Category: 8.2 Judicial cooperation in criminal matters

Do Facebook and the USA violate EU data protection law? The CJEU hearing in Schrems

ORIGINAL PUBLISHED ON EU LAW ANALYSIS
Sunday, 29 March 2015
by Simon McGarr, solicitor at McGarr solicitors (*)

Last week, the CJEU held a hearing in the important case of Schrems v Data Protection Commissioner, which concerns a legal challenge brought by an Austrian law student to the transfers of his personal data to the USA by Facebook, on the grounds that his data would be subject to mass surveillance under US law, as revealed by Edward Snowden. His legal challenge was actually brought against the Irish data protection commissioner, who regulates such transfers pursuant to an agreement between the EU and the US known as the ‘Safe Harbour’ agreement. This agreement takes the form of a Decision of the European Commission made pursuant to the EU’s data protection Directive, which permits personal data to be transferred to the USA under certain conditions. He argued that the data protection authority has the obligation to suspend transfers due to breaches of data protection standards occurring in the USA. (For more detail on the background to the case, see the discussion of the original Irish judgment here).

The following summarises the arguments made at the hearing by the parties, including the intervening NGO Digital Rights Ireland, as well as several Member States, the European Parliament, the Commission and the European Data Protection Supervisor. It then sets out the question-and-answer session between the CJEU judges (and Advocate-General) and the parties. The next step in this important litigation will be the opinion of the Advocate-General, due June 24th.

Please note: these notes are presented for information purposes only. They are not an official record or a verbatim account of the hearing. They are based on rough contemporaneous notes and the arguments made at the hearing are paraphrased or compressed. Nothing here should be relied on for any legal or judicial purpose, and all the following is liable to transcription error.

Schrems v Data Protection Commissioner
Case C-362/14
Judges:
M.V Skouris (president); M.K. Lenaerts (Vice President); M.A. Tizzano; Mme R. Silva de Lapuerta; M. T. Von Danwitz (Judge Rapporteur); M. S. Rodin; Mme K. Jurimae; M. A Rosas; M. E. Juhász; M. A. Borg Barthet; M. J. Malenovsky; M. D. Svaby; Mme M. Berger; M. F. Biltgen; M. C. Lycourgos; M. F. Biltgen
M. Y. Bot (Advocat General)

Max Schrems

Noel Travers SC for Mr. Schrems told the court that personal data in the US is subject to mass and indiscriminate mass surveillance. The DRI v Ireland case struck down the EU data retention directive, establishing a principle which applies a fortiori to this case. However, the court held that Data Retention did not affect the essence of the right under Article 8, as it concerned only metadata. The surveillance carried out in the US accesses the content of data as well as the metadata, and without judicial oversight. This interference is so serious that it does violate the essence of Article 8 rights, unlike the data retention directive. Mr. Travers held that the Safe Harbour decision is contrary to the Data Protection directive’s own stated purpose, and that it was accordingly invalid.
Answering the Court’s question as to whether the decision precludes an investigation by a Data Protection Authority (DPA) such as the Irish Data Protection Commissioner, he submitted that compliance with fundamental rights must be part of the implementation of any Directive. Accordingly, national authorities, when called upon in a complaint to investigate breaches must have the power to do so.
Article 25.6 of the data protection Directive allows for findings on adequacy regarding a third country “by reason of its domestic law or of the international commitments it has entered into”. The Safe Harbour Principles (SHPs) and FAQs are not a law or an international agreement under the meaning of the Vienna Convention. And the SHPs do not apply to US public bodies. The Safe Harbour Principles are set out in an annex to a Commission Decision, but that annex is subject to US courts for interpretation and for compliance. Where there is a requirement for compliance with law, it is with US law, not EU law.

Irish Data Protection Commissioner

For the Data Protection Commissioner, Mr. Paul Anthony McDermott said that with power must come limitations. All national regulators are firstly bound by domestic law. The Data Protection Commissioner is also bound by the Irish Constitutional division of powers. She cannot strike down laws, Directives or a Decision.
Mr. Schrems wanted to debate Safe Harbour in a general way- it wasn’t alleged then that Facebook was in breach of safe harbour or that his data was in danger. The Irish High Court had a limited Judicial Review challenge in front of it. Mr. Schrems didn’t challenge Safe Harbour, or the State, or EU law directly, and the Irish High Court declined the application by Digital Right Ireland to refer the validity of the Safe Harbour Decision to Luxembourg. Mr. McDermott asked the court to respect the parameters of the case.
Europe has decided to deal with the transfer of data to the US at a European level. The purpose of the Safe Harbour agreement is to reach a negotiated compromise. The words “negotiate”, “adapt” and “review” appear in the Decision. It is clear therefore that a degree of compromise is envisaged. Such matters are not to be dealt with in a court but, as they involve both legal and political issues, by diplomacy and realpolitik.
The Data Protection Commissioner can have regard to the EU Charter of Fundamental Rights when she’s balancing matters but it doesn’t trump everything. It doesn’t allow her to ignore domestic law or European law, Mr. McDermott concluded. Continue reading “Do Facebook and the USA violate EU data protection law? The CJEU hearing in Schrems”

Within the Sound of Silence. Dangerous Liaisons between Detention and Citizenship under European Union Law

by Leandro Mancano (*)

Many scholars have recently pointed out the need to revise those European Union (EU) instruments adopted under the former ‘third pillar’. This urgency has only grown after the expiring of the transitional period, occurred 1st December 2014, which resulted in issues of legal uncertainty as to which kind of legal regime is to be applied to such instruments (whether the pre-Lisbon framework, the post Lisbon rules or a ‘middle-way’ solution). In this context, three EU law instruments on detention deserve particular attention: Council Framework Decision (FD) 2009/829/JHA on supervision measures; Council FD 2008/947/JHA on probation measures and alternative sanctions; Council FD 2008/909/JHA on mutual recognition of custodial sentences (also known as FD on the transfer of prisoners).

