Unaccompanied minor asylum-seekers: a step in the right direction?

Steve Peers

The EU’s Dublin system on the allocation of responsibility for asylum-seekers, which sets out rules determining which single Member State has responsibility for considering an asylum-seeker’s application, has long been decried as unworkable and an infringement of human rights. These broader arguments will be addressed in a future post on this blog, but for the moment it’s a good time to have a look at yesterday’s proposal from the Commission to ameliorate the Dublin system’s effects a little.

The proposal only covers applications by unaccompanied minors, who make up a small proportion of the total number of asylum-seekers. Nevertheless, they constitute a particularly vulnerable group. Currently, the Dublin III Regulation states that the Member State responsible for an unaccompanied minor asylum-seeker is the Member State where a family member or sibling of the minor is legally present, if that is in the best interests of the child. A ‘family member’ is defined as a spouse, parent or guardian (if the minor is unmarried), or child of the asylum-seeker, if the family already existed in the country of origin. If the minor is married but his or her spouse is not in the EU, then the Member State where his or parents are legally present is responsible.

If there are no such persons on the territory of a Member State, then the Member State where a ‘relative’ of the unaccompanied minor is legally present is responsible, if that relative can take care of him or her.  A ‘relative’ is defined as an aunt, uncle or grandparent.

If there are family members, siblings or relatives in multiple Member States, then the responsible Member State is decided on the basis of the best interests of the child.

Finally, if no such persons can be found, the ‘default’ rule is that the Member State responsible is the State where the unaccompanied minor has applied for asylum, if that is in his or her best interests. But the legislation does not expressly address how this rule applies if the minor applies for asylum in more than one Member State.

When the Dublin III Regulation was negotiated in 2012, these provisions were hotly disputed between the European Parliament and the Council. The two institutions finally agreed to leave the default rule untouched, since there was a pending case on the interpretation of that rule before the CJEU. However, they adopted a joint declaration calling on the Commission to consider making a proposal to amend the legislation as regards that issue once the Court had delivered its ruling.

The Court gave its ruling in that case (MA) in June 2013, and the Commission has now presented its proposal. According to the Court, where an unaccompanied minor has already made an application for asylum in one Member State, and then proceeds to make an application in another one, the default rule should be interpreted to mean that the Member State where the most recent application was made is responsible for the application.

In the Court’s view, this interpretation was necessary first of all for literal reasons, as the legislation does not refer to the first Member State where the application was made. Secondly, unaccompanied minors were vulnerable persons, so the procedure to apply the Dublin rules should be as short as possible. Finally, this interpretation was most consistent with the ‘best interest of the child’, as required by Article 24 of the EU Charter of Fundamental Rights.

Yesterday’s proposal would first of all entrench the Court’s interpretation as an express rule in the Dublin Regulation, covering all cases where the asylum-seeker had applied in multiple Member States. This is the interpretation that the EP favoured, and had tried to fight for as an express rule back in 2012.

It would also set out a new rule which would apply when the unaccompanied minor has made an asylum application in one Member State, and is present in a second Member State, but has notmade an application in the second Member State.  In that case, the second Member State should ‘inform’ the child of the possibility of applying for asylum there, and give him or her an ‘effective opportunity’ to apply.

If the minor takes up the opportunity to apply for asylum in the second Member State, that Member State becomes responsible for the application. If he or she does not apply, then the Member State where he or she has most recently applied is responsible.

The new proposal also specifies that the Member States concerned shall cooperate to establish what the best interests of the child are. Finally, it sets out an express rule on Member States informing each other of their decisions; the CJEU had already established such an obligation in the MA judgment.

Comments

In principle this proposal is very welcome, given that it exempts unaccompanied minors from the full rigour of the Dublin rules. While this might reduce the pressure to reform those rules, there is little prospect of a fundamental change in those rules (at least at the EU legislature's behest; the courts may be a different matter). So at least one category of vulnerable persons can escape from them. 

More particularly, the proposal both confirms the ‘applicant’s choice’ rule for unaccompanied minors without family members first established by last year’s judgment, and also extends that rule to more situations. However, there are certain limits on the proposal, and flaws which could be improved.

First of all, it should be noted that the proposal does not cover the position of those whose application for asylum has already been rejected in another Member State. But the Court of Justice referred to that issue in its MA judgment, noting that in such cases the second Member State has the option to treat the application as inadmissible in accordance with the EU’s asylum procedures rules. Presumably that rule would continue to apply here.

On this point, however, in principle there should not be many fast-track refusals of applications by unaccompanied minors, given the convoluted exceptions from some of the fast-track rules set out in the second-phase Directive on asylum procedures.

Secondly, the new amendment would not clarify what is meant by the obligation to ‘inform’ the child about applying for asylum and give him or her an ‘effective opportunity’ to apply for asylum. Although there is a rule in the Regulation already spelling out an obligation to inform asylum-seekers about Dublin rules, it only applies once the person concerned has applied for asylum. So it doesn’t cover the position of those who haven’t applied yet. There should be express rules on this issue, in order to ensure that the child is made fully aware of the choice of making a fresh application.

As for the effective opportunity to apply for asylum, there is a (rather vague) rule on this issue in the second-phase Directive on asylum procedures. But it isn’t clear if the proposed new rules in the Dublin Regulation would confer less, more or the same degree of protection than the rules in the Directive.

Thirdly, the prospect of Member States deciding between themselves on what is in the best interests of the child is problematic. Surely, in accordance with the EU Charter, the child has a right to express a view on this issue, especially since EU asylum law guarantees him or her the right to a representative for this very purpose? So the legislation should guarantee that any decision which Member States take which is purportedly in the best interests of the child should be open to challenge, following a prior right to a hearing and the disclosure of relevant information on this subject.

Next, the proposal may mean that more Member States in practice embark on the controversial practice of trying to determine the age of teenagers who claim to be 'minors' (the EU legislation defines this as being under 18). The asylum procedures Directive has rules on this issue, but there are no rules on what happens if the person turns 18 during the procedure.  

Finally, it must be noted that the rules will only be relevant for those minors who have the effective possibility of moving between Member States. They will need some knowledge of which Member States they might wish to apply to, and how to get there, as well as the money to arrange for their travel. Furthermore, they will obviously not be able to move to another Member State in order to apply there if they are in detention. On this point, it should be noted that the revised reception conditions Directive provides that unaccompanied minors can only be detained in ‘exceptional circumstances’.

Given the freedom of unaccompanied minors to make applications in another Member State, it cannot be argued that this possibility justifies their detention. In fact, the grounds for detention in the reception conditions Directive do not provide for such a case. Similarly, while the Dublin rules do allow detention if there is a ‘significant risk of absconding’, it is difficult to see how that ground for detention can apply to unaccompanied minors in light of these rules.  

Barnard & Peers: chapter 9, chapter 26 

Read More

The CJEU ensures basic democratic and judicial accountability of the EU’s foreign policy

 

Steve Peers

In today’s judgment in European Parliament v Council, the Court of Justice of the European Union (CJEU) has ensured that a minimum degree of democratic and judicial scrutiny applies to the EU’s Common Foreign and Security Policy (CFSP).

