Brexit and Data Protection: The Tale of the Data Protection Bill and UK-EU Data Transfers

Elif Mendos Kuşkonmaz, PhD student at Queen Mary, University of London[*]

Introduction

A Bosnian folk song tells the death of a severely ill Ottoman Pasha. After hearing of the Pasha’s death, his wife also passes away from sorrow. Now that the UK voted to leave the European Union (EU) on 23 June 2016, will data protection laws also pass away from sorrow after the UK leaves the EU?

The Data Protection Act 1998 (DPA), which is the UK’s current key regulatory regime for data protection, implements the EU’s Data Protection Directive of 1995 into the UK national law. This Directive is replaced by the General Data Protection Regulation (GDPR) adopted in April 2016, which introduces a task force (European Data Protection Board), new responsibilities for data controllers and processors, and new rights for data subjects such as right to transfer data from one server to another and right to be forgotten. All EU Member States have to transpose this Regulation by 25 May 2018 (before the UK is due to leave the EU). Accompanying the GDPR, a new Directive in relation to data protection in the field of police and justice sectors was also introduced at the EU level. This Directive creates a comprehensive framework for data processing activities performed for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. All EU Member States have to transpose this Directive into their national laws by 6 May 2018.

As an EU regulation, the GDPR will be directly applicable in the UK without the need for an Act of Parliament from 25 May 2018 forwards as the UK is expected to leave the EU officially some point after March 2019 and its EU membership continues until then. Still, there exists some provisions under the GDPR that Member States can adapt in their national laws such as permitted derogations from data protection principles (Article 23 on derogations from transparency obligations and data subject rights for purposes of national security, defence, public security etc., and Articles 85-91 on derogations for specific data processing situations such as necessary for freedom of expression, employee data, and scientific and historical research purposes). So, in anticipation of dealing with these issues, first, a statement of intent was published by the UK Government on 7 August 2017 as a form of commitment to the GDPR. Then, the Data Protection Bill was introduced to the House of Lords on 13 September 2017. (Also, see here for the House of Lords’ report on Brexit and data protection). This Bill will replace the Data Protection Act 1998, and will regulate the areas where the UK has competence to do so such as the permitted derogations mentioned above and areas that fall outside the scope of the GDPR like data processing for law enforcement purposes or for national security interests. So, in light of these recent developments, it is clear that the data protection in the UK will not experience an immediate death.

The Data Protection Bill in a nutshell

As a whole, the Data Protection Bill contains the general definitions under the GDPR and the derogations from data protection principles provided under it. These derogations include data processing for journalism, for research, and by employees under certain conditions.

It also covers the areas that are not covered by the GDPR. The first area is the data processing in the context of law enforcement (Part 3 of the Data Protection Bill), which is in fact covered by the Data Protection Directive on processing of personal data for law enforcement purposes (the ‘Law Enforcement Directive’). Unlike the GPDR, this Directive is not directly applicable in the UK.

Therefore, with the inclusion of the data processing by competent public authorities in relation to law enforcement purposes, the Data Protection Bill transposes the Law Enforcement Directive into UK law. It is said that the principles for such processing resembles the 2014 Regulations, through which the UK transposed the previous EU data protection rules for data processing in the context of law enforcement. On the basis of the broad definition of a competent authority for data processing under the Bill, data can be processed not only by criminal justice agencies in the UK, but also other organisations with law enforcement functions such as such as Her Majesty’s Revenue and Customs, the Health and Safety Executive and the Office of the Information Commissioner. The competent authority definition under the Law Enforcement Directive provides for such broad definition (Article 3(7) of the Law Enforcement Directive). Another area that is covered by the Bill and not by the GDPR is data processing for intelligence services (Part 4 of the Data Protection Bill). It is said that the provisions on this processing are based upon the Council of Europe’s Convention on automatic processing of data (Convention 108) and changes which are being made to that Convention [note 40 of the Explanatory Notes for the Data Protection Bill]. This part of the Bill is complementary to the other legislation in relation to intelligence services such as the Investigatory Powers Act 2016 (discussed below) [note 47], and therefore constantly refers to this legislation. It also provides for national security exemptions for certain provisions it sets forth for data processing by intelligence services (Chapter 6 of the Part 4 of the Data Protection Bill).

Consequently, when the Data Protection Bill receives Royal Assent (in principle, in May 2018 on the same day the GPDR is due to be applicable) the GDPR, which will be converted to UK law with the EU (Withdrawal) Bill upon Brexit, has to read alongside the Data Protection Bill. For references in the GDPR such as ‘Union law’ and ‘Member State law’ that will be no longer relevant after Brexit, Schedule 6 of the Data Protection Bill introduces amendments.

The Data Protection Bill has received both positive and negative comments. The positive ones hinged on the relief it has brought to data controllers based in the UK. That said, it is argued that the Bill contains some complex and legally questionable provisions, like this sentence: ‘Terms used in Chapter 2 and in the GDPR have the same meaning in Chapter 2 as they have in the GDPR’ (Section 4). Or this sentence: ‘GDPR applies to the processing of personal data to which this Chapter applies but as if its Articles were part of an Act extending to England and Wales, Scotland and Northern Ireland’ (Section 20(1)). Nevertheless, the second reading of the Data Protection Bill in the House of Lords is due on 10 October 2017 and there might be further changes to it before it becomes law.

What is at stake for the future of UK-EU cross-border data transfer after Brexit?

For the importance of the UK-EU cross-border data transfers the numbers speak for themselves. 43% of EU tech companies are based in the UK and 75% of the UK’s data transfers are with the EU Member States. It is for this reason that the UK Government has consistently referred to the importance of maintaining the data flow between the UK and the EU after Brexit [note 8.38]. However, even if one assumes that the Data Protection Bill successfully aligns UK law with the EU data protection framework, this does not mean that the Bill is a panacea for the future of this flow post-Brexit. This point was also accepted by the UK Government in their position paper on the exchange and protection of personal data after Brexit [note 4]. Upon the UK’s exit from the EU, the UK will be considered as a third country within the meaning of the abovementioned framework and any data transfer from the EU to there will have to comply with the rules on data transfer to a third country under the same framework.

