Category: 1.1 News from the Area of Freedom, Security and Justice

Daily news from the Area of Freedom, Security and Justice.

Mostly Found via:
Statewatch – http://statewatch.org
Eu Logos Athena – http://eu-logos.org/
Euobserver – http://euobserver.com/
Presseurop – http://presseurop.eu
Euractiv – http://euractiv.com/
European Media Monitor – http://emm.newsbrief.eu/overview.html
Réseau Universitaire Européen Droit de l’Espace de Liberté, Sécurité et Justice – http://gdr-elsj.eu/

DATA RETENTION: A LANDMARK COURT OF JUSTICE’s RULING (4) .. will this saga continue and how ?..

FROM EUANALYSYSBLOG
by Professor Steve PEERS Tuesday, 8 April 2014

The data retention judgment: The CJEU prohibits mass surveillance

On July 7, 2005 a relative of mine started her journey to work on a London tube train. Within half an hour, bombs on that train left by terrorists exploded, in conjunction with three other bombs across London. Dozens of people died (although my relative was not injured).
Understandably, public concern about terrorist incidents, following on from the earlier outrages of 9/11 and the Madrid bombings, led to further EU anti-terrorist legislation.
In particular, the British Presidency of the EU Council made it a top priority to adopt legislation providing for retention of a large amount of communications data. But according to the Court of Justice of the European Union (CJEU), in a crucial judgment today, that legislation was essentially an over-reaction to these terrorist atrocities. The Court has effectively prohibited mass surveillance in the EU, and thus taken significant steps to entrench itself as the EU’s constitutional court.

Summary of the judgment

As discussed in detail by Chris Jones’ post on this blog (EUANALYSYSBLOG), the Directive requires Member States to require telecommunications service providers to retain significant amounts of data on the use of all forms of telecommunications by all individuals within the EU, for a period of between 6 months and 2 years. This data is collected for the use of law enforcement agencies as regards investigations into serious crime or terrorism, but there are no detailed rules in the Directive governing the access to and use of the data by those authorities.
The CJEU only found it necessary to address the question of the validity on the Directive in light of the Charter rights to privacy and data protection (Articles 7 and 8 of the Charter).

First of all, the Court unsurprisingly had no difficulty finding that the Directive interfered with the protection of those two rights. Its analysis focussed instead on whether such an interference could be justified.

The rules on justifying interferences with Charter rights are set out in Article 52 of the Charter. Any limitation upon Charter rights must be laid down by law, respect the essence of the right, and subject to the principle of proportionality, limit rights and freedoms only if it is necessary and genuinely meets public interest objectives and the rights and freedoms of others.
The Court easily found that there was a public interest justification (public safety) for the restriction of the Charter rights at issue.
It also found that the ‘essence’ of the rights was not affected, because (as regards the right to privacy) the content of communications was not recorded, and (as regards the right to data protection) certain data processing and data security rules had to be respected.

Therefore the key issues in the Court’s ruling were the proportionality of the interference with Charter rights.
The Court indicated that judicial review of the EU legislature’s discretion should be ‘strict’ in this case, applying factors such as the area of law concerned, the nature of the right, the nature and seriousness of the infringement and the objective pursued. Here, it followed from the nature of the right and the nature and seriousness of the infringement that the EU legislature’s discretion was reduced; the CJEU took no account expressly of the objective being pursued.

The first aspect of proportionality (the appropriateness of the interference with the right for obtaining the objective) was fulfilled, because the data concerned might be useful to investigations. However, the CJEU found that the Directive was problematic as regards the second facet: the necessity of the measure in question.
Crucially the Court ruled that the important objective of investigating serious crime and terrorism did ‘not, in itself’ justify data retention. So for the CJEU, the safety of the people is not the supreme law.
Its analysis proceeded by setting out the general importance of safeguards as regards the protection of privacy and data protection rights (building upon the case law of the European Court of Human Rights). These safeguards are even more necessary when data is processed automatically, with a risk of unlawful access.

Applying this test, the Court gave three reasons why the rules on data retention in the Directive were not strictly necessary.

First of all, the Directive had an extremely broad scope, given that it applied to all means of electronic communication, which have ‘widespread and growing importance’ in everyday life, without being sufficiently targeted.
Indeed, it ‘entails an interference with the fundamental rights of practically the entire European population’. In other words (the Court does not use the term), it amounts to mass surveillance.

Secondly, besides the ‘general absence of limits’ in the Directive, it failed to limit access to the data concerned by law enforcement authorities, and the subsequent use of that data, sufficiently precisely. In particular: it referred generally to ‘serious crime’ as defined in national law; it did not restrict the purpose of subsequent access to that data; it did not limit the number of persons who could access the data; and it did not control access to the data by means of a court or other independent administrative authority.

Thirdly, the Directive did not set out sufficient safeguards, as regards: the data retention period, for instance as regards the categories of data to be retained for the whole period; the protection of the data from unlawful access and use (here the CJEU criticises the possible limits on protection measures due to reasons of cost); the absence of an obligation to destroy the data; and the omission of a requirement to retain the data within the EU only.

Comments

The CJEU reached the same conclusion as the Advocate-General’s opinion, but for different reasons.
In the Advocate-General’s view, the Directive was invalid because it breached the ‘quality of law’ requirement applicable to interferences with Charter rights, having failed to establish sufficient safeguards relating to access to and use of the data. It also was disproportionate for failing to explain why storage periods of up to two years were necessary.
The Court’s ruling appears to go further, by ruling out mass surveillance in principle.

The opinion discussed some interesting and important issues that the Court does not directly address, in particular: the existence of a ‘quality of law’ requirement as regards breaches of the Charter; whether the EU or the Member States have responsibility for ensuring the satisfaction of that requirement in this case; and the complications of the ‘legal base’ issue, ie the awkward point that inserting safeguards relating to law enforcement authorities might go beyond the ‘internal market’ legal base of the legislation.
It might be deduced that the CJEU has a view on these issues: there is a ‘quality of law’ rule; the EU is responsible for upholding that requirement in this case; and the ‘legal base’ point is not a barrier to the EU adoption of rules regulating law enforcement authorities. But unfortunately, the Court did not expressly spell out its reasoning on these issues.
It is certainly peculiar that, having ruled previously that the Directive was validly based on EU internal market powers, the CJEU rules here that its interference with Charter rights is justified by the objective of public safety.

As for the reasoning which the Court did provide, as usual it was easy to find public interest objectives for the interference with rights.
The most important part of the reasoning is therefore the analysis of the interference with the ‘essence’ of the right, and of proportionality.
It is very significant that the Court makes clear that these are two different issues: even if the essence of a right is respected, legislation can be disproportionate. Earlier case law on restriction of rights often seemed to suggest that respecting the essence of rights was sufficient.

Another important aspect of the judgment is the development of a doctrine indicating when strict scrutiny of the EU legislature’s interference with fundamental rights should apply.
This is based upon Strasbourg case law, not the standards of national constitutional courts, which have of course addressed this issue in their own way.
Obvious questions arise as to whether the same standards should apply to national implementation of EU law, or to Charter rights not based upon the ECHR.

While many data protection specialists argue that there is a fundamental distinction between the right to privacy and the right to data protection, the Court’s judgment only reflects that distinction to a limited degree. It assesses separately whether there is an interference with Articles 7 and 8 of the Charter, and whether the essence of each right has been affected. However, it made no distinction between the rights when assessing the required intensity of judicial review, and linked the two rights together when assessing the proportionality of the interference with them.

Consequences of the judgment

First and foremost, the data retention Directive is entirely invalid.
The Court did not in any way rule that it could continue in force. So the immediate consequence is that we return to the status quo before 2005.
This means that Member States have an option, not an obligation, to retain data pursuant to the e-privacy Directive (see further Chris Jones’ post on the background to the data retention Directive). However, Member States’ exercise of this option will still be subject to the requirements set out in this judgment, since their actions will fall within the scope of the Charter, given that the e-privacy Directive regulates the issue of interference with telecommunications.

Would it be possible for the EU to adopt a new Directive on mandatory data retention? In other words, can the Directive in some way be ‘fixed’?

First of all, since the 2006 Directive is entirely invalid, the EU legislature has to start from scratch, rather than amend it.
Secondly, it is clear from the Court’s judgment that some form of mandatory data retention in order to combat serious crime and terrorism is acceptable from the perspective of the EU Charter.
How would such a new Directive differ from the measure the Court has just struck down?
The Court sets out unusually detailed guidelines for the legislature (and, in the meantime, for national legislature) in its judgment.

First of all, any new Directive would have to be in some sense targeted upon communication which has a particular link with serious crime and terrorism. Very simply, mass surveillance is an unjustifiable infringement of Charter rights.

Secondly, a new Directive would have to contain rules on: the definition of ‘serious crime’; the purpose of subsequent access to the data; limits on the number of persons who could access the data; and control of access to the data by means of a court or other independent administrative authority.

