Analysis of the ECtHR judgment in Big Brother Watch: part 2

Lorna Woods, Professor of Internet Law, University of Essex

(These comments on the judgment follow part 1 of the analysis, which explained the Court’s reasoning).

The Big Brother Watch judgment is, depending on your point of view, a confirmation of the possibility of bulk surveillance (para 314) or a recognition of the fact that the Regulation of Investigatory Powers Act (RIPA) regime was insufficient and that, to the extent that these weaknesses are copied over into the Investigatory Powers Act (IPA), that act is deficient also.  These two different views reflect the fact that the judgment is long and complex and that a one sentence summary is unlikely to do justice to all its nuances. In fact, in an area where there is a rapidly increasing body of case law, it is likely that the full significance of the judgment will not be known for some time and we know how it has been interpreted, followed, distinguished, over-written or simply ignored.  What follows then is necessarily a preliminary indication of the issues and points of significance that arise from the judgment.  It contains a number of themes, or questions:-

-          To what extent is there a consistent, even if gradated, approach across the different forms of surveillance?

-          To what extent should we say that the case law from the analogue era is not the best indicator of necessary safeguards for the digital?

-          What impact will this ruling have for the IPA – especially given that the Court’s assessment of the RIPA regime changes to improve accountability following on from the Snowden disclosures?

Admissibility

The first question, at least in relation to two of the sets of applicants, was the question of exhaustion.  While the Court accepted that there were “special circumstances” (para 268) (recognised in Sejdovic v Italy (app no. 56581/00)), so that the case was admissible, it is worth noting briefly the Court’s approach in getting to this point.

The applicant’s argument was based on the reasoning of the Court in Kennedy, that while the Investigatory Powers Tribunal (IPT) has heard cases which effectively constitute a challenge to the legal regime itself (rather than a claim of interference in the claimant’s individual case), the domestic regime did not obviously “benefit the applicant, given that it did not appear to give rise to a binding obligation on the State to remedy the incompatibility” (Big Brother Watch para 251, Kennedy para 109). Here, the Court relied on Zakharov - in terms of its discussion of victimhood and the admissibility of a claim in abstracto rather than in the context of availability of a remedy - to suggest that the distinction in Kennedy between an individual grievance and a general complaint against the system (in which latter case the IPT cannot provide a remedy) as regards has been removed. 

The fact that there might still not be a remedy for an individual in the context of a general complaint, even if the IPT agrees to hear the complaint, is not addressed. Is the Court suggesting that a complainant should (in any event) bring an individual challenge so as to find a remedy to exhaust? Such a suggestion would follow the same line as the reasoning of the concurring opinion in Zakharov: that showed a preference for specific cases of interference. 

While the Court emphasised the importance of the IPT and how it has changed over its 15 year period – specifically its independence, the scope of its powers and techniques it has developed to allow it to hear cases without running into difficulties from the sensitivity of some of claims, it did not address head on the fact that the IPT has only rarely found against the Government in cases involving the security and intelligence services and that only after the Snowden disclosures (see for details the IPT’s report covering 2011-15 and the much shorter statistical report covering 2016).  While the elucidation of procedures – especially those “below the waterline” - is clearly helpful to the Court (see para 257), it does not help the victim if there is no remedy. 

This approach signals that the Court will not accept more applications which seek to avoid the delays and expense inherent in bringing an action before the IPT – campaigners take note.

Merits of Case

Article 8 and the Section 8(4) Regime

The applicants argued that the s. 8(4) regime was not lawful in the sense that the regime was complex and significant elements of the regime were not made public but were “below the waterline”; further they argued it did not comply with the 6 requirements to guard against unfettered discretion and the risk of abuse found in Weber.  The Court’s response is detailed and considered but -in the end – perhaps overly deferential to a set of institutions which seemed happily unaware of the practices of the security and intelligence services.

The Court’s reasoning starts with the statement that in previous judgments different approaches had been taken to different types of surveillance and that “there is no one set of general principles which apply in all cases concerning secret measures of surveillance” (para 303).  Weber consolidated the position in a number of earlier cases, though these were not cited: e.g Malone (App no. 8691/79); Huvig (App no. 11105/84) and -broadly speaking - Leander (App No. 9248/81 but crucially specifically identified the criteria whereas earlier case law operated on the basis of a broader test. Later in its judgment the Court pointed to Uzun (App no. 35623/05) (concerning GPS tracking where the Court considered that because the tracking of movements in public disclosed less information about the conduct, opinions and feelings of the person concerned less strict safeguards were required) and RE (App no. 62498/11) (concerning covert surveillance of consultations of individuals with legal advisors in a police station) as cases involving surveillance where the Weber 6 criteria were not applied (para 351).  Nonetheless, following the standard line for interception cases (albeit targetted interception rather than bulk), it agreed that the 6 principles from Weber should be the starting point for assessing foreseeability. In this, the Court is following a well-trodden path – one that case also be seen in Centrum för Rättvisa (App no. 35252/08) which also deals with bulk interception (para 99).  The Court found the complexity point was a question of foreseeability; insofar as it dealt with that issue, it did so as part of the Weber criteria.

While a consistent central principle is desirable, and the intention of the Court to set this out is to be applauded, the approach of the Court here suggests that there are differences between types of surveillance which are relevant (see similarly RE para 130), but it does not give us a clear framework as to what factors to be taken into account in determining what relevant differences are.  Should we look at the distinction between bulk and targeted interception, between content interception and meta-data collection; or even between the legitimate purposes? It may be that all are relevant; it would have been helpful had the impact of these differences been clearly mapped; this judgment, however, seems more to give rise to questions than answers.

One key factor the Court emphasised was the level of intrusion – and in this it followed previous jurisprudence. Notably, it argued that:

it would be wrong automatically to assume that bulk interception constitutes a greater intrusion into the private life of an individual than targeted interception, which by its nature is more likely to result in the acquisition and examination of a large volume of his or her communications (para 316). 

Does this mean that the level of safeguards in relation to bulk acquisition should be less than those for targeted interception based on the degree of intrusion? Or, might we argue that untargeted acquisition is more problematic because of its impact on society generally and because it is less likely to be proportionate? The Court deals with this issue by distinguishing between interception and selection/examination.  Another area in which the Court is unclear on the level of intrusion is in its consideration of meta data and whether it is less intrusive – more intrusive or similarly intrusive albeit in a different way. 

