Thursday, 17 June 2021

Big Brother Watch v UK: the ECtHR Grand Chamber rules on mass surveillance


 


 

Lorna Woods, Professor of Internet Law, University of Essex

 

Introduction

 

This is the Grand Chamber’s take on a challenge to the UK’s RIPA regime originally decided by a chamber (judgment 13 September 2018). It is the culmination of a long series of challenges to the UK regime, following the publication of information revealing that the UK (and other Governments) had engaged in bulk surveillance of people’s communications as well as in intelligence sharing. The judgment arose from three applications originally filed before the Strasbourg Court: Big Brother Watch and Others v. the United Kingdom (App no. 58170/13); Bureau of Investigative Journalism and Alice Ross v. the United Kingdom (App no. 62322/14); and 10 Human Rights Organisations and Others v. the United Kingdom (App no. 24960/15) (and on which I commented).  Similar questions were also in issue in Centrum för Rättvisa v. Sweden (App no. 35252/08), another Grand Chamber judgment handed down on the same day but based in a longstanding challenge to Swedish surveillance laws from 2008 which had been found by a chamber of the court not to violate Article 8 ECHR (the right to privacy). 

 

It raises questions about the extent to which such surveillance is permissible and under what conditions – and is about the extent to which the safeguards identified before digitization and which were generally applied in relation to interception of communications can apply to intelligence gathering based on data analytics, where issues of meta data are directly considered as well as concerns about the content of communications. The particular problem is that surveillance has historically been considered from the perspective of individual surveillance, where a person may be the subject of surveillance when there are reasonable grounds for suspicion. The very nature of bulk data acquisition and intelligence gathering means that there is no such suspicion.

 

As many commentators have remarked, it is the first mass electronic surveillance case to be decided against the UK after the Edward Snowden revelations and, significantly, it also considered meta data (communications data) as well as content. While the Court found the UK government to be in violation of Article 8 on some points, it is not a complete ‘win’ for privacy activists. Notably, this judgment and that in Centrum för Rättvisa, sets the conditions for bulk collection of data; in so doing, has it – as the Court of Justice of the EU apparently has following La Quadrature du Net (Case C-511/18) -accepted the possibility the principle of mass survellance, with the loss of anonymity not just online but – with smart homes, cars and cities – potentially everywhere?

 

Facts

 

The UK Government Communications Headquarters (GCHQ) was running three surveillance systems:

 

-          bulk interception of (foreign) communications (which was then winnowed down through automated means to sets of information that would be analysed by the security services);

-          intelligence sharing among the ‘Five Eyes’ (the United States, Canada, Australia, New Zealand as well as the UK), specifically in collaboration with the PRISM and Upstream programs run by the American NSA; and

-          acquisition of communications data from internet service providers.

 

The regime at that time was based on the Regulation of Investigatory Powers Act 2000 (RIPA), which has now been replaced by the Investigatory Powers Act 2016 (IPA); the Court decided matters on the basis of the law as was and not in the light of the IPA (though the IPA shares some features with the RIPA regime). In addition to statutory provisions, RIPA envisaged that codes of practice would provide more detail as to actual practice. As regards the sharing of intelligence, the Counter Terrorism Act 2008 allowed for the disclosure of information to each arm to exercise any of their functions, subject to any limitations imposed by virtue of the Data Protection Act 1998 (now itself replaced by the Data Protection Act 2018) and the Human Rights Act. The Official Secrets Act also applies.  The U.K.-U.S. Communication Intelligence Agreement governs the exchange of intelligence information relating to “foreign” communications between the UK and the US, with the code of practice containing more detail as to treatment of foreign intelligence.

 

The applications – which included journalists and human rights organisations and which might be understood to be particularly affected by the threat of surveillance -were heard together. The 10 Human Rights Organisations had started their action in the IPT; the other applicants claimed there was no effective remedy.  The Chamber decision found a violation of Article 8 and Article 10 in relation to the bulk interception regime in s 8(4) RIPA, and the regime for obtaining communications data, but found no violation as regards the information sharing.

 

 

Judgment

 

There are three aspects to the judgment regarding Article 8. The consideration  of the bulk interception (and the possibility of analysing associated communications data); the receipt of data from foreign intelligence services; and the acquisition of communications data from service providers. These also gave rise to claims under Article 10.

 

Bulk Intercept

 

The analysis of the bulk communications involves a number of stages, each one narrowing the dataset but at the same time, intensifying the level of scrutiny on that information. The Court identified the following stages (para 325):

 

-          the interception and initial retention  of communications and related communications data;

-          the application of specific ‘selectors’ (whether stong selectors – eg an email address - or complex queries);

-          the examination of the resulting selected communications and communications data and retention of data;

-          use of ‘final product’, including sharing that information.

 

While the mere holding of such information by the State in and of itself has long been held to be an intrusion into Article 8 rights, the Court portrayed the four stages as a process in which the degree of interference increases as the analysis progresses (paras 330-331). While bulk surveillance was not per se prohibited by the ECHR, the entire process must be subject to “end-to-end safeguards”.

 

The Court considered whether there was a need to develop the case law given the developments in technology.  In Weber and Saravia and Liberty & Ors the Court had applied the principles developed in relation to targeted interception – targeted interception, however, has a much narrower impact that bulk surveillance.  The Court identified a number of differences between targeted and bulk interception:

 

-          bulk interception was predominantly directed towards international communications (para 244);

-          bulk interception was predominantly aimed at intelligence gathering (rather than investigating crime) (para 345);

-          insofar as individuals were targeted, there devices were not monitored but rather ‘strong selectors’ were used to fish out their communications from the mass of communications intercepted (para 346).

