Foreign fighters' helpers excluded from refugee status: the ECJ clarifies the law

Professor Steve Peers

What if a person claiming to be a refugee is an alleged terrorist, or at least giving assistance to alleged terrorists? Can they still claim to be a refugee – and if not, how should we define ‘terrorism’ for the purposes of rejecting their claim to be one? Today’s judgment of the EU Court of Justice in the Lounani case usefully clarifies some aspects of this controversial and legally complex issue, but inevitably leaves some difficult questions open.

Legal framework

The starting point for this issue is the wording of the UN Refugee Convention, known by the EU as the ‘Geneva Convention’, which contains an ‘exclusion’ clause in Article 1.F:

F. The provisions of this Convention shall not apply to any person with respect to whom there are serious reasons for considering that:

(a) he has committed a crime against peace, a war crime, or a crime against humanity, as defined in the international instruments drawn up to make provision in respect of such crimes;

(b) he has committed a serious non-political crime outside the country of refuge prior to his admission to that country as a refugee;

(c) he has been guilty of acts contrary to the purposes and principles of the United Nations.

The UN rules (which all EU Member States have signed up to) have been transposed, but with variations, in the EU’s Qualification Directive, which applies to every Member State except Denmark. (Technically the UK and Ireland are bound only by the first version of this Directive, but the rules on exclusion haven’t changed).  Article 12(3) of that Directive reads as follows:

2. A third-country national or a stateless person is excluded from being a refugee where there are serious reasons for considering that:

(a) he or she has committed a crime against peace, a war crime, or a crime against humanity, as defined in the international instruments drawn up to make provision in respect of such crimes;

(b) he or she has committed a serious non-political crime outside the country of refuge prior to his or her admission as a refugee, which means the time of issuing a residence permit based on the granting of refugee status; particularly cruel actions, even if committed with an allegedly political objective, may be classified as serious non-political crimes;

(c) he or she has been guilty of acts contrary to the purposes and principles of the United Nations as set out in the Preamble and Articles 1 and 2 of the Charter of the United Nations.

3. Paragraph 2 applies to persons who incite or otherwise participate in the commission of the crimes or acts mentioned therein.

It can be seen that the EU rules differ from the UN rules to the extent that: they add some wording on the timing and nature of ‘serious non-political crimes’; they clarify the reference to acts contrary to UN ‘purposes and principles’; and they apply the exclusion to those who ‘incite or otherwise participate’ in all three categories of acts leading to exclusion.

Despite this attempt at clarification, there will always be issues of interpreting these rules. The EU Court has ruled on them once before, in its judgment in B and D, when it stated that first of all that the second and third exclusion clauses can apply to terrorist offences.  However, exclusion must be assessed in each individual case, meaning that membership of a group listed as ‘terrorist’ in EU foreign policy sanctions against terrorists does not automatically trigger the exclusion clause, although it is a ‘factor’ to consider. Participating in a terrorist group, as defined by EU criminal law on terrorism, does not automatically trigger the exclusion clause either. Instead, there must be direct involvement by the person concerned in such offences, as further explained by the Court. Furthermore, there is no additional ‘proportionality’ or ‘present danger’ test for exclusion. Finally, the exclusion clause is mandatory: ie Member States cannot assert a right to apply higher standards and give someone refugee status if they fall within the exclusion criteria.

The judgment

What does today’s judgment add? The person concerned was convicted of participating in a terrorist group, but not of carrying out any terrorist acts as such. So is such a conviction sufficient to trigger the exclusion clause?

The EU court ruled that it was. First of all, the preamble to the EU Directive referred to UN Resolutions on ‘financing, planning and inciting’ terrorism; so the third exclusion clause goes beyond terrorist acts as such. Secondly, the EU legislature had not intended to match the exclusion clause in asylum law with the narrower definition of terrorism in (current) EU criminal law legislation.

Next, the EU court ruled that following a later UN Security Council Resolution, assisting with recruitment, organisation or transport of ‘foreign fighters’ could also fall within the scope of the exclusion clause. So could ‘participation’ in such activities, pursuant to Article 12(3) of the EU Directive. It was relevant that the group in question was listed as terrorist by the UN Security Council, and particularly relevant that the person concerned had been convicted of terrorist offences in Belgium.