Like the Data Protection Directive of 1995, the GDPR allows for transfer of personal data outside the EU/EEA, for instance if the European Commission decides that third country to which data are transferred ensures an ‘adequate level of protection’ for those data (Article 45 of the GDPR) or if the UK businesses (either as data processors or controllers) individually adopt other adequacy mechanisms such as standard contractual clauses and binding corporate rules (Articles 46 and 47 of the GDPR). In its position paper on the exchange and protection of personal data after Brexit, the UK Government referred to the Article 45 adequacy finding and mentioned that the future UK-EU data transfers could built upon this adequacy model [paras. 22, 32-41]. Moreover, it noted that the UK should be found as compliant with EU data protection framework as it introduced the Data Protection Bill, which implemented the GDPR and the Law Enforcement Directive [ibid, para. 23]. As discussed below, achieving a positive adequacy decision for the UK is not as uncontentious as the UK Government think it is.

At the outset, the UK should be found to afford an adequate level of data protection, which was defined in the CJEU’s Schrems decision (discussed here) as ‘essentially equivalent’ data protection to that of afforded under EU law. The crux of this decision is that in the Court’s view, US law failed to offer that level of protection because it included expansive national security derogations for the use of personal data by the US intelligence agency, which in turn meant that EU citizens were stripped of their privacy and data protection rights once their data reached the shores of the US under the then valid Safe Harbour principles scheme. It is evident from this decision that the activities of intelligence agency of a third country with respect to personal data transferred from the EU comes under the scrutiny of the European Commission in its quest for an adequacy decision for that country. Indeed, the GDPR requires the European Commission to consider a wide array of issues such as the rule of law, respect for fundamental rights, and legislation on national security, public security, and criminal law in that country (Article 45(2) of the GDPR). So, the UK Government’s assumption that the implementation of the GDPR will suffice for a positive adequacy finding for the UK is false because UK laws on data processing by intelligence agencies’ for national security purposes will come under the scrutiny of the European Commission.

Regretfully, the surveillance practices of UK intelligence services may imperil a positive adequacy decision. The discussions surrounding the Investigatory Powers Act (IPA), and its predecessor the Data Retention and Investigatory Act 2014 (DRIPA) is illustrative in this matter. The latter Act provided for the storage of telecommunications’ data for later to be used by police and security agencies. Following the CJEU’s Digital Rights Ireland decision (discussed here) finding practices of indiscriminate data retention in the context of fight against terrorism and transnational crime incompatible with EU fundamental rights of privacy and data protection, the DRIPA was challenged in the joined cases of Tele2 and Watson before the CJEU on the ground that it provided for such practices, and thus violated the mentioned rights. Consequently, the CJEU found the DRIPA unlawful as the data retention scheme established under it exceeded the limits of what is strictly necessary and was not justified. (See here for Prof Lorna Woods’s take on the Tele2 and Watson decision).

The IPA, which took the place of DRIPA, retains the contested provisions of the DRIPA, and in some situations provides for more controversial data processing. For example, the IPA provides for the retention of telecommunications data for preventing or detecting crime or preventing disorder (Article 87(1) of the IPA), which does not comply with the CJEU’s finding in Tele2 and Watson that ‘only the objective of fighting serious crime is capable of justifying such access to the retained data [para. 172]’. Therefore, the IPA sits at odds with the CJEU’s finding in Tele2 and Watson.

In fact, a legal challenge to the IPA in this matter has already been brought before the UK High Court by the UK based civil liberties organisation Liberty. Equally relevant is that Investigatory Powers Tribunal referred the question on the compatibility of the acquisition and use of bulk communications data under s.94 of the Telecommunications Act 1984 with EU law to the CJEU. (See here for Matthew White’s review on the matter).

Here, the status of the EU Charter of Fundamental Rights (Charter) and the jurisdiction of the CJEU after Brexit requires further attention. The EU (Withdrawal) Bill provides that pre-Brexit case-law of the CJEU stays binding after Brexit with certain exceptions (Clause 6. When departing from pre-Brexit case-law of the CJEU, the Supreme Court must apply the same test it applies when deciding whether to depart from its own case law, and Parliament or the executive can override that prior CJEU case law). However, the EU (Withdrawal) Bill in its current form excludes the Charter (Clause 5(4)), and puts an end to the jurisdiction of the CJEU (Clause 6) after Brexit. Still, this does not mean that the UK can ignore the decisions of CJEU given after Brexit because the EU data protection framework, which the European Commission will refer to when considering the adequacy question, will be interpreted in light of those decisions. The UK Government, on the other hand, seems to sweep these issues under the carpet in its post-Brexit paper because neither the discussions surrounding the IPA nor the case-law of the Charter after Brexit were mentioned in its position paper on the exchange and protection of personal data. Only when dealing with the UK-EU model of data exchange, it referred that such model should ‘respect UK sovereignty, including the UK’s ability to protect the security of its citizens and its ability to maintain and develop its position as a leader in data protection [note 22.] This statement might be read as a reference to the IPA, or any future law on surveillance practices and the end of the direct jurisdiction of the CJEU.

Alternatives to the adequacy finding under Article 45 of the GDPR include subjecting the data transfers to safeguards under Article 46, which include Binding Corporate Rules under Article 47. The Government already noted that these alternatives are not its primary target due to their limited scope [Annex A]. Still, as the ongoing challenge against the standard contractual clause scheme for data transfers under the Data Protection Directive of 1995 shows, neither alternative is immune from a legal challenge before the CJEU.

One might ask whether all these will be relevant for the data transfer during the transitional period should there be a transitional period after Brexit. The short answer is: yes, they will be. Despite the UK Government’s discontent, if the transitional period is based on the UK’s joining of the European Economic Area (EEA) and the European Free Trade Association (EFTA)– the so-called Norway option-, the data will continue to flow from the EU without an adequacy decision by way of retaining the GDPR as parts of UK law after Brexit since the GDPR has EEA relevance (ie, non-EU EEA states will apply the GDPR as such).

Other than that, the UK may seek to conclude a transitional agreement as part of the Article 50 negotiations, as indicated in the Prime Minister’s recent Florence speech (discussed here). That agreement will not be immune from the adequacy requirements discussed above because it will have to match the EU standards, and particularly the EU data protection framework and its rules on data transfers.