 

This meant that the safeguards already in place, although they provide a useful framework, should be adapted. Specifically, rules that envisaged a particular person or group of persons would not work here – eg the  requirement  to  define  clearly  in  domestic  law  the  categories  of  people  liable  to  have  their  communications  intercepted  and  the  nature  of  offences  which  might  give  rise  to  such  an order or the requirement to have “reasonable suspicion” of the persons put under surveillance (para 348). Nonetheless, domestic law should still set out with sufficient clarity and detail the grounds upon which bulk interception might be authorised and any circumstances in which an individual’s communications might be intercepted. Supervision and review become more important (para 349). The domestic regime should ensure that an assessment of necessity and proportionality is made at each stage of the measures being taken; that bulk interception should be subject to independent authorisation at the outset, when the object and scope of the bulk operation are being defined; and that the operation at each stage should be subject to supervision and independent ex post facto review (para 350). Affected individuals should have access to an effective remedy. When assessing a regime, the Court would take into account its operation in practice including instances of actual abuse (para 360).

 

Note that the Court was not persuaded that the acquisition of related communications data through bulk interception was necessarily less intrusive than the acquisition of content. The same safeguards should therefore be used to assessed bulk collection and analysis of communications data as content.

 

The starting point for analysis is the typical three stage test (lawful, legitimate aim and necessary in a democratic society), but the Court blends the lawful and necessity questions together which it claims is established (citing Roman Zakharov – a Grand Chamber decision discussed here - and Kennedy). The Court produced a framework that was wider -in the assessment of the Court - than the six Weber criteria (para 361):

 

-          the grounds on which bulk interception may be authorised;

-          circumstances in which an individual’s communications may be intercepted;

-          the procedure for granting authorisation;

-          procedures for selecting, examining and using intercept material;

-          precautions when communicating material to other parties;

-          limits on duration of interception, storage of intercept material and circumstances in which that material must be erased/destroyed;

-          supervision by an independent authority (with powers to address non-compliance);

-          independent ex post review.

 

The Court also took the opportunity to provide more detail on data sharing. Any data shared must have been collected and stored in a Convention compliant manner. Additional safeguards relating to the transfer must be in place: the circumstances in which data are to be shared should be set out in domestic law; the receiving state should have safeguards in place capable of preventing abuse, including secure storage and restriction on onward disclosure. Heightened safeguards are required as regards material requiring special confidentiality (eg journalistic material). In principle the same tests apply to communications data, which it viewed as no less intrusive as content, though the safeguards need not be exactly the same given the different way content and communications data were likely to be analysed.

 

The UK regime did not provide sufficient “end to end” safeguards. In assessing the safeguards, the Court took into account the breadth of the grounds on which surveillance could take place; the UK’s rules ‘were formulated in relatively broad terms’ (para 371). The Court specifically focussed on the absence of independent authorisation, the failure to include the categories of selectors in the application for a warrant (which had implications for the necessity assessment), and the failure to subject selectors linked to an individual to prior internal authorisation both as regards content but also related communications data. Although the Court assessed the oversight provided by the Commissioner and the IPT as effective and robust respectively, these did not compensate for the shortcomings.

 

Note that in the parallel Swedish case, the Court applied a similar framework to find that the Swedish regime was also deficient. So, it found ‘the absence of a clear rule on destroying intercepted material which does not contain personal data, the absence of a requirement in the Signals Intelligence Act or other relevant legislation that, when making a decision to transmit intelligence material to foreign partners, consideration is given to the privacy interests of individuals; and the absence of an effective ex post facto review’ (Centrum för Rättvisa, para 369).

 

The complaint under Article 10 was considered separately, with the Court’s starting point being the importance of journalism. It emphasised the detrimental impact of compelled source disclosure, as well as the more serious intrusion of searching of journalists’ homes and workplaces. Safeguards must ‘be attended with the right to protection of journalistic sources must be attended with legal procedural safeguards commensurate with the importance of the principle at stake’, referring back to its decision in Sanoma Uitgevers (para 444). Crucially, independent review must take place prior to disclosure. In the older case of Weber, the interference with the journalist’s expression rights had not been seen as particularly serious; the journalists had not been targeted by the surveillance. The court determined that confidential journalistic material could have been accessed by the intelligence services either intentionally, through the deliberate use of selectors or search terms connected to a journalist or news organisation, or unintentionally, as a “bycatch” of the bulk interception operation. While the former category must be authorised in accordance with the approach in Sanoma Uitgevers, for the latter category because interference with journalistic material was not intended, it could not be predicted and therefore ex ante authorisation would not be possible.

 

The Court noted the technological developments since Weber, finding that the intrusion now would be more significant than at the time of Weber. Robust safeguards are therefore required so that when it becomes apparent that confidential journalistic material is in issue, that material could only continue to be stored and examined by an analyst if authorised by a judge or other independent and impartial decision‑making body with the power to determine whether its continued storage and examination was “justified by an overriding requirement in the public interest” (para 450). In both aspects, despite specific provisions in the relevant code of practice, the UK regime was deficient.

 

Data-sharing

 

The complaint was considered from the perspective of solicited intercept material from the NSA. The applicants did not challenge the Chamber’s decision as regards the effectiveness of the IPT. Avoiding questions about Article 1 ECHR and the issue of a State’s jurisdiction, the Court focused on the initial request and subsequent receipt of intercept material, together with any subsequent use thereof. The Court noted the risk of States seeking to circumvent controls; there must be a clear basis in domestic law for such requests (found in the Code), and guarantees against the risk of abuse specifically relating to examination, use and storage, any onward transmission as well as erasure/destruction.  The Grand Chamber found that, since the treatment of foreign intelligence was essentially the same as the treatment accorded to domestically generated material, the United Kingdom had in place adequate safeguards for the examination, use and storage of the content and communications data received from intelligence partners, as well as for the onward transmission of this material and for its erasure and destruction. It also noted the extra layer of protection provided by the Commissioner and the IPT. It found no violation of Article 8. The claims under Article 10 were likewise dismissed.

 

Communications Data

 

The Chamber’s finding that a regime which suffers the same flaws as a regime accepted to be incompatible with EU law, then having priority over domestic law, must also fail the in accordance with the law test was not challenged as regards Article 8. The Grand Chamber also agreed with this reasoning. An Article 10 challenged had also been brought against the regime. This was also considered not to be in accordance with the law; again the Grand Chamber followed this reasoning to find a violation of Article 10.

