Speaking of EU legislation and.. of sausages making. Still today there is no way of knowing how EU “Safe Countries” legislation was made ..

By Emilio De Capitani

Setting the ..table

“Laws are like sausages. It is best not to see them being made” is the most famous Otto Bismark’s quote, (even though, there’s no evidence, that Bismarck ever said it, much less coined it…). This statement may well come to mind when looking at the procedure followed by the EU legislators when preparing, negotiating and adopting the legislation on “Safe Countries”. The legislative act is Regulation (EU) 2024/1348 establishing a common procedure for international protection in the Union. It consolidates the first list of EU “Safe countries” established by Regulation (EU) 2026/464 as well as the new rules defining the concept of ‘safe country’ eg Regulation (EU) 2026/463

It is worth noting that these texts creates some “legal presumptions” whose main justification is to make easier to repatriate or expel both irregular migrants and people who have not been granted the right to asylum[1] These legal presumption which amounts to consider as unfounded most of the request for protection of the people trying to enter the EU from these third countries and because of this it significantly restricts the rights of people who are extradited, removed or turned back. It will be up to them to prove in very short deadlines that, in exceptional circumstances, the concept of a safe country of origin should not apply in their specific case (see paragraph 5 of Regulation 2026/464)[2] . Furthermore, the right to judicial protection, guaranteed by Article 47 of the Charter of Fundamental Rights of the European Union, would be severely restricted, as judicial appeals must be lodged within very short time limits, would not automatically have suspensive effect and, in the event of a negative decision, the individual would not be permitted to remain legally within the territory of the EU.

On these aspects it is worth recalling the art.52.1 of the EU  Charter which states “Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law (emphasis added) and respect the essence of those rights and freedoms.  Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.limitations to fundamental rights may be adopted “

Has the principle of legislative transparency been respected in the Safe Countries case ?

In the following lines I will focus notably on some principles of the EU Legislation which in my opinion have been violated in this case.

It is self evident that these three Regulations have been adopted under the joint responsibility of the European Parliament and of the Council [3]following the so called “ordinary procedure” (art.294 TFEU) and are therefore EU “legislative acts” (art.289 TFEU). However it is worth recalling that since Lisbon art.15.2 TFEU has established the obligation of  legislative transparency which covers not only the votes (as it was the case before Lisbon) but also debates and negotiating preparatory documents. Unsurprisingly the CJEU has declared in 2018 that “transparency is inherent to legislative procedure” as legislative transparency is the main expression of EU democratic nature. As such, the co-legislator obligation of proactively publishing legislative preparatory documents shall not depend from the aleatory condition that citizens may submit a request for access to these documents. Proactive publication of legislative preparatory documents paves also the way for citizens’ timely participation to the EU decision making process as granted by art.10.3  11 of the TEU.

Building on the CJEU jurisprudence on Safe Countries ..

Furthermore in the case of the EU legislation defining the “safe countries” the general obligation of legislative transparency foreseen by art.15.2 TFEU has already been strengthened by the CJEU jurisprudence. According to the judgment of the Court of Justice of the European Union in Alace and Canpelli (in joined cases C-758/24, paragraphs 86–87, and C-759/24), “ the information justifying the designation of a third country as ‘safe’ – and on which a legal presumption may be based – must be precise and accessible not only to the public but, in particular, to the person seeking asylum or being refused entry; and, above all, it must be verifiable by any court called upon to rule on the matter[4](emphasis added). This jurisprudence was referring to national legislation dealing with “safe countries” and in my opinion is transferrable also to EU legislation. Moreover Article 61 of the same ‘Procedures’ Regulation, provides for the use of ‘relevant and available’ sources in order to verify whether a country can be defined as safe.  In other words, the designation of a country as ‘safe’ cannot be the result of mere political discretion, as it affects the exercise of a fundamental right (the right to political asylum) and because it may limit the prohibition on expulsion laid down in the Charter of Fundamental Rights of the European Union.