Comments

The Court’s judgment asserts a broad scope of the exclusion clause, meaning that a degree of support for ‘foreign fighters’ will also result in exclusion from refugee status. In doing so, it answers the claims of those who believe that many refugees are ‘jihadists’. Simply put, anyone who has been directly involved in terrorist acts (B and D) or in facilitating the activities of ‘foreign fighters’ (today’s judgment) is not entitled to refugee status. Although the judgment does not mention it, this aligns the interpretation of the exclusion clause to some extent with recent developments in criminal law, namely the 2015 Protocol to the Council of Europe Convention on the prevention of terrorism, and the agreed revision of the EU’s anti-terrorism laws.

But the judgment cannot help leaving some difficult questions open. What if the asylum-seeker has not been convicted of terrorist offences anywhere, but there are allegations of such action? Since a conviction is particularly relevant to applying the exclusion clause, would a lack of such conviction conversely be particularly relevant in determining that the clause should not apply? Would that assessment be different if the person had been acquitted, or if an investigation or trial was pending? If the criminal law process was pending, should the asylum determination process be put on hold? What if the authorities had claimed to have information supplied from the security services, and were reluctant to bring criminal proceedings in order to preserve their sources and intelligence capability? 

What if there is a criminal conviction for terrorism from another country – particularly in the asylum-seeker’s country of origin, which might define criticism of the government as ‘terrorism’? Similarly what about ‘provocation’ to terrorism, which might include ‘glorification’ of terrorist acts, according to the revised EU criminal law? Here the question is to what extent freedom of expression, not directly connected to violent acts, might justify a refusal of refugee status. Recent acts remind us that as far as criminal law is concerned, terrorist acts – and the climate of hatred that surrounds them – are not confined to Islamist extremists, but stem also from those who fanatically hate minority groups as well.

Barnard & Peers: chapter 25, chapter 26

JHA4: chapter I:5, chapter II:5

Photo image: Worldbulletin

The draft EU Directive on Combating Terrorism: Much Ado About What?

Cian C. Murphy, The Dickson Poon School of Law, King’s College London

The slow strangulation of the transnational public sphere continues. The publication last month of a draft EU Directive on Combating Terrorism is the Union’s initial (legislative) response to recent murders by Islamic State fighters in Europe and elsewhere. The draft Directive will recast the Framework Decision on Combating Terrorism, first adopted in 2002 and amended in 2008, and will further broaden the impact of EU law in national criminal law as regards terrorism.

The Directive may be of more significance in terms of constitutional law in this field than criminal law. The majority of the Directive’s content can already be found in the Framework Decision (as amended) and, as such, will not require much by way of transposition by those Member States that have been fastidious in their transposition of the Framework Decision (although such Member States may be fewer than one would expect).

The draft Directive does have certain rule of law strengths. As a measure to be adopted upon the legal bases of Article 83(1) and Article 82(2) TFEU it will enjoy the full enforcement mechanisms and procedures that the European Commission and the Court of Justice of the EU can bring to bear. This is in contrast to the Framework Decision which, as a (former) third pillar measure, did not (at first) benefit from the application of these enforcement mechanisms. The extent to which these rule of law strengths are virtuous might, however, be open to discussion. The content of the Directive is rather broad and it is not absolutely clear what faithful transposition of some measures would entail.

Nevertheless, for those Member States to whom the adopted Directive applies, there will be the prospect of enforcement in the case of tardy or inaccurate transposition. It remains to be seen as to which Member States the adopted Directive will apply. The list will not include Denmark, which does not participate in these measures, but it may include Ireland or the United Kingdom. Either Member State may elect to participate in the measure – either before or after its adoption. The United Kingdom’s opt-out from former third pillar measures (discussed here) included an opt-out from the Framework Decision on Combating Terrorism – a somewhat absurd decision given the emphasis the UK places on action in this field (at national, EU, and international levels).

Even if none of the three Member States participate in the Directive, two of them (Ireland and Denmark) will continue to be bound by the Framework Decision. Because the majority of the two texts are identical there may not be much variance in the ‘variable geometry’ in this field – although the different powers of enforcement for the European Commission and Court of Justice merit restatement. The example of the Framework Decision and Directive demonstrate how increasingly complex this field of EU law is at a constitutional level – a complexity that is not helpful from either the point of view of operational effectiveness or the protection of civil liberties.

