The AG Opinion in Schrems II: Facebook, national security and data protection law

Lorna Woods, Professor of Internet Law, University of Essex

Last week a CJEU Advocate-General gave an opinion in the case of Schrems II, the latest challenge to US national security rules as they apply to transfers of personal data from the EU (via Facebook). The original Schrems case (discussed here) shocked the data protection world when the Court of Justice of the EU (ECJ) ruled that the adequacy decision with regards to the United States (which simplified personal data transfers between the EU and the US) was invalid and – effectively - that US practices were incompatible with the EU Charter. Companies transferring data to the US turned to other legal mechanisms to legitimise the transfer of data and Schrems II (Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (Case C-311/18)) concerns one of these mechanisms: standard contractual clauses (SCCs). Surely, given the similar context and the fact that those under US jurisdiction must comply with US law, the outcome must be the same?

The Facts

Max Schrems aimed to stop the transfer of his personal data from the EU to the US under SCCs, following on from the finding in Schrems I that US law did not provide sufficient safeguards for individuals’ privacy rights in the context of bulk surveillance. This resulted in an action being brought by the Irish Data Protection Commissioner (DPC). The DPC took the view that her assessment of whether the transfers were valid depended on whether the model SCCs (established by the European Commission by Decision 2010/87/EU) were valid and she brought an action before the Irish courts, which resulted in an 152 page judgment and a reference to the ECJ, to determine this.

The reference comprised 11 questions, which the Advocate General bundled into a number of topics:

-          the applicability of EU law when data transferred is processed for national security purposes in third countries;

-          the level of protection required;

-          the impact of the non-binding nature of an SCC on the authorities of a third country on the validity of Decision 2010/87;

-          the validity of Decision 2010/87 in the light of the EU Charter; and

-          an assessment of the Privacy Shield decision (the replacement adequacy decision for transfers to the US, following the finding in Schrems I that the previous decision, known as ‘Safe Harbour’, was invalid).

The Opinion

The first issue was whether the fact that the concerns regarding privacy occur in the policy space of national security (an area outwith EU competence) affects the applicability of the data protection directive (DPD) or the replacement law, the GDPR. Those rules are designed for the commercial sphere. As the Advocate General noted,

The significance of that question … lies in the fact that, if such a transfer fell out side the scope of EU law, all the objections raised ...would be rendered baseless [101].

Given the Court’s approach in Schrems I, it is unsurprising that the answer here was that the locus of regulation was the commercial activity that was being undertaken. The purpose of the transfer was not that of allowing the data to be processed for national security [106]. So, ‘the possibility that the data will undergo processing by the authorities of the third country of destination for the purposes of the protection of national security does not render EU law inapplicable...’ [108].

The second issue at which the Advocate General looked was that of the level of protection. He accepted that the approach of the Court in Schrems I to adequacy decisions (under Article 25(6) DPD, and now Article 45(3) GDPR) is also relevant to SCCs so that the ‘appropriate safeguards’ envisaged by Article 46 GDPR should ensure data subjects benefit from a level of protection ‘essentially equivalent’ to that which follows from the GDPR [115]. While the adequacy decision mechanism and the SCC mechanism both aim towards the same objective, the way they each achieve it may be different: the underlying difference between the mechanisms is that the adequacy decision considers whether the protections provided by law in the destination country are adequate; the SCCs accept that they are not and provide other safeguards [120, see also 123-4].

Validity of Decision 2010/87

Moving on to the question of validity of Decision 2010/87 in the light of the EU Charter, the fact that SCCs are not binding on the third country undermines the ability of the recipient of the data always to respect the data protection safeguards contained in the SCC. The Advocate General considered this in the context of the question the Irish Court raised regarding the obligations on the national supervisory authority to suspend transfer [122]. The Advocate General proposed that:

-          SCCs may be assessed only on the ‘soundness of the safeguards’ they each provide;

-          safeguards may be reduced/eliminated as a result of the law of the third country;

-          the mechanism imposes on the exporter/controller or the national supervisory authorities, on a case-by-case basis, to prohibit or suspend transfers.

The Advocate General concluded that this did not invalidate the Decision but rather raised the question of ‘whether there are sufficiently sound mechanisms to ensure that transfers based on the standard contractual clauses are suspended or prohibited where those clauses are breached or impossible to honour’ [127]. He also highlighted the requirement in Article 46(1) GDPR that data subjects’ rights must be enforceable and remedies available.

Obligations on data controllers

The SCC imposes obligations on exporter and importer to comply with the terms of the contract. Given the obligations on the data controller (the person in control of the uses to which the data is put) imposed by the GDPR, where the exporter is aware that the importer cannot honour the terms of the SCC, the controller does not have a choice to suspend transfer but is required to do so [132]. The Advocate General also suggested that the parties should carry out an examination into whether the law of the third country would entail such a breach [135]. The rights of the data subject are ensured as against the exporter/controller under the SCC in Decision 2010/87 and the data subject may also apply to the national supervisory authorities.

Obligations on the supervisory authorities

The Advocate General proposed that national supervisory authorities are required to order the suspension of the transfer. Specifically, the right to suspend is not only to be used in exceptional cases (this follows amendment of the SCC terms in the light of Schrems I) and recital 11 of Decision 2010/87 is ‘obsolete’ [143].  The Advocate General emphasised that

‘the exercise of the powers to suspend and prohibit transfers …. is no longer merely an option left to the supervisory authorities’ discretion’ [144].

Article 58(2) GDPR, which sets out the powers of supervisory authorities, should be understood in the light of Article 8(3) EUCFR and Article 16(2) TFEU (both of which provide that compliance with data protection law should be overseen by an independent authority) – the Advocate General inferred that this meant the authorities have to act in such a way as to ensure the proper application of the GDPR. This imposes a due diligence requirement on the authorities, as well as an obligation to react appropriately to infringements. Failure to do so can lead to judicial action, and this re-emphasises that the obligation on the national supervisory authorities is ‘strict’, not discretionary [150].

The DPC had contended that this obligation is insufficient: it fails to address the systemic problems of inadequate safeguards; and that the approach leaves unprotected those whose data have already been transferred. The Advocate General disagreed; while problems existed they were not sufficient to invalidate the decision. He stated that:

EU law does not require that a general and preventive solution be applied for all transfers to a given third country that might entail the same risks of violation of fundamental rights [154].