Firstly, the Commission has rebuked Member States at the outset of 2014, in light of the weak state of implementation of these instruments (1). After one year, such report has been followed by updated information about the state of play of the implementation of these FDs, which testify that many Member States have not fulfilled their obligation of transposition so far (2). This raises concerns especially if one considers that detention has been increasingly playing a major role throughout EU law, establishing a potentially dangerous liaison with EU citizenship.

As shown below, the risky factor lies in the circumstance that many cross references have made between EU criminal law and EU citizenship. However, such connections are surrounded with a sound of silence, as their meaning and outline have not been sufficiently clarified hitherto.

The basic assumption which EU citizenship brings with it is that every Union citizen is entitled to move and reside freely within the Union regardless of their nationality, and without requiring a link to the performance of an economic activity.This can be inferred from primary legislation (in particular Articles 18, 19 and 21 of the Treaty on the Functioning of the EU), as well as Directive 2004/38/EC (also known as ‘Citizenship Directive’). On the one hand, under Article 16 of the Directive Union citizens are granted the right of permanent residence in the host Member State after legally residing therein for a continuous period of five years. On the other, Article 28 states that: those Union citizens (or their family members) who have the right of permanent residence in the host Member State, may be subject to an expulsion measure so long as there are serious grounds of public policy or public security; Union citizens who have resided in the host Member State for ten years may not be expelled from the host Member State, unless imperative grounds of public security, as defined by Member States, justify the measure. The provision also applies to family members who are not nationals of a Member State and have legally resided with the Union citizen in the host Member State for the same timeframe.

The intersections between EU citizenship and detention may be traced back to a threefold track. Continue reading “Within the Sound of Silence. Dangerous Liaisons between Detention and Citizenship under European Union Law”

Another episode of the EU PNR saga: remarks of the national data protection authorities

LETTER SENT BY THE PRESIDENT OF THE ART 29 WORKING PARTY (*) TO THE CHAIRMAN OF THE PARLIAMENTARY COMMITTEE IN CHARGE OF THE EU PNR  DRAFT DIRECTIVE (emphasized by me)

Dear Mr Moraes,
Since the terrorist attacks in Paris and Copenhagen, the discussion on the possible introduction of an EU Passenger Name Records system (hereafter: EU PNR) has moved significantly forward, both in the Council and in the European Parliament. In particular, Mr Kirkhope, rapporteur on this issue, has presented an updated report on the Commission’s 2011 draft directive establishing an EU PNR to your Committee.
As stated early last month, the Article 29 Working Party (hereafter: the WP 29) is not in principle either in favour of or opposed to PNR data collection schemes  (See press release issued by the Article 29 Working Party on EU PNR on 5 February 2015), as long as they are compliant with the fundamental rights to respect for private life and to the protection of personal data.
However, considering the extent and indiscriminate nature of EU PNR data processing for the fight against terrorism and serious crime, the WP 29 believes that it is likely to seriously undermine the rights as set out in Articles 7 and 8 of the Charter of Fundamental Rights in the European Union.
In this regard, the Working Party acknowledges that there have been some improvements to the initial draft from a data protection perspective. Still, the Working Party wishes to urgently draw your attention to the following outstanding issues to ensure that the aforementioned fundamental rights are respected.
First, the necessity of an EU PNR scheme still has to be justified.  Precise argumentation and evidence are still lacking in that respect.   Further restrictions should also be made to ensure that the data processing is proportionate to the purpose pursued, in particular considering that the report now includes intra-EU flights in the data processing. Therefore, it is recommended that the data collection is limited with reference to specific criteria in order for the scheme to guarantee respect for individuals’ fundamental rights and to take the CJUE data retention judgment into account.  Besides this, the scope of the offences concerned should be further reduced and the retention period shortened and clearly justified.
In addition, a major error in the new Articles 10a and 12(1b) stemming from an apparent misunderstanding of the data protection authority’s role must be rectified in order to set the responsibilities of governments and data controllers.
Finally, the WP29 insists on the necessity to present as soon as possible a detailed evaluation of the efficiency of the PNR scheme. A sunset clause should also be inserted into the directive to assist in ensuring periodic review of the necessity of the system.

All these points will be developed in an appendix of this letter, as well as concrete modifications and improvements proposed to the text by the Working Party. I would be grateful if you would be so kind as to forward this letter to the members of your committee in order for them to take account of these views before the deadline for further amendments to the proposal. Naturally, the Working Party remains at your disposal for any clarification you would require and further input during the discussion on EU PNR.

Yours sincerely,
On behalf of the Article 29 Working Party,
Isabelle FALQUE-PIERROTIN Chairwoman

Appendix :
Demonstrating the necessity and ensuring the proportionality of the EU PNR scheme
Continue reading “Another episode of the EU PNR saga: remarks of the national data protection authorities”

House of Lords recommends to change the Governement’s strategy on the UK’s opt-in.

“The UK’s opt-in Protocol: implications of the Government’s approach” 

NOTA BENE : the full report is accessible on the House of Lords website.