Unfortunately, it is by no means clear from the text and the preparatory work on the European legislation concerning safe countries what information the legislator relied on in designating several third Countries as ‘safe’. This is notably the case of Regulation (EU) 2024/0464, which, despite affecting the exercise of fundamental rights, did not undergo an impact assessment, as required by the 2016 ‘Better Law-Making’ Interinstitutional Agreement. Instead it merely refers to information gathered by the European Asylum Agency (EUAA) which may be considered the real impact assesment in this case. As such, following the 2018 “ClientHeart” jurisprudence on the accessibility of legislative impact assessment  it should had been, at least partially disclosed.  No way: when in 2024 I submitted to the EUAA a request of access to that information I received a negative answer for procedural reasons. Then I challenged the refusal of disclosure before the General Court (case T-661/25).[5] On my side the history could had be ended here awaiting for the General Court Ruling but something, unexpected, happened and may now re-open the issue of legislative transparency of that EU legislation on Safe Countries even before the CJEU.

India is a “safe Country” ? No according to the association “Sikhs for Justice”

It is worth noting that the EU has declared, that INDIA is a “safe” Country  for all its territory and for all the categories of people living there notwithstanding Article 63 of the ‘Procedures’ Regulation would had permitted to exclude parts of the territory or specific categories of persons. The latter approach has been adopted, for example, by the legislation of the Netherlands, which states: “The designation of this country as a safe country of origin does not apply to: • people originating from the ‘union territory’ of Jammu and Kashmir; • religious minorities who have experienced problems because of belonging to that religious minority; • Dalit women and girls; • journalists; • persons who have been critical of the Indian government and government policy, and have experienced problems as a result (for example, human rights activists, academics and demonstrators).” ([6] )

However these reservations, which, if mirrored at EU level would allowed for greater protection of certain categories of people and citizens of certain Indian states, can no longer be invoked because the new EU-level general declaration ([7]) declaring India as safe takes precedence over national declarations. However, a number of questions may arise, such as: which of the two declarations more accurately reflects the reality on the ground in India? On what facts was the Netherlands’ decision based, and on what other elements the European legislator has decided that certain safeguards intended for specific categories of people and specific regions of India can no longer be invoked?

This may explain why a representative of the Sikhs for Justice association has recently submitted a request of access to documents to the European Parliament and to the Council of the European Union.

Both the EP and the Council have, at least as a first reaction, refused to disclose the EUAA information.

How EU legislative transparency may be granted by invoking “classified” information?

On one side it has been evoked the risk for EU external relations even though what is at stake is the autonomy of EU “internal” legislation and not international negotiations.

On the other side both the institutions have declared that the Asylum Agency has ‘classified’ these information as ‘RESTREINT’ and that the EP and the Council have retained that classification.

This is quite disturbing because first the only institutions which may “classify” EU information according to art.9 of Regulation 1049/01 are at very large extent the Commission, the EP and the Council which were the only institutions covered by art.255 TCE on which Regulation 1049/01 was founded. Moreover it emerges very clearly from the legislative preparatory work of Regulation 1049/01 that art.9 was as an exceptional regime for information covering only EU and MS defence policies ([8]) and clearly not information dealing with a Country general condition of “safety” as in the this case.

It is at least unfortunate that the this EUAA ‘classification’ has been  subsequently endorsed by the Commission when the legislative proposal and, later, by the Parliament and the Council in their capacity as legislators. However even if endorsed by the EP and the Council this choice  appears open to criticism, at the very least, in terms of both form and content. It is open to criticism in terms of form, insofar as the ‘RESTREINT’ level is not provided for in Article 9 of Regulation (EC) No 1049/01, the only European legislation dealing with ‘sensitive information’ that may be shared only with authorised persons (‘need to know’). But it is open to criticism above all on the merits, as two scenarios could be envisaged:

  1.  either this information proves that India is a safe country, in which case it is difficult to see what negative consequences a possible disclosure might have,
  2. or, conversely, it proves the opposite, in which case its ‘classification’ would violate European law on two counts.

Indeed, by declaring a country to be safe, despite independent information to the contrary, the European legislator would be exercising its remit in an arbitrary manner (which should instead be based on independent and objective information, precisely because it affects the exercise of a fundamental right such as the right to asylum and compliance with the prohibition on refoulement, as laid down in the Charter of Fundamental Rights).

Above all, however, the ‘classification’ of the information used to justify the concept of a ‘safe country’ meant that its contents could not be debated publicly during the legislative negotiations, particularly in the European Parliament which denounced this situation in its resolution on access to documents.[9]  

Conclusion

Invoking classified information to justify the non disclosure of legislative preparatory documents seems to me a clear breach of the principle of legislative transparency laid down in Article 15(2) of the Treaty on the Functioning of the European Union, and risks, unfortunately, of bringing the European legislator closer to that of North Korea[10] .