Thirdly, the new Directive would have to include stronger rules on the data retention period, for instance as regards the categories of data to be retained for the whole period, as well as the protection of the data from unlawful access and use. It would also have to contain rules on the absence of an obligation to destroy the data, and require that data be retained within the EU only. The Court did not rule on whether subsequent processing of the data in third States would be acceptable, but logically there must be some rules on this issue too.
Probably it would be simplest to extend the external processing rules in the main EU data protection legislation to this issue.

Depending on the timing of a proposal for a new Directive (assuming that there is one), it might possibly get mixed up with the conclusion of negotiations over main the main data protection package being negotiated by the EU institutions. Alternatively, if those negotiations have concluded, they will establish a template that the negotiation of the new Directive can take account of.

Final comments

The Court’s judgment can be seen in the broader context of continued revelations about mass surveillance.
Its reference to the retention of data by third States is a thinly-disguised allusion to the spying scandals emanating from the United States.
It also responds, sotto voce, to the very great concerns of national constitutional courts about this Directive, discussed in detail in Chris Jones’ post on this issue.

More broadly, the CJEU has seized the chance to give an ‘iconic’ judgment on the protection of human rights in the EU legal order. Time will deal whether the Digital Rights judgment is seen as the EU’s equivalent of classic civil rights judgments of the US Supreme Court, on the desegregation of schools (Brown) or criminal suspects’ rights (Miranda). If the Charter ultimately contributes to the development of a ‘constitutional patriotism’ in the European Union, this judgment will be one of its foundations.

DATA RETENTION: A LANDMARK COURT OF JUSTICE’s RULING (3) ..a contentious saga…

National legal challenges to the Data Retention Directive
by Chris Jones, Researcher for Statewatch

This post, which examines the numerous legal challenges against the EU’s Data Retention Directive at both national and EU level (not including today’s judgment), is the third post in a series examining the EU’s mandatory data retention legislation, which was struck down today by the Court of Justice of the European Union (CJEU). It is based on work undertaken by Statewatch as part of the SECILE project (Securing Europe through Counter-terrorism: Impact, Legitimacy and Effectiveness).

EU Court of Justice legal basis challenge

The first legal challenge to the Data Retention Directive came when Ireland, supported by Slovakia, asked the EU Court of Justice to annul the Directive on the grounds that it had the wrong legal basis. They argued that the correct legal basis for data retention resided “in the provisions of the EU Treaty concerning police and judicial cooperation in criminal matters,” rather than those on the internal market. The ECJ dismissed the case in February 2009, stating that:“Directive 2006/24… regulates operations which are independent of the implementation of any police and judicial cooperation in criminal matters. It harmonises neither the issue of access to data by the competent national law-enforcement authorities nor that relating to the use and exchange of those data between those authorities… “It follows that the substantive content of Directive 2006/24 is directed essentially at the activities of the service provides in the relevant sector of the internal market, to the exclusion of State activities coming under Title VI of the EU Treaty”.

Bulgaria

The first ruling on national laws transposing the Directive came from Bulgaria in proceedings launched by the NGO Access to Information Program. In December 2008 the country’s Supreme Administrative Court annulled an article of the transposing legislation permitting the Ministry of Interior “passive access through a computer terminal” to retained data, as well as providing access without judicial permission to “security services and other law enforcement bodies”. The court found that:“[T]he provision did not set any limitations with regard to the data access by a computer terminal and did not provide for any guarantees for the protection of the right to privacy stipulated by Art. 32, Para. 1 of the Bulgarian Constitution. No mechanism was established for the respect of the constitutionally granted right of protection against unlawful interference in one’s private or family affairs and against encroachments on one’s honour, dignity and reputation.”The court also found the legislation failed to make reference to other relevant laws – the Penal Procedure Code, the Special Surveillance Means Act and the Personal Data Protection Act – “which specify conditions under which access to personal data shall be granted.”

Hungary

In June 2008 the Hungarian Civil Liberties Union (HCLU or TASZ, Társaság a Szabadságjogkért) requested “the ex-post examination” by the Hungarian Constitutional Court of the amendment of Act C of 2003 on electronic communications, “for unconstitutionality and the annulment of the data retention provisions.”According to the HCLU, Act C “already comprised numerous restrictive data retention provisions prior to the directive. The only changes brought in by the amendments were the retention of Internet communications data and the elimination of the lax – but at least pre-defined – legal purposes of the data processing”. The HCLU argued that “the amendments completely disregarded the provisions of the directive [stating] that data should be ‘available for the purpose of investigation, detection and prosecution of serious crimes’.” Despite being filed in 2008, the case is yet to be heard. According to Fanny Hidvégi of the HCLU, this is because as of 1 January 2012 new restrictions were placed on submitting cases to the Constitutional Court, and “every pending case submitted by a person or institution which no longer has the right to do so were automatically terminated”. The HCLU has begun a new and lengthy procedure that requires the exhaustion of all other remedies before the Constitutional Court can examine the Hungarian data retention measures.

Romania

In October 2009, the Romanian Constitutional Court found that proposed national legislation implementing the Data Retention Directive violated Romanian constitutional provisions protecting freedom of movement; the right to intimate, private and family life; secrecy of correspondence; and freedom of expression. The court found that the government’s attempt to justify the mandatory retention of telecommunications data by invoking undefined “threats to national security” was unlawful. The Court also referred to the 1978 ECHR ruling in Klass v Germany, which stated that “taking surveillance measures without adequate and sufficient safeguards can lead to ‘destroying democracy on the ground of defending it’.”

In October 2011 the European Commission asked the Romanian government to bring forward new laws transposing the Directive, issuing a “reasoned opinion” under Article 258 of the TFEU, which carries the threat of full infringement proceedings at the European Court of Justice if the request is not met. A new law was duly drafted, but was rejected by the Romanian Senate. The law was heavily criticised in the media prior to the vote and the country’s Data Protection Authority had refused to endorse it, claiming that articles relating to the security services were “still vague”. Civil society organisations also opposed it and even the government refused to sponsor it, leaving the Minister of Communications and Information Society to propose it in his role as MP rather than minister. Strong support from the Minister of European Affairs fuelled criticism that it was motivated solely by the need to escape sanction by the European Court of Justice.

Ultimately the Senate vote was not decisive and the law continued its journey to the Chamber of Deputies, where at the end of May 2012 it was adopted with 197 votes for and 18 against, with many abstentions amongst the 332 deputies. There was no substantive discussion of fundamental rights issues in the Chamber of Deputies or the main two committees that debated the law and critics have argued that the provisions on access to retained data are even more problematic than the original statute. On 21 February 2013 the European Commission withdrew the infringement procedure that it had opened in 2011.

Cyprus

In February 2011 the Supreme Court of Cyprus ruled that aspects of the national transposing legislation breached the Cypriot constitution and case law on surveillance. The case was brought by individuals whose telecommunications data had been disclosed to the police in accordance with District Court orders. They argued that the laws underlying the orders were based (Articles 4 and 5 of Law 183(I) 2007, that sought to harmonise Cypriot law with the Directive), and therefore the District Court orders themselves violated their rights to privacy and confidentiality of communications. The Supreme Court found that petitioners had indeed been subject to a violation of their rights and annulled provisions it said went beyond the requirements of the Data Retention Directive. However, the legality of the Directive itself was not called into question.

Germany

Legislation transposing the Data Retention Directive into the Telecommunication Act and Code of Criminal Procedure was passed by the Bundestag on 9 November 2007 and entered into force on 1 January 2008. The day before, 31 December 2007, 35,000 German citizens (represented by the NGO AK Vorrat) filed a complaint against the legislation at the Federal Constitutional Court. On 2 March 2010 the Court ruled that the transposing provisions were a disproportionate interference with Article 10 (confidentiality of communications) of the Basic Law (Grundgesetz), and contravened legal standards on purpose limitation, data security, transparency and legal remedies.

However, the Court made no ruling on the actual Directive, stating that data retention is in principle proportionate to the aim of investigating serious crime and preventing imminent threats against life, body, freedom of persons, and the existence and security of the Federal Republic or one of its states. The Court found that the new domestic law failed to comply with legal standards on purpose limitation (restrictions on use of the retained data), data security, transparency and legal remedies.

In January 2011 the Ministry of Justice (MoJ) presented a paper proposing an alternative to data retention – a “quick freeze” system of limited data preservation for criminal investigations. The police and/or public prosecutors would issue a “quick freeze” order seeking access to metadata already held by telecommunications providers, for example for billing purposes. To actually access the “frozen”’ data would require the approval of a judge. In addition, the MoJ proposed an obligation for ISPs to store internet traffic data for seven days, allowing criminal investigators to identify persons behind (already known) IP addresses in particular in cases of child pornography. Criminal investigators would request the traffic and communications data via service providers without having direct access to these traffic data. This paper reflected proposals made in June 2010 by the Federal Commissioner for Data Protection, as well as the suggestions of more pragmatic privacy advocates.

More radical activists claim that any mandatory storage of communications data should be prohibited. The Interior Ministry rejected these proposals and insisted on full implementation of the Directive, arguing that the Constitutional Court had already shown that it is possible to implement the Directive and ensure individual privacy through high data security standards, including encryption and the “four eyes principle” (approval by at least two people) as prerequisite for accessing data and log files; strict purpose limitation; and the protection of professions whose confidentiality must be ensured.