As regards, effective redress for those already affected, the Advocate General emphasised the roles of the supervisory authorities to take corrective measures and the rights under Article 82 GDPR.

Privacy Shield

The Advocate General than took the view that it was unnecessary to consider the ‘Privacy Shield’ decision, in part because it assumes that the general level of law and protection in the recipient state need to afford adequate protection for SCCs to be available – a point which the Advocate General had already rejected.  Nonetheless the Advocate General did produce some guidance for the Court were it to consider the issue.

The finding of adequacy under the Privacy Shield does not preclude a national supervisory authority from exercising its powers. A number of parties challenged (directly or indirectly) the finding of adequacy in relation to the Privacy Shield. He suggested that when considering the comparison between the law and safeguards of the third country the appropriate comparison would be with the approach of the Member States to their own national security within the framework of the European Convention on Human Rights (ECHR) [207] and that those standards must be known in advance. The Advocate General discussed the scope of the national security exception, defined as:

activities connected with the protection of national security in so far as they constitute activities of the State or of States authorities that are unrelated to fields in which individuals are active [para 210, citing inter alia Tele2 Sverige and Watson (Cases C-203/15 and C-698/15, discussed here)].

The Advocate General suggests that the exclusion covers measures ‘that are directly implemented by the State for the purposes of national security, without imposing specific obligations on private operators’ [211]. He notes that where private operators are involved the law is less clear with the earlier PNR judgment (Parliament v Council and Commission (Cases C-317/04 and C-318/04)) seemingly pointing in a different direction from more recent jurisprudence including Tele2/Watson.  He proposed a number of ways to reconcile the two lines of cases:

-          Tele2/Watson arose where operators were required to keep data; the airlines kept the data for their own commercial purposes [218];

-          Tele2/Watson arises where operators are required to cooperate as regards the access to the data, irrespective of whether there is a prior obligation to retain data - because the provision required the operators to engage in data processing [219-220].

The Advocate General favoured the second approach, suggesting it was also in line with Schrems I and that, once national authorities have the data and engage in further processing of them, such processing is not caught by the scope of the GDPR. In this view of the Advocate General, this means verification must take place by reference first to the GDPR and Charter and secondly by reference to the ECHR.

A further issue was whether continuity of protection means that measures must be in place during transit (e.g. through submarine cables). Article 44 GDPR refers to ‘after transfer’ which could mean after arrival or once transfer has been initiated. Relying on a teleological interpretation, the Advocate-General adopted the second interpretation.

Moving on to the validity of the Commission’s assessment of adequacy, the Advocate General assessed whether the Commission’s findings warranted the adoption of an adequacy decision, recalling the principles set down in Schrems I allowing for ‘a certain flexibility in order to take the various legal and cultural traditions into account’ but ‘that certain minimum safeguards and general requirements for the protection of fundamental rights that follow from the Charter and the ECHR have an equivalent ...’ [249].  It was this essential equivalence that the referring court challenged. The Advocate General re-stated case law from both Courts that recognised the existence of an interference, and as far as the ECJ is concerned it does not matter whether the data are sensitive. Further:

the obligation to make the data available to the NSA, in so far as it derogates from the principle of confidentiality of communications, entails in itself an interference even if those data are not subsequently consulted and used by the intelligence authorities [259].

As regards the requirement that interferences must be provided for by law, the Advocate General – treating the approach of the ECJ and ECtHR together states that this test means that:

regulations which entail an interference … lay down clear and precise rules governing the scope and application of the measure at issue and imposing a minimum of requirements, in such a way as provide the persons concerned with sufficient guarantees to protect their data against the risks of abuse and also against any unlawful access to or use of data [para 265, citing Digital Rights Ireland (discussed here), Tele 2 Sverige, Opinion 1/15 (discussed here), Weber and Saravia, Zakharov (discussed here) and Szabo and Vissy].

The Advocate General doubted whether the US framework met this threshold [266].  Following existing jurisprudence, however, the Advocate General accepted that the very essence of Article 7 or 8 was not compromised.  In this, the Advocate General noted that the position of the ECtHR was that such surveillance could, in principle, be capable of justification [282].

National security has long been accepted as a legitimate public interest ground justifying interferences with rights. The scope of ‘national security’ was challenged. The Advocate General accepted that some aspect of foreign affairs might fall within ‘national security’; further objectives dealt with under ‘foreign intelligence information’ could constitute other public interest objectives but that these would have a lesser weighting in a proportionality analysis. However, ‘it may be asked whether those measures are defined sufficiently clearly and precisely to prevent the risk of abuse and to permit a review of the proportionality.’ [289].

The Advocate General nonetheless considered the necessity and proportionality aspects, within the framing set down by Schrems I in particular. The Advocate General also noted the safeguards required by Article 23(2) GDPR. He doubted whether the selection criteria were sufficiently clear and precise and whether there were sufficient guarantees to prevent the risk of abuse noting in particular the difference between the requirement that an activity be ‘as tailored as feasible’ is not the same as an activity which is strictly necessary [300], nor does it necessarily forewarn data subjects [307]. There is no prior review. He therefore concluded that he had doubts about the adequacy of protection provided.

The next issue was the right to an effective remedy and the impact of the introduction of the Ombudsperson Mechanism which is intended to compensate for some of the deficiencies in the US system.  The Advocate General noted that the Article 47 right is in addition to the requirement that there be independent oversight/authorisation of surveillance activities. Re-iterating Schrems I, where there is no possibility to pursue legal remedies, the national rules do not respect the essence of the right. The right include that of receiving confirmation from national authorities whether or not they are processing data as well as being notified about an investigation once it would no longer jeopardise that investigation (though the ECtHR has not made this aspect a requirement). The US system is deficient in these aspects. The Advocate General considered whether the Ombudsperson Mechanism compensates but was not convinced. Such a body to be effective must be established by law and be independent. The Advocate General noted that the mechanism satisfied neither requirement and is not subject to judicial control.

Comment

A cursory look at the conclusion to the Opinion might suggest that there will be no change in the approach to data transfers and that in general this was a bit of a defeat for Schrems. This would mis-characterise the position (and also overlook the fact that it was the DPC that was arguing for invalidity of the SCC decision, not Schrems).  The Opinion is divided broadly into two topics: the first which deals the legality of the SCC decision and the second which deals with the Privacy Shield adequacy decision. 