The procedure for access to documents, initiated by the Sikhs for Justice Association, is still ongoing, so it is not yet clear whether the European Court will be called upon to settle the matter, but in the meantime, the Sikhs for Justice association has taken steps to limit the damage caused by the new European regulations, including through ‘participatory’ channels, by publishing an open letter and by submitting a petition to the European Parliament calling for the suspension and amendment of India’s designation as a ‘safe country’ (as foreseen by Article 63 of the ‘Procedures’ Regulation)

It now remains to be seen whether the legality of designating India as a ‘safe’ country will be reviewed through the courts or following a legislative review process. Whatever the future of the European legislation may be, it is certainly commendable and noteworthy that representatives of civil society, such as the organisation Sikhs for Justice, are fighting so resolutely not only for the respect of their own fundamental rights, but also for better quality legislation and European democracy, in accordance with the principles of democracy, the rule of law, the protection of minorities, solidarity and non-discrimination, upon which the European Union is founded.


[1] Article 41(1)(e) and Article 3(a) concerning accelerated procedures

[2] see: https://eur-lex.europa.eu/legal-content/IT/TXT/PDF/?uri=OJ:L_202600464

[3]  As required by see art 14 and 16 TEU.

[4] SEE: “(86 ) However, the effectiveness of judicial review regarding compliance with the substantive conditions set out in Annex I to Directive 2013/32 presupposes that the court before which the case is brought has access to the sources of information on the basis of which the competent national authority designated the third country in question as a safe country of origin. That requirement of effectiveness also implies that the court in question must be able to verify whether that designation complies with the substantive conditions set out in Annex I to that directive, taking into account any other information it may have gathered itself, whether from public sources or from sources which it has requested one of the parties to the proceedings before it to produce, provided that, on the one hand, the reliability of that information has been established and, on the other hand, in accordance with the principle of the right to be heard, those parties have the opportunity to submit their observations on that information. (87 ) It follows that Member States are required, under Article 46(3) of Directive 2013/32, to adapt their national law in such a way as to ensure sufficient and adequate access to the sources of information on which they have relied in designating safe countries of origin. Such access must enable an applicant for international protection originating from such a country, and the national court hearing an appeal against a decision concerning the application for international protection, to familiarise themselves effectively with those sources of information in accordance with the case-law referred to in paragraph 78 of this judgment.”

[5] Even though the main issue at stake in this case is the fact that I have submitted my confirmatory application with two days delay that EUAA has considered mandatory and I consider only of ordinatory nature.  

[6] See Council document WK 8158/2025, pp. 23–24

[7]  According to Regulation (EU) “With regard to India, according to information from the Asylum Agency, nine Member States currently designate it as a safe country of origin at national level, and in 2024 the recognition rate at Union level for applicants from that country was 2 per cent. The country has ratified the main international human rights instruments. India is a constitutional republic with a parliamentary democracy. There is no evidence of expulsion, removal or extradition of Indian nationals to countries where they would be at risk of being subjected to the death penalty, torture, persecution or other inhuman or degrading treatment. In general, there is no real risk of serious harm within the meaning of Article 15 of Regulation (EU) 2024/1347. Although India retains the death penalty in its criminal law and has not signed the Second Optional Protocol to the International Covenant on Civil and Political Rights, which aims to abolish the death penalty, in practice the death penalty has not been carried out since 2020. India has signed the Convention against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment. There are no armed conflicts in India and, consequently, there are no threats arising from indiscriminate violence in situations of internal or international armed conflict. In general, there is no persecution in the country within the meaning of Article 9 of Regulation (EU) 2024/1347.”

[8] Following the adoption of art.9 the European parliament accepted to withdraw a Court Case dealing with an agreement between the Council and NATO (so called “Solana agreement”)

[9] “..calls, in particular, on the European Union Agency for Asylum (EUAA) to grant the European Parliament timely access to its documents, in particular information and analysis on safe countries of origin and safe non-EU countries..” Par 16 of  European Parliament resolution of 10 March 2026 on public access to documents – report covering the years 2022 – 2024 (2025/2137(INI)) (C/2026/4005)

[10] As stated in plenary by Graham Watson, Chair of the European Parliament’s Committee on Civil Liberties, on May 2nd,2000 when voting on the Access to documents last compromise.