The European Parliament (EP) was challenging the Council’s decision to sign and conclude (ie, ratify) a treaty between the EU and Mauritius, relating to the EU’s military operation as regards pirates in the Indian Ocean. As discussed further in the previous blog post concerning the Advocate-General’s opinion, one important aspect of this treaty (and similar treaties with other nearby States) was the inclusion of rules governing the transfer, trial and treatment of alleged pirates to Mauritius, once the EU caught them.

The dispute had two elements – substantive and procedural – which will be considered in turn.

Substantive issues

In the Council’s view, this treaty ‘exclusively’ concerned the CFSP. In that case, Article 218 TFEU (the clause which sets out the procedures for negotiating and concluding international treaties by the EU) states that the EP does not even have to be consulted. But in the EP’s view, it had the right of consent over this treaty, since it also touched upon issues of development policy and criminal and police cooperation. Article 218 provides that where a treaty concerns issues where the EU’s ordinary legislative procedure applies (such as those policy areas), the EP has a right of consent before a treaty can be concluded.

The Court assumed that the EP was not actually arguing that the EU/Mauritius treaty should also have been adopted by means of the development policy, police and judicial cooperation legal bases. So therefore it confined itself to ruling on a narrow legal point. Article 218 states that when a proposal to negotiate a foreign policy treaty is first made to the Council, the Commission and the High Representative for the CFSP shall make recommendations where that treaty relates ‘exclusively or principally’ to the CFSP.

But the CJEU ruled that the different wording (‘exclusively or principally’ when recommending a negotiation, and ‘exclusively’ when concluding a treaty) was immaterial. In its view, the basic rule in Article 218 is an underlying parallelism between the internal powers of the EP and its external powers. So where it has an internal power of consent and control (for instance, pursuant to the ordinary legislative procedure), the EP should have a corresponding external control over the conclusion of treaties.

This approach inevitably meant that the EP lost its substantive argument, since Article 36 TEU only gives the EP the power to be informed and consulted of the main elements of the CFSP.

The Court’s analysis contrasts with that of the Advocate-General, who assumed that the EP was arguing that the treaty should have had also the legal bases regarding development policy and police and judicial cooperation. (His interesting arguments were fully discussed in the previous blog post).

Procedural issues

The EP’s procedural argument was based on a new clause added by the Treaty of Lisbon (Article 218(10)), which states that the EP ‘shall be immediately and fully informed at all stages of the procedure’. In this case, the Council had informed the EP of its decision to sign and conclude the agreement over three months after it had taken it.

But before the Court could rule on the merits of this argument, it had to rule on whether it had jurisdiction to consider it. Article 275 TFEU rules out the Court’s jurisdiction as regards the CFSP, except as regards sanctions on individuals or ‘legal base’ arguments.

Nevertheless, the Court asserted its jurisdiction, arguing that the rule in the Treaty was its ‘general jurisdiction’, and so Article 275 was a ‘derogation’ which had to be ‘interpreted narrowly’. So the Court did have jurisdiction to consider issues of procedure as distinct from substance, since the procedural legal basis for CFSP treaties is Article 218, ie a provision outside the scope of the CFSP rules as such.

The Court then ruled in favour of the EP’s main argument.  Unlike the Advocate-General, it reached the common-sense conclusion that a three-month delay in informing the EP did not constitute ‘immediately’ informing it. Publishing the treaty in the Official Journal was not enough, since the purpose of the information requirement was to ensure ‘democratic scrutiny’ by the EP, including as regards legal base issues. The failure to inform the EP was an ‘essential procedural requirement’, ie a ground to annul the act concerned under Article 263 TFEU, since it was ‘an expression of the democratic principles on which the [EU] is founded’.  

This information requirement applied even though the treaty in question concerned the CFSP, where the EP had no power of consent or even consultation. The Court emphasised that the information requirement applied to any sort of treaty, and to any stage of the procedure.

Comments

If the EP had won its argument on the substantive issues, it would have gained the power of consent over most foreign policy treaties, given their links (which the Treaties in fact require) with other aspects of EU external policies. It does appear that the EP was trying to argue a more general legal base point, and so the Court’s decision to confine itself to a more technical analysis is disappointing. If the Court had ruled on the substantive legal base arguments, it would have been its first clarification of the external scope of the EU’s policing and criminal law powers, and its first clarification of the scope of CFSP powers since the Treaty of Lisbon came into force. So the missed opportunity is unfortunate. Perhaps next time, the EP will challenge a foreign policy treaty more unambiguously, so that its legal base arguments are decided on the merits.

It could have been argued that the exception (as regards CFSP) to the normal rule that the EP has consent or consultation powers over international treaties is also a ‘derogation’ from the normal rule which had to be ‘interpreted narrowly’, just like the rule limiting the Court’s CFSP jurisdiction. However, the Court adopted different rules of interpretation as regards these two issues. One could deduce that the Court is more concerned about asserting its jurisdiction than enhancing the EP’s rights.

But having said that, the Court’s ruling on the procedural point is quite significant. First of all, as regards its own jurisdiction, the Court’s ruling means that any CFSP measure can be litigated before it, as long as the legal arguments relate to a procedural rule falling outside the scope of the CFSP provisions of the Treaty (Title V of the TEU). For instance, it arguably means that the Court would have the power to rule on the compatibility of proposed CFSP treaties with EU law, since that jurisdiction is conferred by Article 218 TFEU and not expressly ruled out by Article 275. But such disputes might often include arguments about the substanceof the measure concerned (for instance, whether it would breach the EU’s human rights obligations), and it could be awkward to distinguish between procedural and substantive issues in practice.

Secondly, as for the EP’s information rights, the Court’s reference to ‘all types of procedures envisaged in Article 218’ surely means that the EP must be given information at least about the recommendations to start negotiations, the decisions to open negotiations, the negotiating directives, the suspension of agreements and the adoption of EU positions in bodies set up by agreements, since all of those measures are referred to in Article 218. This allows the EP to indicate its point of view on draft or planned treaties or measures implementing them at an early stage of the process, allowing for further democratic input into the treaty-making process.

More broadly, the CJEU quite rightly rejected the absurd view that a three month wait could constitute an ‘immediate’ notification.  It applied the literal interpretation of the Treaty rule (applying to all treaties, and to every stage of the procedure) as well as the purposive rule (advocated in the previous blog post), agreeing that the purpose of the rule was to ensure democratic scrutiny and to allow the EP to ‘make known its views’. As I previously pointed out in that blog post, such public scrutiny would be an opportunity to discuss, for instance, whether the country in question had a problematic human rights record, and therefore to influence public debate over whether the treaty in question ought to be concluded.

 

Barnard & Peers: chapter 5, chapter 24, chapter 25

Read More

Pregnant workers and EU citizens’ free movement rights

Steve Peers

Jessy Saint Prix, a young French woman, came to live in Britain in 2006, in order to embark on a career as a school teacher. In the event, she has learned rather more than she probably anticipated about EU law and the English legal system.

