratory phenomenon even if it is hard to consider that it has taken the European Union by surprise as the dimension of the Sirian crisis should had been taken in account much more in advance …

But the real reason is that several countries (such as Germany, Austria, Slovenia,) have decided to re-establish the controls at the internal borders of the Schengen area which is an exceptional possibility explicitly foreseen in and regulated by the new art 23 of the Schengen Borders Code, in case of a serious threat to public policy or internal security.. However if the “exception” is triggered by too many countries is the general rule of the freedom of movement inside the Schengen area which is under threat and this risk to have an impact not only on the freedom of EU Citizens but on the internal market itself (which for national and European administrations is even more important of EU citizens rights..).

The decision has then been taken after painful discussions and under the growing pressure of the European Council (as it happened previously only in exceptional cases such as after September 11th..). What is worrying is that the Visegrad Countries which have been outvoted risk to challenge the text adopted before the Court of Justice. (according to EUOBSERVER the Czech interior minister Milan Chovane said his country’s willing to do so).

If this was the case the Court will be confronted to a text which from a legal and institutional point of view is messy, inconsistent and under some perspectives probably contrary to the Treaty. Just to mention some of these aspects it is appalling that a Council Decision pretend to establish a “lex specialis” which could “temporary” amend the Dublin Regulation (an act adopted under a different legal basis and in codecision).

Moreover the Decision as adopted yesterday is different from the one voted by the European Parliament some days ago so that, under a constant CJEU Jurisprudence the Council is under the obligation to re-consult the European Parliament on the latest modifications (such as the exclusion of Hungary from the mechanism…).

However the difficult path towards the implementation of a true EU solidarity and burden sharing in these policies (as foreseen by art 80 of the TFEU) is at least starting now…

ANNEX: THE TEXT OF THE COUNCIL DECISION (Council doc 12098/15 Interinstitutional File: 2015/0209 (NLE) BEWARE THE LEGAL LINGUISTIC REVISION IS STILL TO BE DONE ! COUNCIL DECISION (EU) 2015/… of … establishing provisional measures in the area of international protection for the benefit of Italy and Greece

Continue reading “EU Provisional measures of Refugees Relocation: some progresses but still on a bumpy road…”