Family reunion,the rights of the child and effective remedies: latest CJEU judgment

Professor Steve Peers, University of Essex

For parents of teenagers, it’s always later than you think, and time is forever slipping through your fingers. But imagine what it’s like for parents who can never live with their children, due to the arbitrary viciousness of immigration law. A first step unseen. A first word unheard. A school play unwitnessed. And even if the immigrant parent moves heaven and earth to comply with the conditions for family reunion in immigration law, it’s possible that just as the children might be able to join their parents, time runs out for their application because they come of age – leaving only the unbearable emptiness of a nest that was never full.

Family reunion for non-EU families in the EU is governed by the EU’s family reunion Directive, which provides for admission of children who are not at the age of majority. But what if an application is made before the child reaches that age, but is decided later?

Two years back, the Court of Justice decided such a case as regards an unaccompanied minor with refugee status, who turned 18 just after applying for asylum: the A and S judgment, discussed here. The Court ruled that as long as an asylum seeker applied for asylum before turning 18, the special rules in the Directive which provide for obligations to admit the parents of unaccompanied minor refugees still apply (assuming, of course, that refugee status was granted). However, that left open the question of what approach to take to other family reunion applications, where there is no such special rule, and in any event the date of an application for asylum would be irrelevant. (While the Directive does apply to refugee parents, it doesn’t logically follow from A and S that the date of their application for asylum should be decisive).

The recent judgment in BMM has addressed this issue – taking a humane approach to the issue of what happens when a child comes of age during the application process.

The basic EU rules on family reunion

The EU’s family reunion Directive sets minimum standards, so states can be more generous if they wish. It mainly concerns reunion of spouses and minor children with a non-EU sponsor; admission of further family members is optional in most cases. It does not apply to the UK, Ireland and Denmark. However, it will apply to family reunion of UK citizens in the EU (besides those living in Ireland and Denmark) after the post-Brexit transition period, when the UK is no longer covered by EU free movement law, unless (a) they are covered by the withdrawal agreement, if the sponsor moved before the end of the transition period (see discussion here), or (b) EU free movement law still applies, because the UK citizen is a family member of an EU citizen who has moved between Member States; or (c) national law only applies, because the UK citizen is a family member of an EU citizen who has not moved between Member States (a French citizen in France, for instance).

The standard rules in the Directive require that: the sponsor has a residence permit valid for at least one year, and has “reasonable prospects” of obtaining permanent residence; the family members must reside outside the territory when the application is made (although Member States can derogate from that rule); “public policy, public security or public health” are grounds for rejection; conditions relating to accommodation, sickness insurance and “stable and regular resources” may be imposed; Member States may require “integration measures”; and there can be a waiting period of two years of lawful stay of the sponsor before family reunion takes place.

There are also exclusions from the scope of the Directive. It does not apply at all to: asylum seekers; persons with temporary protection; persons with subsidiary protection on the basis of national or international law; and, as noted above, family members of EU citizens (whether they have moved within the EU or not). Implicitly it does not apply to irregular migrants, since by definition they do not have a residence permit with the prospect of long-term residence, until and unless Member States decide to regularise their status.  Member States can choose to extend the Directive to those categories of persons (except those covered by free movement law) if they wish. 

Member States can set lower standards than the Directive, where it allows for such derogations, although this is subject to detailed conditions. These derogations exist as regards: children over 12, who arrive separately from the rest of the family; minimum ages for the sponsor or spouse; children over 15; and a waiting period of three years.

The Court of Justice has ruled on the Directive several other times, as regards: its validity in light of human rights concerns (EP v Council); its application to dual EU/non-EU citizens (O and S); the sufficient resources condition (Chakroun and Khachab); the minimum age of spouses (Noorzia, discussed here); integration conditions (K and A, discussed here, and K); the application of the Directive by analogy to family reunion with “home State” EU citizens (C and A) and persons with subsidiary protection (K and B, discussed here); loss of a residence permit due to fraud which the family member was unaware of (YZ and others); documentation in refugee cases (E); the public policy exception (GS and VG); the definition of dependent family members of refugees (TB); and the consequences of a late decision by the administration (X).

As well as the special rules for refugee family reunion set out in the original Directive, subsequent EU legislation contains more favourable rules for the family reunion of other groups of non-EU citizens: holders of an EU Blue Card for highly-skilled workers (discussed here); intra-corporate transferees (discussed here); and researchers (discussed here). The proposal to amend the Blue Card law (discussed here) would enhance these rules further.

The judgment

The sponsor in the MBB case is a citizen of Guinea with refugee status – although the case concerns the general rules in the Directive, rather than the special rules on applications by refugees. Applications for family reunion with the sponsor’s three children were rejected, and the sponsor challenged those rejections in court. The first instance court refused to consider the legal challenges, on the grounds that the children were now grown up. On appeal, the appellate court decided to ask the CJEU questions about the interpretation of EU law in the circumstances, given the differences between the position of unaccompanied minor refugees in the AS case and the general rules in the Directive.

