Friends with benefits: the legal elements of the reset of the EU/UK relationship

 

Professor Steve Peers, Royal Holloway University of London

Photo credit: Julian Herzog, via Wikimedia Commons

Introduction

Advocates of Quebec’s independence from Canada have long argued that their plan would not entail complete separation from Canada, but rather a fusion of independence and continuing links that they described as ‘sovereignty-association’. Conversely, opponents of Quebec separation derided this suggestion as ‘divorce with bed privileges’. Why should one party to a marriage get to walk away – but still expect sex?

On the other hand…what if sex was never the problem? What if both sides to the relationship could agree to end the marriage as a whole, yet consent to occasional mutually enjoyable booty calls? Especially if the relationship with that cute American that one of them was always fantasising about while the couple was married was not really working out as planned.

The debate about the post-Brexit UK/EU relationship has raised similar issues, albeit with less horny analogies: ‘cherry-picking’ and ‘having one’s cake and eating it’. During the initial Brexit talks, the EU indicated that it would trade off market access against the degrees of integration which the UK would accept with the EU, comparing this to models of its relationships with other non-EU countries: Barnier’s even less sexy ‘escalator’.

This explains the nature of the UK/EU relationship, as eventually devised. First of all, though, the two sides agreed a withdrawal agreement which wound down the UK’s membership of the EU, retaining some continuing alignment with EU law, especially for the bitter ex-couple’s troubled child: Northern Ireland. That entailed continued jurisdiction for the CJEU and ongoing application of the direct effect and supremacy principles of EU law, rather than the more usual UK approach to international law, keeping it separate from the national legal order.

After the divorce, though, the parties agreed a very different type of treaty: the Trade and Cooperation Agreement (TCA), which co-exists alongside the withdrawal agreement. It explicitly eschewed any link with EU law, and therefore any CJEU jurisdiction (except as regards UK participation in EU research programmes), ruling out the ‘direct effect’ principle allowing individuals to invoke the treaty in courts to obtain rights – except as regards the social security provisions.

It proclaimed itself as the single framework for the UK/EU future relationship, with all further treaties between the two regarded as supplementary. But in fact it was itself several different treaties under a trenchcoat, containing within it a number of different rules on dispute settlement as well as separate termination and suspension rules for certain parts of the treaty.

Five years later, and a different UK government, believing there are economic benefits in closer ties – but political jeopardy in very close ties – with the EU, returned to the bottom of the Barnier escalator, hoping that closer ties could be negotiated without stepping on it. Ultimately this has proved possible, with the EU and UK willing to agree a complex compromise between both a number of substantive areas of interest and as regards the integration/market access trade-off in some particular fields.

The following blog post is an overview of the legal aspects of the reset deal – both substantively and in terms of the legal nature of what the two sides have agreed in principle.

Legal Framework

The reset arrangements are set out over three documents: a joint statement on broad foreign policy issues; a security and defence partnership; and a common understanding on development of the UK/EU relationship.  None of this is legally binding as such; but some of it is legally binding-adjacent, in the sense that it is linked to legally binding texts or indicates an intention to negotiate them. While operational cooperation can be important in practice, this blog post focusses on the issues with a link to legally binding measures.

Alongside these documents, the EU and UK have also agreed (as briefly mentioned in para 3 of the common understanding) to extend the current arrangements for fisheries and energy cooperation in the TCA. More precisely, according to the Commission’s Qs and As on the reset, the EU and UK have reached a ‘political agreement’ to extend the rules on fisheries in the TCA for 12 years, and to keep extending the rules on energy in the TCA annually. (Both sets of rules had been set to expire on 30 June 2026)

They have agreed to formalise this agreement to extend those rules ‘within one month’. [Update 20 June 2025:*] In practice, this deadline was met by means of decisions of the Partnership Council set up by the TCA and other measures adopted by 19 June 2025 (the reset agreement was dated 19 May 2025). 

Security and defence partnership

As the common understanding notes (para 6), agreeing the partnership potentially enables the UK and EU to agree on defence procurement within the context of the ‘SAFE’ Regulation on defence spending, under discussion at EU level (see the proposal here). The partnership text also refers to the UK’s participation in the EU’s military mobility project (approved under the previous UK government) and possible participation in other EU crisis management operations, along with association with training and the European Defence Academy. But it mainly provides for more frequent discussions between the EU and the UK in various security and defence fields.  

Common understanding

First of all, the much-discussed prospect of a ‘youth experience’ scheme is mentioned in para 13:

13. Therefore, the European Commission and the United Kingdom should work towards a balanced youth experience scheme on terms to be mutually agreed. The scheme should facilitate the participation of young people from the European Union and the United Kingdom in various activities, such as work, studies, au-pairing, volunteering, or simply travelling, for a limited period of time. It should provide a dedicated visa path and ensure that the overall number of participants is acceptable to both sides.