The Advocate General may have suggested that the Decision underlying the SCCs should not be considered invalid but this does not mean that those transferring data to the US can ignore the privacy concerns. The response of the Advocate General - in avoiding challenging the underlying system itself - is to rely on decentralised, and ultimately private, enforcement by the exporter/data controllers, but also by the national supervisory authority.  This obligation is described in rather strong terms; certainly a data exporter cannot be passive but must investigate conditions and if it finds problems it must act to suspend transfers. A head in the sand approach – if the Court follows the reasoning of the Advocate General – is unlikely to be successful. For national supervisory authorities the obligation seems still stronger and the obligation to assess on a case by case basis potentially increases their workload. Underpinning this again is the threat of legal action by data subjects. While empowering data subjects is probably to be regarded as positive, viewing private enforcement of regulation as an essential element of that scheme is problematic.  It assumes data subjects have the energy and the resources to take action – a real weakness in this approach, despite the possibility for class actions.

It is noteworthy that while the Advocate General heads the section on the acceptability of the Decision as its acceptability under the Charter, in practice his analysis focuses on the right to a remedy. This leaves the impact of the transfers on privacy and data protection (especially against a backdrop of bulk surveillance) under-considered.  Further, the Advocate-General seems to assume that the ability to sue in the EU (under Article 80 causes of action) compensates for the difficulties in standing and lack of remedies in the relevant third country, and assumes that compensation is adequate (as opposed to more behavioural remedies such as ceasing processing).  This aspect of the analysis is in marked contrast to the considerations discussed under the Privacy Shield section.

While the ruling on the impact of national security in the early part of the Opinion may not come of much surprise, it is potentially significant for the UK. At the moment, as a member of the EU, the activities of its security and intelligence services mainly lie outside the ECJ’s purview (though note pending reference on scope of this: Privacy International v Secretary of State for Foreign and Commonwealth Affairs (Case C-623/17)); once it becomes a third country (and subject to any negotiated agreement) national security becomes a relevant consideration.  This difference between EU States and third countries did not escape the attention of those making representations before the court. On this difference, the Advocate General when discussing the comparison that must take place to come to any decision on whether a third State’s data privacy protections are essentially equivalent argues that, in regards to interferences arising in the context of national security (which falls outside EU law and therefore the scope of the Charter), the relevant standards are to be found in the ECHR. 

As noted, however, that boundary is somewhat uncertain and consequently the extent to which it is consistent with earlier jurisprudence, including Schrems I, open to question. The approach of the Advocate General does seem to move away from the approach in the PNR judgment, which was based on looking at the provision’s purpose to determine whether it fell within the national security exception. Perhaps the forthcoming cases will develop a clear and consistent line on this point going forward. The significance of drawing a boundary between the EU Charter and the ECHR lies in the extent of difference in approach of the Strasbourg and Luxembourg courts to bulk surveillance, especially that in relation to communications data. On this, the Big Brother Watch case (discussed here and here) is heading to the ECtHR Grand Chamber.

As regards the second aspect, having noted that the Advocate General seeks to avoid commenting on the Privacy Shield, some of his comments in this regard (made ‘in the alternative’) highlight some real problems for that system. In his discussion he beds his reasoning both in the ECJ’s jurisprudence but also that of the ECtHR.  The Opinion constitutes a clear statement as to the applicability of the law to ‘automated’ surveillance and also as to the requirement of legality (which is not particularly clear as regards the Strasbourg jurisprudence).  In this, as well as in the context of necessity and proportionality of the measures the Advocate General was not convinced the US framework passed the tests. This is not just one problem to fix, but many.  While the Advocate General did not the difference in the jurisprudence between the two courts, this difference did not seem to lead to a different outcome in terms of his assessment of the acceptability of the US regime.

If the Court chooses to consider this question, there will be some serious difficulties going forward for data flows.  Whether the approach will stick is a question; the ECJ has been under pressure to step back from its stance on bulk collection and automated assessment of data in particular. Some of the surveillance issues will be returning to the Court in a bevy of cases: in addition to Privacy International see La Quadrature du Net & Ors v Commission (Case T-738/16); La Quadrature du Net & Ors and French Data Network & Ors (Cases C-511-12/18); and Ordre des barreaux francophones et germanophone, Académie Fiscale ASBL, UA,  Liga voor Mensenrechten ASBL, Ligue des Droits de l’Homme ASBL, VZ, WY,  XX v Conseil des ministres (Case C-520/18). Further Advocates-General opinions in several of these cases are set for January.

Barnard & Peers: chapter 9

Photo credit: Forbes

The Three Villains and the Lifeblood of the European Union Project – Advocate General Sharpton’s Opinion in C-715/17 (the asylum relocation mechanism)

Niels Kirst, PhD candidate in EU law, Dublin City University

The Backdrop of the Migration Crisis

Recently, Advocate General Sharpston (hereafter ‘the AG’) had to give her opinion on the failure to implement Decisions of the Council regarding the relocation of migrants within the European Union. The opinion deserves distinction due to its firmness and its comprehensive categorization of the concept of solidarity in the European Union legal order. The case itself has a political importance since it relates to the ongoing rule of law crisis within the European Union.

The case concerned the Area of Freedom, Justice and Security (hereafter ‘AFJS’), Article 72 TFEU (the safeguard clause) and the Dublin Regulation, which allocates responsibility for asylum applications within the EU. In the proceedings, the European Commission (hereafter ‘the Commission’) brought infringement proceedings under Article 258 TFEU against Poland, Hungary and the Czech Republic for not implementing Decisions of the Council within their legal order. The case occurred at the Court of Justice of the European Union (hereafter ‘the Court’ or ‘Court of Justice’) as a direct cause of the migration crisis of 2015 in the European Union.

In September 2015 the migration crisis in the European Union was in full swing. Italy and Greece were overwhelmed by the number of migrants arriving at their shores each day. In response, on the 14th and 22nd of September 2015 respectively, the Council decided in urgently convened meetings that provisional measures are necessary to support Greece and Italy, which under the provisions of the Dublin Regulation, had to bear the highest burden in the migration crisis. This emergency was caused by a sudden influx of migrants into the European Union due to the military conflict in Syria.