According to the CJEU, while the Directive left it to Member States to determine the age of majority as regards the general rules on applications (it’s set at 18 where the applicant is an unaccompanied minor refugee), it does not refer to national law as regards when to determine when that condition is satisfied. Member States should not have any discretion on the latter point, because EU law should have a uniform interpretation when it does not refer to national law, taking account of the context and objective of the legislation. The objective of this law is ‘to promote family reunification’, and it respects fundamental rights, including the right to family life and the rights of the child (to maintain a relationship with parents) in the EU Charter of Rights. So the Directive ‘must be interpreted and applied in the light of’ the Charter, including the best interests of the child.

If applications ‘timed out’ once a child became an adult, national authorities and courts might be tempted to run down the clock, ‘and could thus act in a way which would jeopardise the very rights of those minors to family reunification’, following the A and S judgment. Indeed, in this case, it took three years and nine months for the first instance court to rule; and ‘such processing times do not appear to be exceptional in Belgium’: the Belgian Government admitted that the average court waiting time is three years, and this case ‘had not been regarded as a priority by that court’ despite the ages of the children concerned. So using the date of the administrative decision would not be in accordance with the best interests of the child. Nor would applicants be treated equally, since the success of their application would be determined by how fast the administration or court decided the application.

Next, the Court ruled on a remedies point. Did the right to bring a legal challenge to a rejection, interpreted in light of the right to an effective remedy in the Charter, mean that a national court cannot simply dismiss a claim as inadmissible purely because a child ‘has reached majority in the course of the court proceedings’?

The Court ruled this out. In its view, the child still had an interest in proceedings, since the application had to take account of the age of the child at the time when the application was made. While there was no time limit for the court to give its ruling, and Member States have ‘some discretion’ as regards rules on legal challenges to rejections of an application for family reunion, Member States are still required to comply with the Charter right to an effective remedy before a tribunal. This meant that legal challenges must be ‘effective and real’. Therefore they ‘cannot be dismissed as inadmissible solely on the ground that the child concerned has reached majority in the course of the court proceedings’.

Comments

Both the substantive and procedural elements of the Court’s judgment give strong protection to family life. Its unqualified ruling that the age of the child when the application is made is decisive will guarantee that parents of teenagers cannot lose the right to family reunion purely because of national administrative or judicial tardiness. This compensates somewhat for the Court’s own decision in X, which failed to provide for an effective remedy (the automatic grant of a residence permit) in the event of a late decision on a family reunion application by the administration.

On that point, the Court’s insistence on effective remedies in the context of this Directive is relevant above and beyond the issue of timing out applications by children. The confirmation that the Charter applies to effective remedies in the context of family reunion is not surprising in light of other recent judgments (on asylum law and on visa applications, for instance), but it is always useful to put to rest any doubt on the issue. This principle has general application – so, for instance, strict time limits, or limitations on the scope of judicial review or the remedies which courts can order, could be challenged as a violation of the Charter, in any family reunion case within the scope of the Directive, not just those involving children. Again, the Court has reaffirmed its interpretation of EU law based on a rights-based reasoning, rather than the control-based approach taken by many Member States and the EU institutions during the supposed “migration crisis”.

More broadly, the Court’s reaffirmation of the importance of the rights of the child when interpreting the legislation could be relevant to interpreting other aspects of the family reunion law, as well as many other EU immigration and asylum laws: for instance, the returns Directive, the asylum procedures Directive, the reception conditions Directive, and the Dublin rules on responsibility for asylum seekers. (Note that conversely, EU criminal law legislation on child suspects’ rights – discussed here – does explicitly address this issue, setting out rules on this point similar to the Court’s family reunion judgments in its Article 2(3)).

Barnard & Peers: chapter 26

JHA law: chapter I:5, I:6

Photo credit: Ackah law

No more fluttering/fleeting line between discrimination in employment and the right to freedom of expression: the CJEU judgment in NH v Associazione Avvocatura per i diritti LGBTI — Rete Lenford

Chiara De Capitani, Ph.D. Researcher in International Studies at the University of Naples "L'Orientale"

Introduction

Case C‑507/18 NH v Associazione Avvocatura per i diritti LGBTI — Rete Lenford (the present case), can be best summarized through the aviary metaphors used by Advocate General Eleanor Sharpston in her opinion (AG’s Opinion): the ruling balances freedom of expression with the “volatility” of discriminatory statements and analyses which roles members of associations can play in the fight against discrimination, whether they have beaks, wings and feathers or not (see more infra).