Insofar as there is new content in the Directive it largely derives from recent ‘international standards’ in the field of counter-terrorism finance and travel by ‘foreign terrorist fighters’. Chief amongst these standards is UN Security Council resolution 2178 – adopted in 2014 to address the threat from Islamic State – and much of the resolution is to be found in the Directive. (See also the recent Council of Europe Protocol on this issue) Key amongst these initiatives are Articles 9 and 10, which require Member States to create offences of travelling abroad for terrorism and of organising or facilitating such travel. Member States must ‘take the necessary measures’ to punish such action ‘as a criminal offence when committed intentionally’. Article 8 provides a new offence – to receive training for terrorism – that aims to capture those individuals that may ‘self-radicalise’ and train themselves using materials available on the internet or elsewhere.

The draft Directive also contains some language of interest to victims of terrorism. Article 22 provides for the protection of, and provision of assistance to, victims of terrorism. Of particular note is the requirement to provide ‘emotional and psychological support, such as trauma support and counselling’. It is unclear how Member States are to ensure that the services are ‘confidential, free of charge, and easily accessible to all victims of terrorism’. This clause would appear to include what could be quite a significant commitment of resources for Member States’ mental health services – one that is entirely commendable but the funding of which may prove a challenge.

A further point of note is that the structure of certain clauses in the Directive, for example setting out the definition of terrorism, have been subject to alteration in comparison with the Framework Decision. It is not clear, however, that anything turns on these syntax changes. Indeed, it seems unlikely that Member States which have already spent legislative time on the implementation of the Framework Decision would now look to revise their national measures merely to update the language of the definition (if, indeed, nothing does turn on the differences).

Certain substantive discrepancies do exist between the Framework Decision and the draft Directive. One example is Article 1(2) of the Framework Decision. The Article provides that the Framework Decision does ‘not have the effect of altering the obligation to respect fundamental rights and fundamental legal principles as enshrined in Article 6 of the Treaty on European Union’. In terms of the application of the law this clause was always redundant – legislation cannot alter a Treaty rule. However, it is easy to read the omission of the clause from the draft Directive as a shift in emphasis – and the failure to address the admission in the proposal document makes this criticism easier to make.

Taken as a whole, the Directive continues the ongoing restriction of various mobilities – of finance, information, and people – in the name of counter-terrorism. This restriction has been the hallmark of international efforts since 11 September 2001. There is an inevitable risk for critiques of such action: on the one hand it appears to be restrictive of civil liberties across Europe and on the other hand its operational usefulness is unclear. Can such a law be both draconian and ineffective? Undoubtedly. As with any EU measure the proof will be in the transposition and implementation.

Update, March 2016: the Council agreed its position on this Directive, which must now be negotiated with the European Parliament. For the text of this position, see here. 

Barnard & Peers: chapter 25

JHA4: chapter II:5

Photo: 9/11 memorial, New York City

Photo credit: www.theblaze.com

What if a refugee allegedly supports terrorism? The CJEU judgment in T

Steve Peers

What happens if a refugee allegedly supports terrorism? The most obvious answer is that the person concerned might be excluded from getting refugee status in the first place, in accordance with Article 1.F of the Geneva (UN) Convention on Refugees, as reflected in the EU’s qualification Directive and interpreted in the CJEU’s B and D judgment of 2010. However, the situation is more complicated if the person already has refugee status, and his or her alleged support for terrorism begins or comes to light only later. This issue was addressed for the first time in today’s CJEU judgment in T.

Background

The qualification Directive offers three possible responses to a situation like this. First of all, a Member State may revoke refugee status where there are ‘reasonable grounds for regarding [a refugee] as a danger to the security of the Member State in which he or she is present’, or where the refugee was ‘convicted by a final judgment of a particularly serious crime’ so ‘constitutes a danger to the community of that Member State’. Secondly, it is possible to refoule a refugee (ie return the refugee to an unsafe country) on the same two grounds (which are also the exceptions to non-refoulement set out in the Geneva Convention), if that is not ‘prohibited’ by Member States’ international obligations. In that case, Member States may revoke or refuse to renew the refugee’s residence permit. Finally, Member States must issue refugees with a residence permit and renew it, ‘unless compelling reasons of national security or public order otherwise require’.

Also, a Member State is obliged to revoke refugee status if the refugee ‘should have been’ excluded from refugee status in the first place, but presumably this only applies where the activity justifying exclusion took place before the refugee status was granted. All of the same rules apply to the parallel status of ‘subsidiary protection’, which exists for persons who don’t qualify for refugee status but who otherwise need international protection because they are fleeing torture, the death penalty or a civil war.