The MoJ produced a “quick freeze” bill in April 2012 but continued opposition from the Interior Ministry meant that it was never tabled in Parliament. The Interior Ministry was unhappy with the length of the proposed freezing periods, demanding three months instead of the one month suggested by the Ministry of Justice. Moreover, the Interior Ministry wanted to include crimes such as fraud and hacking. The controversy continues and no new legislation has yet been introduced.

By this time the European Commission had initiated infringement proceedings and took its case to the European Court of Justice in July 2012. The Commission is seeking to impose a daily fine of €315,000.

Czech Republic

On 13 March 2011 the Czech Republic’s Constitutional Court declared national legislation implementing the Directive unconstitutional. It found that the retention period exceeded the requirements of the Directive, and that use of the data was not restricted to cases of serious crime and terrorism. “The national legislation lacked, according to the constitutional court, clear and detailed rules for the protection of personal data as well as the obligation to inform the person whose data has been requested.” As in Germany, the Court stated that it could not review the Directive itself, but noted there was nothing in principle preventing implementation in conformity with constitutional law.

A second Constitutional Court decision in December 2011 examined the procedures put in place for obtaining access to retained data and found the “procedure in question to be too vague, in breach of [the] proportionality rule (its second step) and thus unconstitutional due to interference with right to privacy and informational self-determination.” In the meantime the Czech government revised the implementing legislation with modifications that took account of the judgment.The NGO Iuridicum Remedium has lodged fresh proceedings against the revised legislation on the grounds that regulation remains inadequate and that the new decree could provide for the “monitoring of contents of Internet communications”.

Slovakia

In August 2012 a group of Slovakian MPs, supported by the European Information Society Institute, lodged a legal complaint against the legislation implementing the Data Directive. The complaint asks the Slovak Constitutional Court to examine whether the laws implementing the Directive and dealing with access by the authorities to retained data are compatible with constitutional provisions on proportionality, the rights to privacy and data protection, and the provision granting freedom of speech. It also argues that the measures infringe provisions guaranteeing privacy, data protection and freedom of expression in Slovakian human rights law, the European Convention on Human Rights and the Charter of Fundamental Rights of the European Union. The complaint has not yet been resolved.

Sweden

The European Commission has engaged in a lengthy battle to try to bring Sweden’s domestic legislation into line with the Directive. After the country missed the initial September 2007 deadline, the Commission brought infringement proceedings, with the European Court of Justice finding Sweden guilty of failing to fulfil its obligations in February 2010. A proposal for transposing legislation was put forward in December 2010 and adopted in March 2012. The new law should have taken effect in May 2012 but despite an overwhelming vote in favour of the new measures in the Swedish parliament (233 MPs voted in favour with 41 against and 19 abstaining), the Left Party and the Greens invoked a constitutional provision allowing the entry into force of new measures to be delayed by a motion of one sixth of the parliament’s members.

In May 2013, the European Court of Justice ordered Sweden to pay a €3 million fine for its delay in implementing the legislation. The Court rejected Swedish pleas regarding the domestic controversy over the implementation of the law:“As the Court has repeatedly emphasised, a Member State cannot plead provisions, practices or situations prevailing in its domestic legal order to justify failure to observe obligations arising under European Union law… The same is true of a decision, such as the one made by the Swedish Parliament, to which paragraph 8 of this judgment makes reference, to postpone for a year the adoption of the draft bill intended to transpose that directive.”

The Court of Justice of the European Union (CJEU)

The most serious challenge to the implementation of the Data Retention Directive has come from joined cases brought by the NGO Digital Rights and the plaintiffs in a case referred from the Austrian Constitutional Court. The Advocate General’s opinion on the case, published in December 2013 following a hearing in July, proposed that the Court declare the Directive as a whole incompatible with EU Charter articles 52(1) (limitations on rights “must be provided for by law and respect the essence of those rights and freedoms”) and 7 (right to privacy). The case focuses on the compatibility of the Directive with Articles 7 (respect for private and family life) and 8 (protection of personal data) of the European Union Charter of Fundamental Rights. At the hearing the representatives of those who brought the cases argued that the Directive is fundamentally incompatible with the Charter and that there is still no evidence to demonstrate that its necessity or proportionality.

On behalf of Austrian privacy group AK Vorrat, Edward Scheucher argued that:“[T]he cumulative effect of fundamental rights restrictions need to be taken into consideration when judging the legitimacy of a single measure. Given the revelations regarding PRISM, this cumulative effect now clearly provides a different result [than] at the time when the German [Constitutional] Court took its decision [to annul certain provisions of German transposing legislation]. Furthermore, he stated that the Austrian implementation of the directive clearly showed that a Charter-compatible national implementation of the Data Retention Directive is not possible. This argument is bolstered by the fact that the main author of the Austrian implementation is among the 11,139 Austrian plaintiffs who challenged data retention before the Austrian Constitutional Court.”

In response to requests for evidence demonstrating the necessity of the Directive, the Austrian and Irish governments presented new statistics on the use of retained data at the hearing. Also arguing in favour of the Directive were representatives of Italy, Spain and the UK, as well as the Commission, the Council and the Parliament. However, the Directive’s advocates still “had to acknowledge a lack of statistical evidence”, with the UK admitting that “there was no ‘scientific data’ to underpin the need” for data retention. Judge Thomas von Danwitz, the Court’s main rapporteur for the hearing, asked for information that had led to the adoption of the Directive in 2006, given that “the Commission in 2008 claimed not to have enough information for a sound review”. The Council’s lawyers, meanwhile, “implored the Court not to take away instruments from law enforcement”.

Ultimately, Advocate-General Cruz Villalón concluded that the Court answer the cases in the following way:“(1) Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC is as a whole incompatible with Article 52(1) of the Charter of Fundamental Rights of the European Union, since the limitations on the exercise of fundamental rights which that directivecontains because of the obligation to retain data which it imposes are not accompanied by the necessary principles for governing the guarantees needed to regulate access to the data and their use.“(2) Article 6 of Directive 2006/24 is incompatible with Articles 7 and 52(1) of the Charter of Fundamental Rights of the European Union in that it requires Member States to ensure that the data specified in Article 5 of that directive are retained for a period whose upper limit is set at two years.”

Today’s Grand Chamber judgment, which is analysed in Steve Peers’ separate post, ultimately agreed with this recommendation. The EU has finally been forced to redraft its mandatory data retention rules.

DATA RETENTION: A LANDMARK COURT OF JUSTICE’s RULING (2) ..a bit of history…

Monday, 7 April 2014
Background to the EU Data Retention Directive
By Chris Jones, Researcher for Statewatch

As the fallout from the Snowden leaks rumbles on, the Court of Justice of the European Union (CJEU) will today decide a case (Digital Rights Ireland, Seitlinger and Others that could spell the end for the EU’s Data Retention Directive in its current form. The Directive mandates the mass storage by private companies of individuals’ telecommunications data, in case it is required by law enforcement authorities to investigate cases of serious crime or terrorism.

The judgment follows the handing down of a critical opinion by Advocate General Cruz Villalón in December 2013, which proposed that the Court declare the Directive as a whole incompatible with EU Charter articles 52(1) (limitations on rights “must be provided for by law and respect the essence of those rights and freedoms”) and 7 (right to privacy). This post, based on work undertaken by Statewatch as part of the SECILE project (Securing Europe through Counter-terrorism: Impact, Legitimacy and Effectiveness), outlines the history of the 2006 Data Retention Directive; the key points of the legislation; and its problematic national implementation, which has been the subject of legal challenges across Europe. Two further posts will examine the implementation of the Directive and the challenges to it.

The Data Retention Directive: a brief overview

The 2006 Data Retention Directive obliges Member States to ensure that telecommunications and Internet Service Providers (ISPs) retain various types of data generated by individuals through the use of landline phones, fax machines, mobile phones, and the internet, “in order to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime”.The data that must be retained are:

The source of a communication;
The destination of a communication;
The date, time and duration of a communication;
The type of a communication;
Users’ communication equipment or what purports to be their equipment; and
The location of mobile communication equipment.

The retention period is a minimum of six months and a maximum of two years.
Member States decide exact duration as well as the conditions under which it may be accessed.

The European Data Protection Supervisor has called the Directive “without doubt the most privacy-invasive instrument ever adopted by the EU in terms of scale and the number of people it affects,” and it ranks among the most controversial pieces of counter-terrorism legislation the EU has ever adopted. Fierce debate as to its legitimacy and effectiveness has raged since the earliest stages of its drafting to the present day.

The policy-making process

According to the preamble of the Data Retention Directive, the terrorist attacks in Madrid in March 2004 and in London in July 2005 “reaffirmed… the need to adopt common measures on the retention of telecommunications data as soon as possible.” However, law enforcement agencies had been seeking data retention legislation long before the destruction of the World Trade Centre on 11 September 2001, and the Directive does not limit data retention to combating terrorism.