This Court of Justice of the European Union (CJEU) case raises many interesting issues and builds on the previous rulings of 2008 – C-54/07 Centrum voor Gelijkheid van Kansen en voor Racismebestrijding v Firma Feryn NV (Feryn) – and 2013 – C-81/12 Asociaţia Accept v Consiliul Naţional pentru Combaterea Discriminării (Asociaţia Accept) rulings.

In all three cases, an employer (Feryn) or a person perceived as being capable of exerting a decisive influence on the recruitment policy of an employer (Asociatia Accept, present case) publicly stated that they would not hire a person from a protected category (ethnic minorities for Feryn, LGBTI* individuals for Asociaţia Accept and present case).

All three cases were brought forward by associations, with no identifiable complainant and, in the case of Asociatia Accept and the present case, the statements were released to the public while the employer had no ongoing or planned recruitment procedures.

Therefore, the Court tries to answer the following questions:

Can discriminatory statements fall under the scope of the directive when no recruitment procedures are ongoing? If so, following which criteria?

How can national Courts assess the balance between the right to freedom of expression and combating discrimination in employment and occupation?

Where no identifiable complainant can be found, can an association bring legal proceedings and ask to obtain pecuniary damages in circumstances that are capable of constituting discrimination?

Facts of the case

During an interview in a radio programme a lawyer (NH) stated that he would never hire a homosexual person to work in his law firm nor wish to use the services of such persons. At the time when he made those remarks, there was no current recruitment procedure open at NH’s law firm.

Having considered that NH had made remarks constituting discrimination on the ground of sexual orientation, the Associazione Avvocatura per i diritti LGBTI — Rete Lenford (the Associazione), brought proceedings against him, asking that he be ordered – among other sanctions – to pay damages to the Associazione for non-material loss.

The action was successful at first instance and upheld on appeal, therefore NH appealed once more in cassation before the Supreme Court of Cassation, Italy (the referring court).

The referring court expresses doubts as to whether the Associazione has standing to bring proceedings against NH and ask for pecuniary damages, since the case has no identifiable complainant. The referring court also asks whether NH’s statements – in light in particular of the absence of an open recruitment position – fall within the scope of Directive 2000/78 (the Anti-Discrimination Employment Directive) on the basis that they concern ‘access to employment’, or whether they should be regarded as mere expressions of opinion.

Analysis

Past, present, and possible future discrimination

NH believes that since there was no current or planned recruitment procedure at his law firm at the time he was interviewed, his statements should not be considered to have been made in a professional context and thus would fall outside of the scope of the Anti-Discrimination Employment Directive.

However, Article 3 (1) (a) of that Directive aims at protecting all persons, as regards both the public and private sectors: “in relation to conditions for access to employment”. Since the Directive is “a specific expression, in the areas that it covers, of the general prohibition of discrimination” laid down in Article 21 of the Charter of Fundamental Rights of the European Union (the Charter) and because of its objectives and the nature of the rights it seeks to safeguard, the Court notes that its scope, defined in Article 3, “cannot be defined restrictively”.

The Court has already found in the rulings Feryn and Asociaţia Accept that discriminatory statements can hinder the “access to employment” of a protected category. Indeed, as stated by Advocate General Maduro and recalled by both the Court and AG Sharpston in the present case: “in any recruitment process, the greatest ‘selection’ takes place between those who apply, and those who do not. Nobody can reasonably be expected to apply for a position if they know in advance that, because of their racial or ethnic origin, they stand no chance of being hired. Therefore, a public statement from an employer that persons of a certain racial or ethnic origin need not apply has an effect that is anything but hypothetical”.

Furthermore, discriminatory statements have a lasting effect in time.

In the Feryn ruling, the Court, interpreting Article 8 of Directive 2000/43 (The Race Equality Directive) - identical to Article 10 of the Anti-Discrimination Employment Directive - established that past statements create “presumption of a discriminatory recruitment policy” which the employer can rebut in Court.

The Court in the present judgment seems to confirm the duration in time, in the past, present but also possibly in the future, as it recognizes – in its answer to the first question – that statements made “outwith any current or planned procedure” can amount to discrimination as long they fulfil a number of non-hypothetical criteria (para 58), which we’ll examine now.

The interpretation of ‘access to employment’

Both the AG and the Court proceed by highlighting a list of criteria National Courts have to follow to establish when discriminatory statements present a sufficient link with ‘access to employment’ to fall under the scope of the Anti-Discrimination Employment Directive.

First, the status of the person making the statements and the capacity in which they made them, which must establish either that they are a potential employer or are, in law or in fact, capable of exerting a decisive influence on the recruitment policy or a recruitment decision of a potential employer, or, at the very least, may be perceived by the public or the social groups concerned as being capable of exerting such influence, even if they do not have the legal capacity to define the recruitment policy of the employer concerned or to bind or represent that employer in recruitment matters.