In consequence, the Council (by qualified majority), agreed on Decision 2015/1523 and Decision 2015/1601 (hereafter ‘Relocation Decisions’ – discussed further here). The Council used Article 78 (3) TFEU as legal basis for the decisions, which provides the following: “In the event of one or more Member States being confronted by an emergency situation characterised by a sudden inflow of nationals of third countries, the Council, on a proposal from the Commission, may adopt provisional measures for the benefit of the Member State(s) concerned.” The article is located in Title V of the Treaty which deals with the AFJS and the common asylum and immigration policy of the European Union.

In an earlier proceeding, the legality of Decision 2015/1601 was unsuccessfully challenged by the Slovak Republic and Hungary (the judgment is discussed here). Having said that, the Czech Republic, Poland and Hungary decided to not follow the Relocation Decisions since they regarded them as a threat to their internal security. The essential question of the present proceedings was, therefore, if the three defendant Member States can advance a claim that absolves them of their obligations under the Relocation Decisions? (see para. 69 of the Opinion)

The Factual Background

The Relocation Decisions by the Council required the allocation of, respectively, 40 000 and 120 000 applicants for international protection within the Member States of the European Union. The Relocations Decisions required Member States to pledge a certain number of applicants, which would be identified by Greece and Italy and subsequentially be transferred to the pledging Member State.

Poland, while initially pledging to take 100 applicants, did not relocate any applicant. Hungary did not pledge to the Commission to accept any applicants. The Czech Republic pledged to the Commission to take 30 applicants, from which 12 have been relocated. (see para. 72) In response, the Commission noted in its Fifteenth Report on relocation and resettlement in 2016 that, "Hungary and Poland remain the only Member States that have not relocated a single person […]. Moreover, the Czech Republic has not pledged since May 2016 and has not relocated anyone since August 2016."

The Substance of the Case

After rejecting a long line of merely procedural challenges of admissibility the AG declared the infringement proceedings brought by the Commission admissible. The challenges of admissibility by the Member States were unfounded in so far as they did not undermine the valid purpose and the legal interest of the Commission in bringing the proceedings.

The AG started her substantive assessment of the case by pointing out that Decisions of the Council pursuant to Article 288 TFEU are binding upon the Member States and that the relevant Decisions are intra-vires as in so far the earlier challenge on legality of one of the Decisions brought by the Slovak Republic and Hungary was dismissed as unfounded by the Court. (para. 153 – 157)

The Commission alleged in its claims that the Member States failed to comply with the pledging requirement on the one hand, and with the relocation requirement on the other hand. By failing to pledge to take any asylum seekers the three Member States consequently also failed to effectively take any asylum seekers. This argument was supported by the AG since the failing to pledge necessarily also fails to relocate. (para. 170 – 171) 

After supporting the Commission’s arguments concerning the factual basis, the AG shifted to the assessment to the justifications of the defendants for their non-compliance with the Relocation Decisions. This gave the AG the possibility to comment extensively on very fundamental concepts of European Union law – namely, the principles of sincere cooperation, the rule of law, and European Union solidarity.

Poland, Hungary and the Czech Republic raised two substantial justifications for their non-compliance with EU law. Respectively, that Article 72 TFEU, read in conjunction with Article 4 (2) TEU allowed Member States to disapply the Relocation Decisions, and that the Relocation Decisions created a dysfunctional system. (para. 172 – 174) The Commission countered these arguments by pointing to the necessity of effet utile of EU law and the principle of solidarity, which is a fundamental principle of EU law. (para. 175)

Article 72 TFEU, which was the main defence raised by the three Member States, provides the following: “This Title shall not affect the exercise of the responsibilities incumbent upon Member States with regard to the maintenance of law and order and the safeguarding of internal security.” The three Member States used this article as justification which relieves them from their obligation to comply with the Relocation Decisions. The Commission argued that Article 72 TFEU should be interpreted similarly to the limitations for public security, et al, that apply to the fundamental freedoms of the internal market. (para. 187)

Regarding Article 72 TFEU, the AG first touched upon the concepts of ‘law and order’ and ‘internal security’ which are essential for understanding the scope of that article. Therefore, the AG turned to the three previous occasions in which the article had been treated by the Court: respectively Adil, A and Slovak Republic and Hungary v Council. (para. 190 – 194)

The AG acknowledged that the judgment in Slovak Republic and Hungary v Council foreshadowed the arguments which had been raised by the three defendants in the present proceedings. The AG cited the following crucial paragraph of the judgment in this regard, “If that mechanism were ineffective because it requires Member States to check large numbers of persons in a short time, such practical difficulties are not inherent in the mechanism and must, should they arise, be resolved in the spirit of cooperation and mutual trust between the authorities of the Member States […].” (para. 194)

On the concepts of ‘public order and security’ the AG pointed out that there must be a sufficiently serious threat affecting one of the fundamental interests of the society to establish a public order intervention (N, discussed here) and that the concept of security cannot be determined unilaterally by each Member State without any control by the institutions of the European Union (Zh and O, discussed here). (para. 196 – 201)

The AG pointed specifically to the judgment in Bouchereau in the realm of the fundamental internal market freedoms, in which the Court found that it is the personal conduct of the individual concerned that must be assessed to determine whether there is a threat to the community of the Member State in question. (para. 199) The assessment of the personal conduct of the individual regarding the concepts of public order and security was crucial in the AG’s assessment.

Regarding Article 72 TFEU, the AG stated that the Article can only serve as a derogation measure in case the European Union legislator disregarded to take account of that obligation when drafting EU secondary law in the area of AFJS. (para. 202) However, in the present case, the European Union legislator did acknowledge the concepts of public order and security when it drafted the Relocation Decisions. Respectively, Article 5 (4) and 5 (7) of the Relocation Decisions took into account the concern of security as they gave right to Member States to refuse an applicant on reasonable grounds. (para. 203)

According to the AG, "it was perfectly possible for them to preserve the safety and welfare of citizens by refusing (on the basis of the Relocation Decisions themselves) to take applicant X, […]." (para. 207) However, they refrained to take that route and instead decided to entirely not apply the Decisions to safeguard their internal security.