Demands for data retention can be traced back to the “International Law Enforcement and Telecommunications Seminars” (ILETS) held at the FBI academy in Quantico, Virginia, which commenced in 1993 with the aim of developing global “interception requirements” – standards for telephone-tapping by police and security agencies to be provided in all telephone networks.
Following the first ILETS meeting, the very first EU Council of Justice and Home Affairs (JHA) Ministers adopted a Resolution in November 1993 – which was not published – calling on experts to compare the needs of the EU vis-à-vis the interception of telecommunications “with those of the FBI”.

A second EU Resolution based on ILETS’ work was adopted in January 1995 and introduced obligations on telecommunications companies to cooperate with law enforcement agencies in the “real-time” surveillance of their customers. This was never actually discussed by the Council of Ministers. It was adopted instead by “written procedure” (where legislative texts are circulated among ministries and adopted if there are no objections). The Resolution, which was not published in any form until November 1996, formed the basis of the provisions on the interception of telecommunications in the EU Convention on Mutual Legal Assistance of 2000.
ILETS continued every year and in 1999 identified a new problem. Valuable “traffic data” – particularly mobile phone and internet usage records – were being erased by service providers after customers had been billed, a particularly acute issue in the EU because of the recently enacted EC Directive on privacy in telecommunications, which obliged service providers to delete traffic data after its use for billing purposes (usually within three months).
ILETS thus introduced the principle of mandatory data retention regimes that would oblige service providers to keep data for much longer periods. This demand then surfaced in other intergovernmental fora concerned with police and judicial cooperation, such as the G8. The American Civil Liberties Union, Privacy International and Statewatch would later dub this process “policy laundering”: “the use by governments of foreign and international forums as an indirect means of pushing policies unlikely to win direct approval through the regular domestic political process.”

In 2000 the EU decided to update the aforementioned 1997 Directive on privacy in telecommunications to take into account “new technologies” and proposed what would become known as the “e-Privacy” Directive. The draft Directive proposed scrapping the clause obliging service providers to delete traffic data after billing use. As a First Pillar matter (dealing with the functioning of the internal market), the European Parliament had what was then a rare vote on what was effectively a Justice and Home Affairs or Third Pillar issue (police surveillance). Following an extensive campaign by privacy advocates the proposal was rejected. However in 2002, with the events of 11 September 2001 providing a fresh justification, a left-right alliance of the European Socialist Party (PSE) and the European People’s Party (PPE) agreed the e-Privacy Directive and the “data retention amendment”, with the liberals, greens and left parties opposed. This paved the way for Member States to introduce their own optional national data retention regimes.
Yet no sooner was the ink dry on the e-Privacy Directive than a confidential draft Framework Decision on the compulsory retention of subscriber and traffic data for 12-24 months across the EU was circulated among Member States and leaked by Statewatch.
Following widespread criticism of the proposal in European media, the then-Danish presidency of the EU was moved to issue a statement saying that the proposal was “not on the table”.
If not ‘on the table’, the proposal appears to have remained close at hand – following the Madrid train bombings in March 2004, the ‘EU Declaration on combating terrorism’ endorsed the principle of mandatory data retention across the EU.
One month later the UK, France, Sweden and Ireland submitted a revised draft Framework Decision on data retention to the Council. By now, a majority of EU Member States had also introduced national data retention regimes. The EU proposal suffered another major setback when Statewatch published the confidential legal advice of the EU Council and Commission Legal Services, both of which had been withheld from MEPs and the public despite stating that the Framework Decision was unlawful because it had the wrong legal basis. Data retention, said the EU’s lawyers, was a First Pillar issue because it regulated the activities of service providers in the single market.

The European Commission, despite previously opposing data retention, redrafted the proposal as a Directive. This complicated things further. Whereas the European Parliament was only consulted on the draft Framework Decision, with the EU Council free to ignore its opinion, it would now enjoy full powers of “co-decision”. Moreover, during the consultation process on the Framework Decision, the Parliament had voted to reject mandatory data retention because it was “incompatible with Article 8” of the ECHR (protection of personal data).

However, between the defeat of the proposal for a Framework Decision and the publication of the proposal for a Directive, the July 2005 London tube bombings happened. These were used as a fresh justification for an EU data retention law, although the UK prime minister suggested at the time that “all the surveillance in the world” could not have prevented the attacks.

The UK then used its presidency of the EU Council to impose a deadline of the end of 2005 for the European Parliament to agree the measure, with Charles Clarke, UK Secretary of State, lecturing the EP on the need to adopt the proposal. Home Office officials were reported to have told MEPs in private that if parliament failed to do this they “would make sure the European Parliament would no longer have a say on any justice and home affairs matter.”
Led by Privacy International and the European Digital Rights Initiative, 90 NGOs and 80 telecommunications service providers wrote to MEPs, imploring them to reject the measure.
Despite their efforts, the EP finally agreed the measure on 14 December 2005, with another PSE-PPE alliance reversing the position on the draft Framework Decision that the parliament had taken just eight months earlier. The Directive completed its passage through parliament following a single reading, meeting the UK’s demands on the timeframe.
The Council of the EU adopted the legislation by qualified majority, with Ireland and the Slovakia voting against, and the Directive passed into law in March 2006.

Two further observations are relevant to any substantive consideration of the policy-making process.
The first concerns the role of the UK government, which took its attempts to enforce data retention to EU institutions after it had been prevented from a domestic mandatory data retention regime by the houses of parliament. In what appears to be a clear case of “policy laundering”, the subsequent EU Directive, championed by the UK government, was binding on the UK and implemented by statutory instrument, in the form of the Data Retention (EC Directive) Regulations 2007 and 2009.

The second observation concerns the role played by the US government in pushing for mandatory data retention in Europe, bilaterally in its discussions with the European Commission and EU Presidency, and in multilateral fora like the G8. This is noteworthy because at that time there were no corresponding powers in the USA, nor any intention to introduce them.
In place of blanket “data retention”, US law enforcement and security agencies are obliged to seek “preservation orders” from special surveillance courts.
However, recent leaks such as that of the FISA court order imposed on Verizon, demonstrate that US agencies and their special “surveillance court” have interpreted these principles so widely as to cover entire telephone networks and all of their users.

Nevertheless, a more principled implementation of such a regime would be more privacy-friendly than the EU’s current blanket approach.
Opposition to the Data Retention Directive in Europe included advocacy from civil society organisations for the development of this model as an alternative, with judicial supervision to try and ensure that access to private data is necessary and legitimate. This is still the preferred option of the Ministry of Justice in Germany, where implementation of the Directive has been highly controversial and the subject of a Constitutional Court ruling that demanded its redrafting.

DATA RETENTION: A LANDMARK COURT OF JUSTICE’s RULING (1)

SOURCE : EUROPEANLAWBLOG
Written by Orla Lynskey

JOINED CASES C-293/12 AND 594/12 DIGITAL RIGHTS IRELAND AND OTHERS: THE GOOD, THE BAD AND THE UGLY

In its eagerly anticipated judgment in the Digital Rights Ireland case, the European Court of Justice held that the EU legislature had exceeded the limits of the principle of proportionality in relation to certain provisions of the EU Charter (Articles 7, 8 and 52(1)) by adopting the Data Retention Directive. In this regard, the reasoning of the Court resembled that of its Advocate General (the facts of these proceedings and an analysis of the Advocate General’s Opinion have been the subject of a previous blog post). However, unlike the Advocate General, the Court deemed the Directive to be invalid without limiting the temporal effects of its finding. This post will consider the Court’s main findings before commenting on the good, the bad and the ugly in the judgment.

The Court’s Findings

In reaching this conclusion, the Court reasoned as follows. It first narrowed the multiple questions referred by the Irish and Austrian courts down to one over-arching issue, whether the Data Retention Directive is valid in light of Articles 7, 8 and 11 of the Charter (setting out the rights to privacy, data protection and freedom of expression respectively). It then conducted its assessment in three parts.

First, it examined the relevance of these Charter provisions with regard to the validity of the Data Retention Directive. Although the Court recognised the potential impact of data retention on freedom of expression, it chose not to examine the validity of the Directive in light of Article 11 of the Charter. It noted that the Directive must be examined in light of Article 7 as it ‘directly and specifically affects private life’ and in light of Article 8 as it ‘constitutes the processing of personal data within the meaning of that article and, therefore necessarily has to satisfy the data protection requirements arising from that article’[29].

Second, it considered whether there was an interference with the rights laid down in Articles 7 and 8 of the Charter. It noted that the Data Retention Directive derogates from the system of protection set out in the Data Protection Directive and the E-Privacy Directive [32]. It cited Rundfunk as authority for the proposition that an interference with the right to privacy can be established irrespective of whether the information concerned is sensitive or whether the persons concerned have been inconvenienced in any way [33]. The Court therefore held that the obligations imposed by the Directive to retain data constitutes an interference with the right to privacy [34] as does the access of competent authorities to that data [35]. The Court also held that the Directive interferes with the right to data protection on the mystifyingly simplistic grounds that ‘it provides for processing of personal data’ [36]. It observed that these interferences were both wide-ranging and particularly serious [37].