The latter point is particularly interesting given that both in Asociaţia Accept and in the present case both authors of the discriminatory statements, during their respective interviews, claimed and acted as if they played an important role and a very influential part in the recruitment process of their company (para 35, Asociaţia Accept; para 20, AG opinion), and were perceived as such by the public. However, ironically, their exact status within the company was either unclear (present case, para 43) or was becoming less important than what they were telling and presenting the public (Asociaţia Accept, para 32).

Furthermore, National Courts, following the Asociaţia Accept ruling, should consider as part of their assessment of this criteria whether the actual employer did or did not clearly distance itself from the statements concerned (para 41, present case).

The second criterion to consider is the nature and content of the statements concerned. They must relate to the conditions for access to employment or to occupation with the employer concerned and establish the employer’s intention to discriminate on the basis of one of the criteria laid down by the Anti-Discrimination Employment Directive. This has clearly been the case for all three rulings where three individuals publicly stated they would not hire ethnic minorities (Feryn) or LGBTI individuals (Asociaţia Accept, present case) within “their” company.

It’s interesting to note that in her opinion, the AG adds to these criteria that the statements must also “be of such a nature as to dissuade persons belonging to the protected group from applying if and when a vacancy with that potential employer becomes available” (para 55 of opinion). The Court does not add this element to the list of criteria but will consider it when assessing the interference of the Directive’s application with the right to freedom of speech (see infra).

Finally, the third criteria National Courts have to consider is the context in which the statements at issue were made “—in particular, their public or private character, or the fact that they were broadcast to the public, whether via traditional media or social networks — must be taken into consideration”.

Unfortunately, neither the Court nor the AG elaborate on why they believe this distinction between private and public statements is of such relevance. We can assume, given the AG’s beautiful paragraph at the beginning of her opinion, that public statements “have wings” and “travel fast and spread quickly”, meaning they are “disseminated rapidly and have consequences”. The likelihood that NH’s statements on the radio reached, hurt and affected many members of the LGBTI* community because of their publicity and fluttering in newspapers and social media is without question. However, as the AG herself notes “one can easily imagine the chilling effect of homophobic ‘jokes’ made by a potential employer in the presence of LGBTI applicants” (in a private setting, presumably). Since Feryn, Asociaţia Accept and the present case all concern public statements, hopefully the Court will elaborate on this aspect of “statements” made in a private setting at another time.

The interference with freedom of expression

The AG notes in her opinion that the referring court “expresses doubts as to whether NH’s statements fall within the scope of (the Anti-Discrimination Employment Directive) on the basis that they concern ‘employment’, or whether they should be regarded as mere expressions of opinion, unrelated to any discriminatory recruitment procedure” (para 25). Furthermore, she notes (para 37) that at the hearing the Italian Government emphasised that the statements were not made during a “serious broadcast with the participation of employers and news journalists” but during an “irony-filled programme of political satire”.

Both the AG and the Court proceed thus to examine why the above interpretation of the Anti-Discrimination Employment Directive is not affected by the possible limitation to the exercise of freedom of expression using the parameters provided by Article 52 (1) of the Charter which, as Professor Peers puts it, “deals with the arrangements for the limitation of rights”. Unsurprisingly, he notes: “the greatest volume of [EU] case law concerning the grounds for interference with rights relates to Article 10 ECHR on Freedom of expression”.

Indeed, the present case has sparked controversy also among some academics (Miller, Tanzarella) which believe the AG and the Court have failed to truly assess the proportionality between protection against discrimination and its interference with the right to freedom of expression - I do not believe this to be the case, especially in light on the “necessity requirement” that I will analyse further on.

Let’s flutter back to the ruling:

Professor Peers’ comments on the scope and interpretation of Article 52(1) of the Charter provide useful guidance to assess the judgment of the Court.

Article 52(1) of the Charter contains three different elements:

-          a procedural rule (limitations on rights ‘must be provided for by law’);

-          a rule on the justifications for limiting rights (‘objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others’), and

-          several interlinked rules on the balancing test to be applied as between rights and limitations (the obligation to ‘respect the essence of’ the rights; the ‘principle of proportionality’; and the requirement of necessity).

The Court and AG go through all the above-cited elements in an orderly fashion.

The limitations to the exercise of the freedom of expression that may flow from the Anti-Discrimination Employment Directive are indeed provided for by law, since they result directly from that directive.