Why the European Parliament should reject (or substantially amend)  the  Commission’s proposal on EU Information Security (“INFOSEC”). (1) The issue of “classified information”

By Emilio De Capitani

1.Setting the scene of EU legal framework on access to documents and to confidential information before the Lisbon Treaty

To better understand why the Commission “INFOSEC” draft legislative proposal (2022/0084(COD) on information security shall be substantially amended, let’s recall what was before the Lisbon Treaty and of the Charter, the EU legal framework on access to documents, and notably of EU classified information. With the entry into force of the Amsterdam Treaty on May 1999 the EP and the Council have been under the obligation (art.255 TCE) of adopting in two years time new EU rules framing the individual  right of access to documents by establishing at the same time “the general principles and limits of public interests” which may limit such right of access.(emphasis added).

Notwithstanding a rather prudent Commission’s legislative proposal the EP strongly advocated a stronger legal framework for access to documents, for legislative transparency and even for the treatment at EU level of information which, because of their content, should be treated confidentially (so called ,“sensitive” or “classified information”). 

Needless to say  “Sensitive” or “classified information” at Member States level, are deemed to protect “essential interests”  of the State and, by law, are subject to a special parliamentary and judicial oversight regime.[1] As a consequence, at EU level, even after Lisbon, national classified information are considered an essential aspect of national security which “.. remains the sole responsibility of each Member State” (art. 4.2 TEU) and “..no Member State shall be obliged to supply information the disclosure of which it considers contrary to the essential interests of its security;”(art 346.1(a)TFEU.

However, if national classified information is shared at EU level as it is the case for EU internal or external security policies it shall be treated as for any other EU policy by complying with EU rules. Point is on what legal basis these rules should be founded. This issue came to the fore already in 2000 when the newly appointed Council Secretary General Xavier SOLANA negotiated with NATO a first interim agreement on the exchange of classified information. The agreement which mirrored at EU level the NATO Classification standards (“Confidential”, “Secret” and “Top Secret”) was founded  on the Council internal organizational power  but this “administrative” approach was immediately challenged before the Court of Justice by the a Member State (NL) [2]and by the European Parliament itself [3] which considered that the correct legal basis should had been the new legislation on access to documents foreseen by art 255 of TEC which was at the time under negotiation.  The Council, at last, acknowledged that art.255 TEC on access to documents was right legal basis and a specific article (art.9[4]) was inserted in in Regulation 1049/01 implementing art.255 TEC and the EP and NL withdrew their applications before the CJEU[5].

Point is that Art.9 of Regulation 1049/01 still covers only the possible access by EU citizens and such access may be vetoed by the “originator” of the classified information. Unlike national legislation on classified information art.9 didn’t solved, unfortunately, for the lack of time, the issue of the democratic and judicial control by the European Parliament and by the Court of Justice to the EUCI. Art.9(7) of Regulation 1049/01 makes only a generic reference to the fact that “The Commission and the Council shall inform the European Parliament regarding sensitive documents in accordance with arrangements agreed between the institutions.” A transitional and partial solution has then been founded by negotiating Interinstitutional Agreements between the Council and the EP in 2002 [6]and in 2014 [7]and between the European Commission[8] in 2010.

Point is that interinstitutional agreements even if they may be binding (art.295 TFEU) they can only “facilitate” the implementation of EU law which, as described above,  in the case of democratic and judicial control of classified information still does not exists. Not surprisingly, both the Council and the Commission Interinstitutional agreements consider that the “originator” principle should also be binding for the other EU institutions such as the European Parliament  and the Court of Justice.

This situation is clearly unacceptable in an EU deemed to be democratic and bound by the rule of law as it create zones where not only the EU Citizens but also their Representatives may have no access because of “originator’s” veto. As result, in these situations the EU is no more governed by the rule of law but only by the “goodwill” of the former.

To make things even worse the Council established practice is to negotiate with third Countries and international organizations agreements [9]covering the exchange of confidential information by declaring that the other EU Institutions (such as the EP and the Court of Justice)  should be considered “third parties” subject then to the “originator” principle.

Such situation has become kafkianesque with the entry into force of the Lisbon treaty which recognize now at primary law level the EP right to be “fully and timely” informed also on classified information exchanged during the negotiation of an international agreement[10]. Inexplicabily , fourtheen years since the entry into force of the Traty the European Parliament has not yet challenged before the Court of Justice these clearly unlawful agreements.