The Court then, thirdly, assessed whether these interferences with the Charter rights to privacy and data protection were justified. According to Article 52(1) of the Charter, in order to be justified limitations on rights must fulfil three conditions: they must be provided for by law, respect the essence of the rights and, subject to the principle of proportionality, limitations must be genuinely necessary to meet objectives of general interest.
The Court held that the essence of the right to privacy was respected as the Directive does not permit the acquisition of content data [39] and the essence of the right to data protection was respected as the Directive requires Member States to ensure that ‘appropriate technical and organisational measures are adopted against accidental or unlawful destruction, accidental loss or alteration of data’ [40].
With regard to whether the interference satisfies an objective of general interest, the Court distinguished between the Directive’s ‘aim’ and ‘material objective’: it noted that the aim of the Directive is to harmonise Member States’ provisions regarding data retention obligations while the ‘material objective’ of the Directive is to contribute to the fight against serious crime [41].
The Court observed that security is a right protected by the EU Charter and an objective promoted by EU jurisprudence [42]. It therefore held that the Data Retention Directive ‘genuinely satisfies an objective of general interest’ [44] and proceeded to analyse the proportionality of the Directive.

The Court effectively adopted a two-pronged proportionality test, considering whether the measure was appropriate to achieve its objectives and did not go beyond what was necessary to achieve them [46].
Applying the ECtHR’s Marper judgment by analogy, it noted that factors such as the importance of personal data protection for privacy and the extent and seriousness of the interference meant the legislature’s discretion to interfere with fundamental rights was limited [47-48]. It held that the data retained pursuant to the Directive allow national authorities ‘to have additional opportunities to shed light on serious crime’ and are ‘a valuable tool for criminal investigations’ [49]. Therefore, it found that the Directive was suitable to achieve its purpose.

With regard to necessity, it noted that limitations to fundamental rights should only apply in so far as is strictly necessary [52] and that EU law must lay down clear and precise rules governing the scope of limitations and the safeguards for individuals [54]. It held that the Directive did not set out clear and precise rules regarding the extent of the interference [65]. It highlighted several elements of the Directive which fell short in this regard.
By applying to all traffic data of all users of all means of electronic communications the Directive entailed ‘an interference with the fundamental rights of practically the entire European population’ [56] and did not require a relationship between the data retained and serious crime or public security [58-59].
Moreover, no substantive conditions (such as objective criterion by which the number of persons authorised to access data can be limited) or procedural conditions (such as review by an administrative authority or a court prior to access) determined the limits of access and use to the data retained by competent national authorities [60-62]. Nor did the Directive determine the time period for which data are retained on the basis of objective criteria [64-65].

The Court also held that the Directive did not set out clear safeguards for the protection of the retained data. This finding was supported by the Court’s observation that the rules in the Directive were not tailored to the vast quantity of sensitive data retained and to the risk of unlawful access to these data [66]. Rather, the Directive allowed providers to have regard to economic considerations when determining the technical and organisational means to secure these data [67]. Moreover, the Directive did not specify that the data must be retained within the EU and thus within the control of national Data Protection Authorities [68]. For these reasons, the Directive was declared invalid by the Court [69].

The Good, the Bad and the Ugly

The Good The judgment is to be welcomed for its end result – the invalidity of the Directive – as well as for many other reasons. It is a victory for grassroots civil liberties organisations and citizen movements: the preliminary references stemmed from actions taken by Digital Rights Ireland – an NGO – and just under 12,000 Austrian residents. More of these types of initiatives are needed in order to assure effective privacy and data protection. From a more substantive perspective, the judgment also recognises the dangers posed by aggregated meta-data – that it may ‘allow very precise conclusions to be drawn concerning the private lives’ of individuals [27] – and by data retention more generally – that it ‘is likely to generate in minds of the persons concerned the feeling that their private lives are the subject of constant surveillance’[37]. It also acknowledges that such data retention may have a chilling effect on individual freedom of expression [28].

The Bad Nevertheless, some aspects of the judgment are less welcome. Most notably here, the Court glosses over the fact that it assesses the proportionality of the Directive in light of its ‘material objective’ – crime prevention – rather than its stated objective – market harmonisation. This sits uncomfortably with the Court’s finding in Ireland v Council that the Directive was enacted on the correct legal basis as its predominant purpose was to ensure the smooth functioning of the EU internal market. The Court also incorrectly applies Article 8 of the EU Charter. Not only does it consider that there is an interference with this right every time data are processed [36], it also fails to consider how the application of this right can be applied to a piece of legislation which pursues law enforcement objectives. The Data Protection Directive excludes data processing for law enforcement purposes from its scope (Article 3(2)) and the right to Data Protection should, pursuant to Articles 51(2) and 52(2) of the Charter, be interpreted in light of and reflect the scope of the Directive. This conundrum is conveniently overlooked by the Court.

And the Ugly However, the most disappointing element of the judgment, like the Opinion of the Advocate General, is that it does not query the appropriateness of data retention as a tool to fight serious crime [49]. Given the prominence of this issue in both the EU and the US in the post-PRISM period, empirical evidence is needed to justify this claim.

Written by Orla Lynskey Posted in EU constitutional law, Fundamental rights, General, Internal Market, Proportionality and Subsidiarity Tagged with article 7 Charter, article 8 Charter, data retention directive, Directive 2002/58/EC, directive 2006/24/EC, Joined Cases C-293/12 and 594/12 Digital Rights Ireland ltd and Seitlinger and others, personal data, Privacy, proportionality, right to data protection
– See more at: http://europeanlawblog.eu/?p=2289#more-2289

The new EU directive on Confiscation : a good (even if still prudent) starting point for the post-Lisbon EU strategy on tracking and confiscating illicit money

(Original version : italian)

by Gabriella Arcifa

Foreword

According to UN estimates the total amount of criminal proceeds generated in 2009 is around $2.1 trillion; however less than 1% of it are frozen and confiscated, proving that dirty money remains in the criminals’ pockets. In a globalized financial world, money laundering is an essential element of facilitate corruption, organized crime, and terrorism, and affect competition with law abiding economy. Tracking and recovering illicit money has then become since the ’90 a political priority at international level. Since then the international acquis is growing steadily. Suffice to remember :

a) the 1990 Council of Europe Convention on laundering, search, seizure and confiscation of the proceeds from crime, of 1990,

b) the 2000 UN Convention against Transnational Organised Crime ;

c) the 2003 United Nations Convention against Corruption (Articles 52-59, which to date has been ratified by the European Union and 23 Member States),

d) the 2008 Council of Europe Convention on laundering, search, seizure and confiscation of the proceeds of crime and on the financing of terrorism (CETS 198), (to date signed by 19 EU Member States and the European Union, and ratified by 11 Member States)

d) the 2010 OECD Financial Action Task Force (FATF) recommendations on Confiscation and Asset recovery (Recommendations 3, 4 and 38)

At European Union level, after the adoption in 1999 of the Tampere European Council Conclusions, a first legislative text on confiscation has been adopted on July 2001: the Framework Decision 2001/500/JHA However it soon appeared soon ineffective because of the MS too wide marge of discretion. It was then soon replaced by the Framework Decision 2005/212/JHAof 24 February 2005 on Confiscation of Crime-Related Proceeds, Instrumentalities and Property and by the F ramework D ecision 2006/783/JHA on mutual recognition of the confiscation orders. Again, even these texts didn’t reach their objective because of the persisting substantial differences among the MS’ legislation so that there was an high number of decisions opposing the confiscation orders issued by another EU MS[i]. To overcome these problems in 2008 the Commission proposed a more ambitious strategy with its Communication “Proceeds of organised crime – Ensuring that ‘crime does no pay’ (COM(2008) 766 final).

However it is only after the entry into force of the Lisbon Treaty and the adoption of the Stockholm Program by the European Council on December 10 2009 that it has been possible to adopt at qualified majority this kind of measures by paving the way to more ambitious common standards.

The new strategy has been endorsed by the 2010 Council Conclusions on Confiscation and Asset Recovery which made reference also to not-conviction-based confiscation procedures[ii] and in the Commission 2010 Communication The EU Internal Security Strategy in Action[iii]” as well as in the 2011 “anti-corruption package” submitted to the European Parliament and the Council in 2011.

Since then tracking the illicit money has become the common objective of several EU legislative measures recently examined by the European Parliament and dealing with

– the protection of EU financial interests

-,the revision of the anti-money laundering directive and the exchange of information linked with the transfer of funds

– the freezing and confiscation of criminal assets.

The new Directive on Confiscation

On March 14 the EU Council of Ministers has adopted the new directive on the freezing and confiscation of the proceeds of crime in the EU (only Poland voted against and UK and DK did’nt take part to the vote. The text was agreed with the European Parliament which adopted its position on February 25 (only EFD group voted against – see here).The agreement has been welcomed by many but concerns have also been raised (for instance by the European Criminal Bar Association – ECBA) which has considered that the new legislation could have an impact on protection of fundamental rights and against the proportionality principle.