Having worked for a year in the UK as a teaching assistant, she started a PGCE course, which would qualify her to be a teacher. In the midst of that course, she became pregnant.  So she dropped her course and registered with an agency. She had a few stints working in nurseries, but she found that work too difficult, now that she was nearly six months pregnant. Then she looked for other work, but didn’t find any, and so she gave up work about 12 weeks before the expected date of confinement.

In the meantime, her baby arrived. But despite her previous work as a teaching assistant and her later agency work, the UK government refused her claim for income support, as she was defined not as a worker, but as a  ‘person from abroad’. She challenged this in court, winning at first instance. But the government won at two further levels, and then the Supreme Court referred questions on the case to the Court of Justice of the European Union (CJEU). The CJEU finally ruled in her favour today. 

The main thrust of the Court’s analysis was the circumstances in which EU citizens retain the status of worker, and therefore access to benefits, having previously been employed in the host Member State (like Ms. Saint Prix). The EU’s citizens’ Directive states that a person retains the status of worker if they are ‘temporarily unable to work as a result of an illness or accident’, or in ‘involuntary unemployment’ (subject to certain conditions) or undertaking vocational training, which must be linked to their prior employment (as in Ms. Saint Prix’s case, before she quit her course) unless they are unemployed involuntarily. The relevant provision (Article 7(3) of the Directive) does not state whether this list is exhaustive or not.

But for the Court, that didn’t really matter. It reiterated its established case law that the concept of ‘worker’, referred to in Article 45 TFEU, is a matter of primary law. So the concept couldn’t be narrowed down by secondary law, although the Court confirmed that, in accordance with its sex discrimination case law, pregnancy could not be equated to an ‘illness’ under the Directive.

In this case, the definition of a worker could encompass someone in Ms. Saint Prix’s situation, who had previously been working in the host State, who gave up work less than three months before the birth due to the physical constraints of late pregnancy, and who began work again three months after childbirth, without leaving the Member State in question. Bizarrely, the Court compares her situation to an earlier judgment concerning prisoners who retained ‘worker’ status during their jail time.

However, retaining worker status in such a case is not unlimited. It is conditional upon returning to work or finding another job ‘within a reasonable period after confinement’. But what is a ‘reasonable period’? The CJEU said that this concept must take account of the ‘specific circumstances of the case’ as well as national law on the duration of maternity leave, in accordance with the EU Directive on pregnant workers.

That Directive provides for a minimum period of 14 weeks’ leave, at least two weeks of which must come before confinement. However, national law can set longer periods, and most Member States do. Although the Commission proposed back in 2008 that the Directive should be amended, in order to extend maternity leave to a minimum of 18 months, this proposal has not been agreed, and the Commission is now contemplating withdrawing it.

It should be emphasised that the CJEU made no reference to compliance with national law on the period of leave taken before confinement. Also, while the pregnant worker’s Directive allows Member States to set a qualifying period of work of up to a year before obtaining the right to maternity pay, there is no such condition as regards the right to maternity leave. So for the purposes of free movement law, the only qualification is that the person concerned can be defined as a worker.

The Court’s final point was to note that in order to obtain permanent residence status under the citizens’ Directive, which requires five years’ stay on the territory, a period of up to one year’s interruption of residence due to pregnancy or childbirth does not break continuity of residence. So a fortiori this should mean that worker status is retained during breaks due to pregnancy. However, the Court clearly does not mean by this that worker status would be retained during breaks lasting up to one year, in light of its earlier reference to the limits on the rule.   

Unlike the Advocate-General’s opinion, the Court of Justice made no mention of the Charter of Fundamental Rights or to sex discrimination issues more generally. Nevertheless, its judgment is obviously of great importance to migrant women who are EU citizens. It could also have a knock-on effect on the interpretation of EU law apply to third-country nationals. For instance, the meaning of ‘worker’ under the EU/Turkey association agreement is the same as under EU free movement law.

What are the limits and possibilities of this judgment for migrant women? One limit is that they have to qualify as a worker in the host State in the first place.  The Court’s insistence that it will define the concept of ‘worker’, despite the possible constraints of secondary law, leaves open the possibility that it will also override the limits in the citizens’ Directive relating to job-seekers’ access to benefits. However, the Court will be ruling on this issue separately in the near future (see the opinion in the pending Dano case).

Another limit is that they have to return to work (ie with their employer), or to find fresh work if they were temporarily unemployed at the time of childbirth, as in Ms. Saint Prix’s case. In fact, EU law makes it easy for a pregnant worker to retain her employment, since dismissal on grounds of pregnancy is banned by the pregnant workers’ Directive, except as regards ‘exceptional cases’ not linked to the pregnant worker’s condition. Anyway, pregnant workers would not normally need to apply for income support in such cases, since they can claim maternity pay or allowances under the pregnant workers’ Directive instead. But access to income support might still be relevant for those pregnant workers who have not yet satisfied the qualifying period for maternity pay under that Directive, as discussed above.

It’s obviously more problematic for a new mother who was unemployed by the end of her pregnancy to find work by the end of the national maternity leave period. Although Ms. Saint Prix was fortunately able to do so, not everyone will be able to. This could raise the awkward question of whether income support would have to be repaid in such cases.

There will likely be some unfortunate cases where ongoing medical problems arising from pregnancy and/or childbirth make seeking work impractical, even after the end of the maternity leave period. This issue has led to a mass of complicated and controversial case-law in the context of sex discrimination law. However, it should be recalled that under the citizens’ Directive, ‘worker’ status is retained by those former workers who are too ill to work. So because the CJEU’s sex discrimination case law treats medical problems which initially arose from pregnancy or childbirth as an ordinary illness, once the period of maternity leave is over, any women with such problems will still retain their ‘worker’ status (and therefore access to any relevant benefits) for the purposes of free movement law.  

Also, there will be some cases where the new mother does not find new work by the end of the maternity leave period despite her best efforts, or (more rarely) where her initial employer has become insolvent. For these difficult issues, it should be recalled that the Court refers to an obligation to consider the ‘specific circumstances of the case’, without further explanation. Arguably, this adds to, rather than qualifies, the reference to national law on maternity leave periods. In any event, the more general limits on expelling unemployed EU citizens would apply in such circumstances.  

It should be noted that the judgment logically applies also to those women who have previously worked in the host State, and then stopped work due to accident, involuntary unemployment, or vocational training, subject to the conditions in the Directive, since they all retain the status of ‘worker’. For Ms. Saint Prix, it wasn’t feasible to complete her course at the time she had initially planned, given the timing of her baby’s arrival. But for other women, whose baby is due after the end of their course, this could be of great practical importance.

Finally, today’s judgment should be seen in its broader context. EU law has long encouraged and facilitated the equal treatment of women on the labour market, including those women who are pregnant or who are mothers. It has also long encouraged and facilitated the free movement of workers. This judgment is the first opportunity for the CJEU to bring these two aspects of EU law together, and to confirm that migrant pregnant women also benefit fully from EU free movement law. Indeed, it is self-evident from the facts of this case that Ms. Saint Prix – like migrant workers generally – paid far more into the UK’s tax and benefits system than the benefits which she received from it.