Nonetheless, in a statement that could be considered an important step forward in terms of the Court’s recognition of the importance of meta data, it Court commented that it was “not persuaded that the acquisition of related communications data is necessarily less intrusive that the acquisition of content” and by contrast to content interception, bulk acquisition magnified the problem (para 356). It seems from the discussion of the related communications that the Weber criteria can be applied to bulk communications data acquisition (para 350).  Finally, though lying outside the fact pattern, the Court referred to its recent decision in Ben Faiza (App no. 31446/12) to say that (perhaps in contrast to Uzun) that real time tracking was more intrusive than the transfer of historical data. 

It is regrettable that – despite its recognition of the significance of communications data - the Court did not investigate further the points raised in some submissions regarding the scope of the data collected and the impact of new technologies in terms of the types of analytical techniques used.  So far this issue has not attracted much judicial attention (the exception being the brief mention in the ECJ’s Canada PNR Opinion (Opinion 1/15)). Judge Koskelo in a partly concurring partly dissenting opinion commented that on the sea change that has taken place in terms of the amount and nature of data that is available, as well as mechanisms for carrying out surveillance, exposing individuals to greater intrusion than before (paras 11-13).

Despite this ‘sea change’, the Court also rejected the proposal to ‘update’ the Weber criteria to require objective evidence of reasonable suspicion in relation to the persons for whom data is being sought and the subsequent notification of the surveillance subject on the basis that it “would be inconsistent with the Court’s acknowledgement that the operation of a bulk interception regime in principle falls within a State’s margin of appreciation” (para 317).  This suggests that the powers of European review are in fact limited so that they cannot exclude a particular instance of bulk surveillance.  Such a position would seem to be a movement from that which says bulk surveillance is not automatically prohibited but it still must satisfy the three-stage test in Article 8(2) as determined at Convention level.  In terms of proportionality of a bulk regime, the Court refers to the Anderson Review of Bulk Powers. It accepts its findings that there is a case for bulk surveillance, but seemingly equates that to a finding that such surveillance is proportionate (paras 384-6). It is clear from the review, however, that the question of the proportionality of any such measures was not considered, this being a matter for Parliament.

A further consideration is the extent to which the proportionality analysis changes (or should change) depending on the public interest objective in view.  The headline statement about the acceptability of bulk surveillance related to national security, yet RIPA allowed (and the IPA does allow) the carrying out of bulk surveillance on a broader range of grounds.  In any event, as Judge Koskelo commented, is it appropriate to judge the adequacy of safeguards in the context of cases that arose in very different factual circumstances? In that context, note that much of the assessment of the facts in this case is based on what the Court previously found in Kennedy – prior to the Snowden disclosures. Further, this approach to generalised surveillance seems to be a point at which there is some divergence between the Court and the ECJ, as noted in the Joint Partly Dissenting and Partly Concurring Opinion of Judges Pardalos and Eicke.

The Court suggested that the 6 criteria in Weber needed to be adapted for the context of bulk surveillance (as it did in Centrum för Rättvisa para 114) despite the fact that Weber itself concerned a bulk regime. Moreover, when the Grand Chamber applied the Weber criteria in the case of targeted interception it did not adapt Weber, although it also considered ‘additional relevant factors’ in relation to the consideration of ‘necessary in a democratic society’ (Zakharov, para 232). It is not therefore clear what the nature of and necessity for this adaptation is in this case.  The Court here also proposed considering the regime in the light of the Zakharov additional factors (para 320).  This consolidation sees to becoming more common (see also Centrum för Rättvisa). It should be noted, however, that while the two sets of considerations will be based on similar facts, their content is slightly different, though whether this consolidation has a detrimental impact on the level of protection afforded is an open question. 

Another issue is the extent to which the ex post controls can be seen as compensating for a lack of ex ante controls.  While Judge Koskelo expressed concerns about the reliance on ex post control generally (paras 17, 20), a key point from this judgment is the Court’s re-iteration that prior judicial authorisation is not essential. Nonetheless, although the Court emphasised the importance of the ex post control by the IPT (para 318) (the new double lock system under the IPA not being in place at the time of the hearing), in relation to the selection of the material the ex post oversight seemed insufficient (paras 345-346).  It may be that the difference in the Court’s approach can be explained by its view of the degree of intrusion, with the selection of material being more intrusive than the collection though there is still a degree of uncertainty in what the test requires here. 

Significantly, the Court has viewed the interception of content as a potential violation in its own right. This seems to contradict the commonly made assertion that the automated collection of data (whether content of communications, communications meta data – or other data eg location via GPS or ANPR) is not an intrusion.  It also reminds us that the interception of content and its examination is not one event, but on ongoing process that may lead to multiple intrusions which need to be assessed individually (the data sharing reasoning reiterates this point too).  While the IPA has brought in greater ex ante controls, this is a weakness that remains in the new act.  The great unexplored territory is, as noted, whether a claim could be made that there should be some sort of control over types of analytical techniques used when analysing big data sets/predictive analytics.

A further point of some significance for the IPA regime is the Court’s approach to the use of related data which, despite some changes in terminology, is the same as in RIPA. It seems from the Court’s analysis that the selection for examination of such data for purposes beyond determining whether the individual is in the UK or Ireland requires greater oversight than the regime currently provides.   The Court also refrained from discussing (perhaps because the Government did not raise it) the question of where the interception takes place (para 271). This issue remains for another day.

Article 8 and Data Sharing

As regards the data-sharing regime, there will no doubt be disappointment that the Court accepted the regime. It could be said that the judgment thereby renders data sharing acceptable, especially given its emphasis on the global nature of terrorism and the States’ duties to protect security. The judgment is perhaps significant for what it did not cover. It carefully limited the topic on which it ruled, the receipt of intelligence and did not discuss the sharing of intelligence gather by the British services and shared overseas. There is also an assumption here that a person outside the UK who data is shared with the British services will still have convention rights when the information is shared/processed in the UK.  The issue of where the intrusion happens may become more complex in other situations – perhaps in the context of equipment interference warrants.