SUMMARY

This report focuses on the Government’s approach to the opt-in Protocol, introduced by the Lisbon Treaty, by virtue of which the UK has a right not to participate in EU justice and home affairs (JHA) measures. At issue is whether the opt-in Protocol can be interpreted to mean that it is the content of an EU measure which determines the application of the Protocol, rather than a legal base under the JHA title of the Treaty on the Functioning of the EU (Title V).

We express no view on the desirability or otherwise of the opt-in mechanisms introduced by the Lisbon Treaty. The function of this report is to examine the way in which the Government has sought to interpret those mechanisms.

We examine the Government’s interpretation of the expression “pursuant to [Title V]” in the opt-in Protocol, and conclude that it has an accepted legal meaning, namely that a Title V legal base is required before the opt-in can be triggered. As a consequence, we recommend that the Government reconsider its broader interpretation.

We consider the Government’s approach to determining the legal base of an EU measure with JHA content. We conclude that the distinction it draws between whole, partial, and incidental JHA measures is misconceived. We again recommend it reconsider its approach.

We consider whether the Government’s overall approach to the opt-in Protocol gives rise to legal uncertainty. We draw a distinction between potential and actual legal uncertainty, concluding that the potential of the Government’s policy to create legal uncertainty is considerable. We further conclude that the Government’s approach risks breaching the EU legal duty of “sincere cooperation”.

We then look at how the opt-in Protocol has been interpreted by the EU institutions. The Government believes that the Commission has actively pursued a policy of “legal base shopping”, in order to undermine the UK’s opt-in rights. In one specific case it provides evidence that lends some support to this allegation, in respect of the former Commission. With this partial exception, however, we conclude that there is no persuasive evidence to suggest that the Commission has circumvented the UK’s opt-in rights.

We review the approach of the Court of Justice of the EU (CJEU) to determining the legal base of international agreements and, while recognising the Government’s concerns, conclude that there is no evidence to suggest that the CJEU has sought deliberately to undermine the safeguards in the opt-in Protocol. We conclude that it is highly unlikely that the CJEU will change its established approach to determining legal base, including for measures with JHA content. We recommend that the Government review its litigation strategy in the light of this conclusion.

Finally, we recommend that the Government consider the feasibility of an inter-institutional agreement on the scope of Title V. Continue reading “House of Lords recommends to change the Governement’s strategy on the UK’s opt-in.”

THE UK IMPLEMENTS EU FREE MOVEMENT LAW – IN THE STYLE OF FRANZ KAFKA

ORIGINAL PUBLISHED ON EU LAW ANALYSIS 

Thursday, 19 March 2015

By Steve PEERS

Most laws are complicated enough to start with, but with EU Directives there is an extra complication – the obligation to transpose them into national law. A case study in poor transposition is the UK’s implementation of the EU’s citizens’ Directive, which regulates many aspects of the movement of EU citizens and their family members between EU Member States. Unfortunately, that defective implementation is exacerbated by a further gap between the wording of this national law and its apparent application in practice, and by the unwillingness of the EU Commission to sue the UK (or other Member States) even for the most obvious breaches of the law.

It’s left to private individuals, who usually have limited means, to spend considerable time and money challenging the UK government in the national courts. One such case was the recent victory in McCarthy (discussed here), concerning short-term visits to the UK by EU citizens (including UK citizens living elsewhere in the EU) with third-country (ie, non-EU) family members.  The UK government has just amended the national rules implementing the EU citizens’ Directive (the ‘EEA Regulations’) to give effect to that judgment – but it has neglected to amend the rules relating to another important free movement issue.

Implementing the McCarthy judgment

The citizens’ Directive provides that if EU citizens want to visit another Member State for a period of up to three months, they can do so with very few formalities. However, if those EU citizens are joined by a third-country family member, it’s possible that this family member will have to obtain a short-term visa for the purposes of the visit. The issue of who needs a short-term visa and who doesn’t is mostly left to national law in the case of people visiting the UK and Ireland, but it’s mostly fully harmonised as regards people visiting all the other Member States.

Although the EU’s citizens’ Directive does simplify the process of those family members obtaining a visa, it’s still a complication, and so the Directive goes further to facilitate free movement, by abolishing the visa requirement entirely in some cases. It provides that no visa can be demanded where the third-country family members have a ‘residence card’ issued by another EU Member State. According to the Directive, those residence cards have to be issued whenever an EU citizen with a third-country family member goes to live in another Member State – for instance, where a British man moves to Germany with his Indian wife. Conversely, though, they are not issued where an EU citizen has not left her own Member State – for instance, a British woman still living in the UK with her American wife.

How did the UK implement these rules? The main source of implementation is the EEA Regulations, which were first adopted in 2006, in order to give effect to the citizens’ Directive by the deadline of 30 April that year. Regulation 11 of these Regulation states that non-EU family members of EU citizens must be admitted to the UK if they have a passport, as well as an ‘EEA family permit, a residence card or a permanent residence card’. A residence card and permanent residence card are creations of the EU Directive, but an ‘EEA family permit’ is a creature of UK law.

While the wording of the Regulation appears to say that non-EU family members of EU citizens have a right of admission if they hold any of these three documents, the UK practice is more restrictive than the wording suggests. In practice, having a residence card was usually not enough to exempt those family members from a visa requirement to visit the UK, unless they also held an EEA family permit. Regulation 12 (in its current form) says that the family member is entitled to an EEA family permit if they are either travelling to the UK or will be joining or accompanying an EU citizen there. In practice, the family permit is issued by UK consulates upon application, for renewable periods of six months. In many ways, it works in the same way as a visa requirement.