Barnard & Peers: chapter 13, chapter 20

Read More

Europe v Facebook: the beginning of the end for NSA spying on EU citizens?

Steve Peers

Since the revelations about the extent of spying by the American National Security Agency (NSA) revealed by Edward Snowden, doubts have increased about the adequacy of the data protection regime in the United States, in particular as regards its impact on EU citizens, who are subject to the more favourable regime established by the Data Protection Directive. One aspect of these doubts concerns the ability of the NSA to examine the content of communications processed by social media companies based in the USA, such as Facebook.

Today’s decision by the Irish High Court to send questions in the ‘Europe v Facebook’ case to the CJEU raises the possibility that the NSA’s access to EU citizens’ personal data might soon come to an end. But it’s not clear if the CJEU will address the most essential issues directly, because the case raises a number of complex legal issues that need to be examined in more detail.

As a starting point, the basic legal regime governing transfers to Facebook is the ‘Safe Harbour’ system, which takes the form of a Commission Decision finding that all American companies certifying their participation in a system for complying with basic data protection principles maintain an ‘adequate’ level of data protection. This is one of the ‘adequacy decisions’ that the Commission can make pursuant to the rules on the data protection Directive on transfers of personal data outside the EU (see further my recent blog post on the planned reforms to this system). Despite the doubts arising from the Snowden revelations, the Commission’s most recent report on the Safe Harbour system did not suggest that the system should be 

Not everyone accepts these assertions, however. An Austrian citizen, Mr. Schrems, complained about the transfer of his personal data as a Facebook user pursuant to the Safe Harbour rules to the Irish data protection authority, which was competent in this matter because Facebook has a subsidiary in Ireland. The national authority argued that it could not take a decision on this complaint, because it was bound by the Commission’s decision. Moreover, it argued that the complaint was ‘frivolous’.

Mr. Schrems then challenged the authority’s decision before the Irish High Court. In its ruling today, the national judge therefore decided to send a question to the CJEU. Essentially, the question is whether the national data protection authority is bound by the Commission’s Decision, and whether that authority can conduct its own examination.

The first obvious question in this case is whether the American system infringes EU data protection law. Basing itself on the recent Digital Rights judgment of the CJEU, in which that Court ruled that the EU’s data retention Directive was invalid, the national court clearly believes that it does. While acknowledging the important anti-terrorist objectives of the law, the judge, when examining national constitutional law states that it is ‘very difficult’ to see how such mass surveillance ‘could pass any proportionality test or survive any constitutional scrutiny’. Indeed, such surveillance has ‘gloomy echoes’ of the mass surveillance carried out in ‘totalitarian states such as the [East Germany] of Ulbricht and Honeker’.

The judge equally believes that the US system is a violation of EU law, with no adequate or accessible safeguards available to EU citizens, and no consideration of EU law issues built in to the review process that does exist.

Is this analysis correct? There are two fundamental issues here which the national court doesn’t consider: the scope of the data protection directive, and the derogations from that Directive. On the question of scope, the CJEU previously found in its Passenger Name Records (PNR) judgment that the EU/US agreement which provided for the transfer of data from airlines to the US authorities was outside the scope of the data protection Directive, because it regulated essentially only the activities of law enforcement authorities, and the Directive does not apply to the ‘processing of personal data…in the course of an activity which falls outside the scope’ of EU law, such as…public security, defence, State security…and…criminal law’. On the other hand, the CJEU ruled that the data retention directive was correctly based on the EU’s internal market powers, since it essentially regulated the activity of private industry, albeit for public security objectives. While in this case, it might be argued that the Americanlaw in question falls within the first type of law, the Safe Harbour agreement clearly falls within the second. So it is a sort of hybrid question, but on balance the issue falls within the scope of the Directive, since the measure at issue is essentially the Safe Harbour agreement.

Secondly, the external transfer rules in the EU Directive do not refer expressly to the issue of derogations from data protection rights on public security grounds. Yet presumably some such derogations can exist, given that the Directive itself provides for public security derogations as regards the standard EU rules. Surely the security exceptions applied by third countries don’t have to be exactly the sameas those applied by the Directive. But some form of minimum standard must apply. For the reasons set out by the national judge, however, there is a strong argument that the US rules fall below the standard of anything which the EU can accept as ‘adequate’.  

Because the national judge takes these two issues for granted, there is no question sent to the CJEU on whether the American regime is either within the scope of the Directive, or violates the minimum standards of adequacy which the EU can accept as regards third states. But both these issues are absolutely essential in the debate over the post-Snowden relationship between the US and EU. It would therefore be desirable if the CJEU addressed them nonetheless.

Next, another problematic issue here is which set of EU data protection rules should apply: the external transfer rules, or the more stringent standard rules? The national court, along with the data protection authority, applies the external transfer rules, given Facebook’s certification under the Safe Harbour system. However, it is doubtful whether this is correct.

As is well known, in the recent Google Spain judgment, the CJEU ruled that the standard rules applied to Google’s search engine function, given that it had an ‘establishment’ in Spain, according to the Court’s interpretation of the rules. As I then argued on this blog, it probably follows from that judgment that the standard rules apply at least to some social networks like Facebook. In any event, the issue will arise again when the revised jurisdiction and external transfer rules, mentioned above, apply.  However, the complainant and the national court assume that the external transfer rules apply. Perhaps the CJEU should also examine this issue of its own motion.

Another problematic issue is the question of how to challenge the inadequacy of data protection in practice in the US, which is the subject of the only question sent to the CJEU. The Safe Harbour agreement addresses this point directly, since it allows national data protection authorities to suspend data transfers as regards an individual company, in accordance with existing national law, if either the US government or the US enforcement system has found a violation of that agreement, or if:

there is a substantial likelihood that the Principles are being violated; there is a reasonable basis for believing that the enforcement mechanism concerned is not taking or will not take adequate and timely steps to settle the case at issue; the continuing transfer would create an imminent risk of grave harm to data subjects; and the competent authorities in the Member State have made reasonable efforts under the circumstances to provide the organisation with notice and an opportunity to respond.

However, Irish national law does not provide for such a system, but simply sets out an irrebutable presumption that the Commission’s adequacy decision is sufficient. This rule may well have played a part in convincing Facebook and the subsidiaries of other US companies to set up in Ireland in the first place.

The challenge argued that the national data protection authority nevertheless had to exercise such powers, and so the national judge asked only whether this was possible. Logically, there can be only one answer, by extension from the NS judgment: Member States cannot create an irrebutable presumption that prevents the exercise of Charter rights, so the national data protection authority must have the powers in question.

In the alternative, or arguably additionally, it must be possible to challenge the validity of the Commission’s adequacy decision in the national courts, which would then have an obligation, if they thought that challenge was well-founded, to send questions on that point to the CJEU. (See the Foto-Frost judgment).