They respect the essence of the freedom of expression, since they are applied only for the purpose of attaining the objectives of said Directive, namely to safeguard the principle of equal treatment in employment and occupation and the attainment of a high level of employment and social protection; Further to this argument, the Court notes in paragraphs 37 and 38 of the ruling “recital 11 of the directive states that discrimination based inter alia on sexual orientation may undermine the achievement of the objectives of the FEU Treaty, in particular the attainment of a high level of employment and social protection, raising the standard of living and the quality of life, economic and social cohesion and solidarity, and the free movement of persons. (The) Directive is thus a specific expression, within the field that it covers, of the general prohibition of discrimination laid down in Article 21 of the Charter”;

They respect the principle of proportionality in so far as the prohibited grounds of discrimination and the material and personal scope are defined in the directive, and the interference with the exercise of freedom of expression does not go beyond what is necessary to attain the objectives of the directive, in that only statements that constitute discrimination in employment and occupation are prohibited.

Finally, the Court elaborates with more detail the last requirement, the “necessity test”: the limitations to the exercise of freedom of expression arising from Anti-Discrimination Employment Directive are necessary to guarantee the rights in matters of employment and occupation of persons who belong to a protected group. The AG opinion underlines (in para 70) the following section of Article 10(2) of the European Convention on Human Rights (ECHR) which seems to be perfectly complementary with Art 52(1) of the Charter: “the exercise of (freedom of expression) carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society (…) for the protection of (…) rights of others”.

Analysing the “necessity test” from another perspective, the Court adds that considering statements as falling outside the scope of that directive solely because they were made “outwith a recruitment procedure, in particular in the context of an audiovisual entertainment programme, or because they allegedly constitute the expression of a personal opinion” could make the “very essence of the protection afforded by that directive in matters of employment and occupation (…) become illusory” (para 54 of the judgment).

Finally, the Court aligns itself with the AG opinion that “in any recruitment process, the principal selection takes place between those who apply, and those who do not” and mentions paragraph 57 of her opinion, where she quotes a section of AG Maduro’s opinion in Feryn: “(A) public statement from an employer that persons of a certain racial or ethnic origin need not apply has an effect that is anything but hypothetical. To ignore that as an act of discrimination would be to ignore the social reality that such statements are bound to have a humiliating and demoralising impact on persons of that origin who want to participate in the labour market and, in particular, on those who would have been interested in working for the employer at issue”.

Associations with standing to bring legal proceedings

The Court moves on to the first question: whether the Anti-Discrimination Employment Directive must be interpreted as precluding national legislation under which an association of lawyers whose objective is the judicial protection of persons having in particular a certain sexual orientation and the promotion of the culture and respect for the rights of that category of persons, automatically, on account of that objective and irrespective of whether it is a for-profit association, has standing to bring legal proceedings for the enforcement of obligations under that directive and, where appropriate, to obtain damages, in circumstances that are capable of constituting discrimination, within the meaning of that directive, against that category of persons and it is not possible to identify an injured party.

The Court analyses step by step the various facets of this complex question.

According to Article 9(2) of the Anti-Discrimination Employment Directive, Member States are to ensure that associations, organisations or other legal entities which have a legitimate interest in ensuring that the provisions of the directive are complied with, may engage, either on behalf or in support of a complainant, with his or her approval, in any judicial and/or administrative procedure provided for the enforcement of obligations under the directive.

Since no injured party can be identified in the present case, Article 9(2) of the Directive does not require an association such as that at issue in the main proceedings to be given standing in the Member States to bring judicial proceedings. Nevertheless, Article 8(1) of the Anti-Discrimination Employment Directive provides that Member States may introduce or maintain provisions which are more favourable to the protection of the principle of equal treatment than those laid down in that directive. This is the case for Italy where article 5 of its Legislative Decree n° 216/2003 provides that “trade unions, associations and organisations (…) shall also have standing in cases of collective discrimination where it is not automatically and immediately possible to identify individuals affected by the discrimination”.

Therefore, as was the case with Asociaţia Accept, the Court recalls that Article 9(2) of the Anti-Discrimination Employment Directive in no way precludes a Member State from laying down, in its national law, the right of associations with a legitimate interest in ensuring compliance with that directive to bring legal or administrative proceedings to enforce the obligations resulting therefrom without acting in the name of a specific complainant or in the absence of an identifiable complainant.

In those cases, it is for that Member State to decide under which conditions an association such as that at issue in the main proceedings may bring legal proceedings and for a sanction to be imposed in respect of such discrimination.

With regards to sanctions, the Court, quoting Asociaţia Accept, recalls that sanctions are required, in accordance with Article 17 of the Anti-Discrimination Employment Directive, to be effective, proportionate and dissuasive, regardless of whether there is any identifiable injured party. As noted by Djelassi and Mertens, sanctions can therefore, include the payment of pecuniary damages also in the present case where there is no identifiable complainant and no ongoing recruitment procedure.