An amendment to the Regulations in 2013 provided that a person with a ‘qualifying EEA State residence card’ did not need a visa to visit the UK. But only residence cards issued by Germany and Estonia met this definition. This distinction was made because the UK was worried that some residence cards were issued without sufficient checks or safeguards for forgery, but Germany and Estonia had developed biometric cards that were less likely to be forged.

In the McCarthy judgment, the CJEU ruled that the UK rules breached the EU Directive, which provides for no such thing as an EEA family permit as a condition for admission of non-EU family members of EU citizens with residence cards to the territory of a Member State. The UK waited nearly three months after the judgment to amend the EEA Regulations to give effect to it.

The new amendments cover many issues, but to implement McCarthy they simply redefine a ‘qualifying EEA State residence card’ to include a residence card issued by any EU Member State, as well as any residence card issued by the broader group of countries applying the EEA treaty; this extends the rule to cards issued by Norway, Iceland and Liechtenstein. Presumably this brings the rules into compliance with EU law on this point (the new rules apply from April 6th). That means that non-EU family members of EU citizens will not need a visa to visit the UK from this point, provided that they hold a residence card issued in accordance with EU law, because they are the non-EU family member of an EU citizen who has moved to another Member State. However, this depends also on the practice of interpretation of the rules, including the guidance given to airline staff.

‘Surinder Singh’ cases Continue reading “THE UK IMPLEMENTS EU FREE MOVEMENT LAW – IN THE STYLE OF FRANZ KAFKA”

DENMARK AND EU JUSTICE AND HOME AFFAIRS LAW: DETAILS OF THE PLANNED REFERENDUM

ORIGINAL PUBLISHED ON EU LAW ANALYSIS

Tuesday, 17 March 2015

by STEVE PEERS 

Danish participation in cross-border criminal law measures is symbolised by ‘The Bridge’, the ‘Nordic Noir’ series about cross-border cooperation in criminal matters between Denmark and Sweden. But due to the changes in EU law in this field, that cooperation might soon be jeopardised. As a result, in the near future, Denmark will in principle be voting on whether to replace the current nearly complete opt-out on EU Justice and Home Affairs (JHA) law with a partial, selective opt-out. I have previously blogged on the implications of this plan in general terms, but it’s now clear exactly what this vote will be about.

First of all, a short recap of the overall framework (for more detail, see that previous blog post). Back in 1992, Denmark obtained an opt-out from the single currency, defence and aspects of JHA law (it’s widely believed that it also obtained an opt-out from EU citizenship, but this is a ‘Euromyth’). These opt-outs were formalised in the form of a Protocol attached to the EU Treaties as part of the Treaty of Amsterdam. The JHA opt-out was then amended by the Treaty of Lisbon.

At present, Denmark participates in: the EU policing and criminal law measures adopted before the entry into force of the Treaty of Lisbon; measures relating to the Schengen border control system (as  matter of international law, not EU law); the EU rules on visa lists (as a matter of EU law); and the EU’s Dublin rules on allocation of asylum applications, ‘Brussels’ rules on civil jurisdiction and legislation on service of documents (in the form of treaties with the EU). In contrast, Denmark does not – and cannot – participate in other EU rules on immigration and asylum law or cross-border civil law, or policing and criminal law rules adopted since the entry into force of the Treaty of Lisbon.

The Protocol on Denmark’s legal position either allows it to repeal its JHA opt-out entirely, or selectively. If it chooses to repeal the opt-out selectively, it would then be able to opt in to JHA measures on a case-by-case basis, like the UK and Ireland, although (unlike those states) it would remain fully bound by the Schengen rules. Indeed, those rules will then apply as a matter of EU law in Denmark, not as a matter of international law. Continue reading “DENMARK AND EU JUSTICE AND HOME AFFAIRS LAW: DETAILS OF THE PLANNED REFERENDUM”

Legal aid in criminal proceedings : will the European Parliament improve the Council’s “general approach” ?

by Claire Perinaud (FREE Group Trainee)

State of implementation of the Procedural rights roadmap.

After years of unsuccessful attempts, starting in 2004 with a general Commission proposal on procedural rights it was only from the end of 2009 that the EU legislation on procedural rights for suspects and accused persons in criminal proceedings has progressively taken shape. This was due to the entry into force of the Treaty of Lisbon (TFEU art. 82(2) now confer the power to adopt legislation on this issue), to article 47 of the Charter of Fundamental Rights (providing for the right to a fair trial) and to a political “roadmap” by which, in November 2009 the Council relaunched the Commission original proposals following a step-by-step approach instead of trying to adopt comprehensive legislation as initially foreseen in 2004.

However it is more than likely that this pragmatic approach and the transition from unanimity to qualified majority voting of the EU Member States in the Council (as from the entry into force of the Treaty of Lisbon) has made possible the adoption in co-decision with the European Parliament of the three first legislative measures on suspects’ rights: Directive 2010/64/EU on the right to interpretation and translation in criminal proceedings; Directive 2012/13/EU on the right to information in criminal proceedings; and Directive 2013/48/EU on the right of access to a lawyer in criminal proceedings.

Building on this success, at the end of November 2013 the Commission proposed a second “package” of suspects’ rights measures, comprising: a directive on procedural safeguards for children who are suspected or accused in criminal proceedings; a recommendation on procedural safeguards for vulnerable people suspected or accused in criminal proceedings; a directive strengthening of certain aspects of the presumption of innocence and of the right to be present at trial in criminal proceedings; a directive on the right to provisional legal aid for citizens suspected or accused of a crime; and a recommendation on the right to legal aid for suspects or accused persons in criminal proceedings.