 

Dissent

 

While the findings of violation were unanimous, the Court was not unanimous as regards to the finding of no violation being split by 12 votes to 5. Three judges shared a partly concurring opinion; judge Pinto De Albuquerque wrote a partly concurring but partly dissenting opinion and  Judges Lemmens, Vehabovic, Ranzoni and Bosnjak produced a partly dissenting opinion.

 

Comment

 

Most of the commentary has focussed understandably on the fact that the Court did not state that the bulk interception of communications was in itself contrary to Article 8 and on the safeguards.  These are – obviously – important points, but there is a prior issue regarding the lawfulness test, which relates to the complexity and availability of domestic law. The Grand Chamber followed the Chamber in accepting that the Codes of Practice satisfied this requirement. While Codes are now public documents, this assessment does not fully take into account that for a considerable period much now in those codes were “below the waterline” and information was only forthcoming as a result of litigation.

 

Another question is the extent to which the judgment takes into the impact of digitalization. The Chamber judgment has suggested the different rules applied in different contexts, and that not all data would have the same impact. The Grand Chamber recognised that some updating of the analytical framework from Weber would be required (which turns out to be both a good and bad thing), and specifically notes the impact of meta data (probably a good thing).  It is open at least to argument to state however that the negative consequences of the revision of Weber outweighed the good.

 

Looking at the good, it is indubitably true that some recognition of the change in techniques of state surveillance facilitated by changes in technology and computing power is an important prerequisite for ensuring effective protection of individuals’ rights.  There is some way to go however before we can state confidently that the Court has appreciated the ramifications of the digitalisation of life and particularly data profiling. The key positive is that the Court does not think that meta data is less sensitive than content (para 363). It emphasises that

 

any intrusion occasioned by the acquisition of related communications data will be magnified when they are obtained in bulk, since they are now capable of being analysed and interrogated so as to paint an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communications patterns, and insight into who a person interacted with (para 342)

In this, the Court joins the Court of Justice (see eg. Tele2/Watson, para 99).  While the Court goes someway to recognise the always-on aspect of digital surveillance (para 341), and certainly does not go down the route of the Chamber in suggesting some data are less impactful than others, it does not acknowledge the possibility of combining communications data with data from other sources. The range of data available is wide, especially given the range of smart devices. These include for example, biometric data from fitness trackers, biometric based systems proposed for cars note the driver’s blood pressure, heart rate and other vital to detect, if the driver is impaired in any way. At home detail from smart energy meters could be shared. Nor does it question the basis on which those analyses and interrogations take place. While in its safeguards it does suggest oversight over the circumstances in which data are chosen, it seems to take the tools as given.  This is worrying given the emphasis that has previously been placed on the need for special safeguards in related to automated tools and processing techniques, a point the Court of Justice of the EU has also made (e.g Digital Rights Ireland, para 55).

 

While the emphasis on the significance of meta data is good, it should not be forgotten that the first part of the case concerned bulk interception – so interference with content. Against this context, the Court’s assessment that the first stage of the surveillance process – the data gathering stage – does not constitute a particularly serious interference is worrying (and arguably not in line with previous case law). It certainly underplays the threat to privacy that is implicit in the acquiring and holding of data (and Judges Lemmens, Vehabovic and Bosnjak discuss this in their concurring opinion, paras  3-8).  A further question arises in relation to other forms of surveillance; what if smart city devices (eg lampposts) can record our conversations as we pass by (UK installation of microphones have apparently not been for this purpose but to detect aggression). How comfortable are we about data acquisition then? This reasoning may be the top of the slippery slope. 

 

Within the EU context it should be remembered that the Court of Justice has repeatedly emphasised that “access on a generalised basis to the content of electronic communications” undermined the essence of the relevant EU Charter right (article 7) and could not be therefore be justified (see e.g. Schrems I, para 94). This then suggests a difference in approach between the two European courts. It would be unfortunate if the recognition of the impact of meta data led to a lowering of standards as regards content. 

 

The more problematic development is the approach to reasonable suspicion. The Court acknowledges that these surveillance practices do something different from other more traditional forms of surveillance, which tend to be reactive (ie somebody has done something bad) and more focussed (as opposed to diffuse), most likely based on existing evidence which suggests suspicion of specific individuals. This mass surveillance is about intelligence gathering, and about predicting – thus severing the link between an individual’s choices and actions and the likelihood of that person being the subject of surveillance. Rather than assess the surveillance by reference to existing standards – for example, the presumption of innocence and the impact of a State carrying out surveillance (which is recognised through the case law on the mere storing of data), the Court abandons these standards as part of its updating in order to fit round state choices. In so doing, it gives some legitimacy to the idea that the State may carry out surveillance on individuals without any grounds related to that person (para 317, 348).

 

This is based on the Court’s deference to the State’s assessment that these are necessary for national security reasons – though this assessment is not really critically examined. Indeed, when it re-emphasised that the choice of adopting certain surveillance techniques fell to the States, it emphasised the valuable nature of the technique (para 386, emphasis added). Judge Pinto De Albuquerque writes critically of the Court’s “self-imposed evidential and adjudicatory limitation” which “leads the Court to assume the inevitability of bulk interception and, even more so, that of a blanket, non-targeted, suspicion-less interception regime (Opinion, para 5). He also points to the fact that previous cases – including Zakharov – have involved bulk intercept of communications and yet still sought to apply the first two Weber criteria that the Court here has abandoned.

 

 

While of course a State may be free to make these choices about approaches to surveillance in principle they should be assessed to ensure that they are lawful and necessary in a democratic society.  The test of lawfulness and the proportionality test implied in the ‘necessary in a democratic society’ actually ask different questions – but blending them together, as the Court has done here, dilutes the protective nature of the proportionality test. Rather than ask whether this is disproportionate and should not be done, the question becomes how to put oversight in place, which accepts the fact of the interference with the right in the first place. This criticism has been levelled at the Court’s approach before; the Court here (in referring to Zakharov and Kennedy to justify this approach) implies that this blurring of the three part test is both well-established and non-problematic. The Court has in some previous cases suggested that a test of “strict necessity” should be used for mass surveillance (Szabo and Vissy v. Hungary, para 73) – that sort of reasoning is not evident here.