On the EU side, the Commission already proposed a mandate from the Member States (ie the Council) to negotiate a treaty to this end in April 2024; this proposal is public. The Council apparently agreed in principle on a mandate in December 2024, but does not seem to have formally adopted it; this might differ from the Commission proposal somewhat but we cannot be certain, as none of the Council texts are fully public at time of writing.

Looking at what the EU and UK have mutually agreed, the mobility will be limited in time, but the extent of this is not determined yet (the Commission had proposed perhaps three or four years). It will be on the basis of a visa (as the Commission had proposed). It appears that some form of limit on numbers will exist (the Commission had rejected this).

The agreement does not refer to a number of key issues, such as: the age range concerned (the Commission proposed 18-30); whether this will be a formal treaty, as the Commission proposed (which would need to be signed and ratified; on the EU side the Member States, via the Council, would have to agree to this, plus the consent of the European Parliament for conclusion); equal treatment in tuition fees (although not student loans), as the Commission proposed; family reunion (mentioned by the Commission); or dropping the UK’s healthcare surcharge (as the Commission proposed).

It should be noted that while some claim that ‘the UK asked for this first’, the Commission’s proposal makes clear that the UK had asked some Member States bilaterally for a youth exchange treaty; the EU preferred to respond by requesting a negotiation with the entire EU. There’s an obvious difference between separate arrangements with some Member States and a treaty open to nationals of all Member States.

If agreed, this would be the EU’s first youth exchange treaty (as distinct from whatever arrangements individual Member States have negotiated), and there’s no framework in EU law for such arrangements. Conversely, the UK has several youth exchange arrangements with non-EU countries.

[update, July 16 2025: the EU adopted its negotiation mandate for this treaty in June 2025]

Para 14 of the common understanding refers to Erasmus:

14. Furthermore, the United Kingdom and the European Commission should work towards the association of the United Kingdom to the European Union Erasmus+ programme. The specific terms of this association, including mutually agreed financial terms, should be determined as part of that process in order to ensure a fair balance as regards the contributions of and benefits to the United Kingdom. The association should be in accordance with the European Union Multiannual Financial Framework and the Trade and Cooperation Agreement.

(nb other non-EU countries are linked to Erasmus already). The reference to the TCA links the UK’s participation in Erasmus to the general rules for UK participation in EU programmes set out in the TCA already; Erasmus is not listed but Article 710 of the TCA gives the joint specialist committee set up by the agreement the power to amend the list of which programmes the UK participates in. So legally the two sides will presumably adopt something similar to the texts associating the UK with the EU research programmes; and like that negotiation, the negotiations will probably focus on the amount of the UK’s contribution. (Let’s not kid ourselves that either the EU or the UK is too high-minded to haggle over money).

Incidentally, as noted already, participation in EU programmes is the one part of the TCA which currently provides for jurisdiction of the CJEU to settle disputes (see Article 728, and my discussion of dispute settlement under the TCA); this will presumably apply to Erasmus too.

Next, there is a paragraph on touring musicians et al:

15. The European Commission and the United Kingdom recognise the value of travel and cultural and artistic exchanges, including the activities of touring artists. They will continue their efforts to support travel and cultural exchange.

Effectively this says nothing – the UK’s previous government having passed up an offer, when negotiating the TCA, to agree declarations similar to those attached to the EU’s visa waiver treaties with some other non-EU countries, which clarify that artists are not required to obtain visas during short visits to EU Member States, as they are not considered to be carrying out paid work.

On the issue of the use of e-gates, the common understanding says:

16. The United Kingdom and the European Commission will continue their exchanges on smooth border management for the benefit of their citizens, including the potential use of eGates where appropriate. They note that European Union citizens can use eGates in the United Kingdom and that there will be no legal barriers to eGate use for British Nationals traveling to and from European Union Member States after the introduction of the European Union Entry/Exit System.

Again, this is not really a commitment to anything. In practice, under the current EU border rules, which make no mention of e-gates, some Member States allow UK citizens to use e-gates before getting their passports stamped. Under the EU entry-exit system, supposedly to be applied later this year (although prior deadlines have been missed), e-gates are referred to explicitly; they will be used at least on some occasions to collect entry and exit data, with passport stamping becoming the exception. (EU legislators have just agreed on amendments to the law to roll out the system more gradually)

Moving on to economic issues, the common understanding refers to a possible agreement on the UK’s link to the EU electricity market:

18. The United Kingdom and the European Commission share the view that close cooperation on electricity is in the interest of both the European Union and the United Kingdom.

19. The European Commission and the United Kingdom should explore in detail the necessary parameters for the United Kingdom's possible participation in the European Union's internal electricity market, including participation in the European Union's trading platforms in all timeframes. Meanwhile, the current electricity trading arrangements will continue to apply.