In 2014 the Council already reached a general approach on the proposal for a directive on procedural safeguards for children and on the directive on the presumption of innocence. On this basis the dialogue between the Council and the European Parliament (EP) is about to start and it is possible that in the coming months an agreement could be reached so that these texts could be adopted already at the EP’s “first reading” .
Last week the Council has reached (after eight months of internal negotiations!) a general approach also on the draft Directive on provisional legal aid for persons deprived of liberty in criminal proceedings and will start in the coming weeks the dialogue with the Parliament also on this text.

The coming months will then be extremely important for EU procedural rights in criminal matters even if it will not be easy to achieve the high results that the European Parliament and some Member States were expecting. In the absence of the energetic push of the former Commission Vice President Reding there is a risk that the negotiations may achieve the lowest common denominator between the Member States also due to the unwillingness of some of them to adopt any EU legislation which can create further financial and internal institutional tensions.

Legal aid : why make it simple when you can make it tricky ? Continue reading “Legal aid in criminal proceedings : will the European Parliament improve the Council’s “general approach” ?”

The European Area of Freedom Security and Justice : still.. lost in transition ?

by Emilio De Capitani

More than five years ago the Lisbon Treaty entered into force carrying along great expectations for the transformation of the EU into a Freedom Security and Justice area. However even if some progress has been made on Schengen,  asylum policies, procedural guarantees in criminal proceedings and judicial cooperation in civil matters the results are far lower than the initial expectations and of the ambitious objectives enshrined in the Stockholm Programme adopted by the European Council on December 10th 2009.

That Programme has been criticized by some member states as it was a sort of “Christmas tree”. However what the European Council adopted in June  last year is little more than a “dry bush” mainly focused on the need for …thorough reflections before adopting new EU legislation. Some commentators considered that this was a Machiavellian move of the European Council to pass the baton to the newly appointed President of the European Commission so that it could take the lead of this European policy as for any other “ordinary” policy.

A deceiving Commission..

In the following months this interpretation was confirmed by the appointment of the first Commission Vice President, in charge of the implementation of the rule of law, of the European Charter of fundamental rights and of better legislation. Moreover the creation of a specific portfolio for migration policy gave the impression of the Commission’s stronger political commitment “..to place the individual at the heart of its activities, by establishing the citizenship of the Union and by creating an area of freedom, security and justice” (European Charter Preamble)

However very soon these initial hopes had been deceived:

1 The rule of law mechanism which was suggested by the last “Barroso” Commission was soon forgotten

2 As far as the Charter is concerned the Commission has apparently been taken by surprise by the Court of Justice opinion 2/13 dealing with the EU accession to the ECHR and is still considering what to do. But the Juncker Commission also seems lost when the issue at stake is to transpose the EU Charter principles into new EU legislation. It will only take more than one year to evaluate what could be the impact of the CJEU ruling on data retention on the pending legislation such as the EU PNR, the entry-exit and the registered travel proposals (not to speak of its impact on EU legislation and agreements that are already in force..)

3 Migration and human mobility are still dealt with and financed by the same General Directorate which is in charge of internal security policy instead of being moved to social affairs policies which should have been a real holistic and individual-centred approach.

4 Last but not least the Commission’s legislative programme for 2015 is more than reticent and it appears more and more evident that for the time being most (if not all) of the Commission’s political energy will be focused on economic objectives so that the Freedom security and justice area related policies have to wait for a new season.

…but the situation between Member States is even worse..

The situation of FSJA policies is even more frustrating on the Member States side.

Not only some legislative procedures like the ones on consular protection, access to documents  or the fight against discrimination remain blocked and others including the data protection reform will require a caesarean section to come to life,  but day after day it appears clearer and clearer  that there is still a majority of member states which do not want  the modernisation of measures adopted before the Lisbon treaty (or even before the entry into force of the Amsterdam Treaty. This is notably the case of Germany which (as a rule)  oppose any new measure which can have a financial impact or will change the former “unbalance” of power between the Council and the European Parliament. Take the case of the recent three Commission proposals (1) repealing FSJA measures dating back to the intergovernamental period. According to German delegation even a 1998 Schengen decision on the adoption of measures to fight illegal immigration should be preserved because “None of the (current) legal instruments include a similarly comprehensive approach to fight illegal migration and immigrant smuggling.” This is appalling : would it not be wiser to urge the Commission to submit a new proposal which could better comply with the EU Treaties and with the Charter by also associating the European Parliament to this endeavour ?

This case apart it is worth noting that all the pre-Lisbon measures dealing with police cooperation and judicial cooperation in criminal matters (2) have been legally “embalmed” by art 9 of Prot.36 according to which “The legal effects of the acts of the institutions, bodies, offices and agencies of the Union adopted on the basis of the Treaty on European Union prior to the entry into force of the Treaty of Lisbon shall be preserved until those acts are repealed, annulled or amended in implementation of the Treaties. The same shall apply to agreements concluded between Member States on the basis of the Treaty on European Union.”

A “Transitional” period ….until when ? Continue reading “The European Area of Freedom Security and Justice : still.. lost in transition ?”

The European Union and State Secrets: a fully evolving institutional framework…in the wrong direction (2).

 By Emilio DE CAPITANI

In a passionate intervention before the Civil Liberties Committee of the European Parliament (LIBE) on January 8 the European Ombudsman has denounced the fact that: “For the first time in its twenty year history, the European Ombudsman was denied its right under Statute to inspect an EU institution document, even under the guarantee of full confidentiality, as part of an inquiry… This power to inspect documents is fundamental to the democratic scrutiny role of the Ombudsman and acts as a guarantor of certain fundamental rights to the EU citizen.”