Judgment

This case concerned a Turkish national who moved to Germany back in 1989 and obtained refugee status there in 1993, on the basis of his activities in support of the PKK, the Kurdish group which Turkey (and subsequently also the EU) regards as a terrorist organisation. However, those links later led to a conviction for supporting terrorism, due to his collection of money for the PKK and distribution of PKK literature. His residence permit was revoked but he retained refugee status, and he was not expelled from the country. Nevertheless, he still challenged the revocation of his residence permit.

The CJEU’s judgment considers the second and third of the two issues above: refoulement (which might lead to the loss of a residence permit) and the loss of the residence permit as such. First of all, the Court explains the relationship between these two overlapping rules. If the criteria to refoule a refugee are satisfied, a Member State can either (a) refoule the refugee; (b) expel the refugee to a safe country; or (c) allow the refugee to stay. In the event that Member States can refoule the refugee, then they can also revoke a residence permit. But conversely, if the criteria to refoule the refugee are not satisfied, then the Member State cannot withdraw a residence permit on this ground.

In that case, the Court ruled, the question arises whether the rules on granting residence permits apply. Those rules don’t expressly refer to revoking a permit which has already been issued, but the Court ruled that this possibility was implicit.

The Court then moved on to interpret the two sets of grounds for loss of a residence permit at issue in this case: the ‘reasonable grounds’ that the refugee is a security risk, and the ‘compelling reasons of national security or public order’. These concepts aren’t further defined in the Directive, and the language versions of the Directive differ. So the Court proceeded to interpret these rules in the overall context of the Directive – protecting human rights and developing a common policy. In the Court’s view, refoulement of a refugee is a ‘last resort’ in the event that there is no other option to protect national security or the public. Since it could have a ‘drastic’ impact on the refugee, it was subject to ‘rigorous conditions’.

In contract, the mere loss of a residence permit did not lead to refoulement, and so the threshold for the application of the relevant rules was lower. The rules on loss of a residence permit ‘only’ apply where the refugee’s actions ‘cannot justify loss of refugee status, let alone the refoulement of that refugee’, and so did not ‘presuppose the existence of a particularly serious crime’.

So does support for a terrorist group meet the threshold to be one of the ‘compelling reasons of national security or public order’? The Court ruled that the concept should be interpreted consistently with the public security exceptions in the EU’s citizens’ Directive, because ‘the extent of protection a company (sic) intends to afford to its fundamental interests cannot vary according to the legal status of the person that undermines those interests.’ So terrorism is covered by that concept, and there must be a ‘genuine, present and sufficiently serious threat affecting one of the fundamental interests of society’. Moreover, the EU has listed the PKK as a terrorist group, which is a ‘strong indication’ that must be ‘taken into account’. Since the CJEU had already ruled (in B and D) that terrorist acts could lead to exclusion from refugee status, it must follow that they could equally justify revocation of a residence permit.  

But that was not the end of the matter. The national court has to go on to a second step, to consider whether the specific actions of a refugee in fact constitute support for terrorism so as to justify revocation of a residence permit. Not all forms of support for an organisation which the EU considers to be terrorist can lead to revocation of a refugee’s residence permit. As with the exclusion clause (see B and D), it was necessary to look at the individual’s behaviour, examining ‘in particular whether he himself has committed terrorist acts, whether and to what extent he was involved in planning, decision-making or directing other persons with a view to committing acts of that nature, and whether and to what extent he financed such acts or procured for other persons the means to commit them’.

In this case, Mr. T had participated in legal meetings, celebrated the Kurdish New Year and collected money for the PKK. The Court asserted that this ‘does not necessarily mean that he supported the legitimacy of terrorist activities’. Indeed, such acts ‘do not constitute, in themselves, terrorist acts’. The national court also had to consider the ‘degree of seriousness of danger’ Mr. T posed. It could take into account his criminal conviction but also had to consider that he was only sentenced to a fine. Also, the principle of proportionality (which the Court stated was not relevant when applying the exclusion clause, in B and D) was relevant here: the national court had to consider if Mr. T was still a threat to public security at the time the decision to revoke the permit was taken.

Finally, the Court ruled on the consequences of the loss of a residence permit. The person concerned retained refugee status and so was still entitled to all of the rights granted to a refugee, including access to employment, education, welfare, healthcare and housing. Although a clause in the preamble to the Directive stated that a residence permit could be made a condition of obtaining such benefits, the Court said that this clause was irrelevant since it was not reflected in the main text. Those rights could ‘only’ be restricted in accordance with the conditions in the Directive, and Member States ‘are not entitled to add restrictions not already listed there’. This was directly relevant to Mr. T, since Germany had indeed restricted his access to all of those benefits. But this is ‘incompatible’ with the Directive.