 

As regards the safeguards themselves, it is unclear which grounds justify bulk surveillance (and contrast the position here with the EU position). It should be noted that that prior judicial authorisation is not a prerequisite for such surveillance, even if it might be best practice (para 320). The Court cites authorities to suggest that ex post oversight compensates for lack of ex ante control; this is like saying it is all right to drop an egg on the floor provided you have bucket and mop to clean up afterwards. The end result is not the same (and Judges Lemmens, Vehabovic and Bosnjak remind the Court of the significant harms that may eventuate from a lack of protection in their partly concurring opinion). Significantly, it seems that despite calling these various safeguards fundamental, a global assessment may be made, suggesting that some regimes may be weaker on some issues (perhaps not deal with them at all?) than others (para 370).

 

The approach to the sharing of data is also worrying. On the one hand, the Court recognises the threat posed by intelligence sharing, and the risk that safeguards may be circumvented. Yet, it seems to imply that a lesser standard of safeguards is acceptable in this context, and in so doing accepts the practice as well as the lower standards applicable (contrast viewpoint of Judge Koskelo joined by Judge Turković in the chamber judgment).  It should be noted that the Court only considers one aspect of intelligence sharing – the receipt by the UK security and intelligence services of information. The issue of proportionality is dealt with relatively briefly. Notably, the Court states that the requirement for safeguards:

 

“... does not necessarily mean that the receiving State must have comparable protection to that of the transferring State; nor does it necessarily require that an assurance is given prior to every transfer” (para 362).

 

How oversight is supposed to function against what seems to be a highly flexible framework is uncertain. It is also questionable whether or to what extent this fits with the EU’s approach – admittedly relating to the export rather than as here import of data – under the GDPR and Articles 7 and 8 of the Charter.  Judges Lemmens, Vehabovic, Ranzoni and Bosnjak suggested that the same “end-to-end” safeguards should apply here.

 

In sum, the outcome of this case while certainly restraining some of the potential excesses of the RIPA regime (and possibly therefore its younger sibling, IPA), it is by no means an unqualified victory for privacy activists.

 


Photo credit: Adrian Drycuk, via Wikimedia Commons







Wednesday, 16 June 2021

Who has jurisdiction over Facebook Ireland? The CJEU rules on the GDPR 'one stop shop'

 



 

Lorna Woods, Professor of Internet Law, University of Essex

 

Introduction

 

This recent CJEU judgment concerns the one stop shop in the GDPR and the way that very large corporations that have operations in most if not all Member States are regulated.  Facebook has its European headquarters in Ireland so that the Irish Data Protection Commissioner (DPC) is ‘lead authority’ – that is, the DPC has primary responsibility for regulating Facebook under the GDPR.  There have been some concerns about how this one stop shop has been working, especially since some of the larger companies have tended to establish themselves in the same, small Member State. The one stop shop mechanism relies on trust between the Member States, but different Member States have varying degrees of enthusiasm for the enforcement of data protection and also have different levels of money to throw at the issue. As is the case with other one-stop shop mechanisms in other legislation, there are exceptions or ways for other affected regulators to be involved. This case is about the space left to those other regulators.

 

Facts

 

In 2015 the Belgian Privacy Commissioner (subsequently the Data Protection Authority) sought an injunction in the Belgian courts against Facebook Belgium with the objective of ending alleged infringements of data protection laws by Facebook through the collection and use of information on the browsing behaviour of Belgian internet users, whether or not  they  were  Facebook  account  holders,  by  means  of  various  technologies,  such  as  cookies, plug-ins (like or share buttons) or pixels. The matter ended up in the Hof van beroep te Brussel (an appeal court) which was uncertain as to the effect of the one stop shop in the GDPR on the competence to the Belgian Data Protection Authority to bring action against Facebook Belgium. So while Article 55(1) GDPR establishes the principle that each national regulatory authority is competent to carry out its role as regards its own national territory, Article 56(1) states:

 

the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor.

 

Judgment

 

The central question concerned the circumstances in which, given the one stop shop established by Article 56(1) GDPR, a supervisory authority could take action in relation to specific instances of processing. In this, the Court emphasised two underpinning considerations: that the high level of data protection applied across the EU; and that the one stop shop depended on the process for cooperation laid down in Article 60.

 

While Article 60 envisages that it is the responsibility of the lead authority to adopt decisions in relation to cross-border processing, and that position is the general rule, there are exceptions found in Articles 56(2) (matter only affecting its own territory) and Article 66 (urgency procedure). The Court noted, however, that the exercise of these provisions “must be compatible with the need for sincere and effective cooperation with the lead supervisory authority” as set [para 60] – but this obligation applies also to the lead authority - so that it cannot eschew dialogue with those other authorities [para 63]. Specifically, any  relevant  and  reasoned  objection  made  by  one  of  the  other  supervisory  authorities has the effect of blocking, at least temporarily, the adoption of the draft decision of the lead supervisory authority.

 

In terms of the protection of fundamental rights, the Court noted this allocation of responsibilities is compatible with the Charter. It noted that:

 

the use of the ‘one-stop shop’ mechanism cannot under any circumstances have the consequence that a national supervisory authority, in particular the lead supervisory authority, does not assume the responsibility incumbent on it under Regulation 2016/679 to contribute to providing effective protection of natural persons from infringements of their fundamental rights as recalled in the preceding paragraph of the present judgment, as otherwise that consequence might encourage the practice of forum shopping, particularly by data controllers, designed to circumvent those fundamental rights and the practical application of the provisions of that regulation that give effect to those rights [para 68].