Data Protection in the field of police and justice sectors

As mentioned above, the UK aims to transpose the Law Enforcement Directive in to UK law with the Data Protection Bill. Yet, as in the case of GDPR, maintaining the data exchange between law enforcement authorities in the UK and in the EU will not be undisputed upon Brexit.

Any obstacle to this data exchange after Brexit has been considered as a gift for criminals and as a threat for public safety. So, it should not come as a surprise that the UK Government highlighted the importance of facilitating this data exchange for cross-border law enforcement cooperation in its position paper on security, law enforcement, and criminal justice [note 21]. Just like the GDPR, the Data Protection Directive on law enforcement requires an adequate level of data protection standards for data transfers to a third country (Article 36 of the Law Enforcement Directive). So, any future agreement between the EU and the UK on law enforcement information exchange would have to comply with these standards. The UK Government voiced its intention to ‘build on’ the adequacy scheme for the future of data exchange for law enforcement. Still, it was of the opinion that the implementation of the Law Enforcement Directive through the introduction of the Data Protection Bill is enough for the UK to secure a positive adequacy decision. I discussed earlier the scope of the adequacy assessment and the matters that may affect the likelihood of securing such decision. Besides, in the recent judgment by the CJEU on the compatibility of the EU-Canada Agreement on transferring passenger information in the fight against terrorism with the EU Treaties and Charter, the Court set a list of procedural requirements for the transfer of information in that context. In this regard, these requirements must be met for law enforcement data transfers to be compatible with the Charter. (See here Prof Lorna Wood’s review of Opinion 1/15.)

What is the EU’s position on data protection?

While all these developments and discussions are unravelling in the UK, the EU’s position on the matter focuses on the use and protection of personal data obtained or processed before Brexit for good reason – the need to determine what happens to data processed before Brexit Day. Accordingly, the EU Commission published a position paper as part of its approach to Article 50 negotiations in relation to such use and protection, updated on 21 September 2017. On the whole, the paper provides for the continuity of the application of the general principles of the EU data protection framework in force on Brexit day to personal data in the UK processed before that day. It also notes the continuity of the principal data subject rights’ such as right to be informed, right of access, and right to rectification. Moreover, it seeks the confirmation that the personal data with specific retention periods under sectorial laws must be erased upon the exhaustion of those periods, and that the ongoing investigations in relation to compliance with data protection principles on the Brexit day should be completed. It does not go unnoticed that the paper mentions to the CJEU as the legal authority to interpret the general principles that it refers to. As a whole, the position paper indicates that amidst the ambiguousness and the complexity that the future partnership with the UK on data protection holds, the EU Commission seeks to secure that this uncharted water will not be detrimental to data subjects whose data were transferred to the UK before Brexit.

Conclusion

The UK Government introduced the Data Protection Bill, which seeks to adjust its national laws on data protection with the GDPR and the Law Enforcement Directive. This development may mean that at least some EU data protection requirements will be implemented in UK law on the day the UK leaves the EU. Still, it should not be read as a solution for the issue of maintaining the UK-EU data transfer after Brexit because the GDPR’s and the Directive’s provisions on third country data transfer will be relevant for such transfer. After the CJEU’s Schrems decision, an adequacy finding and other legal mechanisms to enable that movement could trigger the extent of national security derogations and their interferences with fundamental rights of the persons whose data are transferred from the EU to the UK. Certain provisions of the IPA and the CJEU’s findings in Tele2 and Watson cannot be reconciled, and this may hinder a positive adequacy finding for the UK. The same conclusion can be drawn for any future EU-UK data transfer deal for law enforcement purposes.

Barnard and Peers: chapter 27

Photo credit: Cyberadvice

---

[*] Many thanks to Prof Steve Peers for his valuable comments.

UK/EU Security Cooperation After Brexit: the UK Government’s Future Partnership Papers

Professor Steve Peers

The Prime Minister’s big speech in Florence has received the most attention in recent weeks, but it’s also worth looking at the UK government’s recent papers on its planned EU/UK close partnership after Brexit.  I’ll look here at the papers on two aspects of security – external security (foreign policy and defence) on the one hand, and internal security (police and criminal law cooperation) on the other. Both of them are impacted in the short term by the Florence speech, since the Prime Minister called for the current UK/EU security arrangements to apply for a period of around two years, followed by a comprehensive EU/UK security treaty. Assuming that such a transition period is agreed, the issue is what happens after that. In other words, what will be the content of that future comprehensive security treaty?

External security: Foreign policy and defence

The UK government's foreign policy paper devotes much of its space – the first 17 pages – to explaining the UK's major commitments in this field, including via its EU membership. A Martian reader would assume that the UK was applying to join the Union. Only the last few pages discuss the government’s preferred policy – which is both rather vague and highly resembles EU membership.

   

In short (although there’s no long version), the government seeks to maintain a relationship with the EU in this field that’s closer than any other non-EU country – although without offering many specifics. The government does, however, state that it wants to contribute to EU defence missions and to align sanctions regimes with the EU. The point about sanctions is particularly relevant, since the UK provides intelligence to justify their imposition and some of the individuals concerned have placed their assets in the UK.

For instance, in the recent ECJ judgment in Rosneft (discussed here), which followed a reference from the UK courts, the sanctioned company tried to reopen the case to argue that the referendum result already meant that EU sanctions ceased to apply in the UK. The ECJ simply replied that the Russian company had not explained how the Brexit vote altered the jurisdiction of the Court or the effect of its judgments.

Of course, the legal position will certainly change from Brexit Day: the UK government plans to propose a new Bill regulating post-Brexit sanctions policy in the near future, following a White Paper on this issue earlier this year (see also the government response to that consultation). One key question will be whether that Bill already attempts to regulate the UK’s post-Brexit coordination with the EU on sanctions, or whether that will be left to the Brexit negotiations to address.

This brings us to the issue of the ECJ, which is a difficult question as regards many aspects of the Brexit talks. In principle, in the area of foreign policy and defence, Brexit talks should not be too complicated by ECJ issues, since the Court has only limited jurisdiction. However, as the case of Rosneft illustrates, it does have jurisdiction over sanctions issues. In fact, there are frequent challenges to EU sanctions and many challenges are successful, so there will be a risk of divergence between EU and UK policy after Brexit that may need to be discussed. Such divergence could lead to a knock-on complication with capital movement between the UK and EU.