Comments

This was the first chance for the Court to rule on the status of refugees, ie the various benefits attached to refugee status, since its previous judgments on the qualification Directive have essentially concerned the definition of refugee or subsidiary protection status (or the linked issues of exclusion from or cessation of that status). Broadly speaking, the judgment does a good job clarifying the points which the Court set out to tackle – but inevitably the Court could not deal with every possible issue, and some of its answers raise further questions of their own.

First of all, the Court provides a useful clarification of the distinction between the non-refoulement rules and the rules on residence permits as such. The crucial point here is that the latter rules apply only when the former do not. While this makes the residence permit rules sound as if they have secondary importance, in fact the reverse is true. In practice, the residence permit rules are more important, since it is rarely if ever possible to refoule a refugee consistently with international obligations. This is because the case law on Article 3 of the European Convention on Human Rights (ECHR) makes clear that even if a person has done things awful enough to justify refoulement under the Geneva Convention, he or she cannot be removed to face a real risk of torture or inhuman or degrading treatment in violation of Article 3 ECHR – since that provision is not subject to any exception relating to the behaviour of the person concerned (or any other exception either). It was not necessary for the CJEU to rule on this point in the T case, since Germany was not seeking to remove him, but it would surely be willing to do so if the case arose (see the judgment in Abdida, discussed here, where the CJEU relied upon another strand of the Article 3 case law).

   

In the unusual event that refoulement might be possible, the CJEU’s ruling leaves some questions to ponder. It refers to the possible removal of a refugee to a safe third country. Presumably the criteria to determine the meaning of that concept are those in the asylum procedures Directive. It is also possible that the Court would be willing to rule on the interpretation of Article 32 of the Geneva Convention – which regulates the substance and procedure of the expulsion of refugees to safe countries (if the refugees are legally resident) – in this context. The CJEU might also be called upon to elaborate further what it means by saying that refoulement is a ‘last resort’ in the event that no other alternatives are available.

   

As for the main thrust of the Court’s ruling, on the ‘compelling reasons’ exception to the grant of residence permits, it is striking that the Court continues its recent trend of applying its case law on the EU citizens’ Directive to the ‘public policy’ clauses in EU immigration and asylum law. It did the same thing just a few weeks ago as regards the voluntary departure rules in the EU Returns Directive (see the Zh and O judgment, discussed here), and the broad wording of its judgment in T on this point suggests that all public policy clauses (they appear in swathes of EU legislation in this area) should have the same meaning. Having said that, the Court clearly accepts that the threshold for refoulement of a refugee is higher than for the normal public policy exception.

The Court also borrows most of its prior reasoning on the exclusion clause (with the addition of a proportionality element) to make clear that broad support of a group which the EU considers to be terrorist is not enough: there must be an active participation in violent acts or the funding of those acts. Presumably there must be a direct link with the funding of those acts, since the Court finds that Mr. T’s participation in collecting money for the PKK generally is not enough. Implicitly the Court shows little sympathy with recent EU and national moves against ‘radicalisation’ of Islamic communities (as very broadly defined), and it makes no reference to the Council of Europe measure (reflected in EU legislation) which criminalises ‘public provocation’ of terrorism. But nor does it refer to the countervailing case law of the European Court of Human Rights on freedom of speech, which requires States to allow the free expression of radical political beliefs and allows limits on that expression only where there is a direct incitement to commit violent acts. Nevertheless, the Court’s approach fits squarely into that latter line of case law.

Finally, the Court’s ruling on the consequences of loss of a residence permit are highly relevant, especially in Germany and any other Member States which do indeed make the receipt of benefits, access to employment et al dependent upon holding a residence permit. In effect, the judgment means that for many refugees the loss of a residence permit, even if justified, will have no real impact on their day-to-day life. It will only have an impact as regards journeys within the Schengen area (since holding a residence permit or long-stay visa is a condition of freedom to travel), or travels to non-Schengen and non-EU countries (since the criteria to revoke a residence permit also apply to the travel documents which refugees obtain from their host States in lieu of passports). It would also have an impact upon those refugees who do not yet have family living with them, since the EU’s family reunion Directive requires a third-country national to have a residence permit as a condition for family reunion. But that doesn’t matter to Mr. T, since he is already surrounded by his very large family in Germany.  