The case concerned Europol’s refusal to give access to a Joint Surpervisory Body (JSB) report on the implementation of the EU-US Terrorist Finance Tracking Program (TFTP) Agreement (known as “SWIFT” agreement). The JSB consists of representatives of the data protection authorities of the Member States which should ensure that the storage, processing and use of the data held by Europol do not violate fundamental EU rights. To check if  Europol was correctly applying EU law the Ombusdman has asked to inspect the JSB report. ”However”,as stated by Mrs O’Reilly,”..according to Europol, the “technical modalities” agreed between the Commission and the US under Article 4(9) of the TFTP Agreement required Europol to obtain the permission of the US authorities before allowing the Ombudsman, or any other entity, any access, including an Ombudsman confidential inspection, to the record. The US authorities have refused such permission to Europol.” Reportedly the  US authorities refused this permission because the Ombudsman “need to know” requirement for having access to that classified document was not met.

Many LIBE members have considered this statement quite appalling because it allowed the US authorities to be the arbiters of whether or not the Ombudsman may exercise her statutory, democratic power to inspect the document at issue in conformity with EU law. It is worth recalling that art. 3 par. 2 of the Ombusdman statute states that : “The Community institutions and bodies shall be obliged to supply the Ombudsman with any information he has requested from them and give him access to the files concerned. Access to classified information or documents, in particular to sensitive documents within the meaning of Article 9 of Regulation (EC) No 1049/2001, shall be subject to compliance with the rules on security of the Community institution or body concerned.” 

To shed some light on this controversy it could be worth recalling some elements which to my opinion have not been developed during the parliamentary debate and I had the occasion to recall in a previous post …five years ago.

The “Originator’s principle” in art. 9 of Regulation 1049/01

First of all it should be noted that art. 9 of Regulation 1049/01 cited in the Ombudsman Statute is the only EU legislative basis which allows the classification of “sensitive documents” which are “..documents are documents originating from the institutions or the agencies established by them, from Member States, third countries or International Organizations, classified as ‘TRÈS SECRET/TOP SECRET’, ‘SECRET’ or ‘CONFIDENTIEL’ in accordance with the rules of the institution concerned, which protect essential interests of the European Union or of one or more of its Member States in the areas covered by Article 4(1)(a), notably public security, defense and military matters.” According to paragraph 3 of the same article “Sensitive documents shall be recorded in the register or released only with the consent of the originator.”

However, according to Regulation 1049/01 the Originator’s consent is an exception to the general rule according to which an Institution when requested for access to a document should be driven by objective criteria and not by the will of the “originator” even when the latter it is an EU Member State (see art. 4 p.4-6 of Regulation 1049/01). The only obligation foreseen by the Regulation is to establish a fair dialogue with the “originator” and the final judge will remain the Court of justice which should assess if Regulation 1049/01 principles and rules have been violated. Not surprisingly this general rule was not easy to agree with the Member States but it was chosen as it was the only possible way out to preserve the autonomy of EU law against the risk of inconsistent decisions at EU level if taken  following national standards which are still extremely diverse (think how different is the approach to transparency in Sweden or in Spain..).

Why then establish an exception in art. 9 ?

The main factor has been the Council reqyest to cover the first 2000 EU-NATO agreement  on exchange of classified information  which, like all similar international agreements was built on the “originator” principle and also because of this was challenged by the European Parliament before the Court of Justice. Mid 2001 a deal was then struck with the European Parliament which obtained that the exception of the “originator’s principle” should had been limited to the intergovernmental domains (at the time the internal and external security policies covered by art. 24 and 38 of the EU Treaty). The logic was that for these policies the Member States are mainly under the control of their national parliaments so that the European Parliament (as well as the Court of Justice) could not be considered co-responsible for violation of EU law.

On this basis the Council has progressively built an autonomous legal framework which can hardly be considered a simple implementation of Art.9 of Regulation 1049/01. Not only the Council has added another lower level of classified documents (“Restricted”) but it embodied  the “originator’s principle”. The Council latest version of these security rules is the Decision 2013/488/EU and  has been adopted  by the Council on its internal organizational powers (art. 240 TFEU) and “without prejudice to Articles 15 and 16 of the Treaty on the Functioning of the European Union (TFEU) and to instruments implementing them”.(eg Regulation 1049/01 and the measures protecting personal data).

Notwithstanding this “disclaimer” this Council Decision has become “de facto” an harmonizing measure as it  define the “principles” which should frame the European Union Classified Informations (EUCI). To comply with the rule of law and democratic principles these “principles” should had been adopted by the  co-legislator as foreseen by art. 15 of the TFEU (1) and by the EU Charter. But the general application of these “internal rules” derives by the fact that they should be “copy and pasted” as such in all the EU Institutions agencies and bodies “internal” security rules if the latter want to share classified informations with the Council or between them.

Also in the international negotiations the Originator’s principle has been spread in dozen of international agreements even if since the entry into force of the Lisbon Treaty these agreements deals with the exchange of classified information linked with  the common foreign and security policy” (art. 37 of the TEU) (2). When classified informations deals with Judicial and police cooperation in criminal matters they now require an internal legal basis as it happened  for the  Decision concluding the EU-US agreement on TFTP. The “mutual respect clause foreseen by art. 40 TEU (3) should be respected and the European Parliament approbation is required.