 

The Court noted that legal action by a regulatory authority could not be completely excluded- for example when the lead supervisory authority has not responded to a request for information (see Article 61(8) GDPR), where there is an urgent need for the adoption of final measures (Article 66(2) GDPR), or where the matter is referred for consideration by the European Data Protection Board (EDPB) (Article 64(2) GDPR). In this instance, the Belgian DPA asked the DPC to respond to its request for mutual assistance as expeditiously as possible, but no response was given.

 

The Court also addressed the question of whether the data controller must have a ‘main establishment’ in the territory of that other regulator, concluding that there was no such prerequisite [para 84]. A third question asked whether the non-lead supervisory would be limited as to which body to sue – that is, whether it can take action against the main establishment of the controller or against the establishment that is located in its own Member State. In the national proceedings in this case, the litigation was brought against Facebook Belgium although the headquarters of the Facebook group is situated in Ireland and Facebook Ireland is the sole controller with respect to the collection and processing of personal data throughout the European Union. Facebook Belgium was set up to sell advertising in Belgium but also to lobby the EU institutions. The Court determined that the non-lead regulatory authority may take action with respect to the main establishment of the controller located in that authority’s own Member State but also with respect to another establishment of that controller, provided that the object of the legal proceedings is data processing  carried out in the context of the activities of that establishment and that that authority is competent to exercise that power [para 96].

 

A fourth question addressed the impact of the change in regime from the Data Protection Directive (which did not have a one stop shop) and the GDPR. The Court distinguished between actions brought before the date the GDPR became applicable and actions after that date. As regards the first situation, such legal action may be continued (on the basis of the Directive); for other actions the GDPR rules apply – and this allows such a regulatory authority to take action where one of the exceptions applies.

 

The Court held that Article 58(5) GDPR (on the power of data protection authorities to bring legal proceedings) has direct effect, so that the relevant authorities may rely on the provision even when it has not been specifically implemented in the national legal system.

 

Comment

 

This seems to be a balanced judgment in which the Court aims to reconcile competing pressures.  It has re-emphasised the one stop shop, but is aware of the unevenness of resources and alive to the risk of forum shopping against that background.  One of the key elements of this judgment is the Court’s emphasis on the obligation to cooperate, which applies to lead authority and other authorities alike. Nonetheless, while the lead regulator must be given the chance to act, lead regulators cannot choose to ignore the importunate demands of other national regulators – whether for lack of resources, or other reasons (eg a different assessment as to what’s important).  The significance of this comes down to the concerns about the effectiveness of the DPC (especially bearing in mind the size of the companies under the DPC’s jurisdiction).  Against this background, the judgment will probably be welcomed by privacy advocates. Whether it is equally good from the perspective of data controllers, at least those based in Ireland, seems far less likely. What is potentially problematic from the perspective of the data controller is the greater unpredictability of the data protection regime. This may be less about fragmenting standards (especially if the decision is referred to the EDPB) but about where enforcement actions may start; this agenda may not rest entirely in the hands of the lead authority.

 

Photo credit: Niamfrifruli, via Wikimedia Commons

Saturday, 5 June 2021

Discriminating against families: Italian family benefits before the ECJ

 



 

Virginia Passalacqua, post-doctoral researcher in EU law, Utrecht University

 

In Italy, if you are a multimillionaire and you just had a baby, the State gives you 960 euros. However, if you are, say, the non-EU domestic employee of such a millionaire and you also just had a baby, the State gives you zero.

How is this possible? Thanks to Italian legislation that for 20 years has discriminated systematically against foreign families. No wonder, these families are also poorer compared to Italian ones: 25% of them were in absolute poverty in 2020, against 6% of Italian ones.

In July 2020, the issue of discriminatory criteria for access to family benefits arrived before the ECJ, thanks to a reference by the Italian Constitutional Court (ICC), currently pending (O.D. and others, C-350/20).

This is the fourth time that the ECJ is asked to assess Italian discriminatory criteria to access family benefits (after Martinez Silva, VR, and WS). But this time, the ECJ is called to interpret a new legal parameter: Art. 34.2 of the Charter of Fundamental Rights of the EU (the Charter). Can this be a game-changer?

The relevance of Art. 34.2 of the Charter has been questioned by commentators: admittedly, secondary norms are sufficient to declare the Italian law incompatible with EU law. Yet, it is argued that the ECJ should not miss this opportunity to clarify that migrants’ equal access to benefits is a fundamental right in the EU, providing guidance both to the Italian top Court and to the lawmaker.

 

The dispute before the ICC and the preliminary question

 

The facts of the case are rather simple. O.D. and seven other TCNs applied for family benefits, either assegno di maternità or bonus bebè, alias maternity and childbirth allowance.

The maternity allowance exists since 2001 and is granted to low-income women that do not receive a job-related maternity allowance. Instead, the childbirth allowance was introduced in 2014 to support families with a newborn. This was originally granted only to low-income families, but a 2019 amendment made all families eligible; still, the amount of the allowance varies according to their income (from 960 to 1920 euros p/y).

The Italian National Institute for Social Security (INPS) refused to grant O.D. and others the maternity and childbirth allowances because only Italian nationals, EU citizens, and TCN long-term residents are eligible under Italian law. Instead, the applicants are single permit holders: legally residing TCN workers whose status is regulated by the Single Permit Directive 2011/98/EU.

O.D and others challenged such refusal on the grounds that it entailed discrimination and was contrary to EU law. Indeed, Art. 12 of the Single Permit Directive imposes to Member States to grant single-permit holders equal treatment with nationals in several areas, including “branches of social security, as defined in Regulation (EC) No 883/2004”. They argued that the two allowances must be considered as social security and that they are equally entitled to them.

The applicants, supported by ASGI - a pro-migrant association, won all the proceedings against INPS before first and second-instance courts, until they reached the Italian Supreme Court. This decided to refer their cases to the ICC for a constitutionality assessment, which, in turn, decided to make a preliminary reference to the ECJ, under the consideration that this is an area “marked by the growing influence of EU law”.