Barnard & Peers: chapter 26

Photo credit: kufarooq93.wordpress.com

Does the EU need more anti-terrorist legislation?

 

Steve Peers

In the wake of the appalling attacks in Paris two days ago, it only took 24 hours for the EU Commission to state that it would propose a new wave of EU anti-terrorist measures in a month’s time. It’s not yet known what the content of this law will be; but the very idea of new legislation is a profound mistake.

Of course, it was right for the EU institutions to express sympathy for the victims of the attack, and solidarity as regards defence of free speech. Equally, it would not be problematic to use existing EU anti-terrorism laws if necessary, in order (for instance) to surrender the suspects in this crime on the basis of a European Arrest Warrant (EAW), in the event that they fled to another Member State.  The question is whether the EU needs more such laws.

For the EU has already reacted to prior terrorism offences, first as regards 9/11 and then to the atrocities in Madrid and London in 2004 and 2005. The result is a huge body of anti-terrorism law, catalogued here by the SECILE project. This comprises not only measures specifically concerning terrorism (such as substantive criminal law measures, adopted in 2002 and amended in 2008), but many other measures which make it easier to cooperate as regards terrorism as well as other criminal offences, such as the EAW, the laws on exchange of police information and transmission of evidence across borders, and so on.  

Moreover, there are proposals already under discussion which would apply to terrorism issues (among others), such as a new law on Europol, the EU’s police intelligence agency (discussed here), and proposed EU legislation on the transfer of airlines’ passenger name records (PNR).  

So what new laws is the Commission likely to propose? It may suggest a new version of the data retention Directive, the previous version of which was struck down by the Court of Justice of the European Union (CJEU) last spring, in the Digital Rights judgment (discussed here). Other ideas under discussion, according to leaked documents (see here and here) are new laws strengthening mandatory checks at borders .  

Are any of these laws really necessary? Member States can already adopt laws on retention of communications data, pursuant to the EU’s e-privacy directive. As the European Parliament’s legal service has confirmed (see its advice here), if Member States adopt such measures, they will be subject to the constraints of the Digital Rights judgment, which bans mass surveillance carried out in the absence of safeguards to protect privacy. Equally, Member States are free to establish their own PNR systems, in the absence of any EU-wide measure (besides EU treaties with the USA, Canada and Australia on PNR). The question of whether mass surveillance is as such compatible with human rights has already been sent to the CJEU by the European Parliament, which has asked the Court to rule on this issue in the context of the EU/Canada PNR treaty (see discussion here).

It would be possible to adopt new laws calling for systematic border checks in specific cases. In practice, this would likely mean checks on Muslims who are returning after travel to places like Syria. It is questionable whether asking detailed further questions at the external borders will, by itself, really do a lot to prevent terrorism. After all, in the Paris attacks, it unfortunately proved impossible to prevent an apparent terrorist attack despite extensive anti-terrorist legislation on the books, and bodyguards protecting the staff of a known terrorist target.

There’s also a question of principle here. The Paris attacks were directed at free speech: the foundation of liberal democracy. Of course efforts should be stepped up to prevent such attacks from happening again; but existing laws allow for targeted intelligence gathering and sharing already, The Commission’s immediate response reeks of panic. And the direct attack on fundamental democratic principles this week in Paris is precisely the wrong context to consider that new legislation curtailing other fundamental freedoms is limited.

 

Barnard & Peers: chapter 25

The data retention judgment: The CJEU prohibits mass surveillance

Steve Peers

On July 7, 2005 a relative of mine started her journey to work on a London tube train. Within half an hour, bombs on that train left by terrorists exploded, in conjunction with three other bombs across London. Dozens of people died (although my relative was not injured).

Understandably, public concern about terrorist incidents, following on from the earlier outrages of 9/11 and the Madrid bombings, led to further EU anti-terrorist legislation. In particular, the British Presidency of the EU Council made it a top priority to adopt legislation providing for retention of a large amount of communications data. But according to the Court of Justice of the European Union (CJEU), in a crucial judgment today, that legislation was essentially an over-reaction to these terrorist atrocities. The Court has effectively prohibited mass surveillance in the EU, and thus taken significant steps to entrench itself as the EU’s constitutional court.