The paper also covers development and external migration policy, where the UK again seeks something which is both vague and much like membership – collaboration on coordinating policy. While the EU has its own development policy, Member States are free to have their own policies, subject to loose coordination – which is what the UK is aiming for as a non-member.

This was, perhaps, a missed opportunity here to touch on the most difficult issue in the talks: the financial liabilities upon leaving in the EU. Some of the EU’s spending in these areas is not part of the ordinary EU budget (as the ECJ has confirmed), although it is part of the EU negotiation position. So the UK could have addressed that issue to move talks along and to make links between ‘upfront’ and ‘future’ issues to get around sequencing problems in the Brexit talks. (The Prime Minister’s subsequent speech in Florence did not explicitly mention these funds). Furthermore, the UK government could have used this paper to reassure some febrile people that it will have a veto on what it chooses to participate in, as well as on the ECJ.

Internal security: Criminal Law and Policing

In many ways, the government paper on criminal law matters is similar to the foreign policy paper. It also starts out by saying how useful the current relationship is, for instance as regards data on wanted persons and stolen objects uploaded into the Schengen Information System, the use of the European Arrest Warrant for fast-track extradition, and the EU police intelligence agency, Europol.

What happens after Brexit? The UK paper correctly points out that the EU already has agreements in this area with many non-EU countries, particularly as regards the exchange of policing data but also as regards some forms of criminal justice cooperation. But as with foreign policy and defence, the UK wants a distinctive relationship after Brexit, given the existing close links.

Again, however, the actual content of what the UK wants is vague. Which of the current EU laws in this field which the UK has signed up to (for a summary of those laws, see my referendum briefing here) would it still like to participate in? The only clear point is that the government doesn't want direct ECJ jurisdiction. In principle, that should be fine for the long term, since the EU27 negotiation position only refers to the ECJ during a transition period. There’s no insistence on using it afterward, which is consistent with EU treaties in this field with non-EU countries.

However, some of those treaties refer to taking account of each other’s case law, and dispute settlement or (in some treaties) possible termination in the event of judicial or legislative divergences. The UK paper gives no idea of how it will tackle those issues, whereas the recent paper on the parallel issue of civil litigation (discussed here) at least indicated a willingness to require UK courts to take account of relevant ECJ rulings.

Comments

The contrast between the importance of these issues and the vagueness with which they are treated is striking. Imagine a television viewer aching to watch Tenko or Broadchurch – but having to settle for Last of the Summer Wine. It is fair to assume that the government has more detailed plans than this but doesn't want to release them; but presumably anything more specific would have opened division in the cabinet or run the perceived risk of making the government look awkward by disclosing an ultimately unsuccessful negotiation position (what the government refers to as undermining negotiations). Increasingly these papers look like an attempt to respond to poor polls about negotiations rather than a contribution to the talks.

The government does have a point, however: the UK and EU have significant shared interests in this area, and the UK has a lot to offer, in terms of its defence contribution, supply of intelligence and round-up of fugitives from other Member States, for instance. Of course, the UK benefits in turn from having swifter access to other countries’ intelligence, as well as fast track extradition and transfer of criminal evidence.  The Brexit process might also be an opportunity to address the civil liberties concerns that sometimes arise about these measures, but there is no detailed discussion of that.

It will likely be awhile before these issues are discussed in detail in the talks, and it remains to be seen how interested the EU27 side is in the UK government’s position. But at first sight, it seems possible that the future of the EU/UK relationship on security issues will not be vastly different from the present.

Barnard & Peers: chapter 25, chapter 27

JHA4: chapter II:3, II:7

Photo credit: EUobserver

Bridge over troubled legal water? Legal issues of the Brexit transition period

Professor Steve Peers*

Compared to famous Florentines, Theresa May’s recent speech on the UK’s Brexit plans inevitably owed more to Machiavelli than Leonardo da Vinci. Nevertheless, it gave a rough indication of the basic legal architecture that the UK government would like to govern its relationship with the EU for a transition period after Brexit Day. I have previously summarised and commented upon the main points of the Florence speech, but there is more to say on this legal framework – and also on the rules which would apply to EU27 citizens in the UK during the transition period.

Legal framework

First of all, is a transition period after Brexit Day even legally possible? If so, what provision of EU law would apply?

Article 50 TEU, which sets out the basic rules on Member States’ withdrawal from EU membership, is silent on the issue of any transitional period after the withdrawal date. However, it might be noted that Article 49 TEU, governing accession, is equally silent on transitional periods after joining the EU; nevertheless such periods are an established feature of the accession process.

In its negotiating guidelines on the Brexit withdrawal agreement, the European Council (EU27 States’ leaders) stated that:

To the extent necessary and legally possible, the negotiations may also seek to determine transitional arrangements which are in the interest of the Union and, as appropriate, to provide for bridges towards the foreseeable framework for the future relationship in the light of the progress made. Any such transitional arrangements must be clearly defined, limited in time, and subject to effective enforcement mechanisms. Should a time-limited prolongation of Union acquis be considered, this would require existing Union regulatory, budgetary, supervisory, judiciary and enforcement instruments and structures to apply.

These principles are set out again in the negotiation directives on the agreement, handed down to the European Commission by the Council (EU27 States’ ministers) at paragraph 19. Those negotiation directives go into no further detail on the transition period issue for now; instead, there will be further negotiation directives in future, once the EU27 side has decided that there has been ‘sufficient progress’ on its priority issues (EU27 and UK citizens’ rights, financial issues, Northern Ireland) during the Brexit talks. 

For the UK’s part, the Florence speech states that on Brexit Day, the UK will cease to participate in the EU political institutions. The period must be ‘strictly time limited’, suggesting ‘around two years’;  but the two sides ‘could also agree to bring forward’ aspects, such as a new dispute settlement system. The latter point implies that the ECJ will apply until that point.