Quite rightly then the European Parliament Legal Service has considered that the “technical modalities” invoked by Europol to justify the refusal of access by the Ombusdman could not be considered a sound legal basis as they were simple  “implementing measures” of the TFTP agreement and have been not part of the agreement itself.

Can the Ombusdman, the European Parliament and the Court of justice be considered simple “third parties” ?

However I am less convinced of the EP Legal Service reasoning  when it justify  the EUROPOL refusal to give the Ombusdman access to the JSB report because the originator’s  principle is embodied in …the Europol internal Security Rules.

First of all I believe that in case of conflict between the Europol Security Rules (which mirror the Council Internal security rules which themselves are implementing measure of art. 9 of Regulation 1049/01) and the Ombudsman Statute the latter should  prevail as the latter it is a direct implementation of the Treaty and is of legislative nature (as it has been adopted in codecision by the European Parliament and the Council).

Secondly (and more importantly) I consider that the question as highlighted by the Ombudsman is indeed more of constitutional nature and deals with the preservation of the principle of institutional balance in an autonomous legal order as it is the European Union (see the recent Court of Justice opinion 2/13 on the EU accession to the ECHR).

Under this perspective I think that the way how the Council has implemented the art 9 of Regulation 1049/01 is creating a sort of “executive privilege” which has no  basis in the EU primary law and can which moreover is threatening the prerogatives of the other institutions.

I find also misleading (to say the least) the formula applied by the Council in the international agreements on the exchange of classified information (even if now limited to external security policy). The formula is the following : 

“The EU institutions and entities to which this Agreement applies shall be: the European Council, the Council of the European Union (hereinafter ‘the Council’), the General Secretariat of the Council, the High Representative of the Union for Foreign Affairs and Security Policy, the European External Action Service (hereinafter ‘the EEAS’) and the European Commission. For the purposes of this Agreement, these institutions and entities shall be referred to as ‘the EU’..”

How can be considered complying with the EU founding values of democracy and of the rule of law as well as with the principle of legal certainty a formula which give the right to a third country such as Russia, Georgia, Turkey,  (4)  to decide that the Ombudsman, the European Parliament and the Court of Justice are “third parties which can be forbidden from acceding to classified information” even when their access is linked with the exercise of their constitutional prerogatives? (5)

Conclusions

For all these reasons I think that the Ombudsman should had challenged the Europol refusal before the Court of justice by giving to the Luxembourg Judges the possibility to better frame the scope of the originator’s principle and of the “third party” rule in the EU law.

In the meantime it could also be possible that the Commission (and notably its Vice president of  Timmermans in charge of the Rule of law of the EU Charter) take on board the amendments to Regulation 1049/01 (and to art. 9) as voted by the European Parliament on December 2011.

Last but not least I think that also the European Parliament should take advantage of what he has learned in Ombudsman-Europol case in  the  current negotiations with the Council on the post-Lisbon  EUROPOL decision. It could be worth amending some worrying articles of the Council “general approach” (Council Doc 10033/14 of May 28 2014) . For instance art.67 of rightly makes reference to Regulation 1049/01 but art. 69 makes reference to the Council Internal Security rules instead to art. 9 of Regulation 1049/01. I think it could also be wise to examine the content of the Europol adopted and pending international agreements as the Council “general approach” foresee  that Europol International agreements “established on the basis of Decision 2009/371/JHA and agreements concluded by Europol as established by the Europol Convention before 1 January 2010 should remain in force”.

NOTES

(1)  “General principles and limits on grounds of public or private interest governing this right of access to documents shall be determined by the European Parliament and the Council, by means of regulations, acting in accordance with the ordinary legislative procedure.” (art. 15 p 3 TFEU)

(2)  See for example the 2011 agreement between the EU and Serbia on the exchange of classified information)

(3) Art 40 TEU. “The implementation of the common foreign and security policy shall not affect the application of the procedures and the extent of the powers of the institutions laid down by the Treaties for the exercise of the Union competences referred to in Articles 3 to 6 of the Treaty on the Functioning of the European Union. 

Similarly, the implementation of the policies listed in those Articles shall not affect the application of the procedures and the extent of the powers of the institutions laid down by the Treaties for the exercise of the Union competences under this Chapter.”

(4)  The third Countries with which the agreements have been concluded are :   Australia, Bosnia and Herzegovina, Former Yugoslav Republic of Macedonia, Iceland,  Israel, Liechtenstein, Montenegro, Norway, Serbia, Switzerland, Ukraine and United States of America. Agreements have also been signed with: Canada (Negotiating mandate approved by the Council  on 21.10.2003 – Under negotiation),  Turkey (Negotiated but not yet approved by the Council), Russian Federation (Agreement signed on 01.6.2010 and published  in OJ L 155, 22.6.2010, p.57. Exchange of  notes verbales following entry into force of the  Lisbon Treaty . Negotiations on  the implementing arrangements are ongoing), Albania Negotiating mandate approved by the Council  on 20.01.2014 (Under  negotiation), Georgia (Negotiating mandate approved by the Council  on 20.01.2014.Under negotiation).

(5) The fact that  the “third party rule” constitutes a guarantee for the third party to a certain extent, but it is not an absolute principle of law has been debated during the negotiations of the EU-Canada exchange of classified informations (with reference to Section 38 of the Canada Evidence Act).

TRIBUNE : “Schengen”, terrorism and security (Bertoncini / Vitorino)

by Yves Bertoncini and Antonio Vitorino (*)

The Paris attacks of January 2015 gave rise to an emotion shared by millions of Europeans, while fueling some doubts on their ability to combat terrorist threats within the “Schengen Area”, write Yves Bertoncini and António Vitorino.