The next problematic issue is the role of the national constitutional protection for human rights. Clearly the national judge believes that the American system breaches the protection for the right to privacy guaranteed in the Irish constitution. Nevertheless, the national court proceeds to examine the issue primarily from the perspective of EU law. So if the CJEU rules against the challenge to the American law on the merits, or does not address those merits for procedural reasons, should the national court proceed to apply Irish law?

In principle, national constitutional law cannot apply here, since EU law, as the national court recognises, has extensively harmonised this issue. This means that, according to the Melloni judgment of the CJEU, only the EU’s human rights standards, in the form of the Charter, can apply. National constitutional standards cannot. But national courts in Ireland (and elsewhere) might be unwilling to accept that outcome.

National law would only apply if the CJEU rules that this issue falls entirely outside the scopeof the Directive, as discussed above. If, on the other hand, the processing falls within a public security derogationfrom the Directive, the EU Charter would apply, by analogy with the CJEU’s recent judgment in Pfleger (discussed here), in which it ruled that the Charter applies to national derogations from EU free movement law. This parallels the argument (discussed here) that national data retention law falls within the scope of EU law, following the Digital Rights judgment, because it is a derogation from the EU’s e-privacy Directive.

Finally, the consequences of any future finding by the national data protection authority that transfers under the Safe Harbour decision must be suspended as regards Facebook must be considered. Assuming that the US had not changed its law in the meantime, Facebook would have a dilemma: should it comply with its US legal obligations, or face the suspension of transfers of data from Europe? Possibly it could avoid this dilemma by ensuring that it only processed EU residents’ data within the EU, potentially avoiding the scope of US law. But this might be expensive, and in any event the US might seek to extend the scope of its law to cover such cases. These issues would inevitably arise for other major US companies as well.

Any real prospect that Facebook transfers from the EU might be blocked would cause a major earthquake in EU/US relations, making the concerns about the recent Google Spainjudgment look like a minor tremor. It may be that the only solution is for the US to take more seriously its ongoing discussions with the EU on data protection issues, with a view to reaching a solution that reconciles its security concerns with the basic principles of privacy protection.

Barnard & Peers: chapter 9 

Read More

The new guidelines for the Area of Freedom, Security and Justice: some critical comments

Emilio De Capitani

In the coming days the European Council will debate and adopt the long awaited Guidelines which will shape the future of the EU's Area of Freedom, Security and Justice for forthcoming years. These guidelines follow the end of the current Stockholm Programme (2009-2014) and come near the end of the last transitional period for the measures adopted before the entry into force of the Lisbon Treaty on police and judicial cooperation in criminal matters (what remains of the former intergovernmental  'third pillar' cooperation).

Regrettably the draft European Council Conclusions which have been circulated (see the Annex below) and the programme of the incoming “trio” Presidencies (Italian, Latvian and Luxembourg) which will implement them in the next 18 months confirm the worst provisions detailed in our previous post on this issue.

If anyone was searching for proof that European Strategies lack political vision and are a collection of bureaucratic and diplomatic choices, he or she will find in these documents the confirmation of this thesis.  

The emphasis of the European Council on the external dimension of the justice and home affairs polices by privileging soft law instruments such as the Global Approach on Migration or instruments such as mobility partnerships confirm two emerging trends since the entry into force of the Lisbon Treaty : 

- to transfer to the European Council the main EU political choices in the last area where the treaties still do not grant and effective parliamentary and judicial control. 

- to continue to avoid legally binding measures on which solidarity mechanisms can be established (Schengen, Frontex, and Eurosur being the exceptions which confirm the rule). 

Rhetorical declarations aside, the draft European Council guidelines confirm the choice for general (and generic) strategies such as the Internal security strategy or the anti-drugs strategy which are adopted without any debate between the European Council members nor with the European Parliament.

These Strategies should then be implemented by the so called “Policy Cycle” where EU agencies and the Member States representatives - instead of verifying their consistency with national internal security strategies deciding which areas the EU's intervention could add value in - pick and choose (on voluntary basis) some priorities which are approved without debate (as point A) by their ministers without (again) any European or national parliamentary debate.

Where choices and priorities are instead very clearly stated is on the role of the EU Agencies (Europol, Eurojust, EASO..) and bodies (the Anti Terrorism Coordinator) or where it is decided to go on with the establishment of an ambitious technocratic project such as the "smart borders" system (the feasibility of which is still to be proved even in the United States) or by creating an entry-exit system for third country nationals to control better the problems of the "over stayers" (those who remain after their initial permitted period of stay runs out) which apparently is one of the most dangerous threats to the EU. Needless to say that this idea is not new as it was raised by the US Congress years ago and  was considered “silly” in the US also by the former Homeland Security Secretary Chertoff under the BUSH administration.

Even worse, both the European Council draft Conclusions and the trio Presidency programme insist as one of their big priorities is the establishment of a "bona fide traveller" system which will discriminate between one traveller and another on the basis of de facto arbitrary criteria. They also reinstate their commitment to the creation of a European passenger name record (PNR) system.

These projects have in common the rather paranoic idea that any traveller is a potential danger. This is appalling in an European Union where there is still no permanent connection between the criminal records of the Member States, so that information on real criminals can be shared and where a terrorist (like the author of the attack to Jewish Museum in Brussels) can freely circulate even after been checked twice as a dangerous person on the Schengen information System.  

Selling out, for a false sense of security, the real fundamental rights of EU citizens, cannot be the real answer to the threats the EU will face in the coming years.

These inconsistencies can be solved by overcoming the 'silo' approach inside and between the MS and by better framing with a legislative measure the policy cooperation between the Member States (which still do not trust each other). True efficiency should then be measured if the threats are really supranational.

Even a project like  PNR could have its (crazy) logic if somewhere in Europe there were a central intelligence system which could filter these data against a massive intelligence analysis and profile, as happens in the USA. But as it has been designed, PNR will be only a policy laundering exercise where the European Union legislation is adopted to justify the collection of massive personal data at national level. Should we remember  that only on April 8th the Data retention directive, which followed the same logic, was annulled by the CJEU as a clear violation of the proportionality principle and of Articles 7 and 8 of the EU Charter?

The point is that selling out the personal data of EU citizens appears to the European Council less costly than building a real binding framework for police cooperation on the basis of Article 87 of the TFEU. The proof is given by the new Europol whose proposed legal basis (after amendments during negotiations) makes no more reference to Article 87 TFEU and which does not compel the Member States to share their security related informations.

These being the worrying projects on the European Council and Council side one can only hope that the newly elected European Parliament, in its July session, will challenge them and take the lead for a new alternative and legally sound policy which can shape in the next legislature an European area of Freedom, Security and Justice where the citizens' needs and not the administrations will be the real compass.

Barnard & Peers: chapter 25, chapter 26

Annex - draft Guidelines 

             

1.             One of the key objectives of the Union is to build an area of freedom, security and justice without internal borders, with full respect for fundamental rights. To this end, coherent policy measures need to be taken with respect to asylum, immigration, borders, police and judicial cooperation.