Similarly, the Court leaves Member State to determine whether the for-profit or non-profit status of the association is to have a bearing on the assessment of its standing to bring such proceedings. The AG provides further insight on this issue: mentioning the written observations of the Greek Government, she analyses the possible risk that a profit-making association abusing the right to bring proceedings in order to enhance its profits, which, according to the Greek Government, would jeopardise the attainment of the objectives of the directive. First, she notes that given the uncertainty inherent in litigation a “trigger-happy” approach to launching actions would itself be “a risky strategy for a commercially minded association to adopt”. Secondly, it is the duty of the national court to verify if necessary that the Associazione is complying with its stated objectives to protect the interests of the persons in question and with its statutes as regards its status.

Although not repeated by the Court, another aspect of the AG’s opinion in this issue is worth mentioning: apparently NH had argued that the Associazione could not be considered to have a legitimate interest to enforce the rights and obligations deriving from Directive since its members were lawyers and trainee lawyers and supposedly they were not all LGBTI* persons. The AG Opinion finds this argument irrelevant and notes that “one does not require, of a public interest association dedicated to protecting wild birds and their habitats, that all its members should have wings, beaks and feathers”. She underlines that “there are many excellent advocates within the LGBTI community, who can and do speak eloquently in defence of LGBTI rights. That does not mean that others who are not part of that community – including lawyers and trainee lawyers motivated simply by altruism and a sense of justice – cannot join such an association and participate in its work without putting at risk its standing to bring actions”.

Conclusions

The present case fills a series of remaining gaps and completes the trilogy of rulings (Feryn, Asociaţia Accept, present case) on discriminatory statements made in a public setting against hiring employees from protected categories.

There are many more aspects that hopefully the Court will clarify in the future: what about statements made in a private setting? What about categories of individuals that are protected by Article 21 of the Charter but not by the scope of the Directive (discriminations based on social origin, genetic features, language, political or any other opinion, property, birth)? The abbreviation LGBTI is often used in the ruling, yet could the directive be considered to apply to members of that community other than homosexual and bisexual individuals?

Nevertheless, this case will likely have an important impact in the daily lives of LGBTI* individuals, whether they are thinking of applying for a job or currently working with a discriminating employer or persons with/perceived to have an influential role within the company.

Furthermore, as noted by Djelassi and Mertens, the implications of this case cover all groups of persons protected by the anti-discrimination directives.

This case is, in other words, pretty fly for a discrimination guide.

Barnard & Peers: chapter 20

Photo image: Wikicommons media – by Sergio D’Afflitto

“You Were Only Supposed to Blow the Bloody Doors Off!”: Schrems II and external transfers of personal data

Lorna Woods, Professor of Internet Law, University of Essex

The Court of Justice today handed down the much anticipated ruling on the legality of standard contractual clauses (SCCs) as a mechanism to transfer personal data outside the European Union.  It forms part of Schrems’ campaign to challenge the ‘surveillance capitalism’ model on which many online businesses operate: there are other challenges to the behavioural advertising model ongoing.  While this case is clearly significant for SCCs and Facebook’s operations, there is a larger picture that involves the Court’s stance against mass (or undifferentiated) surveillance. This formed part of the background to Schrems I (Case C-362/14, discussed here), but has also been relevant in European jurisprudence on the retention of communications data. This then brings us to a third reason why this judgment may be significant. The UK, like the US, has a system for mass surveillance and once we come to the end of the year data controllers in the EU will need to think of the mechanisms to allow personal data to flow to the UK. The approach of the Court to mass surveillance in Schrems II is therefore an indicator of the approach to a similar question in relation to the UK in 2021.

Background

The General Data Protection Regulation provides that transfer of personal data may only take place on one of the bases set out in the GDPR. The destination state may, for example, have an ‘adequacy decision’ that means that the state in question ensures an adequate (roughly equivalent) level of protection to the ensured by the GDPR (Article 45 GDPR).  The original adequacy agreement in relation to the United States (safe harbour) was struck down in Schrems I because it failed to ensure that there was adequate protection on a number of grounds, some of which related to the safe harbour system itself, but some of which related to the law in the US, specifically that which allowed mass surveillance.  While the safe harbour was replaced by the Privacy Shield under Decision 2016/1250 on the Privacy Shield (Privacy Shield Decision) which improved some of the weaknesses as regards the operation of the mechanism itself, including the introduction of an ombusdman system, little if anything has changed in relation to surveillance.

Another mechanism for transfer of personal data outside the EU is that of SCCs, which are private agreements between the transferor (data controller) and transferee. Article 46(1) GDPR states that where there is no adequacy decision “a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available”. Article 46(2) GDPR lists possible mechanisms including standard data protection clauses. The Commission has produced a model form of these agreements in Commission Decision 2010/87 (SCC Decision). 