Substantively, during the transitional period, ‘access to one another’s markets should continue on current terms’; the UK will ‘continue to take part in existing security measures’; and the ‘framework’ will be ‘the existing structure of EU rules and regulations’.  There would be no change to other Member States’ payments and contributions during the current funding cycle (ending in 2020), implying that EU laws on funding and spending continue without amendment until then.

EU citizens can still come to live and work during this period, but they will be registered; but as I noted in the previous blog post, such registration is allowed under the EU citizens’ Directive. (More on that below). Finally, the speech referred to one substantive difference in law: the UK would hold its own trade negotiations, and would ‘no longer directly benefit’ from the EU’s trade negotiations.

Moreover, the speech made comments on another aspect of the withdrawal agreement – maintaining EU27 citizens’ rights – that may be relevant by analogy to transition issues. The Prime Minister said that the UK would ‘incorporate our agreement [on citizens’ rights] fully into UK law and make sure the UK courts can refer directly to it’; and that UK courts must be ‘able to take into account’ relevant ECJ case law.

Comparing the UK to the EU27 position on the transitional period, there are lots of similarities. Both sides are willing to contemplate such a period (the EU27’s ‘legally possible’ caveat is considered below). Both sides want it to be for a limited time. The Florence speech states that the transitional rules would be linked with the future permanent UK/EU relationship (‘a bridge from where we are now to where we want to be’), matching the EU27 position. (Note there’s no need to define the future relationship in detail in the withdrawal deal: Article 50 refers only to defining a ‘framework’ for that relationship, and the EU negotiation position refers only to bridges towards the foreseeable future framework).

The greatest difficulties may come with the issues of post-Brexit EU legislation, and the legal effect of EU law. At present the European Communities Act provides for the adoption of new EU law into the UK’s legal order. It gives that law direct effect and supremacy, and gives effect to ECJ rulings in domestic law. However, the proposed EU Withdrawal Bill would remove all these provisions, instead retaining pre-Brexit EU rules and ECJ judgments in force pending potential amendment by government or Parliament. Pre-Brexit ECJ judgments would retain their force subject to such amendments or overruling by the UK Supreme Court, and UK courts would have an option to take post-Brexit ECJ case law into account. The Bill would also remove the principle of damages liability for breach of EU law, and would not keep the EU Charter of Fundamental Rights as part of retained EU law in the UK (on the latter point, see discussion here).

Technically, anything which the UK agrees to in the Withdrawal Agreement can be incorporated into UK law easily enough, since clause 9 of the Withdrawal Bill would give the UK government unlimited power to amend any UK laws to give effect to that Agreement. (Note, however, that the Bill could be amended in Parliament as regards any of these points before it becomes an Act of Parliament). So the issue is not the capability of the UK government to give effect to the Withdrawal Agreement, but its willingness to negotiate on these issues.

After her speech, the Prime Minister deliberately avoided answering a question about whether the UK would apply post-Brexit EU law during the transition period, saying it was a matter for negotiation. In fact, there is some flexibility on this, since the EU27 negotiation position does not take any view on that point. (Remember that the EU27 negotiation position on transitional issues will be enlarged later). In the meantime, UK cabinet members have tried to rule this prospect out. (Note that the speech refers to keeping ‘existing’ and ‘current’ EU law in force).

There is less flexibility as regards the legal effect of EU law, where – to recall – the EU27 position is that ‘existing EU regulatory, budgetary, supervisory, judiciary and enforcement instruments and structures’ should apply. The combined reference to ‘judiciary’ and ‘enforcement’ structures suggest that the ECJ’s current jurisdiction, and the current legal effect of EU law in the UK, should apply. While the Prime Minister obliquely referred to the ECJ, she hoped that its role could be terminated early as regards the UK; and the UK government’s position on the legal status of EU27 citizens (no ECJ role; option to take account of ECJ rulings; incorporation of Withdrawal Agreement into UK law but no special status), if extended to the transitional rules in the Withdrawal Agreement, would fall short of the EU27 position. Equally, while it is not expressly mentioned in the current negotiation position, the EU27 might, when amending that position, argue that the EU Charter should still apply to the UK during the transitional period. (Note that the Charter does not apply to all actions of Member States, but only applies to Member States when they implement EU law). 

Three further points. First, what happens to the position of non-EU countries as regards the UK? They are parties to some treaties with the EU alone, and to some treaties with the EU together with its Member States. The legal issues arising in this respect during the transitional period will have to be addressed.

Secondly, what happens after the end of the transitional period? In particular, what if it is deemed desirable on both sides to continue the arrangement, in whole or part? In that case, the special decision-making rule applying to Article 50 (see next point) will have expired, and so the normal decision-making rules of EU law will apply. Depending on the content of what is carried forward then, this may require some unanimous voting and even ratification by all Member States, although it should be recalled that the EU side can decide to apply treaties provisionally pending national ratification.

That brings us to the most fundamental legal issue: can the EU27 side include a transitional deal within the scope of Article 50 in the first place? The words ‘[t]o the extent…legally possible’ hint at some doubt on this point, presumably because of an argument that Article 50 cannot extend to the regulation of legal relationships that are created after Brexit Day, but only to the regulation and/or termination of those created before that date. However, while little is certain now about how the ECJ might interpret Article 50, in my view that interpretation is too narrow, given that Article 50 refers to taking account of the framework for future relations with the withdrawing state, and Article 8 TEU refers to maintaining strong relationships with neighbouring non-EU countries. If this is correct, it follows that as long as the transitional deal is limited in time and linked to the future framework for relations – as both the EU27 and UK side intend – there should not be a legal problem. (On the other hand, there is nothing in Article 50 to require that anything in the withdrawal agreement must be subject to ECJ jurisdiction, besides the usual rule that only the ECJ can rule definitively on how to interpret EU law for EU Member States).

The importance of this is that the Article 50 agreement needs only a qualified majority vote to be approved by the EU27, without national ratification by Member States (as confirmed in the negotiation directives). But the EU27 and UK should prepare a ‘Plan B’ in the event that some Eurosceptic devoted to a ‘WTO-only’ and/or ‘no deal’ relationship between the UK and EU brings a legal challenge. If such a challenge were successful, the ECJ might anyway maintain the problematic parts of the treaty in force temporarily due to legal certainty; and the UK and EU should aim to agree the impugned parts of the Withdrawal Agreement on the correct legal basis as soon as possible, applying that new treaty provisionally.