The legal basis of the new Directive are art. 82.2 and 83 p. 1 of the TFUE so that it defines the minimum rules to be applied in the EU MS when “..freezing property with a view of possible later confiscation and confiscation of property, recommending general principles for the management and disposal of the confiscation objects” [iv].

The new directive has at least the merit to establish a clearer legal framework which can strengthen the judicial cooperation between the EU MS. That having been said it is worth noting that the initial scope of the draft Directive as submitted by the Commission has been significantly reduced during the negotiations between the European Parliament and the Council.

To better understand the dynamics of the interinstitutional negotiation in the following paragraphs the initial negotiation mandate adopted by the Parliamentary Committee (draft report A7-0178/2013 ) is juxtaposed with the final text as adopted by the Plenary (and by the Council). The following aspects require a particular attention :

– the scope

– the definition of proceeds and instrumentalities related to the criminal offence;

– the regime of confiscation;

– the eligibility and the meaning of the “extended confiscation powers”

– the conditions to admit a confiscation from a third party;

Continue reading “The new EU directive on Confiscation : a good (even if still prudent) starting point for the post-Lisbon EU strategy on tracking and confiscating illicit money”

EP STUDY : NATIONAL CONSTITUTIONAL AVENUES FOR FURTHER EU INTEGRATION

This study was requested by the European Parliament’s Committees on Legal Affairs and on Constitutional Affairs. It investigates national constitutional limits to further EU integration and explores ways to overcome them. It includes an in-depth examination of the constitutional systems of 12 Member States (Croatia, the Czech Republic, Estonia, Finland, France, Germany, Hungary, Ireland, Italy, the Netherlands, Poland, and the United Kingdom) and a bird’s eye view of all Member States. EU integration can be advanced by avoiding substantive constitutional obstacles in various ways. Overcoming the substantive obstacles requires managing national procedural constitutional hurdles. This is possible to the extent that the required broad political consensus exists.

AUTHOR(S) : Mr Leonard F.M. BESSELINK, Mrs Monica CLAES, Mrs Šejla IMAMOVIû, Mr Jan Herman REESTMAN.
This document is available on the Internet

EXECUTIVE SUMMARY

1. The central research question of this study is whether, and to what extent, national constitutions provide guidance for further European integration and reversely how the latter can take place in full respect for national constitutional identities.

2. The research involved an in-depth analysis of a representative selection of Member States: Croatia, the Czech Republic, Estonia, Finland, France, Germany, Hungary, Ireland, Italy, the Netherlands, Poland, and the UK; and a bird’s eye view of all Member States. The study conducts a cross-national comparative analysis of the national constitutional approaches to EU integration, on the basis of which some final conclusions are offered.

3. This study deals with the relationship between the EU and national constitutions mainly from a national perspective. But there is also another side of the story, taking the EU perspective.
The EU Treaties (TEU and TFEU) acknowledge the central role of national constitutions, for instance when they require ratification by all the Member States ‘in accordance with their respective constitutional requirements’ for their entry into force, for their amendment and for the accession of new Member States. This presumably implies more than a mere procedural rule and acknowledges that the Treaties should also substantively be in accordance with national constitutions, or at least, it grants the Member States the opportunity, if their constitution so requires, to ensure that they do not enter into Treaties which would be unconstitutional.
On a more general level, the EU expects its Member States to comply with the common fundamental constitutional values that all Member States share, and which also apply to the European Union (Arts. 2 and 7 TEU). More specifically with respect to fundamental rights protection, the Treaty, the EU Charter of Fundamental Rights and the CJEU case law explicitly seek to connect EU human rights to the common constitutional traditions of the Member States. Yet, under the Treaties, the EU is not only bound to respect the common constitutional values of the Member States.
In addition, Article 4(2) TEU obliges the Union to respect ‘their national identities, inherent in their fundamental structures, political and constitutional, inclusive of regional and local self-government’.
Accordingly, if the Union should fail to respect these national identities as inherent in their fundamental constitutional and political structures, it would infringe not only those identities, but also the Treaty obligation to respect them. Whether this is indeed the case is, as a matter of EU law, to be decided ultimately by the Court of Justice of the Union, and not unilaterally by the Member States.
In addition, the Union must, under Article 4(2) TEU, respect the Member States’ essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security. In particular, national security remains the sole responsibility of each Member State.
The Treaty thus recognises that there are ‘essential State functions’ which remain with the Member States and which the EU must respect.
What exactly these functions are is not clear, beyond those mentioned in the provision.
On the other hand, and despite the central role of national constitutions in the EU constitutional edifice, Member States cannot invoke their national constitutions to escape compliance with EU law before the Court of Justice of the European Union. And even before national courts, national constitutional law should not, as a matter of EU law, take priority over conflicting provisions of national law.
Indeed, the principle of primacy of EU law,1 which is firmly settled in the case law of the CJEU, and has been confirmed in Declaration 17 annexed to the TEU, applies to national constitutional law as well. With respect to fundamental rights, more specifically, Article 53 of the Charter does not lead to a different conclusion.

4. Turning the perspective to national constitutions, it can be said that, in general, constitutions generally perform the four main functions of
* constituting the polity, which may be understood as expressing the basic social contract;
* organising and structuring the exercise of public authority and dividing powers between the various branches;
* limiting the exercise of public authority, which also includes fundamental rights protection of individuals and
* expressing common values of society and/or carrying its ‘national identity’.
As power-organizing tools, two of the main functions of constitutions go in different directions.
One is the enabling function of constitutions: constitutions constitute the institutions which are to exercise public authority and empower these institutions.
A second function is associated with ‘constitutionalism’ in a narrow sense and concerns the limiting function of constitutions: constitutions limit the exercise of public authority, for instance via human rights and a division of powers.
These different functions of a constitution are also reflected with regard to EU integration: national constitutions help to enable, and limit.

5. In the context of participation in the EU, the enabling function of constitutions is illustrated by those constitutional provisions which allow for a ‘limitation of sovereignty’ or a ‘transfer of sovereign powers’ to the EU.
However, national constitutions not only enable, but also set limits to further EU integration.
Membership of the European Union challenges the national constitutions in various ways: powers, which under the constitution have been attributed to national bodies, are transferred to the EU, and hence they are exercised differently from the way it was intended under the national constitution.
The EU is, as such, not bound by those national constitutions, but does indeed require the Member States to apply EU law even if it should infringe the national constitution.
Accordingly, the supremacy of the Constitution itself is challenged.
Seen in this light, it should come as no surprise that many Member States, while having adapted their constitutions to allow for membership and facilitate it, have at the same time retained constitutional limits and reservations, and impose conditions on EU law.
Moreover, constitutions are not only often considered to be expressions of the will of the people to form a polity (political autonomy) and to be governed under the constitution, but many constitutions also legally and judicially protect this foundational will.
This may take different forms, for instance by protecting the sovereignty of the state, statehood itself or the national nature of democracy, or a combination of these.

6. To put the constitutional obstacles to further EU integration in proper perspective, the report draws two main distinctions.
The first concerns a distinction between further integration under the current EU treaty framework and further integration by means of new (EU amendment) treaties.
The second distinction is that between substantive and procedural constitutional obstacles.
Generally, the substantive constitutional obstacles can be overcome by the adoption of a treaty (amendment), by the adoption of a constitutional amendment or by a combination of both.
For the adoption of such amendments, national procedural constitutional hurdles have to be taken.
Continue reading “EP STUDY : NATIONAL CONSTITUTIONAL AVENUES FOR FURTHER EU INTEGRATION”

Transparency in the EU : the distance between principles and Institution’s practices is widening up..

By Emilio De Capitani

As clearly explained in the previous post (Henri Labayle study on Access to documents) Transparency and good administration have become a core element of the post-Lisbon Constitutional Framework (1) However, notwithstanding the recurrent rhetoric declarations and promises in these pre-electoral days by several political figures at European and national level, four years after the entry into force of the Treaty and of the Charter the situation is even worse than before.
It is then more than likely that the the best supporters of the Eurosceptic movements are in these days the EU institutions and the Member States which are still blocking the reform of the EU rules on access to documents and whose daily practices are often contrary to the Treaties, the legislation into force, the ECJ jurisprudence and probably their own internal rules

A dead end for the rules on access to documents (Regulation 1049/01) ?

The EU legislative framework on access to documents dates back to 2001 when Regulation 1049/01 was adopted. It was against the unwillingness of the Commission and of several Members States but it was a success because of a (temporary) strong political majority in the European Parliament, a skilled Swedish Council Presidency and clear support by the civil society.

However in the following years notwithstanding a growing support by the European Court of Justice Jurisprudence the Council and Commission practice has tried to rebuild the previous opaque practices. Paradoxically the turning point has been after the groundbreaking “Turco” Case (C-39/05 P and C-52/05 P Sweden and Turco v Council and Commission, judgment of 1 July 2008) by which the Court considered that openness “contributes to strengthening democracy by enabling citizens to scrutinise all the information which has formed the basis for a legislative act. The possibility for citizens to find out the considerations underpinning legislative action is a precondition for the effective exercise of their democratic rights”(Sweden and Turco v Council, paragraph 46). In this perspective the Court of justice considered that it was also admissible to have access even to the Institution’s legal service opinions notably when dealing with the soundness of legislative works (2).
Continue reading “Transparency in the EU : the distance between principles and Institution’s practices is widening up..”