Furthermore, the AG clarified that Article 72 TFEU may not be used in this way. It is not a conflict of laws rule which give the Member States competence over measure enacted by the EU legislature; instead, it is a rule of co-existence under the principle of subsidiarity. (para. 212) To substantiate this claim, the AG cited Factortame, NN (L) International, and Commission v Hungary to find that Article 72 TFEU is not a carte blanche to disapply any valid measure of EU secondary law with which a Member State disagrees. (para. 214 – 221)

In conclusion, the AG pointed to the measures which exist in EU law, regarding the safeguarding of security and public order, which allow Member States to deny a particular applicant entrance into a Member State. However, the AG clarified that there is no general pre-emption of EU secondary law by Article 72 TFEU. (para. 223)

Regarding the invocation of the principle of national identity enshrined in Article 4 (2) TEU by the three Member States, AG Sharpston again pointed to the case-law: Commission v Luxembourg, in which the Court held that national identity cannot lead to a general exclusion of applicants due to their nationality. There are less restrictive means to preserve the social and cultural cohesion of a society. In analogy, the AG applied this concept to find that a general exclusion of asylum applicants cannot be sustained. (para. 224 – 227)

Finally, all three defendants raised the claim that the Relocation mechanism was dysfunctional and that the dysfunctionality exposed them to a hardly assessable security risk. Further, the Czech Republic claimed that it would have been pointless to pledge certain numbers to the Commission since the majority of applicants would have been undocumented in any case, and the Czech Republic would be unable to assess the risk that such undocumented migrants pose to the country. (para. 228 – 229)

The AG rebutted the arguments by pointing to the principle of solidarity which requires the Member States to support each other in a situation of emergency, which was present during the migration crisis. Further, there would have been other means for the Member States concerned to express their fear of the dysfunctionality of the system. For example, by applying for temporary suspension of their obligations under the Decisions, as done by Austria and Sweden. (para. 234 – 235) Consequently, the AG opined to uphold the infringement against the three Member States.

Additional Remarks by the Advocate General

In the final part of the Opinion, the AG commented on the concepts of the rule of law, the duty of sincere cooperation and the concept of solidarity within the European Union. Concerning the rule of law, the AG noticed its primordial importance recognised in Article 2 TEU and the case-law of the Court (the most recent rule of law judgment is discussed here). Specifically, the AG remarked, "at a deeper level, respect for the rule of law implies compliance with one's legal obligations. Disregarding those obligations, in a particular instance, [when] they are unwelcome or unpopular is a dangerous first step towards the breakdown of the orderly and structured society governed by the rule of law which, as citizens, we enjoy both for its comfort and safety." (para. 241)

Concerning the duty of sincere cooperation, the AG clarified that this principle builds upon the common values of all EU Member States as enshrined in Article 2 TEU. These common values allow mutual trust among them which subsequentially enables mutual recognition in the realm of AFJS. Against this backdrop, the principle of sincere cooperation has to be understood. The AG assessed that the principle of sincere cooperation has been manifestly mistreated by the conduct of the three Member States. (para. 242 – 245)

Concerning Solidarity, the AG referred to the founding fathers of the ‘European project’, to find that only their openness and spirit to one another enable the European Union to flourish. Famously, the Schuman Declaration recognized solidarity as a cornerstone. Subsequently, the Court echoed that call for solidarity in Klöckner-Werke v Commission and formally recognized the principle of solidarity in Eridania zuccherifici nazionali and Others. (para. 246 – 251)

Moreover, the AG recognized that the principle of solidarity requires burden-sharing as seen in Grzelczyk and Bidar. Particularly, the AG stated that "Solidarity is the lifeblood of the European project. Through their participation in that project and their citizenship of the European Union, Member States and their nationals have obligations as well as benefits, duties as well as rights. Sharing the European ‘demos’ is not a matter of looking through the Treaties and the secondary legislation to see what one can claim. It also requires one to shoulder collective responsibility and (yes) burdens to further the common good.” (para. 251 – 255)

Comment

The significance of this opinion cannot be overstated. Due to the pending departure of the United Kingdom from the European Union, this could have well been the last Opinion from the British Advocate General Eleanor Sharpston. This may explain the length, accuracy and profundity of the opinion. Indeed, the Opinion provides a fully-fledged account of some of the core principles of European Union law and their respective case-law. The opinion will likely find its way into the canon of significant AGs' opinions – most notably concerning the reconstruction of what solidarity within the European project means, entails and what it requires by the Member States.

While touching upon core principles of European Union law, the opinion also clarifies the obligations of Member States under Decisions of the Council in the realm of AFJS. The Opinion gives guidance concerning the concepts of security and public order in EU law and assess the position of Article 72 TFEU in the EU legal order. Article 72 TFEU does not serve as a general derogation clause for Member States when they do not agree with a specific measure, instead, Article 72 TFEU applies only for particular cases under individual assessment or, when the EU has failed to take security and public order into account during the legislative process.

Besides, the Opinion has also a significant relevance in the ongoing rule of law crisis in the European Union. The proceeding before the Court concerned a case of disregard of secondary EU law by Member States. This disregard was presumably based on a national preference of not taking any applications for asylum. The Opinion clarifies that the rule of law in the European Union requires not only the independence of the national legal system but also, and foremost, the respect for and implementation of valid European Regulations, Directives and Decisions.

The key take-away of the opinion is the emphasis and the account on solidarity by the AG. Solidarity is essential for the functioning of the European legal order, as well as for the flourishing of the European project. By spanning a frame from the founding fathers of the European Union project to the migration crisis in the European Union of today, the AG distils the purpose and the idea of European solidarity. The European Union is not a system of cherry-picking of only the good parts while denying the burdens and obligations which also come with the membership. Instead, benefits and burdens have to be shared equally in the spirit of European Union solidarity.

Barnard & Peers: chapter 26

JHA4: chapter I:5

Photo credit: The Malta Independent

Friendly Fire in the European Union? AG Sharpston’s opinion on the validity of the revised firearms Directive

Niels Kirst (University Paris II – Panthéon-Assas)                             

The recent opinion by Advocate General Sharpston (hereafter: “AG”), which was released on 11th April 2019, concerned the validity of Directive 2017/853, the so-called firearms Directive. The Czech Republic claimed that the European Parliament and the Council used the wrong legal basis, the internal market harmonisation clause (Article 114 TFEU), for adopting this Directive.