Summary of the judgment

As discussed in detail by Chris Jones’ post on this blog, the Directive requires Member States to require telecommunications service providers to retain significant amounts of data on the use of all forms of telecommunications by all individuals within the EU, for a period of between 6 months and 2 years. This data is collected for the use of law enforcement agencies as regards investigations into serious crime or terrorism, but there are no detailed rules in the Directive governing the access to and use of the data by those authorities. The CJEU only found it necessary to address the question of the validity on the Directive in light of the Charter rights to privacy and data protection (Articles 7 and 8 of the Charter).

First of all, the Court unsurprisingly had no difficulty finding that the Directive interfered with the protection of those two rights. Its analysis focussed instead on whether such an interference could be justified.

The rules on justifying interferences with Charter rights are set out in Article 52 of the Charter. Any limitation upon Charter rights must be laid down by law, respect the essence of the right, and subject to the principle of proportionality, limit rights and freedoms only if it is necessary and genuinely meets public interest objectives and the rights and freedoms of others. The Court easily found that there was a public interest justification (public safety) for the restriction of the Charter rights at issue. It also found that the ‘essence’ of the rights was not affected, because (as regards the right to privacy) the content of communications was not recorded, and (as regards the right to data protection) certain data processing and data security rules had to be respected.

Therefore the key issues in the Court’s ruling were the proportionality of the interference with Charter rights. The Court indicated that judicial review of the EU legislature’s discretion should be ‘strict’ in this case, applying factors such as the area of law concerned, the nature of the right, the nature and seriousness of the infringement and the objective pursued. Here, it followed from the nature of the right and the nature and seriousness of the infringement that the EU legislature’s discretion was reduced; the CJEU took no account expressly of the objective being pursued.

The first aspect of proportionality (the appropriateness of the interference with the right for obtaining the objective) was fulfilled, because the data concerned might be useful to investigations. However, the CJEU found that the Directive was problematic as regards the second facet: the necessity of the measure in question. Crucially the Court ruled that the important objective of investigating serious crime and terrorism did ‘not, in itself’ justify data retention. So for the CJEU, the safety of the people is not the supreme law.

Its analysis proceeded by setting out the general importance of safeguards as regards the protection of privacy and data protection rights (building upon the case law of the European Court of Human Rights). These safeguards are even more necessary when data is processed automatically, with a risk of unlawful access.

 Applying this test, the Court gave three reasons why the rules on data retention in the Directive were not strictly necessary. First of all, the Directive had an extremely broad scope, given that it applied to all means of electronic communication, which have ‘widespread and growing importance’ in everyday life, without being sufficiently targeted. Indeed, it ‘entails an interference with the fundamental rights of practically the entire European population’. In other words (the Court does not use the term), it amounts to mass surveillance.

Secondly, besides the ‘general absence of limits’ in the Directive, it failed to limit access to the data concerned by law enforcement authorities, and the subsequent use of that data, sufficiently precisely. In particular: it referred generally to ‘serious crime’ as defined in national law; it did not restrict the purpose of subsequent access to that data; it did not limit the number of persons who could access the data; and it did not control access to the data by means of a court or other independent administrative authority.

Thirdly, the Directive did not set out sufficient safeguards, as regards: the data retention period, for instance as regards the categories of data to be retained for the whole period; the protection of the data from unlawful access and use (here the CJEU criticises the possible limits on protection measures due to reasons of cost); the absence of an obligation to destroy the data; and the omission of a requirement to retain the data within the EU only.

Comments

The CJEU reached the same conclusion as the Advocate-General’s opinion, but for different reasons. In the Advocate-General’s view, the Directive was invalid because it breached the ‘quality of law’ requirement applicable to interferences with Charter rights, having failed to establish sufficient safeguards relating to access to and use of the data. It also was disproportionate for failing to explain why storage periods of up to two years were necessary. The Court’s ruling appears to go further, by ruling out mass surveillance in principle.

The opinion discussed some interesting and important issues that the Court does not directly address, in particular: the existence of a ‘quality of law’ requirement as regards breaches of the Charter; whether the EU or the Member States have responsibility for ensuring the satisfaction of that requirement in this case; and the complications of the ‘legal base’ issue, ie the awkward point that inserting safeguards relating to law enforcement authorities might go beyond the ‘internal market’ legal base of the legislation. It might be deduced that the CJEU has a view on these issues: there is a ‘quality of law’ rule; the EU is responsible for upholding that requirement in this case; and the ‘legal base’ point is not a barrier to the EU adoption of rules regulating law enforcement authorities. But unfortunately, the Court did not expressly spell out its reasoning on these issues. It is certainly peculiar that, having ruled previously that the Directive was validly based on EU internal market powers, the CJEU rules here that its interference with Charter rights is justified by the objective of public safety.