1. The Schengen Agreement has resulted in a diversification of police checks, making them more effective, including those to identify terrorist threats.

The creation of the Schengen Area, which currently comprises twenty-six member countries, including twenty-two of the twenty-eight EU Member States, has led to a redeployment of national and European police checks, based on four complementary principles.

Firstly, the closure of permanent “internal” border posts within the Schengen Area, in order to avoid long and pointless queues to hundreds of thousands of Europeans who cross over every week to work, study, meet relatives and enjoy themselves – while this wait remains compulsory for those who wish to travel to or from Bulgaria, Cyprus, Croatia, Ireland, Romania and the United Kingdom.

Secondly, the organisation of mobile patrols across all Schengen Area member countries, which may be conducted jointly: these checks are much more effective, particularly with regard to the fight against cross-border crime and terrorism, as they can be used to flush out wanted persons when they are not expecting it (as is the case at a border). No terrorist has ever declared his intention when crossing a border!

Thirdly, the joint management of external borders, which are ipso facto “our” borders, as those crossing them can travel to other member countries, provided that they comply with European regulations on visas and resources. These common borders are land, sea and air borders (all airports welcoming flights from non-Schengen countries). Each country is in charge of a section of these borders, and must act to combat terrorist threats as a priority, particularly when they escalate due to conflicts occurring around the EU, namely in the Middle East and the Sahel regions.

Lastly, the possibility of applying “safeguard clauses” to reestablish national border checks for a limited period of time, for example during sporting or social events, and also in the case of terrorist threats. These clauses have already been used dozens of times since 1985, under EU supervision, in order to enable governments to deal with emergency situations.

2. Terrorist threats call for the spirit of the Schengen Agreement to be furthered

The emotion aroused in the aftermath of terrorist attacks often revives a need for reassurance that can be centred around the reopening of posts at national borders, given their importance in the collective psyche. In-depth considerations, however, urge us to satisfy this need for security within the very framework of the Schengen Area, in which the spirit of cooperation and mutual trust must be fostered.

The Madrid bombings in March 2004 were perpetrated by Islamic fundamentalists from Morocco and the East, with the complicity of Spanish nationals: it is through increased security at the Schengen Area’s external borders and stronger police and judicial cooperation that this terrorist attack could have been thwarted. While it is not a member of the Schengen Area, the United Kingdom was the target of bloody attacks in July 2005. These attacks were perpetrated by British nationals, one of whom was able to leave the country after crossing a national border: he was arrested in Rome, thanks to European police and judicial cooperation.

The perpetrators of the Paris attacks in January 2015 were born in France and were known to the country’s police and legal departments and/or its intelligence services. One of the men had been checked by Paris police a few days prior to the attacks and a few hours before leaving for Spain with his girlfriend, currently in hiding in Syria. In light of the information in the police’s possession, it’s equally unlikely that he would have been detained at the border between France and Spain. In hindsight, it can be noted that the surveillance of the three terrorists was insufficiently constant and effective to be able to detect their intention to attack.

It is by granting additional financial, human and legal resources to the police and justice bodies on both national and European levels that we can combat such terrorist attacks more effectively. Not by allocating these resources to controls at Schengen Area internal borders, which would result in pointless and very onerous checks of the millions of crossings that take place each month.

3. The police and judicial cooperation organised by the Schengen Agreement and the EU must be reinforced, including cooperation to combat terrorism

The Convention implementing the Schengen Agreement is made up of 141 articles, which were then integrated into community legislation. The first articles set out the rules that offer residents of member countries the possibility of freedom of movement. Most of the articles concern the organisation of police and judicial cooperation between national authorities – in which even non-member countries such as the United Kingdom may take part occasionally. “Schengen” therefore results in greater freedom and increased security, efforts intended to compensate and to balance, but which could be reassessed in light of terrorist threats.

The reinforcement of the financial and human resources allocated to member country policing and justice must come together with an improvement of the “Schengen Information System”, and the stepping up of exchanges between intelligence services, including bilateral arrangements. The creation of a European legal framework for air passenger data exchanges (known as “EU-PNR”) will improve police forces’ effectiveness – while the guarantees governing the use of personal data are reinforced in consequence.

European bodies such as Europol, Eurojust and the Frontex agency could step up their technical assistance for member countries if they were allocated more resources. They will contribute to reinforcing the quality of checks conducted in all respects of the Schengen Area, including on the basis of one-off assessment assignments that target suspected “weak links” and by heightening mutual trust between countries.

In conclusion, European cooperation with third countries in which terrorists are likely to travel must be improved – for example Turkey and North African countries – and also with the USA. A globalised movement of police and judicial cooperation must be promoted to increase Europeans’ safety, against a movement of unrealistic and ineffective focus on national borders.

An improved application of the Schengen Area’s operating rules is without doubt possible, to enable its member countries and the EU to withstand terrorist threats. Questioning these rules does not in any way impede freedom of movement, a right granted since the Rome Treaty to all EU residents, regardless of whether or not their country is a member of the Schengen Area. Yet this would make the exercise of this right much more complex and costly, while undermining the shared responsibility that Europeans require in order to dismantle terrorist networks.

(*) António Vitorino is president and Yves Bertoncini director of Notre Europe – Jacques Delors Institute, the EU think tank based in Paris. Vitorino is also former European Commissioner for justice and home affairs.

This Tribune of Notre Europe / Jacques DELORS Institute was also published on the HuffingtonPost.fr and on Euractiv.com.