The preliminary reference asks whether the childbirth and maternity allowances can be considered as branches of social security under Regulation 883/2004 so that they would fall in the scope of application of Art.12 Directive 2011/98 and Art. 34.2 of the Charter, which grants equal treatment to any legally resident person in matters of social security and social advantage.

I will tackle these issues in order.

 

Are the maternity and childbirth allowances to be considered as social security under Regulation 883/2004?

 

Arguably, EU law and case law leave little space for interpretation on this question. The ECJ has consistently held that to understand whether a benefit falls within the scope of Regulation 883/2004 we need to look at its “constituent elements”, i.e. “its purpose and the conditions for its grant, and not on whether it is classified as a social security benefit by national legislation” (UB C-447/18, at 22).

First, the benefit’s purpose must be related to one of the risks listed in Art. 3 of Regulation 883/2004, among which appear “maternity and equivalent paternity benefits” and “family benefits”, defined as “all benefits in kind or in cash intended to meet family expenses” (Art. 1).

Second, the benefit must be granted automatically on the basis of objective criteria, without any individual or discretionary evaluation of personal needs (Martinez Silva, at 22).

Both maternity and childbirth allowances are granted on the basis of objective criteria (i.e. income and the birth of a new child) and give economic support to families. They perfectly match the ECJ definition of social security, and this is why all first and second-instance Italian courts upheld the applicants’ view and granted them equal access to the allowances as required by Art. 12 of the Single Permit Directive.

INPS and the Italian government, however, advanced an exception in respect to the childbirth allowance. They argued that its goal is to incentivizing birthrate, rather than meeting family expenses; this would be confirmed by the fact that (from 2019) the childbirth allowance is a universal benefit, granted to all families and not only to low-income ones.

But this point too had already been addressed by the ECJ, in the case law on free movement of workers. In Reina, the Court assessed whether a German measure (“childbirth loan”) could be legitimately reserved to German nationals on the grounds that it was aimed “to make up the relative deficit in births among the German population in relation to the foreign population”.

Unsurprisingly, this chauvinistic argument did not convince the ECJ. The Court stated that the sole fact that a social measure pursues a demographic aim is not enough to exclude it from the scope of application of EU law and that social security and advantages must be granted equally to EU migrants (Reina at par 15; Commission v. Greece, C-185/96, at 34). Ironically enough, in the case of Reina the discriminated family was of Italian nationality.

 

Art. 34.2 of the Charter: a hollow hope or an added value?

 

As mentioned, the Italian Constitutional Court’s decision to invoke Art. 34.2 of the Charter was met with skepticism by commentators, who deemed it superfluous and of questionable relevance (Giubboni, 2021). This is because, as previously shown, secondary law is sufficient to declare unlawful the exclusion of single permit holders from the beneficiaries of the two allowances. So, does the Charter lack any added value?

Upon a closer look, the answer is no. Art. 34.2 of the Charter states:

Everyone residing and moving legally within the European Union is entitled to social security benefits and social advantages in accordance with Union law and national laws and practices.

This provision does present at least three important advantages. First, it refers to both social security and social advantages, while Art. 12 of the Single Permit Directive refers only to social security. Second, it grants equal treatment to all migrants residing legally, without making distinctions based on status. Third, it confers to the migrants’ right to equality a fundamental status in the EU.

The concreteness of the first two advantages is tempered by their limited scope of application (the Charter applies to Member States only when they implement EU law) and by their being subject to limitations under EU and national law. Instead, the third advantage, abstract as it is, is more significant.

In a context where even the European Social Charter grants migrants only limited access to social benefits (see Art. 19), the broad scope of Art. 34.2 sounds revolutionary. This confirms that, despite the (often valid) criticisms against the restrictive EU migration policy, fighting discrimination against migrants is a hallmark of the EU.

Indeed, the ECJ has fought discrimination against (EU and TCN) migrants for decades, pioneering the idea that equality is a necessary precondition for inclusion and integration (Kamberaj, at 90).

The case of O.D. and Others offers the ECJ the opportunity to clarify the fundamental nature of the principle of equal access to benefits for TCN migrants, which so far has been relegated to an ‘ordinary legislative function’ (Muir, 2020, at 121). This would pursue not only a rhetorical function, but it would provide guidance amidst a very confusing “polycentric” adjudication practice (Kilpatrick, 2014).

Especially in Italy, national courts have suffered from a lack of uniform interpretation when adjudicating migrants’ equal treatment (also because of the ‘dual preliminarity’ controversy, Lazzerini 2020). And the ICC denounced this situation in its reference: “The sheer number of pending disputes is testament to the serious uncertainty concerning the meaning to be ascribed to EU law.”

Moreover, Italian norms in many parts contain discriminatory provisions against migrants, and a current proposal to reform family benefits features again discriminatory selection criteria, despite a pending Commission infringement on the matter.

The ECJ evaded its obligation to interpret Art. 34.2 once (in the case of UB, C-447/18). This time, it should state clearly that migrants’ equal access to benefits is a fundamental principle of the Union, sending a powerful message to the Italian Constitutional Court and the Italian lawmaker.

 

Conclusion

 

The preliminary reference in the case of O.D. and Others speaks of an alarming phenomenon. In Italy, TCN families in need have been denied equal access to social benefits for decades, and the childbirth allowance reached a low point in this respect: it is universally granted to all but to TCN migrants.

Against this background, the preliminary reference in the case of O.D. and Others offers an important opportunity. The ECJ has a long tradition of fighting discrimination and constitutionalizing equality. In the case of O.D. and Others, its ruling can acquire erga omnes effect thanks to the follow-up ICC judgment.

The EU Court should not miss this opportunity for stating out and loud that equality is a fundamental principle of the EU also when it comes to TCN migrants, which cannot be disposed of by the erratic will of the government of the day.