That Institutional problem kept apart, fact remains that until the presentation of the draft INFOSEC proposal none challenged the idea that in the EU the correct legal basis supporting the treatment also of classified information should be the same of access to documents which after the entry into force of the Lisbon treaty is now art.15.3 of the TFEU[11].

2 Why the Commission choice of art 298 TFEU as the legal basis for the INFOSEC proposal is highly questionable [12]

After the entry into force of the Lisbon Treaty and of the Charter the relation between the fundamental right of access to documents and the corresponding obligation of the EU administration of granting administrative transparency and disclose or not its information/documents has now been strengthened also because of art.52 of the EU Charter.

In an EU bound by the rule of law and by democratic principles,  openness and the fundamental right of access should be the general rule and  “limits” to such rights should be an exception  framed only “by law”. As described above the correct legal basis for such “law” is art.15 of the TFEU which, as the former art.255 TEC, states that  “General principles and limits on grounds of public or private interest..” may limit the right of access and the obligation of disclosing EU internal information / documents. Also from a systemic point of view  “limits” to disclosure and to access are now covered by the same Treaty article which frames (in much stronger words than art 255 before Lisbon) the principles of “good governance”(par 1), of legislative transparency  (par 2) and of administrative transparency (par 3).

Such general “Transparency” rule is worded as following:    “1. In order to promote good governance and ensure the participation of civil society, the Union institutions, bodies, offices and agencies shall conduct their work as openly as possible.(..) Each institution, body, office or agency shall ensure that its proceedings are transparent and shall elaborate in its own Rules of Procedure specific provisions regarding access to its documents, in accordance with the regulations referred to in the second subparagraph.”

Bizarrely, the European Commission has chosen for the INFOSEC regulation art.298 TFEU on an open, independent and efficient EU administration by simply ignoring art.15 TFEU and by making an ambiguous reference to the fact that INFOSEC should be implemented “without prejudice” of the pre-Lisbon Regulation 1049/01 dealing with access to documents and administrative transparency.  How a “prejudice” may not exist when both Regulations are overlapping and INFOSEC Regulation is upgrading the Council Internal Security rules at legislative level is a challenging question.

It is indeed  self evident that both the INFOSEC Regulation and Regulation 1049/01 deal with the authorized/unauthorised “disclosure” of EU internal information/documents.

Such overlapping of the two Regulations is even more striking for the treatment  EU Classified information (EUCI) as these information are covered both by art. 9 of Regulation 1049/01 and now  by articles 18 to 58 and annexes II to VI of the INFOSEC Regulation.

As described above, Art 255 TCE has since Lisbon been replaced and strengthened by art 15 TFEU so that the Commission proposal of replacing it with art.298 TFEU looks like a “detournement de procedure” which may be challenged before the Court for almost the same reasons already raised in 2000 by the EP and by NL.  It would then been sensible to relaunch the negotiations on the revision of Regulation 1049 in the new post-Lisbon perspective but the Commission has decided this year to withdraw the relevant legislative procedure. Submitting a legislative proposal such INFOSEC promoting overall confidentiality and withdrawing at the same time a legislative proposal promoting transparency seems a rather Commission’s strong message to the public.

3 Does the INFOSEC proposal grant a true security for EU internal information?

Point is that European administrative transparency is now a fundamental right of the individual enshrined in the Charter (Article 42).The protection of administrative data is one of the aspects of the “duty” of good administration enshrined in Article 41 of the Charter which stipulates that every person has the right of access to their file, “with due regard for the legitimate interests of confidentiality and professional and business secrecy.”  

However Art.298 TFEU is not the legal basis framing professional secrecy. It is only a provision on the functioning of the institutions and bodies which, “in carrying out their tasks … [must be based] on an “open” European administration”[13] and is not an article intended to ensure the protection of administrative documents.

This objective is better served by other legal basis of the Treaties.

First of all, protecting the archives of EU institutions and bodies from outside interference is, even before being a legitimate interest, an imperative condition laid down by the Treatiesand the related 1965 Protocol on the Privileges and Immunities of the Union adopted on the basis of the current Article 343 TFEU. Articles 1 and 2 of that Protocol stipulate that the premises and buildings of the Union, as well as its archives, “shall be inviolable.”