2.             All the dimensions of a Europe that protects its citizens and offers effective rights to people inside and outside the Union are interlinked. The success or failure in one field depends on the performance in the other fields as well as on synergies with related policy areas.  The answer to many of the challenges in the area of freedom, security and justice lies in relations with third countries, which calls for improving the link between the EU’s internal and external policies. This has to be reflected in the internal organisation of the EU institutions and bodies. Coordination with and within the Member States should be stepped up.

3.             Building on the past programmes, the overall priority is now to consistently transpose, effectively implement and consolidate the legal instruments and policy measures in place. Intensifying operational cooperation, enhancing the role of the different EU agencies and ensuring the strategic use of EU funds will be key. In further developing the area of freedom, security and justice over the next years, it will be crucial to ensure the protection of fundamental rights, including data protection, whilst addressing security concerns, also in relations with third countries, and to adopt a strong EU General Data Protection framework by 2015.

4.             Faced with challenges such as instability in many parts of the world as well as global demographic trends, an ageing population and skills shortages in Europe, the Union needs an efficient and well-managed migration and asylum policy. A comprehensive approach is required, optimizing the benefits of legal migration and offering protection to those in need while tackling irregular migration resolutely.

5.             To remain an attractive destination for talents and skills, Europe must compete in the global race for talent. Strategies to maximise the opportunities of legal migration should be developed, including the streamlining of existing rules and a dialogue with the business community. The Union should also support Member States' efforts for active integration policies which foster social cohesion and economic dynamism.

6.             The Union's commitment to international protection requires a strong European asylum policy based on the Treaty's principles of solidarity and responsibility. The full transposition and effective implementation of the Common European Asylum System (CEAS) is an absolute priority. This should result in high common standards and stronger cooperation, creating a level playing field where asylum seekers are given the same procedural guarantees and protection throughout the Union. It should go hand in hand with a reinforced role of the European Asylum Support Office (EASO), particularly in promoting the uniform application of the acquis. Converging practices will enhance mutual trust and allow to move to future next steps, including mutual recognition of asylum decisions.

7.             Addressing the root causes of irregular migration flows is an essential part of the EU migration policy. It is imperative to avoid the loss of lives of migrants undertaking hazardous journeys as well as to prevent and reduce irregular migration. A sustainable solution can only be found by intensifying cooperation with countries of origin and transit. Migration policies must become a much stronger integral part of the Union's external and development policies, applying the more for more principle and building on the Global Approach to Migration and Mobility. The focus should be on the following elements:

- strengthening and expanding Regional Protection Programmes, in particular in the Horn of Africa, in close collaboration with UNHCR. In view of the protracted crisis in Syria, increase contributions to global resettlement efforts;

- addressing smuggling and trafficking in human beings more forcefully, with a focus on priority countries and routes. Particular attention should go at present to the situation in Eritrea and the Sinai;

- establishing an effective common return policy and enforcement of readmission agreements;

- fully implementing the actions identified by the Task Force Mediterranean.

8.             The establishment of the Schengen zone, allowing people to travel without internal border controls, and the increasing numbers of people travelling to the EU require efficient management of the EU's external borders to ensure strong protection. This is in the first place the role of the Member States, which must fully take their responsibilities. At the same time the Union must mobilize all the tools at its disposal to support them in this task. To this end:

- the integrated management of the external borders should be modernised to ensure smart border management with an entry-exit system and registered travellers programme and helped by the new Agency for Large Scale IT systems (EU-LISA);

- Frontex, spearheading European solidarity in the area of border control, should reinforce its activities in terms of operational assistance and increase its reactivity towards rapid evolutions in migration flows, making full use of the new European Border Surveillance System EUROSUR;

- the possibility of setting up a European System of Border Guards to enhance the control and surveillance capabilities at our external borders should be explored.

At the same time, the common visa policy needs to be modernised by facilitating legitimate travelling while maintaining a high level of security and implementing the new Schengen governance system.

9.             It is essential to guarantee a genuine area of security to European citizens by preventing and combatting organised crime, human trafficking and corruption. At the same time, an effective EU Counter terrorism policy is needed, whereby all relevant actors work closely together, integrating the internal and external aspects of the fight against terrorism. In this context, the European Council reaffirms the role of the EU Counter Terrorism Coordinator. In its fight against organised crime and terrorism, the Union should back the national authorities by mobilising all instruments of judicial and police cooperation, with a reinforced coordination role for Europol and Eurojust, including through:

- the review of the internal security strategy;

- the improvement of cross-border information exchanges, including on criminal records;

- the development of a comprehensive approach to cybersecurity and cybercrime;

- the prevention of radicalisation and extremism and addressing the phenomenon of foreign fighters, including through a legal instrument allowing for EU wide alerts.

10.         The smooth functioning of a true European area of justice with respect of the different legal systems and traditions of the Member States is vital for the EU. In this regard, mutual trust in each other's justice systems should be further enhanced. A sound European justice policy will contribute to economic growth by helping businesses and consumers to benefit from a reliable business environment within the internal market. Further action is required to:

- promote the consistency and clarity of EU legislation for citizens and businesses;

-simplify access to justice; promote effective remedies and use of technological innovations including the use of e-justice; 

- examine the reinforcement of the rights of persons, notably vulnerable persons, in civil procedures to facilitate enforcement of judgements in family law and in civil and commercial matters;

- enhance mutual recognition of decisions and judgments in civil and criminal matters;

- reinforce exchanges of information between the authorities of the Member States;

- fight fraudulent behaviour and damages to the EU budget by advancing negotiations on the European Public Prosecutor's Office;

- facilitate cross-border activities and operational cooperation;

- enhance training for practitioners;

- mobilise the expertise of relevant EU agencies such as Eurojust and the Fundamental Rights Agency (FRA).

11.         As one of the fundamental freedoms of the European Union, the right of EU citizens to move freely and reside and work in other Member States needs to be protected, including against possible abuse or fraudulent claims.

12.         The European Council calls on the EU institutions and the Member States to ensure the appropriate legislative and operational follow-up to these guidelines and will hold a mid-term review in 2017. 

Read More

The reform of Europol: modern EU agency, or intergovernmental dinosaur?

Introduction

The EU’s police cooperation agency, Europol, has played a major role in the development of Justice and Home Affairs cooperation in the EU from an early stage. Europol was originally set up informally, then on the basis of a 1995 Convention, subsequently replaced by a Council Decision in 2009. While its powers have gradually been expanded, so has the controversy about its accountability and the adequacy of its data protection rules. Since it is a creature of the former 'third pillar' (the previous special rules on policing and criminal law) it is something of a 'dinosaur' in institutional terms, being an essentially intergovernmental body.

With the entry into force of the Treaty of Lisbon, the European Parliament (EP) now has joint powers with the Council as regards the adoption of a Regulation governing Europol, and the Treaty now refers expressly to the importance of ensuring accountability to both national parliaments and the EP. Furthermore, the EU institutions agreed in 2012 a ‘Common Understanding’ on standard rules which would apply to the governance of EU agencies. To expand Europol’s powers further, while addressing the issues of governance, accountability and data protection, the Commission proposed a new Regulation reconstituting Europol in 2013.