Following the outcome of Schrems I, Schrems reformulated his complaint to the Irish Data Protection Commissioner (DPC) about data transfers arguing that the United States does not provide adequate protection as United States law requires Facebook Inc. to make the personal data transferred to it available to certain United States authorities, such as the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) and the data is used in a manner incompatible with the right to private life, and that therefore future transfers by Facebook should be suspended.  These transfers are currently carried out on the basis of SCCs as approved by the SCC Decision.  The DPC took the view that this complaint called into question the validity of that decision as well as the Privacy Shield Decision, which moved the issue back into the courts. The Irish High Court referred the question to the Court of Justice and it is the outcome in this ruling that we see today.

The Judgment

The Advocate General in his Opinion (discussed here) suggested to the Court that the SCC Decision was valid; the problem was the context in which it operated. He took the view that the Privacy Shield’s validity should be considered separately. Crucially, he held that data controllers need to determine the adequacy of protection in the destination state. This in practice is difficult; while a data controller might have some control over what the recipient does with the data (how processed, data security etc), it would have little control over the general legal environment. In any event, data controllers would be required to make specific country assessments on this, which could be challenged by dissatisfied data subjects.  The Court took a slightly different approach. It agreed with its Advocate General that the SCC Decision was valid, but it struck down the Privacy Shield.

The Court made a number of findings. The first relates to the scope of inquiry and to competence. Given that national security lies outside the GDPR (and outside EU competence), should questions about the processing of data for purposes of public security, defence and State security be outside the scope of the GDPR rules. Following its position in Schrems I, the Court (like its Advocate General) rejected this argument [para 83, 86, 88]: the transfers of personal data by an economic operators for commercial purposes, even if that personal data is then processed by the authorities of the destination state for national security reasons, remains within the GDPR framework. Exclusions from the regime should be interpreted narrowly (citing Jehovan todistajat (Case C-25/17), discussed here).

In determining the level of protection the GDPR requires, the Court re-iterated its stance from Schrems I and following the reasoning of its Advocate General in this case held that we are looking for a level of protection “essentially equivalent” to that in the EU- and bearing in mind that the GDPR is understood in the light of the EU Charter.  So not only must the terms of the SCCs themselves be taken into account but also the general legal environment in the destination State.  The Court summarised:

…..the assessment of the level of protection afforded in the context of such a transfer must, in particular, take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the personal data transferred, the relevant aspects of the legal system of that third country, in particular those set out, in a non-exhaustive manner, in Article 45(2) of [the GDPR]. [para 105]

The Court noted that the national supervisory authorities are responsible for monitoring compliance with EU rules, and may check compliance with the requirements of the GDPR (following on from the position under the DPD established in Schrems I), and the national regulatory authorities have significant investigative powers. Where the SCCs are not complied with – or cannot be complied with – the national regulatory authorities must suspend or prohibit transfers and the Commission’s competence to draft SCCs does not restrict the powers of national authorities to review compliance in any way.  In this the Court’s approach is broadly similar to that of the Advocate General.  As regards an adequacy decision, a valid adequacy decision is binding, until such time as it may be declared invalid; this does not stop individuals from being able to complain.

Applying the principles to the SCC Decision, the Court noted that the standards bind only the parties to the agreement. Consequently, although there are situations in which, depending on the law and practices in force in the third country concerned, the recipient of such a transfer is in a position to guarantee the necessary protection of the data solely on the basis of standard data protection clauses, there are others in which the content of those standard clauses might not constitute a sufficient means of ensuring, in practice, the effective protection of personal data transferred to the third country concerned. [para 126]

Does this possibility mean that the SCC Decision is necessarily invalid? The Court held not. Unlike an adequacy agreement which necessarily relates to a particular place, the SCC decision does not. The SCCs therefore may require supplementing to deal with issues in individual cases.  Moreover, the SCC Decision includes effective mechanisms that make it possible to ensure compliance with EU standards [para 137].  Specifically, the SCC Decision imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected  in the third  country  concerned. The recipient of the data must inform the data controller of any inability to comply with the SCCs, at which point the data controller is obliged to suspend transfers and/or terminate the contract. The SCC Decision is therefore valid; the implications of this in practice for this case were not drawn out. The Court in the end held that

…. unless there is a valid European Commission adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer of data to a third country pursuant to standard data protection clauses adopted by the Commission, if, in the view of that supervisory authority and in the light of all the circumstances of that transfer, those clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law, in particular by Articles 45 and 46 of that regulation and by the Charter of Fundamental Rights, cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer [operative ground 3].

The existence of an adequacy decision is then key. Turning to the Privacy Shield Decision, the Court set the same analytical framework, emphasising the GDPR is understood in the light of the Charter and the rights to private life, to data protection and to an effective remedy. In assessing the decision, the Court noted that it awards primacy to the requirements of US national security, public interest and law enforcement, which the Court interpreted as condoning interference with the fundamental rights of persons whose data are transferred.  In the view of the Court, access and use of personal data by US authorities are not limited in a way that is essentially equivalent to EU law – the surveillance programmes are not limited to what is strictly necessary and are disproportionate. Further, data subjects are not granted rights to take action before the courts against US authorities. The Ombudsperson mechanism, introduced by the Privacy Shield Decision as an improvement on the position under safe harbour, is insufficient.  The Court therefore declared the Privacy Shield invalid.