Furthermore, in order to ensure that, in the performance of their duties, officials are obliged to protect the documents of their institutions, Article 17 of the Staff Regulations stipulates that

1. Officials shall refrain from any unauthorized disclosure of information coming to their knowledge in the course of their duties, unless such information has already been made public or is accessible to the public.

Again, (as for Regulation 1049/01), the INFOSEC regulation  reinstate that it should be applied “without prejudice” of the Staff Regulation by so mirroring the second paragraph of art.298 TFEU which states that itself states that it should be implemented  “in accordance with the Staff Regulations and the rules adopted on the basis of Article 336.” So, also from this second perspective, the correct legal basis for INFOSEC could be the Article 339 (on professional secrecy) and 336 TFEU, with the consequent amendment of the Staff Regulations by means of a legislative regulation of the Parliament and the Council.

By proposing a legislative regulation on the basis of Article 298, the Commission therefore circumvents both the obligation imposed by Article  336, art 339 (on professional secrecy)  and, more importantly  of Article 15(3) TFEU, according to which each institution or body “..shall ensure (i.e., must ensure) the transparency of its proceedings [and therefore also their protection from external interference] and shall lay down in its rules of procedure specific provisions concerning access to its documents [and therefore also concerning their protection], in accordance with the regulations referred to in the second subparagraph.”(NDR currently Regulation 1049/01)

The objectives set out in Article 298 cannot therefore override the requirements of protecting the fundamental right of access to documents, nor those of Article 15 TFEU which could be considered the “center of gravity”when several legal basis are competing [14].

The same applies to compliance with the regulation establishing the Statute and, in particular, compliance with Article 17 thereof, cited above.

Ultimately, the provisions on the legislative procedure for Union legislative acts are not at the disposal of the Commission, given that administrative transparency is a fundamental right and the protection of documents is a corollary thereof and not a means of functioning of the institutions. Administrative transparency is a fundamental right of every person; the protection of administrative data is a legitimate interest of every administration.

A ”public” interest that can certainly limit the right of access, but only under the conditions established by the legislator of art 15 TFEU and only by the latter.

4. Conclusions

If a recommendation may be made now to the co-legislators is to avoid illusionary shortcuts such as the current Commission proposal whose real impact on the EU administrative “bubble” is far to be clear[15] . The EU Legislator, since the entry into force of the Lisbon Treaty more than fourteen years ago is faced to much more pressing problems.

What is mostly needed is not inventing several layers of illusionary “protection” of the EU information but framing the administrative procedures by law as suggested several times by the European Parliament and by the multiannual endeavor of brilliant scholars focusing on the EU Administrative law[16].

What matters is that the management and the access to EU information should be framed by law and not depend from the goodwill of the administrative author or the receiver as proposed by the INFOSEC Regulation. Nor information security is strengthened transforming each one of the 64 EU “entities” covered by the INFOSEC Regulation [17] in sand-boxes where the information is shared only with the people who, according to the “originator” has a “need to know” and not a “right to know”.

Moreover the EU should limit and not generalize the power for each one of the 64 EU entities of create “classified” information (EUCI). In this perspective art.9 of Regulation 1049/01 needs indeed a true revision but in view of the new EU Constitutional framework and of the new institutional balance arising from the Lisbon treaty and of the Charter.

Fourtheen years after Lisbon the democratic oversight of the European Parliament and the judicial control of the Court of Justice on classified documents , shall be granted by EU law as it is the case in most of the EU Countriesand not by interinstitutional agreements which maintain the “Originator” against these institutions in violation of the rule of law principle as well as of the EU institutional balance.

Could still be acceptable fourteen years after the entry into force of the Lisbon Treaty that the European Parliament and the Court of justice are not taken in account in the dozens of international agreements by which the Council frame the exchange of EUCI with third countries and international organizations?

Instead of dealing with these fundamental issues the European Commission in its 67 pages proposal makes no reference to 24 years of experience in the treatment of classified information and prefer dragging the co-legislators in Kafkian debates dealing with “sensitive but not classified information”  or on the strange idea by which documents should marked “public” by purpose and not by their nature (by so crossing the line separating public transparency from public propaganda).

But all that been said, it is not the Commission which will be responsible before the Citizens (and the European Court) for badly drafted legislation. It will be the European Parliament and the Council which shall now take their responsibility. They can’t hide behind the Commission unwillingness to deal with substantive issues (as well as with other aspects of legislative and administrative transparency) ; if the Council also prefer maintain the things as they were before Lisbon it is up to the European Parliament to take the lead and establish a frank discussion with the other co-legislator and verify if there is the will of fixing the real growing shortcomings in the EU administrative “Bubble”.