 

Barnard & Peers: chapter 26

JHA4: chapter I:6

Photo Credit: Guiseppe Milo, via Wikimedia Commons

Friday, 4 June 2021

But What’s Detention After All? Strasbourg, Luxembourg and the Hungarian Transit Zones



 


Victor Davio,* PhD Researcher at the Institute for European Law, KU Leuven and Assistant in Constitutional Law at University Saint-Louis Brussels

That Europe has gone from one crisis to another over the past decade has become almost self-evident. Since the economic and financial crisis of 2008-2010, the European continent has been shaken not only by an identity crisis through the British departure, but also by a rule of law crisis and an unprecedented sanitary crisis. Most of these crises have called for drastic measures on the part of governments to address these unexpected situations, frequently putting fundamental rights under severe strain.

The migration crisis is a case in point. In response to the influx of asylum-seekers into Europe in the mid-2010s, the EU institutions and the Member States introduced highly questionable measures. If the EU-Turkey deal might be a telling example, another that has recently been in the spotlight is that of the so-called ‘transit zones’ in Hungary. In the last two years, the European Court of Human Rights (‘ECtHR’) and the Court of Justice of the European Union (‘CJEU’) have rendered several groundbreaking judgments on this issue.

At first glance, it is perhaps not surprising that both courts have had to deal with this highly sensitive question. Depicted as a crowded house, the European fundamental rights architecture is characterised by the coexistence of several layers of norms and institutions that protect fundamental rights. In recent years, EU law has become a prominent source of fundamental rights. Since 2000 for instance, the EU has its own Bill of Rights, the Charter of Fundamental Rights (‘Charter’). This has inevitably led to an intensification of fundamental rights litigation before the EU courts and an ever-growing overlap with Strasbourg. 

More striking in the judicial saga surrounding the Hungarian transit zones is that, for once, the EU legal order seems to offer a higher level of protection of fundamental rights than the ECHR system. As will be discussed below, this appears to be the case in particular with regard to the concept of detention, a major component of the right to security and liberty protected by Article 5 of the ECHR and Article 6 of the Charter. This may seem somewhat unexpected. Traditionally, the EU legal order has lagged behind the ECHR system as regards the protection of fundamental rights and has often sought to accommodate its specificities, such as the principle of mutual trust.

The aim of this short contribution is twofold. Firstly, I will highlight the differences in the interpretation of the concept of detention between Strasbourg and Luxembourg in their case-law on the Hungarian transit zones. Secondly, I will take this judicial saga as an invitation to reflect on the interactions between the ECHR and the EU in light of the growing role of the latter in the field of fundamental rights.

The Start of the Journey: From Hungary to Strasbourg

Our legal journey starts in Hungary in 2015. Amidst the rise of asylum applications in Europe, Hungary adopted a series of measures to limit drastically migrants’ access to its territory. One of these measures consisted of the establishment of transit zones. Located on the southern border between Hungary and Serbia, these no-man’s-lands were not only the place where asylum-seekers had to apply for asylum but also where they were accommodated during their asylum application. The living conditions in these areas were spartan, to say the least. The largest transit zone, Röszke, was reported to be ‘a compound with mobile containers and a narrow open-air area surrounded by approximately four-metre high fencing with barbed wire on the top. The entire zone was guarded by police officers and armed security guards.’ (ECtHR(GC) Ilias and Ahmed, §15)

It was not long before the legality of stay in these transit zones was contested before the ECtHR in the Ilias and Ahmed v. Hungary case. Ilias and Ahmed, two Bangladeshi nationals, arrived in Hungary from Serbia and entered the Röszke transit zone. On the day of their arrival, their asylum requests were rejected as being inadmissible since Serbia was deemed to be a safe third country. Following an appeal against these decisions, they spent 23 days in the transit zone while the procedure was underway. The rejections were upheld on appeal and the applicants were then escorted out of the transit zone. One of the most significant legal issues was whether the stay of asylum-seekers in the transit zone was to be considered as ‘detention’ under Article 5 of the ECHR, thereby triggering a series of important procedural guarantees.

While the Chamber of the European Court of Human Rights found this to be the case, the Grand Chamber of the Court, in a landmark judgment of 21 November 2019, held that Article 5 of the ECHR was not applicable since the applicants could not be deemed in detention. To reach this conclusion, the Grand Chamber gave special emphasis to the following elements:

-          The applicants entered the Röszke transit zone of their own initiative, with the aim of seeking asylum in Hungary (ECtHR(GC) Ilias and Ahmed, §220);

-          The duration of the stay, namely 23 days, was not unreasonable for the purpose of examining the asylum applications (ECtHR(GC) Ilias and Ahmed, §226-227);

-          The applicants had a concrete and effective possibility to leave the transit zone and go to Serbia (ECtHR(GC) Ilias and Ahmed, §237).

This part of the judgment was fiercely criticised. Not only is it difficult to grasp how one may consider that migrants chose to come to Hungary or that they were free to leave, but the ruling is also hardly reconcilable with the previous case-law of Strasbourg. In particular, in its well-known Amuur v. France (1996) judgment on stay in airport transit zones, the ECtHR held that: ‘The mere fact that it is possible for asylum-seekers to leave voluntarily the country where they wish to take refuge cannot exclude a restriction on liberty, the right to leave any country, including one’s own’ (ECtHR Amuur v. France, §48).

The Bumpy Road: From Strasbourg to Luxembourg

Shortly afterwards, the legal journey resumed and arrived in Luxembourg in 2020 in the Országos case. The facts were fairly similar to those in the Ilias and Ahmed case. In late 2018 and early 2019, two Iranian and two Afghan nationals arrived in Hungary from Serbia and submitted applications for asylum from the Röszke transit zone. All four applications were rejected as inadmissible and return decisions to Serbia were adopted. However, Serbia refused the readmission of these persons, which led the Hungarian authorities to change the country of destination mentioned in the original return decisions to the country of origin of the persons. Subsequently, the four persons brought an action before a Hungarian court where they argued among other things that their stay in the Röszke transit zone constituted unlawful detention. The Hungarian court referred several preliminary questions to the CJEU, including one on the concept of detention.