Article 8 and Bulk Communications Data

The Court’s analysis of the bulk communications data regime is in some ways disappointing as it does not deal directly with the substance. Instead the regime falls because there is no basis in law, despite the existing statutory framework (whether we consider RIPA or IPA). Simply put, the domestic courts have recognised that the statute must be disapplied for non-compliance with the requirements of EU law, and the Strasbourg Court therefore concluded that the regime “cannot be in accordance with the law within the meaning of Article 8” (para 467).  The point worth emphasising here is that the Court based its conclusion on its understanding of domestic law, not by relying directly on EU law.  It certainly has not gone as far as adopting the reasoning of the Court of Justice in the data retention cases.

Article 10

Finally, a relative novelty in Big Brother Watch is the Article 10 freedom of expression arguments (the Court not having considered the issue since Weber).  Note that the Court relied on its reasoning under 8(2) with regard to the assessment of 10(2): the considerations seem therefore to be the same, implicitly introducing the Weber criteria and the Zakharov additional considerations into freedom of expression.  Presumably this jurisprudence will not be relied on save in the specific context of the impact of secret surveillance on the media. While the Court did not state that journalistic communications would be entirely off-limits (similarly lawyers’ conversations are not sacrosanct: Kopp), there are a couple of points that will have implications for the IPA. In relation to bulk interception there were concerns about the lack of safeguards in relation to the selection of material (para 493), an area where the Court had already found the regime to be weak. Further, the IPA provides safeguards that are limited to applications that have the purpose of targetting journalists’ communications; the Court here noted that the protections did not “apply in every case where there is a request for the communications data of a journalist or where such collateral intrusion is likely” (para 499). This lack, adding to the general failings of the regime (above), meant that the regime could not be considered in accordance with the law for the purposes of Article 10(2).

Barnard & Peers: chapter 9

JHA4: chapter II:7

Photo credit: MiniPress news

Brexit means...no legal changes yet: the CJEU rules on the execution of European Arrest Warrants issued by the UK prior to Brexit Day

Professor Steve Peers, University of Essex

There’s a lot of legal debate about the consequences of Brexit, but the definitive word on the legal issues, as far as the EU is concerned, is the EU’s Court of Justice. Its first judgment on Brexit issues was released today, defining the legal position up until Brexit Day – and arguably influencing the approach to be taken after that date.

Today’s judgment in RO concerned whether Ireland was still obliged to execute a European Arrest Warrant (EAW) issued by the UK, in light of the UK’s expected withdrawal from the EU, having notified its intention to leave on the basis of Article 50 TEU.  In fact, the draft withdrawal agreement would regulate this issue to some extent: EU law (including the EAW) would still apply to the UK for a transition period (discussed here) until the end of 2020, subject to the caveat that EU Member States could refuse to surrender their own citizens pursuant to an EAW issued by the UK (the UK could reciprocate). At the end of the transition period, outstanding EAWs could still be executed between the UK and EU as long as the fugitive was arrested on the basis of the EAW before that date.  However, these specific provisions are not yet agreed, and of course nor is the entire withdrawal agreement, so inevitably the Court made no mention of this draft treaty in its ruling.

The UK issued two EAWs for the purpose of prosecuting RO on grounds of murder, rape and arson charges, but he has challenged the execution of the warrants in Ireland. RO is in detention pending execution of the EAWs, which is why the Court agreed to fast-track this case. (Note that it refused to fast-track an earlier reference on the same issues, referred by the Irish Supreme Court. It also refused to fast-track a similar case on whether the Dublin asylum rules still apply to the UK in light of Brexit). RO argued that he faced torture or inhuman or degrading treatment in UK prisons, based on 2016 CJEU case law (discussed here), which was since clarified in July. The Irish High Court therefore asked the issuing judicial authority to clarify that detention conditions in Northern Ireland would meet minimum standards, and it was satisfied with the reply.

However, the Irish High Court was still concerned about the impact of Brexit on RO’s case, and so asked the CJEU if it had any impact on executing the EAW. RO argued that there was no guarantee that the UK would continue to be bound by the EAW law after Brexit Day, in particular the rules on: deducting custody periods spent in the executing state from any subsequent sentence; the ‘specialty’ rule (the fugitive can only be prosecuted for the offences specified in the EAW); limits on further surrender or extradition to an EU or non-EU State; and the protection of human rights under the EU Charter of Fundamental Rights.  Furthermore, the CJEU would likely not be in a position to rule on these issues as regards the UK after Brexit Day.

Judgment

The Court began by noting that mutual trust between Member States was founded on “common values” referred to in Article 2 TEU. This principle means, as regards justice and home affairs, that “save in exceptional circumstances” Member States must presume all other Member States “to be complying with EU law and particularly with the fundamental rights recognised by EU law”. For the EAW, this manifested itself in a system of mutual recognition, entailing an obligation to execute an EAW issued by a Member State except “in principle” where the exhaustive grounds for refusal listed in the EAW apply. But the “exceptional circumstances” permit an executing State’s court to end the EAW process, for instance where there was a risk of torture et al under Article 4 of the Charter (which matches Article 3 ECHR). In this case the national court was satisfied that there was no risk of losing rights at present; but what about the position of the fugitive after Brexit day?  

On that point, the Court noted that an Article 50 notification “does not have the effect of suspending the application of EU law” in the withdrawing Member State. Therefore EU law, including the EAW legislation “and the principles of mutual trust and mutual recognition inherent in that decision, continues in full force and effect in that State until the time of its actual withdrawal from the European Union”. The Court summarised the Article 50 process without commenting on whether it would be possible to rescind the notification, as discussed here. That issue is relevant to this case since a withdrawal of the notification would render the fugitive’s argument moot, but the issue does not seem have been raised in the case, presumably because it would not have helped the fugitive and is only hypothetical as long as the UK government is not contemplating withdrawing the notice.

In the Court’s view, disapplying the EAW to the UK simply because an Article 50 notification had been sent would “be the equivalent of unilateral suspension of the provisions of the” EAW law, and would ignore the wording of its preamble, which says that it can only be suspended if the EU decides that an issuing Member State has breached the EU’s values. A recent CJEU judgment concerning alleged breaches of EU values in Poland (discussed here) concluded that EAWs could only be suspended on a case-by-case basis if no such finding of breach had been made.  An Article 50 notification was not an “exceptional circumstance” suspending the principle of mutual trust.