The case is interesting for three reasons. First, the case deals with question of legal basis, and has therefore gained significant attention from EU lawyers. Second, it is yet another case in which the Czech Republic is acting jointly with Hungary and the Republic of Poland (which intervened to support the Czech Republic) to defend their common interest (see also the pending Case C-715/17 Commission v Poland, on relocation of asylum-seekers). On the other side, France and the Commission intervened to support the Council and the European Parliament. Third, Directive 2017/853, which was contested by the Czech Republic, amended Directive 91/477, which was the first legislative measure setting a minimum standard regarding civilian firearms acquisition and possession in the European Union (hereafter: “EU”). (The 1991 Directive had been previously amended in 2008)

There is a specific prehistory to the case. After the terrorist attacks in Paris and Copenhagen, the Juncker Commission proposed tightening the gun laws in the European Union. This was met by much scepticism on the Czech side. Why is this the case? The Czech Republic’s gun laws differ tremendously from those of most Member States of the European Union. The history of liberal gun possession in the Czech Republic stretches back to the 18th century. Therefore, the Czech Republic had a great interest to oppose the Directive, also given the fact that it is the 7th largest post-war arm exporter in the world.

Having said that, the Directive was finally approved under the ordinary legislative procedure on the 25th April 2017 with qualified majority voting in the Council, with only the Czech Republic, Luxembourg and Poland voting against the Directive. Beforehand it had been approved in the first reading by the European Parliament. While Poland voted against the Directive, due to stringent norms, Luxembourg voted against the Directive, since it wanted a stronger regulation of firearms. (Note that the Directive only sets minimum standards, so Member States can opt unilterally for higher standards, as the UK does, for example) Among other things, the revised Directive prohibits many semi-automatic weapons.

The first plea: wrong legal basis

Preliminary remarks

The first claim of the Czech Republic was that the Directive infringes the principle of conferral of powers upon the European Union, which is enshrined in Article 5(2) TEU. This Directive was adopted on the basis of the EU’s internal market powers (Article 114 TFEU), but the Czech Republic alleged that the aim of the Directive was not minimum harmonisation in the internal market concerning guns, but instead the prevention of crime and terrorism. Therefore, the Directive had to be adopted under Article 84 TFEU, which deals with crime prevention, and forms part of the Treaty provisions on the area of freedom, justice and security. Article 84 TFEU does not allow harmonisation of national law.

Article 114 TFEU

In a first step, the AG analysed the particularities of Article 114 TFEU, which is designed to allow the EU legislator to adopt legislation with the aim of achieving the objectives of the internal market. The precedents which are highly relevant for this case were British American Tobacco and Philip Morris Brands. Both cases concerned the question, if consumer health may be protected on a European Union level by means of legislation with Article 114 TFEU as legal basis. In analogy, the AG draws attention towards Article 114 (3) TFEU, which defines that questions of consumer safety shall be taken into account when harmonising the laws (para 47).

Having said that, the AG also drew attention to Germany v Parliament and Council in which the Court found that such a harmonisation under Article 114 TFEU is not without limits, as regards a ban on advertising of tobacco products.

The yardstick question for the AG was whether the Directive eliminates obstacles to free movement, while not exceeding the competences under Article 114 TFEU (para 50). The AG rejected the argument by the Czech Republic, Hungary and Poland that recitals 2 and 23 in the preamble to the Directive, which mention crime prevention as an objective, alter the scope in a way that it cannot be regarded as falling under the auspices of the internal market any longer (para 54).

Directive 2017/853

In a second step the AG analyzed the substantive legal purpose and the provisions of the Directive. The AG clarified that what matters are the ultimate legal effects of the Directive and not the recitals (para 65). Further, the AG laid out, by citing Digital Rights Ireland (discussed here), that the fight against serious crime constitutes an objective of general interest of the EU (para 66).

In her analysis the AG followed a four-pronged approach. First, the AG found that firearms are intrinsically dangerous goods, therefore any legislation concerning firearms must contain a security aspect (para 67). Second, the Directive enhances mutual confidence among the Member States in cross-border trade (para 68). Third, the Directive aims to harmonize technical barriers to trade, which may include technical specifications (para 69). Fourth, the Directive provides for a improved cooperation among Member States (para 70).

By this analysis, the AG derived the conclusion that the content of the Directive does not harmonize crime prevention in any material sense (para 71), clarifying that the Directive has to be assessed in the light of the 1991 Directive and that a mere change of recitals does not indicate that the aims of the internal market are removed.

The second plea: proportionality

The second plea of the Czech Republic was the alleged lack of proportionality of the Directive. The Czech Republic argued that the measures adopted are manifestly disproportionate to the objectives pursued, on two grounds. First, the Commission failed to conduct an impact assessment, event though the Commission pledged to do so in an interinstitutional agreement on better law-making. Second, the Directive interferes disproportionately with the right to property, which is a fundamental right in the EU legal order.

The question arose, if an interinstitutional agreement, as far as it concerns an impact assessment obligation, is legally binding on EU institutions. This question is general importance for the EU. Hungary argued in support of the Czech Republic that an interinstitutional agreement shall be legally binding, while the Parliament, the Council and the Commission maintained that the obligation to carry out an impact assessment in an interinstitutional agreement is not binding.

The AG dissected these questions starting by lying out that firearms are intrinsically dangerous, and that the EU legislator decided to regulate the entire lifecycle of a weapon in the internal market (para 87). This is important to keep in mind, when verifying if the articles of the Directive are proportionate to the aims. The arguments of the parties were among others that without an impact assessment it cannot be assessed, if the provisions of the Directive are actually proportionate.

Impact assessments are referred to in the inter-institutional agreement on better law-making, adopted on the basis of Article 295 TFEU, and the Court had earlier found, in Commission v Council (para 49), that such agreements among the institutions can be binding on them. However, in this case the AG found that there are no such obligations to conduct an impact assessment in each and every case. An omitted impact assessment cannot be a valid ground to annul a fully lawful Directive.

In case of urgent actions, the AG argued, an impact assessment is not always possible. Further, the Court had already confirmed, in the case of Poland v European Parliament and Council (para 159), that an impact assessment itself is not binding on either the Parliament or the Council. The key take-away is that an omitted impact assessment should not restrict possible actions by the institutions.

The second argument by the parties concerned the right to property. The AG determined that there is no fundamental right to own firearms in the EU, nor does such a right form part of the ‘common constitutional traditions’ of the Member States. The AG went on by stating that the right to property as laid out in Article 17 of the Charter is a qualified right, and not an absolute right. Therefore, the Directive does not deprive citizens of the Union of their right to property.