Comment

The most obvious consequence of this ruling is that of how data transfers to the US can continue? The Privacy Shield is no more, and its demise has consequences for the operations of SCCs in practice. Given the weaknesses in the general legal system from the perspective of the Court of Justice, weaknesses over which the data controller/exporter can have little control, how can the requirements to individually assess adequacy be satisfied?  Are there, however, any other mechanism on which data transfers could be carried out?

In this context, we should note how the Court has interpreted the provisions of Chapter V to create a common baseline for standards, despite differences in wording between Arts 45 and 46 GDPR.  Article 45 deals with adequacy decisions and it requires that there is “an adequate level of protection”; Article 45(2) then lists elements to be taken into account – notably respect for the rule of law and human rights and “relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data”. It was this provision that was interpreted in Schrems I to require a level of protection that is ‘essentially equivalent’. Article 46(1) – which is relevant to the other mechanisms by which transfers may take place, including agreements between public authorities and binding corporate rules as well as SCCs – says something different. Article 46(1) requires “appropriate safeguards” and “enforceable data subject rights and effective legal remedies for data subject”. This is then not necessarily the same – at least in terms of simple wording – as Article 45(1). The Court however has read Articles 46 and 45 together so as to ensure that, as required by Article 44, data subjects’ rights are not undermined. This brings the essential equivalence test across to Article 46 [see para 96] and not just SCCs, but all the other mechanisms for data transfer listed in Art 46(2).  More specifically the factors to be taken into account when considering whether there are appropriate safeguards match the list set out in Article 45(2). 

The Court also emphasised that the requirements of the GDPR must be understood in the light of the EU Charter as interpreted by the Court itself [para 100].  In this context, the backdrop of the Court’s approach to fundamental rights – specifically the right to private life in Art 7 EU Charter – is significant.  The Court in a number of cases involving the bulk retention of communications and location data by telecommunications operators so that those data could be accessed by law enforcement and intelligence agencies found those requirements – because they applied in an undifferentiated manner irrespective of suspicion across the population – to be disproportionate (Digital Rights Ireland and Others, Cases C-293/12 and C-594/12; Tele2/Watson (Cases C-203/15 and C-698/15), discussed here and here). The Court has also criticised the use of passenger name records (PNR) data (Opinion 1/15 (EU-Canada PNR Agreement, discussed here)) and particular the use of automated processing.  The Court in its review of the facts referred to a number of surveillance programmes and that the referring court had found that these were not ‘essentially equivalent’ to the standards guaranteed by Article 7 and 8 EU Charter.  This would seemingly cause a problem not just for the adequacy agreement, but for an operator seeking to rely on SCCs – or on any other mechanism listed in Art 46(2).

This brings to the forefront Article 49 GDPR, referred to by the Court as filling any ‘vacuum’ that results from its judgment, which allows derogations for external transfers in specific situations, notably that the data subject has consented or that the transfer is necessary for the performance of a contract. While these might at first glance give some comfort to data controllers a couple of words of caution should be noted. First, these reflect the grounds for lawful processing and should be interpreted accordingly. Notably ‘explicit consent’ is a high bar – and all consent must be freely given, specific informed and unambiguous – and it should be linked to a specific processing purpose (on consent generally, see EDPB Guidelines).  The ground that something is necessary for a contract does not cover all actions related to that contract – in general a rather narrow approach might be anticipated (see EDPB Guidance). 

The final point relates to the UK. The UK perhaps infamously – also has an extensive surveillance regime which has been the subject of references to the Court of Justice (as well as a number of cases before the European Court of Human Rights). Crucially, the regime does have some oversight and there is an independent tribunal which has a relaxed approach to standing. Nonetheless, bulk collection of data is permissible under the Investigatory Powers Act, and it is an open question whether the Court of Justice would accept that this is necessary or proportionate, despite the changes brought in since the Tele2/Watson ruling on the communications data rules. Further, the UK has entered into some data sharing agreements with the US which have given rise to disquiet in some parts of the EU institutions. Whilst a member of the EU it benefitted in terms of data flows from not having to prove the adequacy of its safeguards. From 2021 that will change.  In the light of the approach of the Court of Justice, which can be seen as reemphasising and embedding its stance on surveillance, obtaining an adequacy agreement may not be so easy for the UK and given the similarity in approach underpinning Articles 45 and 46 GDPR, other mechanisms for data flow may also run into problems if this is the case. For now, the jury is out.

Photo credit: Security Dive