However, RO could argue that there were “substantial grounds for believing” that after Brexit, he was “at risk of being deprived of his fundamental rights and the rights derived” from the specific provisions of the EAW law referred to by the national court (listed above). On those points, the Irish court had already dismissed the argument that there was a risk of torture, et al, owing to UK prison conditions. Brexit would not affect that position, in the Court’s view:  

In that regard, it must be observed that, in this case, the issuing Member State, namely the United Kingdom, is party to the ECHR and, as stated by that Member State at the hearing before the Court, it has incorporated the provisions of Article 3 of the ECHR into its national law. Since its continuing participation in that convention is in no way linked to its being a member of the European Union, the decision of that Member State to withdraw from the Union has no effect on its obligation to have due regard to Article 3 of the ECHR, to which Article 4 of the Charter corresponds, and, consequently, cannot justify the refusal to execute a European arrest warrant on the ground that the person surrendered would run the risk of suffering inhuman or degrading treatment within the meaning of those provisions.

As for the specific provisions of the EAW, there were no “ongoing legal proceedings” which might infringe the specialty rule, and no “concrete evidence to suggest” that any such proceedings are being “contemplated”. This was equally true of the potential surrender or extradition to an EU or non-EU State. Furthermore, these provisions of the EAW law “reflect” provisions of the Council of Europe’s extradition Convention, which has been ratified by the UK and applied in its national law. So in the Court’s view, “[i]t follows that the rights relied on by RO in those areas are, in essence, covered by the national legislation of the issuing Member State, irrespective of the withdrawal of that Member State from the European Union”. The deduction of previous prison time served also exists in UK law and will apply regardless of whether the extradition process is part of EU law.

Since the rights based on the legislation and the Charter “are protected by provisions of [UK] national law in cases not only of surrender [under the EAW law], but also of extradition, those rights are not dependent on the application” of the EAW law as such to the UK, and “there is no concrete evidence to suggest that RO will be deprived of the opportunity to assert those rights before the courts and tribunals of” the UK after Brexit.

Nor was the potential absence of CJEU jurisdiction decisive, because the fugitive “should be able to rely on all those rights before a court or tribunal of” the UK, and the Court’s jurisdiction did not always apply to the EAW law anyway. Indeed while the law applied from 2004, the Court’s jurisdiction did not apply fully until 2014.

Overall then:

…in order to decide whether a European arrest warrant should be executed, it is essential that, when that decision is to be taken, the executing judicial authority is able to presume that, with respect to the person who is to be surrendered, the issuing Member State will apply the substantive content of the rights derived from the Framework Decision that are applicable in the period subsequent to the surrender, after the withdrawal of that Member State from the European Union. Such a presumption can be made if the national law of the issuing Member State incorporates the substantive content of those rights, particularly because of the continuing participation of that Member State in international conventions, such as the European Convention on Extradition of 13 December 1957 and the ECHR, even after the withdrawal of that Member State from the European Union. Only if there is concrete evidence to the contrary can the judicial authorities of a Member State refuse to execute the European arrest warrant.

Comments

What has the Court’s judgment told us about the Brexit process? First of all, it confirms that in the run up to Brexit nothing much will change, even though some legal relationships and processes begun before Brexit Day will conclude after it. The general statement that EU law continues to apply to the UK until Brexit Day is qualified, but those qualifications have little impact, as long as the UK continues to apply the ECHR, the Human Rights Act, EU legislation and any other relevant international treaties until that date. While the Court refers implicitly to the UK’s Extradition Act, the EU Withdrawal Act has more generally provided for the retention of EU law in UK domestic law after Brexit.  

Only if the UK starts making prospective changes to that retained law before Brexit Day will there be an issue about the UK/EU relationship during that time.  In that case the test will be whether the specific EU law rights which the litigant seeks to rely upon will be removed by the UK post-Brexit. There would have to be “concrete evidence” of the removal of such rights. Logically the rantings of an angry backbencher should not be enough evidence to that end, whereas a change in the law should be. In between those two ends of the spectrum, a government intention to amend policy, or a government bill tabled before parliament, would arguably be enough.

After Brexit it remains to be seen whether the EAW largely continues applying during the transition period, with an agreed phase out process (in the event that the withdrawal process is agreed). In that scenario attention will turn to the details of the future UK/EU relationship in this area (more on that issue here). Today’s judgment, with its acceptance that Member States can rely upon the future position of a non-Member State as long as it complies with the ECHR and EU legislation, even if no CJEU jurisdiction applies, does not lend support to those who claim that it will be impossible for the UK to have a close relationship with the EU in this field after Brexit. (Note also that in the NS judgment, the CJEU assumed that the principle of mutual trust can apply to non-EU States, in para 78). In any event, the limits on Member States extraditing citizens of another Member State to a non-EU State will apply (see discussion of the case law here).

If there’s no withdrawal agreement, then there may be conflicting approaches to the validity of EAWs pending on Brexit day (which the CJEU will likely be called upon to settle, along with similar issues relating to other EU legislation disapplying to the UK). There would also be a reversion to the use of the Council of Europe extradition treaty, with EAWs either being treated as extradition requests or having to be reissued. The UK would immediately lose access to the Schengen Information System, which is how many EAWs are transmitted. As a consequence, as evidenced by the impact of introducing the EAW, fewer people would be extradited and the process would take longer. All this would one among a number of legal and practical challenges arising from such a major disorganised disruption.

Barnard & Peers: chapter 25; chapter 27

JHA4: chapter II:3

Photo credit: The Journal.ie

The EU’s commitment to combatting violence against women: rhetoric or reality?

Catherine Briddick, Martin James Departmental Lecturer in Gender and Forced Migration at the Refugee Studies Centre of the University of Oxford - @CateBriddick

Background

The EU has, at its heart, a legal commitment to combat discrimination, including that based on sex, and to promote gender equality. It has however, been subject to sustained and justified criticism for its failure(s) to live up to these commitments, particularly in relation to its treatment of migrant and refugee women. The announcement by the Commission in 2016 that the EU would sign and conclude (ratify) the Council of Europe Convention on Preventing and Combatting Violence Against Women (the Istanbul Convention) was, therefore, warmly received by activists and academics alike.