EU gives US six months to come clean on visa policy

Published on EurActiv (http://www.euractiv.com)

Source URL: http://www.euractiv.com/justice/eu-gives-usa-deadline-reciprocat-news-533275

Published: 05 February 2014

EXCLUSIVE / The European Commission has told the United States to lift visa requirements on Poland, Romania, Bulgaria, Cyprus and Croatia, whose citizens still need an entry permit to travel to the country.

Background

Back in 2008, when the nationals of twelve EU countries were subject to the visa requirement to travel to the US, the Commission warned that it may force American diplomats to apply for visas to travel to the European Union.

At that time, nationals of Bulgaria, the Czech Republic, Estonia, Greece, Cyprus, Latvia, Lithuania, Hungary, Malta, Poland, Romania and Slovakia were excluded from the US Visa Waiver Programme, which allows visa-free travel. Washington has been refusing to grant visa-free access to US territory on a bloc-wide basis, saying it had to first ensure that each individual country fulfils its stringent security requirements.

At that time, EU officials have accused the US of attempting to undermine the Union’s common visa policy and force individual countries to agree to additional security measures that are in violation with Union rules on aviation security and data protection. [more]

The citizens of most EU countries travel without visas to a list of foreign countries, listed in annex II of Council Regulation No 539/2001. But the nationals of some new EU member states still need a visa to travel to countries such as the United States, Canada or Australia. A regulation which entered into force on 20 December requires EU countries to “react in common” on visa matters, especially in cases where foreign countries “subjects [EU] citizens to differing treatment”.

If within six months the problem is not solved, the EU could introduce visas for US diplomats, the Commission warned. But diplomats of the countries concerned told EurActiv they would continue to negotiate bilaterally to solve the problem.

New EU regulation on visa matters

According to the new regulation, the Commission can temporarily suspend the EU’s own visa exemptions on foreign countries if they have not lifted their visa requirements within six month. The Commission has warned in the past that such rules may force American diplomats to apply for visas to travel to the European Union, if Washington doesn’t lift the visa requirement for individual EU countries (see background).

The new legislation is an initiative of the European Parliament, which in a 2012 report drew a list of third countries maintaining visa requirements on some EU countries. Canada requires visas for nationals of Bulgaria and Romania, while Australia in theory applies a unified system of treatment of visa requests to all EU countries, but its visa grant to nationals of Bulgaria and Romania is by far the lowest. According to MEPs, the Lisbon Treaty gives new powers to the Union to request that its member countries are treated as a whole and that the USA reciprocates on visa policy.

US pressure on data exchange

The four EU countries were reportedly asked by Washington to sign certain bilateral agreements as a precondition for benefitting from the US Visa Waiver Program. One of them is a 2003 provision for the exchange of terrorism screening information (HSPD-6), which called for the establishment of a single consolidated watchlist to improve the identification, screening, and tracking of known or suspected terrorists and their supporters [more].

Another is the agreement on Preventing and Combating Serious Crime (PSCS), requiring signatory countries to share biometric and other data of individuals, for the purpose of preventing, detecting and investigating serious criminal activity and terrorism, on a query basis. The US has signed such agreements with a number of EU countries already.

But the European Commission is reportedly not happy that individual countries sign data exchange agreements with the USA in the absence of a so-called EU-US Umbrella Agreement on data protection, which ensures EU citizens keep their rights when their data is processed in the US.

Diplomats from the countries lacking reciprocity in their visa affairs told EurActiv that their capitals would notify the Commission of their situation with third countries before the deadline of 9 February. According to the new regulation, if the US still applies visas for those countries 90 days following notification, the Commission may decide to suspend EU visa exemption for “certain categories of US nationals”, a jargon term referring to holders of diplomatic passports.

However, diplomats said they would pursue bilateral negotiations as well, suggesting they did not put too much hope in the EU common effort. Indeed, when the new regulation was adopted in December, it was accompanied by a statement by several member states who said that while raising the issue, the EU countries would also “take into account potential adverse political consequences that might arise from such proposals or decisions for the external relations, both of the Union and its Member States”. “This applies in particular to external relations with strategic partners,” says the statement, signed by Belgium, Germany, Estonia, Greece, Spain, France, Italy, Cyprus, Latvia, Lithuania, Luxembourg, Hungary, Malta, the Netherlands, Austria, Portugal, Slovenia, Slovakia, Finland, Sweden, but also Poland, a country under US visa requirement.

Next Steps

9 Feb.: Deadline for the EU countries who are still under visa requirement to notify the Commission on their situation;
March: EU countries can ask the Commission that the EU suspends the visa exemption for certain categories of US nationals;
June: At the latest six months after publication of the regulation, the Commission may decide that the suspension of the visa obligation should take effect.

Steve PEERS : Amending the EU’s visa list legislation (Analysis – February 2014 )

ORIGINAL PUBSLISHED ON STATEWATCH

Steve Peers: Professor of Law, University of Essex

Background

The EU’s legislation defining the countries and territories whose nationals are (and are not) subject to a visa requirement to enter the EU is a crucial part of the EU’s immigration policy, and has a further significant impact on the EU’s external relations. In its current form, this legislation was originally adopted in 2001 (Regulation 539/2001), and was amended seven times up until 2010 (in 2001, 2003, 2005, 2006, 2009 and twice in 2010), as well as by the last three accession agreements, without ever being codified.

A new amendment to the visa list rules was adopted in December 2013, and the European Parliament and the Council have also agreed on two further amendments to the rules, which will be officially adopted early in 2014. This analysis examines all of these recent changes, and presents an informally codified version of the text of what the Regulation will look like after they all take effect. Furthermore, the visa list Regulation was also amended back in summer 2013, as part of a set of amendments to the Schengen borders code and other EU visa legislation.

The amendment (which is also highlighted in the codified Regulation below) changed Articles 1(2) and 2 of the visa list Regulation in order to provide for a revised definition of ‘visa’. This was intended to overturn a ruling of the EU’s Court of Justice on the calculation of the time period during which a third-country national non-resident in the EU can visit (Case C241/05 Bot [2006] ECR I-9627).

The EU’s visa list rules are applicable to all the Member States (including Denmark) except the UK and Ireland, plus the four Schengen associates: Norway, Iceland, Switzerland and Liechtenstein. This includes those newer Member States which do not yet apply all of the Schengen rules (Romania, Bulgaria, Cyprus and Croatia)

The three new amendments

(a) the December 2013 amendments

This first amendment, which came into force on 9 January 2014, did not make any amendment to the lists of countries and territories whose nationals do (or do not) need a visa to enter the EU. Instead, it set out three other changes to the rules: a new ‘safeguard clause’, a revised ‘reciprocity clause’ and revised rules on exemptions for categories of persons. These three issues will be considered in turn.

First of all, the ‘safeguard clause’ (new Article 1a; see also new Article 4a) provides for a possible fast-track reintroduction of visa requirements for the nationals of any country on the visa ‘white-list’ (ie whose nationals are not subject to a visa requirement) in cases where Member States believed that visa liberalisation has resulted in a sharp increase in irregular (‘illegal’) immigration. This change is mainly a response to concerns about the impact of the waiver of visa requirements for nationals of Western Balkan countries in 2009 and 2010, although the new safeguard clause could in theory apply to any country on the visa white-list. The Council (ie, Member States’ interior ministers) amended the Commission’s proposal so that the relevant rules leave more discretion. Both this new clause and the amended reciprocity clause must be reviewed in 2018 (new Article 1b).

Secondly, the Commission had proposed only a minor amendment to the rules governing ‘visa reciprocity’, ie the procedure for encouraging third States on the EU white-list to exempt citizens of all Member States from a visa requirement. These rules had been amended in 2005 to make them more diplomatic (the original version of 2001 had been too threatening to be credible). However, Member States had become disappointed with their application in recent years since Canada reintroduced visa requirements for Czech nationals and the Commission neither persuaded Canada to change its policy nor took any move towards retaliation. So during negotiations, the Council amended the reciprocity rules to make them tougher again, and the European Parliament insisted that they be tougher still. The revised Article 1(4) of the visa list Regulation (Article 1(5) was deleted; see also the new Article 4b); has therefore strengthened the rules to provide for a fast-track process of reimposing visa requirements upon countries like Canada. In fact, immediately after the new rules entered into force, Canada waived its visa requirement for Czech nationals again.

The negotiation of these provisions took some time because the European Parliament, the Council and Commission argued over the precise legal process that would govern the Commission’s use of the revised reciprocity clause. Ultimately, the Commission was dissatisfied with the final results and so threatened to bring a legal challenge to the final Regulation before the EU courts. It has until the beginning of March to do so.

Finally, the amendments to the rules on exemptions (Article 4) drop a cross-reference to repealed legislation, add an exemption from the rules for the crew of ships who visit the shore, and provide for an optional waiver of the visa requirement for refugees and stateless persons residing in the UK and Ireland. The Commission had proposed bigger changes to these rules, including a specific clause relating to the visa waiver which some Member States must extend to Turkish service providers due to the EU’s association agreement with Turkey, but these proposals were not accepted by the Council.