The third plea: legal certainty

In its third plea the Czech Republic argued that the Directive infringed the principle of legal certainty. Its two main arguments were that i) some of the Directive’s provisions are not sufficiently clear and precise enough and ii) the Directive would force Member States to adopt domestic legislation, which will have a retroactive effect, infringing the principle of legitimate expectations.

The AG reiterated that the principle of legal certainty is a general principle of EU law, as seen in the case of Spain v Council (para 124). Having said that, the AG regarded the wording of the Articles as sufficiently clear and precise enough to meet the requirements of legal certainty. Concerning the possible retroactive effects of the Directive, the AG first reiterated that also the principle of legitimate expectations is a general principle of EU law, as seen in Agrargenossenschaft Neuzelle. However, since there was no assurance by the administration that the classifications of weapons would not be changed in the future, the requirements to invoke that principle are not fulfilled.

Finally, the AG reiterated that these principles cannot be stretched to the point of preventing a new rule to apply to situations which arose under earlier rules (para 132). Consequently, the AG rejected the claims of the Czech Republic concerning legal certainty and legitimate expectations.

The fourth plea: equal treatment

In its last plea, the Czech Republic argued that Article 6(6) of the Directive (the so-called Swiss exception) should be annulled, since it violates the principle of non-discrimination. Switzerland is a Schengen associate; therefore, all Schengen-related legislation (such as the Directive) also applies to Switzerland. Having said that, there are certain areas in which Switzerland enjoys an exception from Schengen-related rules. This Directive is one of those cases, since Switzerland has a reserve army based on conscription, and there is an exception for States which have had such a system for more than 50 years.

In a preliminary step the AG reiterated that the principle of equal treatment is a general principle of EU law, as seen in Arcelor Atlantique et Lorraine and Others. However, the AG concluded its common ground that only Switzerland has such a system of conscription, further, Member States (and Schengen associates) differ in their culture and tradition, therefore, this article cannot be regarded as discriminatory towards other Member States and Schengen associates.

Comments

The opinion gives much food for thought and discusses numerous general principles of EU law. Surely, the opinion will not be welcomed in the Czech Republic. As a key take-away, it is important to note that the institutions might be capable to act without an impact assessment in urgent situations, even when they have subscribed to an inter-institutional agreement under Article 295 TFEU.

Furthermore, the opinion, if followed by the Court, can be seen as a further integration in the area of European Union criminal law. Guns are one of the predominant tools for committing criminal acts, and by tightening the requirements for gun holders in the Member States, the EU legislator aims to impact upon on crime prevention in the European Union.

Finally, the opinion gives guidance on the importance of the right to property in the EU’s legal order, confirming that the right to property as laid down in Article 17 of the Charter is a qualified right and not absolute. Further, the AG illustrates that there is no such thing as a fundamental right to possess guns in the European Union legal order (para 104). It will be interesting to see if the Court follows the opinion of the AG.

Barnard & Peers: chapter 11, chapter 12, chapter 25

Photo credit: EuropeWord

Revoking the notice to withdraw from the EU? The opinion in Wightman

Professor Steve Peers, University of Essex

Introduction

Was sending the Article 50 notification of withdrawal from the EU like jumping off a cliff – impossible to change your mind after jumping? Or was it rather like setting off to the shops, where you can change your mind about shopping while on the way there, in the car park, or even in the shop itself – perhaps because you discover that the promised discounts don’t exist, the management is under police investigation, and the massive Turkish foods section consists of a couple of dusty hazelnut packets?

We should soon find out from the Court of Justice. In the meantime we have today’s non-binding opinion from an Advocate-General. Although the Court might not follow the opinion, the judges will consider it carefully, and it’s worth discussing the issues which it raises. (See also the discussion here of the national court background to the proceedings, and the discussion here of the arguments for and against unilateral revocability. The EU courts have also ruled on a challenge to the withdrawal agreement negotiations, and on the UK’s current status as a Member State: see discussion here and here).

The opinion

First of all, the opinion dismisses the UK government’s argument that the case is hypothetical, because the government has not decided to withdraw the Article 50 notice and has no intention of doing so. In particular, the outcome of the ruling might be relevant when MPs cast their vote on whether to approve the withdrawal agreement with the EU, or on deciding what to do if the agreement is not approved.

The opinion then agrees with the petitioners – mainly UK politicians in the Westminster Parliament, the Scottish Parliament and the European Parliament – that the notification is in principle unilaterally revocable. First of all, it notes that Article 50 is silent on the issue of revocation, and so notes that three outcomes are possible: no revocation, unconditional revocation, and revocation with conditions. It approaches the issue by looking first of all at general public international law, and then at the specific wording of Article 50, followed by the issue of agreed revocation.

As for international law, the opinion is uncertain as to whether revocation of notification of withdrawal from a treaty is firmly established as a matter of customary international law (although there are several examples). The right to revoke withdrawals from a treaty unilaterally is, however, expressly set out in the Vienna Convention on the law of treaties (VCLT). The Opinion discusses whether the VCLT applies to withdrawal from the EU, and reaches the conclusion that it does not, given that the EU itself and some of its Member States are not parties to that Convention. Nevertheless, it argues that the VCLT may be useful when interpreting Article 50.

As for the interpretation of Article 50 as such, a literal interpretation does not resolve the question, since Article 50 is silent on the question of unilateral revocation of a withdrawal notice.  So it’s necessary to examine the context of the Article. In the Advocate-General’s view, it starts with a national phase ‘exclusively’ for the withdrawing State, when it decides on its intention to withdraw, ‘only conditional’ on following ‘that State’s own constitutional requirements’. The logical corollary is a unilateral power to revoke that decision, as ‘a manifestation of that State’s sovereignty’. So unilateral powers continue into ‘the negotiation phase, which begins with the notification of the intention to withdraw to the European Council and culminates two years later, unless there is an extension by unanimous decision of the Council.’ (Note that the withdrawal agreement itself can also set a later date, although the draft withdrawal agreement concluded between the UK and EU does not). More generally, like ‘other areas of law, in the absence of an express prohibition or a rule which provides otherwise, whoever has unilaterally issued a declaration of intent addressed to another party, may retract that declaration until the moment at which, by the addressee’s acceptance, conveyed in the form of an act or the conclusion of a contract, it produces effects’.