 

The Istanbul Convention, for readers unfamiliar with it, is only the second international, legal instrument to focus on violence against women and the role of that violence in maintaining women’s inequality. The purposes of the Convention (set out in Article 2) are to protect women from all forms of violence and to prevent, prosecute and even eliminate violence against women and domestic violence. To achieve these purposes the Convention imposes on Parties a comprehensive range of obligations including that they:

-          adopt integrated, co-ordinated and properly resourced policies and programmes to challenge gender inequality, monitor and respond to violence against women (Istanbul Convention, Chapter II);

-          prevent violence through education, training and awareness-raising (Chapter III);

-          protect and support victims via a range of non-legal and legal measures (Chapters IV, V and VI);

-          investigate, prosecute and punish offenders (Chapter VI);

-          grant autonomous and/or renewable residence permits to migrant women who are victims of violence (Article 59); and,

-          ensure that refugee women’s claims for protection and dealt with in a gender-sensitive way (Arts 60 and 61).

Significantly, the rights and protections the Convention provides victims are to be secured by Parties without discrimination on any ground, including migration or citizenship status (Article 4(3)).

In force since 2014, the Convention has, at the time of writing, been ratified by thirty-three States (including Germany, Austria, Denmark, France, Italy, Spain, Sweden and Turkey) and signed by many others, including the UK.

The EU’s current approach

The Istanbul Convention itself envisages EU accession (Article 75), something that the EU can do to the full extent of its competences, as this blog has already discussed. The procedure to be followed involves the Council, following a Commission proposal and the consent of the European Parliament, adopting a decision which concludes the agreement. The agreement must identify the legal bases for the EU’s accession, bases derived from the EU’s legal competence (its ability or power) to act in a particular field. Once ratified, this agreement is binding on the institutions of the EU and EU Member States, to the extent that the EU has concluded the treaty. You can read more about this process here.

The EU’s competence in relation to violence against women is extremely broad. The legal bases under the Treaty on the Functioning of the European Union (TFEU) identified by the Commission in its Proposal for the Council on the conclusion of the Istanbul Convention were:

Article 16 (data protection), Article 19(1) (sex discrimination), Article 23 (consular protection for citizens of another Member State), Articles 18, 21, 46, 50 (free movement of citizens, free movement of workers and freedom of establishment), Article 78 (asylum and subsidiary and temporary protection), Article 79 (immigration), Article 81 (judicial cooperation in civil matters), Article 82 (judicial cooperation in criminal matters), Article 83 (definition of EU-wide criminal offences and sanctions for particularly serious crimes with a cross-border dimension), Article 84 (non-harmonising measures for crime prevention), and Article 157 (equal opportunities and equal treatment of men and women in areas of employment and occupation).

The Commission argued that it was appropriate to base a Council Decision signing the Istanbul Convention on Articles 82(2) and 84 TFEU because the ‘predominant purpose’ of the Convention is to prevent crime and protect victims. Selecting these bases would enable the EU to ‘exercise its competences over the entirety of the Convention’. Accordingly, the Commission’s draft Council Decision refers to Article 82(2) and Article 84 TFEU and refers to the EU signing up to the Convention as a whole.

The Council, however, took a radically different approach to that proposed by the Commission, taking not one but two decisions to sign the Convention in May 2017.

The first decision refers to Article 82(2) and Article 84 TFEU but states in Article 1 that:

The signing, on behalf of the European Union, of the Council of Europe Convention on preventing and combating violence against women and domestic violence with regard to matters related to judicial cooperation in criminal matters is hereby authorised, subject to the conclusion of the said Convention (emphasis added).

The second decision identifies Article 78(2) TFEU (on the establishment of a Common European Asylum System) as its legal base, stating in its Article 1 that the signing of the Convention is ‘with regard to asylum and non-refoulement’ (again, emphasis added).

These decisions limit the legal obligations the EU will accept in relation to the Istanbul Convention only to those that concern judicial cooperation in criminal matters and to asylum and non-refoulement (not, for example, European Union free movement law).

These decisions not only diverge from the Commission’s proposal, but also from the EU’s position in relation to the UN Convention on the Rights of Persons with Disabilities (the CRPD). The Council decision which signed the CRPD signed the Convention as a whole and took as its legal basis the EU’s commitment to non-discrimination.

(Update: in April 2019, the European Parliament decided to ask the Court of Justice about legal issues relating to the EU's proposed conclusion of the Istanbul Convention).

Commentary

Readers of this blog can be forgiven for asking if any of the above really matters. The obligations that the EU is planning to assume under the Istanbul Convention are significant, even if they are more limited than many hoped for and anticipated. EU action in either of the two areas it has signed up to could yield significant improvements in the way that violence against women is responded to, at both an EU and national level.  

Well it does matter, for at least two reasons.

First, EU free movement law disadvantages women, including women who have been subject to violence. To take just one example, as this blog and I have argued, the CJEU’s shameful decision in NA (which concerned Article 13 of the Citizens Directive), left a third-country national woman whose EU citizen husband subjected her to domestic violence and then left the UK, without a secure migration status. Article 59 of the Istanbul Convention requires Parties to grant autonomous and/or renewable residence permits to victims of violence in a broader range of circumstances than that currently provided for by EU law, potentially improving the position of women like NA whose migration status is (or was) dependent on their partner. The EU’s decision not to sign up to this provision means that women who are subject to violence whose migration status is determined by EU law will continue to face considerable hardship.

Second, the Convention itself and the holistic approach it adopts to violence and discrimination against women have been attacked and undermined by States who are either Parties or signatories to it.  Some States, including Poland, Latvia, Lithuania and Croatia have sought to limit the obligations the Convention imposes by making impermissible and potentially invalid declarations / reservations to it. In Bulgaria the process of ratifying the Istanbul Convention has been halted following a controversial judgement from its Constitutional Court that the Convention contradicts Bulgaria’s constitutional protection of women as mothers. The Commission has expressed concern about these developments and has sought to encourage States to ratify the Convention fully and without delay, highlighting its own role as a potential enforcer of the Convention where EU competences are involved. The EU’s ability to provide either political leadership or legal support on these issues is, however, hampered by its own partial and highly selective engagement with the Convention. Not only is the EU open to allegations of hypocrisy, but its own actions give succour to, rather than challenge, the conduct of the very States whose behaviour it seeks to influence.

Can the Council’s position be challenged?

Whether the Council’s two decisions will actually lead to the EU engaging with the Istanbul Convention in the very limited way described here is, as yet, far from clear.  