Extension of the Article 50 period

Some have suggested extending the negotiation period for the Brexit talks instead – as Article 50 expressly allows for – arguing that a transition phase is no different from extending the negotiation period anyway.  It’s true that legally the extension of the negotiation period would be simple: it requires only a unanimous vote of the EU27 Member States (with no national ratification) required, plus the UK government, with no role for the European Parliament. As a matter of domestic UK law, arguably an Act of Parliament would be required to this end (note that the European Union (Notification of Withdrawal) Act, which gave the government power to invoke Article 50 pursuant to the Miller judgment, does not mention the issue of extension).

But an extension to the negotiation period would be politically difficult. It’s not known whether the EU27 would give their unanimous consent, particularly given the awkward consequence that the UK would then end up participating in the 2019 European Parliament elections. And within the UK, announcing an intention to delay Brexit would likely mean that Theresa May would immediately be the centrepiece of a modern version of Da Vinci’s Last Supper – followed swiftly by the political resurrection of Nigel Farage.

Furthermore, it’s false to say that there is really no difference between a negotiation extension and a transition period. First of all, during a negotiation extension the UK would still participate in the EU’s political institutions. Secondly, it’s certain that there would be no change in the legal effect of EU law in the UK or the substance of EU laws in the UK, and that new EU laws and new ECJ judgments would continue to apply, in the event of a negotiation extension – whereas those issues may, as discussed above and below, be addressed differently during a transition period.

Thirdly, in the event of a change of mind in the UK on Brexit, remaining within the EU on the basis of a negotiation extension may be different from rejoining the EU after having left. This depends (a) on the resolution of some legal issues concerning Article 50 (Can the withdrawal notice be rescinded? If so, must the EU consent? If so, can the EU attach conditions? Or can the Article 50 period simply be extended indefinitely, with no further negotiation taking place?) and (b) on the extent to which the UK could rejoin on the same terms (Would the EU have already removed the UK’s opt-outs from the Treaties? Would the UK rebate on the EU budget have been rescinded yet?).

EU27 citizens

As noted already, the UK government’s intention to require EU citizens to register if they come to the UK during the transitional period is consistent with the EU citizens’ Directive, which allows registration for stays longer than three months. Indeed, the Commission has reported that almost all EU states register citizens from other EU Member States. But a failure to register can only be punished by proportionate penalties, not expulsion or detention (see the ECJ ruling in Watson and Bellman, concerning a prior version of this law). According to the ECJ ruling in Huber, Member States may include information on EU citizens in a database, but this can only be used for the purpose of administering EU free movement law; if they put information on EU citizens in a criminal database, they must be treated equally with nationals of that Member State.

The Directive goes on to say that Member States cannot insist that registration certificates must be the sole method of checking entitlement to reside or any other right, since other forms of proving identity are possible; and that Member States can only penalise EU citizens for not carrying their registration certificates if they penalise their own citizens the same way for not carrying ID cards (see also the ECJ judgment in Oulane). It follows that as long as the UK doesn’t have an ID card system, it could not penalise EU citizens for not carrying registration certificates.

So while registration of EU citizens is permissible, the limits set out in the legislation and case law put the more general questions about ‘transition law’ raised in this blog post in a particular context. It would not be credible for the EU27 to insist that the UK not register EU citizens at all, particularly given that most of them do the same thing themselves. But will the important limits on registration apply? It’s an important question given the tendency of the UK Home Office to create a ‘hostile environment’ for EU and non-EU citizens alike, and the risk that absent the application of EU case law and legislation to this issue, there could be fines, detention, expulsion or other refusals of rights for EU citizens who didn’t register, lost their registration certificate or forgot to carry it. (All the same issues arise if the UK extends – as it could – the registration obligation to EU citizens who were present before Brexit Day).

If the EU27 and UK agree that the existing EU law still applies and the pre-Brexit ECJ case law remains binding, in principle the issue is resolved, at least during the transitional period. But what if the UK breaches this agreement, or if there is some question about how the UK applies the requirement, or if there is some new relevant ECJ case law? Then the important questions will be whether the existing EU law remedies (direct effect, supremacy, damages) are still available; whether UK courts can still ask the ECJ questions; and whether the UK courts are obliged to follow post-Brexit ECJ case law.

This issue, important as it would be for many EU citizens resident in the UK, is only a microcosm of the legal issues raised by the transition period – and which the UK and EU27 will hopefully have time to consider properly.

Barnard & Peers: chapter 27

Photo credit: Thousand Wonders

* *This blog post was supported by an ESRC Priority Brexit Grant on 'Brexit and UK and EU Immigration Policy'

A Renaissance of the Brexit talks? Theresa May’s Florence speech

Professor Steve Peers*

Today’s speech by Prime Minister Theresa May was widely understood to be an attempt to unblock the talks on the Brexit process, which have clearly become stalled, in particular over financial issues. Will her speech accomplish that aim? Or will its implicit attempt to reassure Leave voters in the UK, especially in the cabinet and the press, mean that it fails to unblock talks? And what does it tell us about the future of UK/EU relations?

The key feature of the talks is that they are sequenced. In an initial phase of talks, the main issues are: a) the position of EU27 citizens in the UK, and UK citizens in the EU27, after Brexit (discussed here); b) the extent of outstanding UK commitments to the EU; and c) the issue of the border between Ireland and Northern Ireland (discussed here). Only if the EU judges there to be ‘sufficient progress’ on these issues will the talks move to a second phase, about the future trade relationship between the EU and the UK and a transitional arrangement to bridge the gap between Brexit Day and that future arrangement.

As things stand, the EU will not judge there to be ‘sufficient progress’ in October, mainly because the UK has not accepted any specific financial commitments, although there has also been little progress in discussion of the Irish border and there are still gaps between the two sides’ positions on UK and EU27 citizens.

In that light, has May’s speech moved the UK closer to reaching the ‘sufficient progress’ threshold? On Northern Ireland, she simply observed that both sides wanted to avoid a ‘hard border’, but said nothing new about that. The UK’s proposals on novel customs methods to address the issue (by the government’s own admission) ‘blue sky thinking’, but she did not further flesh them out.