As for the reasoning which the Court did provide, as usual it was easy to find public interest objectives for the interference with rights. The most important part of the reasoning is therefore the analysis of the interference with the ‘essence’ of the right, and of proportionality. It is very significant that the Court makes clear that these are two different issues: even if the essence of a right is respected, legislation can be disproportionate. Earlier case law on restriction of rights often seemed to suggest that respecting the essence of rights was sufficient.

Another important aspect of the judgment is the development of a doctrine indicating when strict scrutiny of the EU legislature’s interference with fundamental rights should apply. This is based upon Strasbourg case law, not the standards of national constitutional courts, which have of course addressed this issue in their own way. Obvious questions arise as to whether the same standards should apply to national implementation of EU law, or to Charter rights not based upon the ECHR.

While many data protection specialists argue that there is a fundamental distinction between the right to privacy and the right to data protection, the Court’s judgment only reflects that distinction to a limited degree. It assesses separately whether there is an interference with Articles 7 and 8 of the Charter, and whether the essence of each right has been affected. However, it made no distinction between the rights when assessing the required intensity of judicial review, and linked the two rights together when assessing the proportionality of the interference with them.

Consequences of the judgment

First and foremost, the data retention Directive is entirely invalid. The Court did not in any way rule that it could continue in force. So the immediate consequence is that we return to the status quo before 2005. This means that Member States have an option, not an obligation, to retain data pursuant to the e-privacy Directive (see further Chris Jones’ post on the background to the data retention Directive). However, Member States’ exercise of this option will still be subject to the requirements set out in this judgment, since their actions will fall within the scope of the Charter, given that the e-privacy Directive regulates the issue of interference with telecommunications.

Would it be possible for the EU to adopt a new Directive on mandatory data retention? In other words, can the Directive in some way be ‘fixed’?

First of all, since the 2006 Directive is entirely invalid, the EU legislature has to start from scratch, rather than amend it. Secondly, it is clear from the Court’s judgment that some form of mandatory data retention in order to combat serious crime and terrorism is acceptable from the perspective of the EU Charter.

How would such a new Directive differ from the measure the Court has just struck down? The Court sets out unusually detailed guidelines for the legislature (and, in the meantime, for national legislature) in its judgment. First of all, any new Directive would have to be in some sense targeted upon communication which has a particular link with serious crime and terrorism. Very simply, mass surveillance is an unjustifiable infringement of Charter rights.

Secondly, a new Directive would have to contain rules on: the definition of ‘serious crime’; the purpose of subsequent access to the data; limits on the number of persons who could access the data; and control of access to the data by means of a court or other independent administrative authority.

Thirdly, the new Directive would have to include stronger rules on the data retention period, for instance as regards the categories of data to be retained for the whole period, as well as the protection of the data from unlawful access and use. It would also have to contain rules on the absence of an obligation to destroy the data, and require that data be retained within the EU only. The Court did not rule on whether subsequent processing of the data in third States would be acceptable, but logically there must be some rules on this issue too. Probably it would be simplest to extend the external processing rules in the main EU data protection legislation to this issue.

Depending on the timing of a proposal for a new Directive (assuming that there is one), it might possibly get mixed up with the conclusion of negotiations over main the main data protection package being negotiated by the EU institutions. Alternatively, if those negotiations have concluded, they will establish a template that the negotiation of the new Directive can take account of.

Final comments

The Court’s judgment can be seen in the broader context of continued revelations about mass surveillance. Its reference to the retention of data by third States is a thinly-disguised allusion to the spying scandals emanating from the United States. It also responds, sotto voce, to the very great concerns of national constitutional courts about this Directive, discussed in detail in Chris Jones’ post on this issue.

More broadly, the CJEU has seized the chance to give an ‘iconic’ judgment on the protection of human rights in the EU legal order. Time will deal whether the Digital Rights judgment is seen as the EU’s equivalent of classic civil rights judgments of the US Supreme Court, on the desegregation of schools (Brown) or criminal suspects’ rights (Miranda). If the Charter ultimately contributes to the development of a ‘constitutional patriotism’ in the European Union, this judgment will be one of its foundations.

Barnard & Peers: chapter 9, chapter 25