The European Parliament has stated that it ‘regrets’ the Council’s approach because it raises ‘legal uncertainties as to the scope of the EU’s accession, as well as concerns regarding the implementation of the Convention’. The Parliament has recommended instead ‘a broad EU accession to the Convention without any limitations’. It is not known whether the Parliament’s ‘regret’ will extent to withholding its agreement to the Council’s decisions.

The decisions could also be subject to legal challenge. The Commission has successfully challenged a Council decision to enter into a legal agreement with a third country on the grounds that it did not proceed on the correct legal bases. A similar challenge, based on the arguments the Commission advanced in its Proposal (as discussed briefly above) or, more persuasively in my view, on the grounds that the EU’s legal response to violence against women should be based in its commitment to combat sex discrimination, may well yield success.

The Istanbul Convention is monitored and enforced by a committee, the Group of Experts on Action against Violence against women and Domestic Violence (GREVIO) via a reporting and inquiry procedure. The EU’s approach to the Istanbul Convention could also be challenged by GREVIO or another Party to it. Article 75 of the Istanbul Convention refers to the Convention as a whole being open for signature, not parts of it whilst Article 73 provides for a dispute mechanism to be created if Parties disagree over the application of its provisions.

At the time of writing the EU’s (stalled) ratification of the Istanbul Convention is being considered by the Council working party on Fundamental Rights, Citizens’ Rights and Free Movement of Persons (FREMP). This scrutiny is being accompanied by a concerted, EU-wide campaign in support of the Istanbul Convention and the EU’s full ratification of it. Over the next few months we will be able to gauge the impact of these processes, as the EU proceeds (slowly) to conclude the Convention. We will then find out whether the EU’s rhetoric on violence against women is any more than that. 

Barnard & Peers: chapter 9, chapter 20

JHA4: chapter I:5

Photo credit: Council of Europe

What do the 'no deal' notices tell us about Brexit and health?

Sarah McCloskey and Professor Tamara Hervey, University of Sheffield

The clock ticks towards Brexit Day and time to devise an agreement dwindles. The odds on reaching one are said to be at 50:50. This means increased incentives for both the UK and the EU to set out exactly what the implications of the UK leaving the EU without a legally binding Withdrawal Agreement (‘no deal Brexit’) would be. The EU began doing this in January 2018, through a series of ‘Brexit preparedness notices’. The UK issued its equivalents in August.

Here we focus on the UK notices, with reference to their EU counterparts, considering their implications for the health sector.

Overall, the UK’s notices attempt to pursue two conflicting functions. This leads to a pervading sense of contradiction. On the one hand, they aim to assure and provide certainty. Simultaneously, however, they set out to paint a sufficiently bleak picture to seek to deter negotiators from such an outcome.

Indeed, contrary to the idea propagated by some ministers that defaulting to WTO rules would be favourable, each notice begins with a statement that the statements merely represent a responsible government prudently preparing for all eventualities in the context of otherwise promising negotiations.

The Secretary of State for Health and Social Care has taken this one step further by advising that the work already done gives a clear basis for the health sector “to plan so that patients can continue to receive high-quality care unhindered.”

Said planned actions outlined within the respective notices include:

-       Stockpiling a six-week supply of medicines to allow for delays as a result of e.g. border controls.

-       Setting up new national systems - e.g. a national portal to which regulatory information about human medicines and devices can be submitted directly.

-       Increasing the role of the Medicines and Healthcare products Regulatory Agency (MHRA), including in areas such as batch testing medicines and approval of paediatric and orphan medicines. This is to account for the cessation of European Medicine Agency (EMA) membership. Its details of this are to be subject to an autumn consultation.

These actions attempt to counter the systemic and regulatory black holes that would result from what the EU has described as a ‘cliff-edge scenario’.

Regulatory alignment - the solution in the EU (Withdrawal) Act 2018 - does not remove the need for contingency planning. For example, despite the UK’s plan to retain regulations on blood and blood product standards, to import into the UK, it will be necessary to show compliance with UK standards, which are to be a continuation of EU standards. But the systems by which such compliance is shown involve cooperation and mutual recognition, not unilateral behaviour.  Similarly, the UK government’s intentions to align with the 2019 Clinical Trials Regulation ‘wherever possible’ when it comes into force post-Brexit Day won’t prevent the UK’s exclusion from the new EU clinical trials database. (Indeed, the EU has advised that efforts have already begun to remove the UK from several existing databases once it exits the EU.) Every example where there are elements of reciprocity in EU-UK relations is similar. UK patients will be excluded from the EHIC scheme. The system of sharing information about medical professionals won’t apply any more, so the UK won’t be notified of concerns about EU-27 doctors working in the UK.

On a no-deal Brexit, the UK will be immediately excluded from EU decision-making processes. The UK will no longer be represented at committees which decide on safety of certain medical devices (including cardiac pacemakers and breast implants). It has already been excluded from some EMA processes, on the basis that the person chairing the EMA committee has to be present for the whole period of decision-making, and that’s not the case for the MHRA.

One of the EU’s strengths is in its collective decision-making powers, used to devise common regulations. Of course, no regulatory system is perfect, but on leaving the EU, the UK loses many of the trade-improving, burden-easing, and practice-refining benefits that come with economies of scale.

And, for the health sector, there are no clear counter-advantages. The EU regulations are a product of the member states’ views; the UK’s voice has been heard and expert research has been considered to create them. Thus, as highlighted by the UK’s notices, there is no clear motivation to do anything other than copy and paste them. But, as the EU has stated unambiguously, the UK’s fundamental change in status to a third country means that this will by no means equate to continuity.

Barnard & Peers: chapter 27, chapter 21

Photo credit: Royal College of Nursing

Analysis of the ECtHR judgment in Big Brother Watch: part 1

Lorna Woods, Professor of Internet Law, University of Essex

This chamber judgment is the latest in a line of cases that deal with secret surveillance, a topic which seems to be appearing increasingly frequently in a post-Snowden world. This judgment is substantial (over 200 pages in length) and deals with three cases challenging the UK’s now mainly repealed Regulation of Investigatory Powers Act 2000 (RIPA) as regards to interception of communications in bulk, the acquisition of communications data and the sharing of intercepted communications and communications data between the UK and the United States of America: Big Brother Watch (app no. 58170/13), Bureau of Investigative Journalism and Alice Ross (app no. 62322/14) and 10 Human Rights Organisations (app. no. 24960/15).  It follows in the steps of the Liberty case (app no. 58243/00) against the previous regime and, given the similarity between some aspects of RIPA and the Investigatory Powers Act 2016 (IPA), might have relevance for our understanding of that act too. In addition to questions about Article 8, the judgment also deals with the impact of surveillance on freedom of speech under Article 10 ECHR. 