Continuing with the negotiations on the current version of the INFOSEC proposal notably on the complex issue of classified information paves the way to even bigger problems which (better soon than later) risk to  be brought as in 2000 on the CJEU table.


[1] According to the Venice Commission “.. at International and national level access to classified documents is restricted by law to a particular group of persons. A formal security clearance is required to handle classified documents or access classified data. Such restrictions on the fundamental right of access to information are permissible only when disclosure will result in substantial harm to a protected interest and the resulting harm is greater than the public interest in disclosure.  Danger is that if authorities engage in human rights violations and declare those activities state secrets and thus avoid any judicial oversight and accountability. Giving bureaucrats new powers to classify even more information will have a chilling effect on freedom of information – the touchstone freedom for all other rights and democracy – and it may also hinder the strive towards transparent and democratic governance as foreseen since Lisbon by art.15.1 of TFEU (emphasis added) The basic fear is that secrecy bills will be abused by authorities and that they lead to wide classification of information which ought to be publicly accessible for the sake of democratic accountability.  Unreasonable secrecy is thus seen as acting against national security as “it shields incompetence and inaction, at a time that competence and action are both badly needed”. (…) Authorities must provide reasons for any refusal to provide access to information.  The ways the laws are crafted and applied must be in a manner that conforms to the strict requirements provided for in the restriction clauses of the freedom of information provisions in the ECHR and the ICCPR.” 

[2] Action brought on 9 October 2000 by the Kingdom of the Netherlands against the Council of the European Union (Case C-369/00) (2000/C 316/37)

[3] Action brought on 23 October 2000 by the European Parliament against the Council of the European Union (Case C-387/00) (2000/C 355/31) LINK chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:C2000/355/31

[4] Regulation 1049/01 Article 9”Treatment of sensitive documents

1. Sensitive documents are documents originating from the institutions or the agencies established by them, from Member States, third countries or International Organisations, classified as “TRÈS SECRET/TOP SECRET”, “SECRET” or “CONFIDENTIEL” in accordance with the rules of the institution concerned, which protect essential interests of the European Union or of one or more of its Member States in the areas covered by Article 4(1)(a), notably public security, defence and military matters.

2. Applications for access to sensitive documents under the procedures laid down in Articles 7 and 8 shall be handled only by those persons who have a right to acquaint themselves with those documents. These persons shall also, without prejudice to Article 11(2), assess which references to sensitive documents could be made in the public register.

3. Sensitive documents shall be recorded in the register or released only with the consent of the originator.

4. An institution which decides to refuse access to a sensitive document shall give the reasons for its decision in a manner which does not harm the interests protected in Article 4.

5. Member States shall take appropriate measures to ensure that when handling applications for sensitive documents the principles in this Article and Article 4 are respected.

6. The rules of the institutions concerning sensitive documents shall be made public.

7. The Commission and the Council shall inform the European Parliament regarding sensitive documents in accordance with arrangements agreed between the institutions.

[5] Notice for the OJ.Removal from the register of Case C-387/001By order of 22 March 2002 the President of the Court of Justice of the European Communities ordered the removal from the register of Case C-387/00: European Parliament v Council of the European Union. OJ C 355 of 09.12.2000.

[6] Interinstitutional Agreement of 20 November 2002 between the European Parliament and the Council concerning access by the European Parliament to sensitive information of the Council in the field of security and defence policy (OJ C 298, 30.11.2002, p. 1).

[7] According to the Interinstitutional Agreement of 12 March 2014 between the European Parliament and the Council concerning the forwarding to and handling by the European Parliament of classified information held by the Council on matters other than those in the area of the common foreign and security policy (OJ C 95, 1.4.2014, pp. 1–7) “4.   The Council may grant the European Parliament access to classified information which originates in other Union institutions, bodies, offices or agencies, or in Member States, third States or international organisations only with the prior written consent of the originator.”