At the most recent Justice and Home Affairs Council, ministers agreed the Council’s position on the Commission’s proposal.  Since the European Parliament also recently agreed its own position, this clears the way for negotiations to take place between the two institutions for a final deal, once the EP is fully operational again following the recent elections. This is therefore a good time to examine the progress of discussions on the proposed Regulation so far.

It should be noted that Ireland has opted in to this proposed Regulation, while the UK and Denmark have opted out. The UK’s objections are due to the proposals to place national law enforcement bodies to comply with Europol’s requests to start investigations, and to supply information to Europol without a national security exception. However, as discussed further below, the Council’s and EP’s positions on the proposal address these issues, raising the possibility that the UK will opt in after adoption of the Regulation.

Europol’s powers

First and foremost, the Commission failed in its attempt to merge together Europol with the European Police College. The Commission thought it was a good idea to merge the two, given the overlap of their subject-matter. There has never been a merger of EU agencies before, for essentially political reasons: Member States fight bitter battles to host EU agencies, and so are reluctant to let one go once they have one. However, unusually, in this case the original host of the European Police College, the UK, was rather keen to kick the agency out, as it was planning to sell the space where the College was located and declared itself unable to find a new one.

So there was a golden opportunity to merge these two agencies, but neither the European Parliament nor the Council wanted to take it. In light of the Commission’s inflexible insistence on its proposal, an unprecedented group of 25 Member States tabled an initiative to amend the previous Decision establishing the European Police College, which was subsequently adopted. This new Regulation simply moves the College to Budapest. The Council has requested the Commission to make a separate proposal making further changes to the Police College, but it remains to be seen whether the Commission will do so, or whether it will continue to sulk about the failure of its original suggestion for a merger.

The Commission’s second main objective related to Europol itself. It cannot carry out ‘coercive powers’, according to the Treaties, and all three institutions agree that a clause to this effect should appear in the new Regulation.  So it is destined to remain an agency which gathers and analyses information, and it is only able to do the latter to the extent that it does the former. As dinosaurs go, Europol is clearly a herbivore, not a carnivore.

But the Commission nonetheless hoped to give Europol some sharper teeth. So it proposed two key amendments: a clarification of Member States’ obligation to give information to Europol, and an enlargement of Europol’s access to national databases. In parallel to this, the Commission’s proposal removed the detailed rules on the structure of data processing that existed in the Europol Decision (and before that, in the Europol Convention). In place of these very specific rules on analysis files and the Europol Information System, et al, there would instead be general provisions on data processing, which would be centred upon an obligation to ensure ‘privacy by design’.

The Council weakened the proposed rules which required national authorities in principle to act upon Europol’s request to initiate investigations. However, this issue is mainly symbolic, since there was no absolute obligation to act, under the Commission’s proposals (authorities could ‘decide not to comply’ with a request, on any grounds).

Furthermore, the Council did not accept the Commission’s proposal to allow Europol to contact national authorities directly in all cases, without going through the ‘Europol national units’ (the official points of contact between Europol and national forces). Instead, it simply provided (as at present) for the possibility for Member States to allow this. It also reinserted the current provisions which allow national authorities to refuse requests for information from Europol on grounds of national security, current investigations or intelligence activities.

However, the Council agreed with the proposal to give Europol a list of other new powers, and added new provisions giving Europol the power to assist with Schengen evaluations, as well as the evaluation of candidate Member States. It also specified that Member States have to allow their Financial Intelligence Units (special units dealing with money laundering) to collaborate with Europol. Finally, it wants to extend the fields of crime which Europol deals with to include war crimes and genocide as well as insider trading.

For its part, the EP, like the Council, voted against strengthening the provisions relating to Europol requests to Member States, although it did agree to Europol’s direct contact with national authorities (under certain conditions). It also agreed to retain the provisions allowing authorities to refuse requests from information from Europol.

Furthermore, the EP wants to reinsert the existing conditions relating to Europol’s participation in joint investigation teams, whereas the Commission (and the Council) want to provide only for general rules in this respect.

Data processing and data protection

Europol’s powers are inevitably closely linked with the data processing and data protection rules that apply to its processing of personal data. On this point, the Commission’s main objective with its proposal was to enhance the data protection framework of Europol by ensuring that its data protection supervisor was fully independent and had effective powers.

To this end, the Commission suggested more detailed rules on data processing and more data protection rights for individuals. The rules on external transfers of data outside the EU, which currently allow Europol itself to sign treaties with the Council’s approval, would be replaced by the general external relations rules of EU law (treaty negotiations carried out by the Commission, treaties concluded by the Council after consent by the EP). In general, the rules on transferring data to third States would be modelled on the rules in the EU data protection directive (see the recent post on this blog), allowing for transfers in principle only where a third State’s data protection has been judged ‘adequate’, with limited derogations from this rule. The supervisory powers currently held by a Joint Supervisory Board would be transferred to existing European Data Protection Supervisor (EDPS), which has data protection supervisory power as regards most EU agencies.   

The Council would amend the proposal to add a general power to process personal data in order to facilitate information exchange between Europol, other EU bodies, third countries, Member States and international organisations. Also, the Council would impose an absolute obligation for Europol to inform Member States about information concerning them. The Council would also allow for broader derogations from the normal rules as regards the transfers of data to third countries, adding grounds relating to legal claims and the combating of criminal offences.

As for data protection rules, the Council would strengthen the proposal by banning the selection of a group persons purely on the basis of a ‘sensitive’ ground, such as racial origin. It would also add a requirement for Europol to notify its data protection officer and the EDPS in the event of a security breach. Europol would also have to inform data subjects of the time period for the processing of their data, and the right to make requests to Europol for erasure, et al of that data.

However, the Council would drop the requirement for Europol to report on its processing of sensitive data every six months to the EDPS. Also, Europol would have to comply with any Member State’s objection to the release of data which it provided to Europol. A data subject’s request for correction et al of personal data would have to be funnelled through a national authority, rather than addressed directly to Europol, and the Council would include very broad grounds for Europol to refuse such requests.

The Council is also keen to amend the institutional ‘architecture’ regarding data protection in the Commission’s proposal. It would cut back a little on the proposed powers of the EDPS, and impose the condition that it considers law enforcement concerns when it communicates with data subjects. National data protection bodies would have the power to comment on the draft annual report of the EDPS before its conclusion. More generally, the EDPS would have further obligations to consult national data protection bodies, and the Council wants to establish a Cooperation Board that would have a large number of advisory powers.

For its part, the EP would subject all access to personal data by Europol to general rules of necessity and proportionality and the adoption of specific rules setting out data protection principles.  The categories of personal data which could be processed would be more tightly restricted, and the EP does not support anything similar to a general power to process personal data to facilitate relations with the Member States, et al. There would be a requirement to carry out an impact assessment before data processing operations.

The EP would ban access to Europol data by OLAF, the EU’s anti-fraud body, and also would impose a ban on processing of data obtained by means which breach human rights. Pre-existing treaties with third states relating to the processing of personal data would have to be renegotiated within five years. The EDPS would have to be consulted before treaties with third States are negotiated. 