This post is the first of two on the judgment. It outlines the issues and the Court’s reasoning. The second comments on the judgment. Given the size of the judgment that will be just an initial reaction to the judgment – there will, no doubt, be much more to be said.

Factual Background

The applicants in the three cases are organisations and individuals who are either journalists or are active in campaigning on civil liberties issues. Their challenges to RIPA were triggered by the information revealed by Edward Snowden which made apparent the existence of surveillance and intelligence sharing programmes operated by the intelligence services of the United States and the United Kingdom.  Specifically, they believed that the nature of their activities meant that their electronic communications and/or communications data were likely to have been intercepted or obtained by the UK intelligence services relying on the regime found in RIPA.  Three areas of problems were highlighted:

-          bulk interception of ‘external’ communications under s. 8(4), as well as connected communications data;

-          the sharing process whereby the British agencies received data collected by the US; and

-          access to communications data under Part II RIPA.

In all instances the applicants thought that the protection against abuse were insufficient and that the regimes were neither lawful nor necessary in a democratic society.

Only the applicants in the third case brought an action before the Investigatory Powers Tribunal (IPT), alleging violations of Articles 8, 10 and 14 of the Convention.  Although the IPT found two ‘technical violations’ of the Convention, in the main it regarded the challenged regime to be in accordance with the requirements of Article 8, notably the requirements set down in Weber and Saravia (app no. 54934/00).

Judgment

The first issue concerned exhaustion of domestic remedies, in particular the failure to bring a case before the IPT.  The applicants argued that in the light of the ECtHR’s own ruling in Kennedy (app no. 26839/05), the IPT would not be an effective remedy and they were therefore not obliged so to do.  The Court agreed with this assessment of its case law in general terms, but now thought that recent practice showed that the IPT now constituted a viable route for a remedy, especially given the response of the UK government to its findings. Nonetheless, the Court accepted that, at the time the applicants in the first and second of the joined cases introduced their applications, they could not be faulted for having relied on Kennedy as authority for the proposition that the IPT was not an effective remedy for a complaint about the general Convention compliance of a surveillance regime. It therefore found that there existed special circumstances absolving those applicants from the requirement that they first bring their complaints to the IPT.

The Court first considered the position under s. 8(4) RIPA and whether it met the tests of legitimate purpose, lawful and necessary in a democratic society. In doing so, it noted that there was jurisprudence in this field but that in previous jurisprudence the Court had distinguished between different types of secret surveillance, finding that there different levels of intrusion depending on the data collected, and also different rules depending on whether national security was in issue.  The Court sought to synthesise the principles, suggesting that the 6 principles established in Weber – to ensure the lawfulness of any such regime - were the starting point, though they might need to be differently applied depending on the type of surveillance. These need not be updated to take account of changes in technology.  These minima are:

-          the nature of offences which might give rise to an interception order;

-          definition of the categories of people liable to have their communications intercepted;

-          a limit on the duration of interception;

-          the procedure to be followed for examining, using and storing the data obtained;

-          the precautions to be taken when communicating the data to other parties; and

-          the circumstances in which intercepted data may or must be erased or destroyed.

In the context of national security it also recognised the gloss added by the Grand Chamber in Zakharov (app no. 47143/06) the review mechanisms and remedies should also be taken into account. The Court noted that the nature of secret surveillance was such that until an individual were to be notified about such surveillance, that individual would not be in a position to exercise their rights. In this, the safeguards against abuse assumed high importance; moreover, the role or rights to remedies was important for protection after notification.

Looking at the situation in issue, the Court started by making the general point that operating a bulk interception scheme was not in itself in violation of the Convention. Governments would have “a wide margin of appreciation” in deciding what kind of surveillance scheme was necessary to protect national security.  The operation of the system would still however need to be checked to ensure that there were sufficient safeguards against abuse.  The applicants argued that the fact that there was no requirement for prior judicial authorization was a fatal flaw in the scheme. 

The Court agreed judicial authorisation was an important safeguard, perhaps even “best practice”, but by itself it was neither necessary nor sufficient to ensure compliance with Article 8. It was unnecessary because of the ex post controls available in the British system. Looking to Zakharov, the Court recognised that a formal requirement was insufficient – the requirement there had not prevented bad practice. The Court then held that regard had to be had to the actual operation of the system of interception, including the checks and balances on the exercise of power, and the existence or absence of any evidence of actual abuse.

In assessing the scheme the Court took the law at the time of its consideration of the claims; this meant that the Court considered the matter after the impact of the Snowden leak and some of the consequent changes to practice, including revisions to relevant codes accompanying RIPA, as well as statements in Parliament (such as the clarification as to what an external communication was – it includes Google searches, tweets and Facebook posts from by users in the UK). 

The Court took the view that, as regards the first Weber requirement, the law was clear as to the circumstances in which and the conditions on which a section 8(4) warrant might be issued. There was no evidence to suggest that the Secretary of State was authorising warrants without due and proper consideration. The authorisation procedure was subject to independent oversight and the IPT had extensive jurisdiction to examine any complaint of unlawful interception. Following its analysis in Kennedy, the Court accepted that the provisions on the duration and renewal of interception warrants, the provisions relating to the storing, accessing, examining and using intercepted data, the provisions on the procedure to be followed for communicating the intercepted data to other parties and the provisions on the erasure and destruction of intercept material provided adequate safeguards against abuse.

There were some weaknesses in the system.  While in the opinion of the Court the selectors (e.g. email address) and search criteria used to narrow down the mass of information collected to that which would be read by analysts did not need to be made public or be listed in the warrant ordering interception, the choice of search criteria and selectors should be subject to independent oversight (para 387); indeed the Court expressed some concerned about the cables (‘bearers’) selected for tapping. Here the ex post review by the Interception of Communications Commissioner (now replaced under the IPA by the Investigatory Powers Commissioner) and, should an application be made to it, the IPT were held not to be ‘sufficiently robust to provide adequate guarantees against abuse’ (para 347).