[8] According to annex III point 5 of the Framework Agreement on relations between the European Parliament and the European Commission (OJ L 304, 20.11.2010, pp. 47–62) In the case of international agreements the conclusion of which requires Parliament’s consent, the Commission shall provide to Parliament during the negotiation process all relevant information that it also provides to the Council (or to the special committee appointed by the Council). This shall include draft amendments to adopted negotiating directives, draft negotiating texts, agreed articles, the agreed date for initialling the agreement and the text of the agreement to be initialled. The Commission shall also transmit to Parliament, as it does to the Council (or to the special committee appointed by the Council), any relevant documents received from third parties, subject to the originator’s consent. The Commission shall keep the responsible parliamentary committee informed about developments in the negotiations and, in particular, explain how Parliament’s views have been taken into account.”

[9] SEE : Agreements on the security of classified information Link : https://eur-lex.europa.eu/EN/legal-content/summary/agreements-on-the-security-of-classified-information.html

[10] Article 218.10 TFUE states clearly that “The European Parliament shall be immediately and fully informed at all stages of the procedure” when the EU is negotiating international agreements even when the agreements “relates exclusively or principally to the common foreign and security policy,” (art.218.3 TFUE).

[11] Interestingly reference to art.15 of the TFEU is also made in the EP-Council 2014 Interinstitutional Agreement on access to classified information (not dealing with External Defence) See point 15 :  This Agreement is without prejudice to existing and future rules on access to documents adopted in accordance with Article 15(3) TFEU; rules on the protection of personal data adopted in accordance with Article 16(2) TFEU; rules on the European Parliament’s right of inquiry adopted in accordance with third paragraph of Article 226 TFEU; and relevant provisions relating to the European Anti-Fraud Office (OLAF)

[12] However this legal basis was fit for another legislative proposal, of a more technical nature, which  has now become EU Regulation 2023/2841 layng  down measures for a high common level of cybersecurity for the institutions, bodies, offices and agencies of the Union. This Regulation apply at EU administrative level the principles established for the EU Member States by Directive (EU) 2022/2555 (2)  improving the cyber resilience and incident response capacities of public and private entities. It created an Interinstitutional Cybersecurity Board ( IICB) and a Computer Emergency Response Team (CERT) which operationalizes the standards defined by the IICB and interact with the other EU Agencies (such as the EU Agency dealing with informatic security, Enisa), the corresponding structures in the EU Member States and even the NATO structures. It may be too early to evaluate if the Regulation is fit for its purpose ([12]) but the general impression is that its new common and cooperative system of alert and mutual support between the EU Institutions, Agencies and bodies may comply with the letter and spirit of art.298 of the TFEU

[13] Quite bizarrely this “open” attribute is not cited in the INFOSEC proposal and, even more strangely, none of the EU institutions has until now consulted the EU Ombudsman and/or the Fundamental Rights Agency.

[14] See Case C-338/01 Commission of the European Communities v Council of the European Union(Directive 2001/44/EC – Choice of legal basis)“The choice of the legal basis for a Community measure must rest on objective factors amenable to judicial review, which include in particular the aim and the content of the measure. If examination of a Community measure reveals that it pursues a twofold purpose or that it has a twofold component and if one of these is identifiable as the main or predominant purpose or component whereas the other is merely incidental, the act must be based on a single legal basis, namely that required by the main or predominant purpose or component. By way of exception, if it is established that the measure simultaneously pursues several objectives which are inseparably linked without one being secondary and indirect in relation to the other, the measure must be founded on the corresponding legal bases…”

[15]  Suffice to cite the following legal disclaimer :”This Regulation is without prejudice to Regulation (Euratom) No 3/1958 17 , Regulation No 31 (EEC), 11 (EAEC), laying down the Staff Regulations of Officials and the Conditions of Employment of other servants of the European Economic Community and the European Atomic Energy Community 18 , Regulation (EC) 1049/2001 of the European Parliament and of the Council 19 , Regulation (EU) 2018/1725 of the European Parliament and of the Council 20 , Council Regulation (EEC, EURATOM) No 354/83 21 , Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council 22 , Regulation (EU) 2021/697 of the European Parliament and of the Council 23 , Regulation (EU) [2023/2841] of the European Parliament and of the Council 24 laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union.

[16]  See ReNEUAL Model Rules on EU Administrative Procedure. ReNEUAL working groups have developed a set of model rules designed as a draft proposal for  binding legislation identifying – on the basis of comparative research – best practices in different specific policies of the EU, in order to reinforce general principles of EU law

[17] The Council has listed not less than 64 EU entities (EU Institutions Agencies and Bodies – EUIBAs) in document WK8535/2023