While the EP broadly agrees with the Council regarding the derogations from the external transfer rules, it wants to require Europol’s Executive Director to consider the record of the third country concerned before authorising the use of these derogations. The EP also agrees with the Council on a clause regarding notification of a data breach to the EDPS, although its version is more detailed, and the EP also wants a clause on notification of such breaches to the data subject. Finally, the EP wants more detail in the annual report by the EDPS, and proposes more cooperation between the EDPS and national authorities, although it does not support the Council’s idea of creating a Board.

Governance

First of all, as regards Europol’s management board, in accordance with the Common Understanding on EU Agencies, the Commission proposed that it have two representatives, alongside one from each Member State. However, both the EP and Council want to cut this back to one representative (as at present). Moreover, the EP (based on the Common Understanding, which refers to full EP members on agencies’ management boards) proposes to let an observer from its Joint Parliamentary Scrutiny Group (see below) attend meetings of the Management Board. Both the EP and the Council want to drop the proposed clause (based on the Common Understanding) which would require Member States to limit turnover in the Board. 

The EP supports the Commission’s proposal to ‘aim to achieve a balanced representation between men and women’ on the board, but the Council does not. 

Next, the Council and Commission agree that (in accordance with the Common Understanding) members of the Management Board should have standard terms of four years. However, the EP wants their term of office to be set by each Member State.

Furthermore, the Council wants the chair of the Management Board to come (as at present) from one of the three Member States which is jointly holding the Council Presidency, whereas the Commission and the EP reject this. Finally, the EP wants all members of the Management Board to sign a declaration of interests, for such declarations to be published, and for the Commission to have the power to object to draft Management Board decisions on fundamental legal or policy grounds. These proposals are based on the Common Understanding.

Secondly, the Council wants to retain its current powers to appoint Europol’s Executive Director and the Deputy Executive Directors, instead of shifting this power to the Management Board as the Commission proposes, in accordance with the Common Understanding on agencies (the EP agrees with the Commission). But the Council does not want to share this power with the EP.

Thirdly, the Commission proposed the creation of a new Executive Board as part of the management structure. The EP rejects this idea completely, whereas the Council can accept it on condition that the Management Board agrees unanimously to create it, leaving it to the Board (rather than the Regulation) to set out the details.

Finally, the Council wants to curtail the scope of the future reviews of the Regulation, while the EP wants to enhance them to include the provisions on parliamentary accountability. The Commission and EP support the possibility of a future amendment or repeal of the Regulation, while the Council wants to drop this possibility. It should be noted that the Common Understanding refers to the possibility of disbanding an agency.

Parliamentary accountability

Currently, the EP can receive reports on Europol, plays a role as regards the budget, is consulted upon implementing measures and can hold hearings with the Director. Due to concerns about ensuring more effective parliamentary accountability for Europol’s actions, the Commission proposed a number of reforms, in particular sending the EP and national parliaments more reports, and involving the EP more in the process of choosing the (Executive) Director.

In response, the Council insists upon separate references to the EP and national parliaments. It would also delete many of the proposed powers for the EP, in particular dropping the proposed obligation for the Executive Director to report to the EP and the obligation for the candidate to be Executive Director to make a statement before the EP.

Conversely, the EP would enhance the parliamentary role in the Regulation, in particular by creating a Joint Parliamentary Scrutiny Group, which would comprise members of both the EP and national parliaments. In its view, references to the EP in the proposal should be replaced by references to this group. There would also be greater powers for the Joint Parliamentary Scrutiny Group as regards the process of appointing the Executive Director. 

Comments

The EP and the Council agree broadly on the modest extension of Europol powers, including in particular the removal of provisions relating to the European Police College and retaining the current limits on Europol’s powers as regards national authorities, so these will likely be the least controversial issues to negotiate. It is striking that these institutions did not take the opportunity either to reduce the agencies’ costs by means of a merger, or at least to increase their efficiency by means of co-location.

As regards data protection, there are significant differences between the EP and the Council as regards: the broadening or tightening of the grounds for data processing; the details as regards notification of security breaches; the rights of data subjects; the architecture of data protection authorities; and the grounds to refuse a data subject’s requests. Both support some further powers for national authorities.

Two specific points should be highlighted here. First of all, the Council’s suggestion of a general power for Europol to process personal data in order to facilitate information exchange has to be rejected on legal grounds, since this is far too broad and imprecise a legal basis on which to justify the exchange of personal data. The EP has the better approach: if (as all the institutions agree) EU legislation should no longer regulate the details of Europol’s databases and analysis files, there need to be strong and specific data protection principles in the Regulation instead.

Secondly, while both the EP and the Council agree on a general derogation from the external transfer rules for the combating of criminal offences, this exception is likely to become the rule, since combating criminal offences is Europol’s whole raison d’etre.

As for governance and accountability, the main issues are the extent of parliamentary powers, and also the nature of those powers (ie, whether there should be separate or joint roles for the EP and national parliaments). It is striking that the Council is keen to have a joint data protection supervisory body, but not a joint parliamentary body, whereas the EP’s preferences are the other way around.  Remarkably, the Council’s removal of the (Executive) Director’s obligation to report to the EP would actually mean lessparliamentary accountability on this point than under the current Decision.

Also, the EP and the Council differ as regards: whether there should be an executive board; the role of Council as compared to the Management Board in appointing the executive director; retaining a special status for the Council Presidency chairing the Management Board; rules on conflict of interest; other aspects of the composition and functioning of the Management Board (term, turnover, gender equality, Commission control, conflict of interests); and the review and possible disbanding of Europol.

On these issues, the Council’s suggestion to go backwards, by eliminating any role for the EP questioning the Executive Director, is simply antedivulian. It flies in the face of the specific reference to parliamentary accountability in the Treaties, given the obvious importance that parliamentary questioning of an agency director can play in ensuring that body’s accountability.

The Council’s attempts to defend the status quo can also be seen in its approach to the appointment of the (Executive) Director and the composition and chairing of the Management Board. The more modern approach of the EP as regards gender equality, declarations of interests, scrutiny by the Commission, and review or disbanding of Europol, should be preferred. Furthermore, accountability surely demands a single parliamentary observer on the Management Board, given that 28 Member States will each have a voting member to advocate their interests.

It is striking that two years after agreeing standard rules on EU agencies, in a bid to forestall future conflicts and difficult negotiations, all three agencies have taken a ‘pick and mix’ approach to the Common Understanding, each selecting certain points that they like from these common principles and rejecting those which they dislike.

Overall, it is clear that the Council’s preference is for Europol to remain an essentially intergovernmental body, with merely another incremental increase in its powers, a modest enhancement of the data protection rules, and no significant change in either its governance or parliamentary accountability. The EP agrees that the increase in its powers should be limited, but is pushing instead for a modernisation of the agency in light of the Treaty of Lisbon and the Common Understanding, as regards stricter data protection rules, reforming its governance, and greater accountability. Time will tell whether the Council will succeed in preserving this intergovernmental dinosaur. 

Read More