On the issue of EU27 citizens, she committed to setting out the withdrawal agreement into UK domestic law, and permitting the UK courts to take account of relevant ECJ case law. But this goes no further than the draft EU Withdrawal Bill, which already assumes (in Clause 9) that the withdrawal agreement will be transposed in domestic law and sets out (in Clause 6) that pre-Brexit ECJ case law binds lower courts (but not the UK Supreme Court, the government or Parliament) and that post-Brexit ECJ may be considered at a UK court’s discretion. While the Prime Minister made much of the excellence and independence of UK courts, she failed to mention the embarrassing recent refusal of the Home Secretary to give effect to a court order. So the EU27 side will still press for the ECJ’s involvement. Nor did she make any concessions as regards the substance of the law. 

On financial issues the Prime Minister said in effect that the UK would pay into EU funds to the end of the current EU budget cycle in 2020, during a transitional period after Brexit Day in March 2019 (see below). She also stated that the UK would honour commitments made during EU membership, although it is not clear if this is a reference to the broader issue of the UK’s share of costs in cases where the EU made a commitment in one year and paid for it in a later year. There are also other financial issues (off-budget funds, pensions, UK share of liability for loans that might not be paid).

More broadly, the Prime Minister supported the idea of a transitional period after Brexit Day of about two years, when the UK and EU would still trade on the same basis and apply the same security arrangements. The UK would still cease to be a formal EU Member State on Brexit Day – ceasing to participate in the EU’s political institutions – although some role for the ECJ seemed to be implicitly conceded. It should be noted that the EU27 side is also open to discussing a short transitional period as long as EU frameworks of enforcement, et al (including the ECJ) continue to apply. So there is broad agreement on the notion of a transitional period – subject to discussion of the details.

What about those details? Mrs May offered little about the substance, stating that EU27 citizens could still come to the UK during the transitional period but would have to register – as already permitted by the EU citizens’ Directive (see Article 8). Presumably the UK would have a customs union with the EU for the transitional period, although she said it would start to negotiate trade deals with non-EU countries. The transitional period could be terminated early on specific issues, for instance dispute settlement – an indication that the UK wants to end involvement with the ECJ as soon as possible.

Comments

Despite the attention paid to Mrs. May’s speech, the key question is whether the details of the UK’s negotiation position have changed. In particular, movement on those financial issues which were not expressly mentioned will be crucial determining whether talks move forward to trade issues in October. But the issue on enforcement of EU27 citizens’ rights will still remain a stumbling block, and the EU side will likely want to see some clarification of the UK’s proposals on customs and the Irish border.

The tone of the Prime Minister’s speech may help. It was civil, emphasising the importance of a future partnership between the UK and the EU, ruling out a rush to lower UK regulatory standards and with only brief mention of the discredited "no deal is better than a bad deal" mantra.

If the talks do move forward to transitional issues, this means there is no immediate need to discuss the technical questions of winding down UK/EU relations as of Brexit day, although they would still have to be discussed at some point if the UK and EU are going to change the substance of their relationship after that date. But this will mean that difficult issues of principle relating to the transitional period will have to be discussed.

What exactly is the transition period a bridge to? Which EU laws (if any) will no longer be applied? What if the transition time frame isn’t long enough? Would the UK be bound by new ECJ rulings during this period? Would it apply new EU legislation? Would the UK be consulted on it if it does? Would EU law apply in the same way as it does as an EU member? While the Prime Minister was anxious to rule out the ‘Norway model’ of EU/UK relations, the transitional period would nevertheless look somewhat like that model – except it appears that the UK would apply even more EU law than Norway does.

Overall, the Florence speech makes it somewhat more likely – but still far from certain – that there will be a conclusion to the Brexit talks, with no immediate ‘cliff edge’ for either side on Brexit Day. As always, the devil will be in the detail.

Barnard & Peers: chapter 27

Photo credit: The Telegraph

* *This blog post was supported by an ESRC Priority Brexit Grant on 'Brexit and UK and EU Immigration Policy'

Privacy at work: the Strasbourg Grand Chamber clarifies the law

Lorna Woods, Professor of Internet Law, University of Essex

Background

The case of Bărbulescu concerned the extent to which employers could track employee communications, including Internet use, when those communications might include private correspondence rather than business communications. Here, an employer dismissed an employee for failing to respect a prohibition on the use by employees of work equipment for private reasons. The employee sued his employer in the Romanian courts but lost, so brought a claim under Article 8 ECHR, which protects the right to private and family life, home and correspondence. In particular, Bărbulescu objected to the fact that, to find that he had violated the policy, his employer monitored his communications. This he claimed was contrary to the jurisprudence of the European Court of Human Rights in Copland v UK.  The Fourth Section of the Strasbourg court held, at the beginning of 2016, that the legal situation in Romania did not give rise to a violation of Article 8. While the media tended to summarise the position as the court permitting entirely unrestricted monitoring, this was not entirely the position as noted by Steve Peers here. The matter was in any event referred to the Grand Chamber and it is with this judgment that this note is concerned. The Grand Chamber came, albeit not unanimously, to the opposite conclusion from the Fourth Section, finding that there had been a violation of Article 8 ECHR.  So, why has it come to this conclusion?

Judgment

The Grand Chamber first considered the applicability of Article 8 to the situation in issue.  Re-iterating a long list of previous cases, it emphasised that Article 8 should not be understood narrowly and includes both the right to develop relationships with others and professional activities or activities taking place in a public context. The Court noted two further separate points. First it commented that:

[r]estrictions on an individual’s professional life may fall within Article 8 where they have repercussions on the manner in which he or she constructs his or her social identity by developing relationships with others [para 71].

In this context work is important in providing the possibility for individuals to develop relationships with others. Secondly, while ‘life’ in the list of interests protected by Article 8 is qualified by the adjective ‘private’, the term ‘correspondence’ is not so limited [para 72]. The Court noted that while the test of a reasonable expectation of privacy has been used to determine the scope of Article 8, it here re-iterated that is a significant though not necessarily conclusive factor [para 73]. The Court concluded that while the employee was aware of the ban, he was not aware of the monitoring; that some of the content was intimate in nature; that he alone had the password to the account. The Court left open the question of whether Bărbulescu had a reasonable expectation of privacy in the light of the employer’s policy (of which Bărbulescu was aware), but then held that ‘an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist …’ [para 80]. Both the right to private life and the right in relation to correspondence were therefore engaged.