In this respect, both the CJEU, sitting in Grand Chamber, and the Advocate General Pikamaë depart from the ECtHR approach in the Ilias and Ahmed case. The CJEU does so implicitly: it mentions the Strasbourg judgment (CJEU Országos, §71) but does not take into account the interpretation of Article 5 of the ECHR proposed in it. The AG is more explicit and states, for instance, that: ‘The Court can therefore leave aside the case-law of the [ECtHR] and examine the questions referred in the light of the Charter, provided its interpretation of the rights (…) leads to a higher level of protection than that guaranteed by the ECHR. I invite the Court to take that approach in the present case.’ (AG Országos, §150-151)

In a nutshell, the CJEU defines the concept of detention, both within the meaning of the Receptions Conditions Directive and the Return Directive, as a ‘coercive measure that deprives [the] applicant of his or her freedom of movement and isolates him or her from the rest of the population, by requiring him or her to remain permanently within a restricted and closed perimeter’ (CJEU Országos, §223). The obligation imposed on a third-country national to remain permanently in a transit zone with a restricted and closed perimeter, within which the movements of that national are limited and controlled, and which he or she cannot legally leave voluntarily meets this definition (CJEU Országos, §231).

 

The CJEU expressly rejects the idea that the applicants were free to leave the Röszke transit zone to go to Serbia (CJEU Országos, §228-231). In this regard, the CJEU relies on two arguments, namely that any entry of these applicants into Serbia would be considered illegal (CJEU Országos, §229), and that, if they had left Hungarian territory, they would have risked losing any chance of obtaining refugee status in Hungary (CJEU Országos, §230). This is in stark contrast to the approach of Strasbourg which acknowledges these two elements but considers them not to be decisive (ECtHR(GC) Ilias and Ahmed, §238 and §247).

The consequences of characterising the stay in the Hungarian transit zones as detention are not minor. From that moment onwards, the numerous guarantees regarding detention, provided for in particular in the above-mentioned directives, are applicable. In the Országos case, the CJEU judged, for instance, that the Receptions Conditions Directive precludes an applicant for international protection from being detained on the sole ground that he or she is unable to provide for his or her needs (CJEU Országos, §256).

The Next Journey: Back to Strasbourg?

A few days after the Országos case on 21 May 2020, Hungary decided to dismantle its transit zones. More recently, the CJEU has reiterated its reasoning on the concept of detention in the Commission v. Hungary (C-808/18) case. Taken together, the overall picture is that of a happy ending. Yet, one may be a little sceptical about this conclusion. In particular, it can be argued that significant risks may arise from the discrepancies between Strasbourg and Luxembourg case-law. Not only may these rulings create conflicting signals for national judges who are bound to apply both EU law and the ECHR, but they can also serve as a ‘false excuse’ for recalcitrant States to refuse to comply with the judicial decision unfavourable to them, arguing that they respect the other one.

While the issue of diverging fundamental rights standards is by far not new in Europe, the specific feature of the transit zones judicial saga is that EU law seems to offer a higher level of protection than the ECHR system. This phenomenon is likely to increase in the future given the proactive stance of the EU legislator in the field of fundamental rights. Although the EU does not have a general competence dedicated to fundamental rights, the EU legislator has increasingly developed fundamental rights standards in areas ranging from criminal law to data protection. The recent Whistleblower Directive is one example among many.

 

How should Strasbourg (re)act in such a situation? The most logical way might be to align itself with the CJEU case-law, which would allow for a process of mutual enrichment between the two legal orders. The ECtHR has already taken this path. For instance, in its landmark Bayatyan v. Armenia (2011) case, it referred to several instruments, including Article 9 of the Charter, to establish an emerging consensus on the right of conscientious objection to military service. Similarly, Article 49(1) of the Charter was the key factor in recognising the retroactivity of the more lenient criminal law under Article 7 of the ECHR in the Scoppola v. Italy (No. 2) (2009) case. Yet, despite its power of attraction, the incorporation of EU fundamental rights standards into the Strasbourg case-law is not an obvious process. In particular, the reception of these standards entails the risk of marginalisation of the non-EU Council of Europe States. If EU standards were to be incorporated systematically into the definition of the ECHR rights, these States would be bound by EU standards without having been able to participate in the deliberative process, which points to a clear danger of majority hegemony. This is all the more so given that the value of EU fundamental rights standards as an indicator of consensus at pan-European level is not limitless. By way of illustration, it suffices to recall that the Charter binds the EU Member States only when they are implementing Union law (Article 51(1) of the Charter).

An avenue that could be used as a way out in the event of such a conflict is Article 53 of the ECHR, which reads as follows: ‘Nothing in this Convention shall be construed as limiting or derogating from any of the human rights and fundamental freedoms which may be ensured under the laws of any High Contracting Party or under any other agreement to which it is a party.’ In light of the proliferation of EU fundamental rights standards, there is nothing to prevent national judges from considering EU law as one of the sources that can go further than the ECHR within the meaning of this provision. Although this could lead to the development of a ‘differentiated Europe’ of fundamental rights where the EU and non-EU Council of Europe States abide by different rules, relying on this provision would ensure that one of the foundational principles of the ECHR system is respected, namely the principle of subsidiarity. The latter entails not only that the Council of Europe States have the primary responsibility to guarantee the ECHR rights, but also that they enjoy a certain discretion to regulate and restrict these rights according to their national preferences. Given the high sensitivity of fundamental rights, it may sometimes be preferable for the EU and non-EU Council of Europe States to move at different speeds.

 

[*] I would like to thank Prof. Elise Muir, Cécilia Rizcallah, Gérald Fierens and Alicja Slowik for their insightful comments. This blog post is part of the RESHUFFLE research project, supported by the European Research Council (European Union’s Horizon 2020 research and innovation programme, grant agreement No 851621).

 

JHA4: chapter I:6

Barnard & Peers: chapter 26

Photo credit: Rebecca Harms, via Wikimedia Commons

Photographer: Bence Jardany