The Court also expressed concern about communications data.  This is often summarised as who, where, when but this underplays the significance of the data collected.  Indeed, here the Court rejected the Government’s argument that communications data was necessarily less sensitive than the content of the communications (para 357). The Court explained the position thus:

... the content of an electronic communication might be encrypted and, even if it were decrypted, might not reveal anything of note about the sender or recipient. The related communications data, on the other hand, could reveal the identities and geographic location of the sender and recipient and the equipment through which the communication was transmitted. In bulk, the degree of intrusion is magnified, since the patterns that will emerge could be capable of painting an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with. (para 356)

In the context of s 8(4), communications data associated with the communications intercepted is also covered by the warrant but crucially some of the limitations (e.g. that the communication must be external) do not apply to this data.  The Court concluded that the unjustified lower level of protection meant that there was a violation in this regard.

The Court then considered the data sharing arrangements, the first time that the Court had been asked to consider the matter. It noted to start with the many ways in which this issue might arise.  The interference in the case had not been occasioned by the interception of communications itself but lay in the receipt of the intercepted material and subsequent storage, examination and use by the intelligence services.  It confined its judgment to the specific argument brought before it: the breach occasioned by the British services receiving American intelligence.  The applicants argued that this indirect access should be treated the same way as direct surveillance by the British services.  The Court commented that:

"[a]s with any regime which provides for the acquisition of surveillance material, the regime for the obtaining of such material from foreign Governments must be 'in accordance with the law'..., it must be proportionate to the legitimate aim pursued, and there must exist adequate and effective safeguards against abuse .… In particular, the procedures for supervising the ordering and implementation of the measures in question must be such as to keep the 'interference' to what is 'necessary in a democratic society'" (para 422).

The Court also recognised the danger of States using intelligence sharing as a means to circumvent controls (para 423).  It nonetheless accepted that the safeguards need not look identical in this context as in that of direct surveillance. Applying the principles to the facts, the Court found unanimously that there had been no violation. In particular, it accepted that the lawful requirement had been satisfied although the basis for the data sharing was an internal agreement which were disclosed only during proceedings before the IPT and subsequently incorporated into the Interception of Communications Code (para 426). The Code links the circumstances in which intelligence may be requested to the issuing of s. 8(1) or s. 8(4) warrants, thus circumscribing the circumstances in which such requests may arise and indirectly imposes supervision via sign-off by the Secretary of State and review by the ISC and the Interception of Communications Commissioner. 

The Court applied its assessment of the Code’s safeguards in relation to s. 8(4) warrants (in paras 361-363) here. Its assessment of the proportionality of information sharing was influenced by the threat of international terrorism and the global nature of terror networks necessitating information flow. In the Court’s view, ‘this “information flow” was embedded into a legislative context providing considerable safeguards against abuse’ so that ‘the resulting interference was to that which was “necessary in a democratic society”’ (para 446) and it considered that the threshold set by the Venice Commission – that the material transferred should only be able to be searched if all material requirements of a national search were fulfilled – were met (para 447). 

The next issue was the final question relating to Article 8.  It concerned Chapter II of RIPA which allows specified authorities to access communications data held by communications service providers (CSPs).  As noted, communications data is not necessarily less intrusive than content.  The Court did not however go into detail on this here, although it noted that real time surveillance is more intrusive that the transfer of records of existing data (citing Ben Faiza (app no. 31446/12)). It re-iterated that the same three criteria apply: lawfulness, legitimate aim and necessary in a democratic society.  The Court focussed on the lawfulness of the rules, referring to the position under EU law – notably Digital Rights Ireland (Case C-293/12 and C-594/12) and Watson (Case C-698/15) - which requires that any regime permitting access to data retained by CSPs was only to be for the purpose of combating “serious crime”, and that such access be subject to prior review by a court or independent administrative body. RIPA -although it provided a clear basis for action on the face of it - did not comply with this requirement and was therefore was not compliant with domestic law requirements (para 467).

A further issue arose in the Bureau of Investigative Journalism (BIJ) complaint. There, BIJ (a newsgathering organisation) and a journalist (Ross) raised the issue of interference with confidential journalistic material occasioned by the operation of both the section 8(4) and the Chapter II regimes.  While the Court has emphasised the importance of protection of journalists’ sources, its case law has distinguished between court orders for disclosure and searches carried out by the authorities to obtain this information – that latter is more intrusive. Further, the Court also distinguished between attempts to reveal sources and investigations into the commission of crimes. So the importance of source confidentiality is not an automatic trump card. The Court noted that the s. 8(4) regime was not aimed at monitoring journalists or uncovering journalistic sources.  The authorities would often only know that a journalist’s communications had been intercepted when examining the intercepted communications. Following Weber, this in itself could not be characterised as a particularly serious interference with freedom of expression. Nonetheless, where those communications were selected, the concerns would increase and safeguards would be required, especially as regards the need to protect confidentiality. In this context, concerns expressed in relation to the s. 8(4) regime ran through to Article 10 concerns. The Court emphasised that:

... there are no [public] requirements...either circumscribing the intelligence services' power to search for confidential journalistic or other material (for example, by using a journalist's email address as a selector), or requiring analysts, in selecting material for examination, to give any particular consideration to whether such material is or may be involved. (para 493)

This blanket power without any “above the water” arrangements limiting the intelligence services’ ability to search and examine such material constituted a violation of Article 10.

As regards the Chapter II regime, while there were some protections in place for journalistic sources, the Court determined that this was limited. They applied only where the purpose of the application was to determine a source. They would not apply in every case where there was a request for the communications data of a journalist, or where such collateral intrusion was likely.  Given this and the fact that access was not limited to ‘serious crime’, the Court found a violation of Article 10.

The Court rejected complaints under Article 6 as well as Article 14 combined with Articles 8 and 10 of the Convention as manifestly ill-founded.

The judgment was not unanimous. Judge Koskelo, joined by Judge Turkovic, disagreed with some points of the reasoning of the majority and particularly the appropriateness of relying on old case law in a context following a technological ‘sea change’ in which people’s lives are more thoroughly exposed to view.  Judges Pardalos and Eicke did not agree that the applicants in the first and second case should have been absolved from the requirement to exhaust domestic remedies, nor – in the light of the recent chamber judgment in Centrum For Rattvisa (app no. 35252/08) – that there had been a violation of Article 8 in relation to s. 8(4) warrants.

Barnard & Peers: chapter 9

Photo credit: Journalism, Media and Culture