The Court then considered whether there had been a violation. In this the Court was faced with the question of whether there was a positive obligation, given that the employer was not a public body. The Court noted that the monitoring of the communications could not be regarded as “interference” with Bărbulescu’s right by a State authority [para 109]. Nonetheless, the measure taken by the employer was accepted by the national courts, thus engaging the State’s positive obligations [paras 110-111]. It re-stated that the test was that of whether a fair balance had been struck between the competing interests. The Court noted that labour law has specific characteristics which allows for a wide margin of appreciation. This is not, however, unlimited; States must ensure that there are safeguards in respect of the monitoring of communications. It identified a number of issues:

-          Clear advance notification of the possibility of monitoring;

-          The extent of the monitoring and the degree of intrusion, taking into account the difference between monitoring ‘flow’ of communications and their content;

-          The justification for the monitoring;

-          Whether less intrusive mechanisms for monitoring exist;

-          The consequences for the employee;

-          Whether adequate safeguards were in place.

Further, there should be the possibility of a domestic remedy. The Grand Chamber took the view that the domestic courts did not consider or did not give appropriate weight to all the issues identified [para 140]. Notably, it did not appear the employer had given Bărbulescu sufficient advance notice of "the extent and nature of [its] monitoring activities, or of the possibility that [it] might have access to the actual content of his messages". The Court was also sceptical of the national courts acceptance of the justification for the intrusion. There was therefore a violation of Article 8.  There was dissent, however, on the assessment of the national courts’ approach to the matter.

Comment

The headline news from this is that the Grand Chamber came to a different determination on the issue of breach from the Fourth Section. It should be noted, however, that even that chamber did not suggest that unlimited monitoring would be permissible (see e.g. Steve Peers’ analysis). Nonetheless in purely practical terms, the Grand Chamber judgment provides a clear statement that workplace privacy cannot be reduced to zero, as well as a list of considerations that will be useful not just for national courts but also employers in considering policies regarding personal communications in the workplace. Note that this case concerned a private employer not – as in Halford and Copland – a public body as employer so the considerations highlighted will be of relevance to all employment relationships. In this, the Grand Chamber seemed to respond to some of the concerns expressed by Judge Pinto de Albuquerque in his dissent from the Fourth Section judgment regarding the factual specificity of the case. The judgment also seems to recognise the importance of work as part of daily life, an important point given the blurring of boundaries in the ‘always on’ culture of smart devices in which work-related information and communications co-habit with those of life outside work.

There are some further points to consider. The first is the scope of Article 8 and in particular the ‘reasonable expectation of privacy’.  Article 8 lists a number of aspects protected: ‘private and family life’ – usually seen as two separate elements ‘private life’ and ‘family life’ – ‘home’ and ‘correspondence’. As written, it seems that these are distinct elements yet the reasoning of the Court does not always treat them as separate; arguably the Court’s previous approach in making the matter one of a ‘reasonable expectation of privacy’ blurs any boundaries between these elements and in so doing, limits the scope of protection as far as ‘correspondence’ is concerned. The Grand Chamber seemed alive at least in some regards to this point: it specified that there is no requirement that correspondence be private. If that is the case, however, why is the issue of reasonable expectation of privacy relevant? Indeed, the Grand Chamber noted that the test of reasonable expectation of privacy is not the be all and end all of Article 8 (see para 78). Despite this recognition, the Grand Chamber still turned the question into one of a reasonable expectation of privacy:

It is open to question whether – and if so, to what extent – the employer’s restrictive regulations left the applicant with a reasonable expectation of privacy [para 80].

Is the Court here suggesting that correspondence is protected by Article 8 only when there is a reasonable expectation of privacy? Seemingly so, yet the Grand Chamber continued to state:

…. an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary [para 80].

The position is consequently somewhat unclear. It would be more straightforward were the Court to recognise that correspondence constitutes a separate class aside from private life however broadly understood, and to deal with scope of Article 8 as a separate issue from that of interference and justification.  The current position unfortunately seems to be embedded in a long line of case law.

Bărbulescu is distinct from previous case law on employee monitoring in that it involved the State’s positive obligations. The Court has tended to adopt a different approach in regard to positive obligations than negative obligations. Rather than look at Article 8(2) and the tests of legitimate objective, lawfulness and necessity (in a democratic society), it adopts a fair balance test within which the State has a broad margin of appreciation. On this basis, the side-lining of the Copland ruling – which fell at the lawfulness stage in a standard Article 8(2) analysis – is understandable.  The Court seems to suggest, however, that there are parallels between positive and negative obligations:

[i]n both contexts regard must be had in particular to the fair balance that has to be struck between the competing interests of the individual and of the community as a whole, subject in any event to the margin of appreciation enjoyed by the State [para 112].

It is questionable whether the derogation from an individual’s rights by state actors really should be seen as being about a fair balance, a stance which arguably nudges the focus of protection away from human rights as paramount. Nonetheless, here the Court brings in factors from the standard Article 8(2) state surveillance case law aimed at preventing abuse of secret surveillance capabilities to provide guidance in finding the fair balance. It is noticeable that Copland is not considered but instead the State surveillance cases of Klass and Zakharov. 

It might be that the Grand Chamber accepted the referral because it wished to deal with failure of the Fourth Section to consider the EU Data Protection Directive, which protects against the collection of personal data without the explicit consent of an individual (or justified grounds for such collection).  This point was highlighted by Judge Pinto de Albuquerque. If so, the judgment fails to engage with EU data protection law in any meaningful way. The Grand Chamber noted that the national courts had considered the directive, but did not consider those rules themselves. Insofar as the Court does refer to international and European standards, it specifies the ILO standards and Council of Europe Recommendation CM/Rec(2015)5, rather than the Directive. It seems then that there has not been any direct engagement with the substantive EU data protection rules.

Photo credit: Aird and Berlis LLP