Next, the opinion observes that Article 50(2) TEU refers to a notification of an ‘intention’ to withdraw, ‘not to withdrawal itself’, which happens later. An ‘intention’ is ‘not definitive and may change’; the notification of that intention to a third party ‘may create an expectation in that party, but does not assume an obligation to maintain that intention irrevocably’.

Interestingly, the opinion also refers to the possibility of a withdrawal decision being ‘annulled, if the body having authority (ordinarily the highest courts of each State) holds that that decision was not adopted in accordance with the constitutional requirements.’ In this scenario, ‘there is little doubt that the State which notified its intention must also make known that it unilaterally revokes that notification, as its initial decision lacked the essential precondition.’

Similarly, following action ‘carried out in accordance with its constitutional requirements (for example, a referendum, a meaningful vote in Parliament, the holding of general elections which produce an opposing majority, among other cases)’, an initial decision might be ‘reversed and the judicial and constitutional basis on which it was sustained subsequently disappears’. Again, in that scenario, ‘that State can and must notify that change to the European Council’. These scenarios have international precedents in practice, as well as corresponding to Article 68 of the VCLT.

Furthermore, the opinion argues that insisting on a Member State leaving under such circumstances would be ‘a result contrary to common sense’, and accepting revocation would ‘respect’ a national parliament’s role as part of a Member State’s national identity. Refusal to accept revocation would entail a de facto forced exit from the EU.

The possibility of applying to rejoin did not contradict this interpretation either, as it would be illogical to spend the Article 50 time period negotiating future membership. And as the CJEU had already noted, a Member State remains a Member State throughout the Article 50 time period.

The opinion then rejected the contrary arguments of the Commission and Council. In the Advocate-General’s view, there is still a unilateral element after the notification is sent, because the withdrawing Member State can simply refuse to negotiate a withdrawal agreement. The power to extend the negotiating period did not mean by a contrario reasoning that no power to withdraw the notification exists. The Council’s argument about costs was unconvincing because ‘the financial costs (for the European Union and its citizens) arising from a Member State’s withdrawal would far exceed the (minimal) costs generated by the revocation’.

The opinion bolsters its argument by adding that the unilateral revocability would enhance the ‘ever closer union’ clause in the Treaties, ‘national identities’ of the Member States, and the rights of EU citizens would be enhanced by permitting unilateral revocability. It also argues that the historical background to drafting Article 50 supports the same result.

However, the opinion argues that some conditions exist. There must be a formal notification of revocation, matching the notification to withdraw. Equally, national constitutional requirements must be respected. Although he accepts that ‘this is an issue which falls to be determined by each Member State’, he argues that in the UK, the requirement for parliamentary authorisation to leave would logically be matched by parliamentary approval to revoke the notification. (He makes no specific mention of whether an Act of Parliament would be required). There would be no need to justify the decision to revoke.

There would also be a temporal limit: revocation ‘is possible only within the two-year negotiation period that begins when the intention to withdraw is notified to the European Council’, and ‘once the withdrawal agreement has been formally concluded, which implies the agreement of both parties’, revocation would no longer be possible either. The discussion here is inconsistent with the opinion’s previous reference to the possibility of extension of the Article 50 time limit.

Next, the ‘principles of good faith and sincere cooperation’ in Article 4(3) TEU set a limit. On this point, the EU institutions were concerned that a Member State ‘could revoke its notification and halt the negotiations if they were not favourable to it’, and ‘resubmit its notification of intention to withdraw, thus triggering a new two-year negotiation period’, circumventing the time limits on the process. But the Advocate-General rejected these arguments: ‘the possibility that a right may be abused or misused is, generally speaking, not a reason to deny the existence of that right’. A means to prevent abuse of the right must be found instead. The established ‘abuse of rights’ principle in EU law could be ‘applied in the context of Article 50 TEU, if a Member State engaged in an abusive practice of using successive notifications and revocations in order to improve the terms of its withdrawal from the European Union.’

There was no indication that any abuse was planned, and ‘any abuse could occur only when a second notification of the intention to withdraw is submitted, but not by unilaterally revoking the first.’ In the Advocate-General’s view, a large number of ‘tactical revocations’ was unlikely, in that the national ‘constitutional requirements’ rule would function as a ‘filter’, given the requirement of (for instance) elections, court decisions or referendums.

Finally, the opinion accepts that revocation can be agreed, in the event of a request from the departing Member State and unanimous agreement in the European Council.

Comments

First of all, the opinion convincingly argues that the case is not hypothetical. It rightly recalls the case law according to which national court references are presumed to be relevant; that presumption can only be rebutted in limited cases. There is a strong argument to answer these questions given the status of those petitioners who are MPs; and otherwise there could be a catch-22 scenario where MPs hesitate to vote on whether a referendum could be held because they do not know if unilateral revocation would be possible.

The main argument for unilateral revocability is equally convincing – in particular as regards the importance of the word ‘intention’, and the emphasis on the sovereign decision-making power of Member States. As regards safeguards against abuse, though, it is at least conceivable that national constitutional requirements will not always work as a filter, and so it would be preferable to spell out what limits – perhaps in the form of a refusal to consider a notification valid within a year or two of the previous notification, or the resumption of an Article 50 process where the last process left off – would be applicable.

It is unfortunate that the opinion is vague about the time limit issue though. Would notification only be possible within the two year time limit, or also during the the time limit as extended? The opinion is contradictory; the Court judgment (if it goes down these lines) should not be. The possibility of a delayed time limit in the withdrawal agreement should also be mentioned. The best interpretation, keeping with the logic of the opinion, is that revocation would also be possible within the extended time period.

Revocation with consent does not easily fit within the literal wording of Article 50, because there is no process for consenting. Moreover, it’s unlikely that any Member State would seek this route if it could revoke unilaterally instead. It might be used in a scenario where the Member State’s current membership was being renegotiated, though only Tony Blair thinks that might happen as regards the UK.

Overall, if followed by the Court, this opinion would be an unqualified victory for those arguing for unilateral revocation. Whether it changes the political dynamics remains to be seen, and I remain of the view that another referendum (which would still have to be won by the Remain side) is very unlikely. In any event, unilateral revocability could still prove relevant as regards other Member States that might someday wish to leave the EU.

Barnard & Peers: chapter 27

Photo credit: The Irish Times