(b) the 2012 proposal

The 2012 proposal to amend the visa list, now agreed by the European Parliament and the Council, will amend the lists of States whose nationals require visas to enter most of the EU (see the Annexes to the Regulation). It will also insert into the Regulation a revised list of criteria to take into account when deciding which States will enjoy a visa waiver from the EU.

First of all, the new Regulation will waive the visa requirement for four categories of quasi-British citizens. This is in line with the Commission’s proposal, and was not contested by either the European Parliament or the Council.

Next, it will waive the visa requirement for nineteen countries, subject to the negotiation of a visa waiver agreement between the EU and each of those countries. The Commission had proposed sixteen of the countries concerned – all of them small tropical islands. But the Council had insisted that the United Arab Emirates be added, and then the European Parliament had insisted that Peru and Colombia be added too. The UAE will be the first Muslim (or Arab) country to be on the EU’s whitelist (countries whose nationals do not require visas). As for Peru and Colombia, this will be the first time that countries which the EU had previously moved to its ‘blacklist’ (countries whose nationals require visas) have returned to the whitelist (those States were moved to the blacklist back in 1995 and 2001 respectively). It seems that the European Parliament was particularly keen to reward these countries for signing a free trade agreement with the EU recently.

This brings us to the third change – the new clause in the main text of the Regulation spelling out the criteria for deciding which States’ nationals must be subject to a visa requirement. This clause was already in the preamble to the Regulation (see recital 5), and has been added to the main text because the European Parliament insisted upon it. Also, the Parliament insisted upon changing the criteria, to add references to ‘economic benefits’ such as ‘tourism and foreign trade’, as well as ‘respect of human rights and fundamental freedoms

(c) the 2013 proposal

The 2013 proposal has one purpose only – to exempt Moldova from the visa requirement. Along with most other States to the east of the EU (as well as Kosovo, and now also Turkey), Moldova has been participating in a ‘visa dialogue’ with the EU, in which the EU set a number of benchmarks and judged whether Moldova had met them before considering waiving the visa requirement. The Commission judged that Moldova had met all the requirements set out in this dialogue, although its proposal (just before the high-profile Eastern Partnership summit last November) was presumably timed for maximum political effect. Moldova is the first Eastern Partnership state to qualify for visa exemption – although the Western Balkans States had also qualified in 2009-10, following their own visa dialogue. Of course, the visa waiver for Moldova must be seen in light of the new rules, discussed above, which allow for a fast-track reimposition of visa requirements.

Assessment

Following the upcoming amendments, the visa Regulation will have been amended fourteen times: eleven times by legislation and three times by accession agreements. In the interest of public transparency, an official codification of these rules is therefore obviously urgent.

As for the substance of the amendments, the decision to apply or waive a visa obligation is an important part of the external relations policy of both the EU and its Member States. So this explains Member States’ desire to retain their remaining discretion as regards visa policy for various categories of persons. It also explains their collective desire, bolstered by the European Parliament, to assert the EU’s authority more forcefully as regards visa policy by the creation of two new fast-track powers to impose visa obligations (as regards reciprocity and safeguards), while retaining a lot of political discretion when using such powers.

In particular, the possible use of the safeguard power will likely entail many contacts between the Commission and the affected third States, perhaps entailing setting benchmarks for staying on the white list which might be compared to those benchmarks which are already set for getting on to that list.

Since the Member States wanted to ensure some control over the Commission in this area, it is not surprising that the European Parliament wanted to do so as well, via means of the use of ‘delegated acts’ which the EP could possibly block the Commission from adopting. The new amendments also demonstrate, for the first time in practice, the EP’s important role as regards the substance of the EU’s visa policy, given its successful demand to extend a visa waiver to Peru and Colombia and to change the grounds determining whether a visa requirement is waived or not.

Member States also asserted their control over the Court of Justice, overturning a judgment that irritated interior ministries, and refusing to make express reference to other case law that irritated them even more, by preventing them from imposing visa requirements on at least some Turkish visitors (Case C-228/06 Soysal; but see the later judgment in Case C-221/11 Demirkan, in which the Court of Justice deferred to Member States’ desire to retain a visa requirement for Turkish tourists). However, as noted already, Turkey has now started a visa dialogue with the EU, in return for signing a readmission agreement.

In general, Member States are clearly unwilling to consider the possibility of a system of decision-making on visa requirements which relies more on objective evidence about trends in irregular migration (as the Commission had proposed, to a limited degree, as regards the new safeguard clause) and less upon discretion, power politics and gestures synchronised with certain Member States’ election cycles.

Sources Continue reading “Steve PEERS : Amending the EU’s visa list legislation (Analysis – February 2014 )”

The EP and the Council agree on the new EU legal framework for seasonal workers

by Emilio De Capitani

After more than three years of negotiations the European Parliament has finally approuved (with 498 votes in favour 56 aginst and 68 abstentions) on February 5th the agreement with the Council on the new legal framework for seasonal workers in the European Union. The text will be finalised and linguistically revised in the coming weeks published in the Official Journal and should be transposed in national law after 30 months since its entry into force (end of 2016 or beginning of 2017)

It will replace a non binding EU Council Resolution which dates back to 1994 and which included some elements defining the notion of “seasonal” worker. According to the new Directive ’seasonal worker’ “means a third-country national who retains his or her principal place of residence in a third country and stays legally and temporarily in the territory of a Member State to carry out an activity dependent on the passing of the seasons”. In more plain terms seasonal workers are people generally engaged in non- or low-skilled economy sectors of the receiving country’s in particular in agriculture during the planting or harvesting period, or in tourism in hotels and catering in particular during the holiday period.(1) Regrettably for this kind of activities the risk of exploitation and sub-standard working conditions threatening the workers’ health and safety is very high also due to the fact that they are very often linguistically or geographically isolated. Around 100.000 people in the EU could fall currently in this category of workers (2).

The main objective of the new legislation is to overcome the existing patchwork of national legislation and of bilateral agreements by establishing the first EU scheme on circular migration where workers while keeping their residence outside the EU could have the chance to come in the EU every year for the same season (re-entry would be facilitated for third-country nationals who were admitted to the Member State as seasonal workers at least once within the previous five years).

Due to the very different economies in the MS (think to the situation which could exist in Finland or in Greece) it will be up to the MS when transposing the Directive to define in consultation with social partners, those sectors of employment which include activities which can be considered of “seasonal” nature.

The maximum period of stay will be between five and nine months in any 12‐month period and non EU seasonal workers may work for more than one employer during that period. For stays not exceeding three months, the provisions of the Directive shall apply without prejudice to the Schengen acquis. The Seasonal worker candidate should have a valid work contract or, a binding job offer which specifies the place and type of the work, duration of employment, the remuneration and the working hours per week. He should give evidence of having applied for sickness insurance and will have adequate accommodation. For admission for stays exceeding three months Member States shall issue a long-stay visa, indicating that it is issued for the purpose of seasonal work or a seasonal worker permit or a seasonal worker permit and a long-stay visa, (if the long-stay visa is required under national law for entering the territory). Most importantly the applicants must also also have sufficient resources without having recourse to Member States social assistance systems.

The main improvement arising from the new Directive will be that seasonal workers will be granted equal treatment with EU nationals at least with regard to (inter alia) terms of employment, including the minimum working age, and working conditions, including pay and dismissal, working hours, leave and holidays, the right to strike, education and vocational training, recognition of diplomas, etc. Member States may restrict equal treatment, particular with regard to access to certain social assistance.

Member States may determine whether the application is to be made by a third country national or by the employer (or both). Member States shall also designate the authorities competent to receive and decide on the application for and to issue a seasonal worker permit following a single application procedure.

Effective mechanisms through which seasonal workers may lodge complaints against their employers directly or through third parties, and measures protecting against dismissal or other adverse treatment by the employer as a reaction to a complaint must also be foressen. The employer shall be liable to pay compensation to the seasonal worker as it will be the case when the employer is a subcontractor, the main contractor and any intermediate subcontractor who have not undertaken due diligence obligations as defined by national law.

Sanctions against employers who have not fulfilled their obligations shall be “effective, proportionate and dissuasive” (following the classical “Greek Maize” formula).

The draft Directive list also the cases when an application may be rejected. This will be notably the case when the vacancy in question could be filled by nationals of the Member State concerned or by other Union citizens, or by third-country nationals lawfully residing in the Member State (principle of “Union preference”). It can also be rejected when the applicant might pose a threat to public policy, public security or public health.
Other grounds of rejection could arise from employer’s misgivings (when he has been sanctioned for undeclared work and/or illegal employment or where the employer’s business is being or has been wound up under national insolvency laws or where the employer has failed to meet its legal obligations regarding social security, taxation, labour rights, working conditions or terms of employment). The authorisation for the purpose of seasonal work granted may also be withdrawn if the third-country national applies for international protection.
Continue reading “The EP and the Council agree on the new EU legal framework for seasonal workers”