20. Regarding its territorial scope, any agreement should be appropriately articulated with the provisions of the Windsor Framework. Any agreement should be based on a balance of rights and obligations and ensure a level playing field. In this context, it should define the relationship between the United Kingdom and European Union rules on the electricity market, as well as on State aid, the promotion of renewables and the protection of the environment, in so far as they relate to the electricity sector.

21. Accordingly, any agreement should include dynamic alignment with European Union rules where relevant, giving due regard to the United Kingdom's constitutional and parliamentary procedures and respect the role of the Court of Justice of the European Union within an arbitration-based dispute resolution mechanism, and an appropriate United Kingdom contribution to decision-shaping.

This appears to contemplate a future treaty, with a broad indication of its content – although of course the details would need to be renegotiated. Although the TCA already has rules on State aid and the environment, this text appears to consider that sui generis rules will be needed, including ‘dynamic alignment’ (ie the UK aligning with current and future EU law in this field) entailing a role for the CJEU, in which arbitrators (in the event of a dispute on EU law) will ask it questions about the interpretations of EU law.

This model is not used in the TCA – as noted above, the CJEU only has jurisdiction in the current TCA in the event of disputes about UK participation in EU programmes – but it is used in the withdrawal agreement (see discussion here), and in a number of EU treaties with non-EU countries. In practice, I don’t believe that any arbitration panel under an international agreement has ever asked the CJEU questions about EU law; and in some ways this would be less far-reaching than the CJEU’s role under the withdrawal agreement, given that some parts of that agreement (the Northern Ireland protocol; the financial settlement; citizens rights) provide for some additional jurisdiction for the Court.

A role for the UK in decision-making is likely to take the form of some kind of consultation similar to treaties with Norway et al (for instance, the EEA).

The detailed outline of a possible food standards agreement raises similar issues on dispute settlement, dynamic alignment, and a UK rule in decision-making, although it is slightly differently worded on these points:

23. The European Commission and the United Kingdom share the view that a functioning sanitary and phytosanitary area would address many of the issues raised in respect of the movement of agri-food products.

24. The United Kingdom and the European Commission should work towards establishing a Common Sanitary and Phytosanitary Area by way of a European Union-United Kingdom Sanitary and Phytosanitary Agreement (hereafter ‘SPS Agreement').

25. Regarding its territorial scope, the SPS Agreement should cover the European Union and the United Kingdom in respect of Great Britain (2). This would result in the vast majority of movements of animals, animal products, plants, and plant products between Great Britain and the European Union being undertaken without the certificates or controls that are currently required by the rules within the scope of the SPS Agreement for such movements. These same benefits would be extended to the movements between Great Britain and Northern Ireland, through the interplay of the Windsor Framework and the SPS Agreement, so long as the SPS Agreement is fully implemented. The continued application of the Windsor Framework would provide for Northern Ireland maintaining its privileged unique dual access to both the European Union Single Market and the United Kingdom internal market.

26. In terms of its material scope, the SPS Agreement should cover sanitary, phytosanitary, food safety and general consumer protection rules applicable to the production, distribution and consumption of agrifood products, the regulation of live animals and pesticides, the rules on organics as well as marketing standards applicable to certain sectors or products.

27. Within the scope defined above, the SPS Agreement should ensure the application of the same rules at all times by providing for timely dynamic alignment of the rules applicable to and in the United Kingdom acting in respect of Great Britain with all the relevant European Union rules, giving due regard to the United Kingdom's constitutional and parliamentary procedures; and where necessary to ensure the European Union's level of food, sanitary, and phytosanitary safety, through the immediate application of the relevant European Union rules.

28. The United Kingdom should be able to take targeted action to protect its biosecurity and public health, in the same way as Member States under European Union law. In addition, the SPS Agreement should include a short list of limited exceptions to dynamic alignment. An exception could only be agreed if: (i) it does not lead to lower standards as compared to European Union rules, (ii) it does not negatively affect European Union animals and goods
being placed on the market in the United Kingdom in respect of Great Britain, and (iii) it respects the principle that only animals and goods compliant with European Union rules move into the European Union.

29. The SPS Agreement should be subject to a dispute resolution mechanism with an independent arbitration panel that ensures the Court of Justice of the European Union is the ultimate authority for all questions of European Union law.

30. To ensure that it can put forward its view, the United Kingdom should be involved at an early stage and contribute appropriately for a country that is not a member of the European Union to the decision-shaping process of European Union legal acts in the fields covered by the obligation to dynamically align. The European Commission should consult the Government of the United Kingdom at an early stage of policy-making. These rights would not extend to participation in the work of the Council or its preparatory bodies.

31. The United Kingdom should have appropriate access to relevant European Union agencies, systems and databases in the areas covered by the SPS Agreement.

32. The SPS Agreement should provide for an appropriate financial contribution from the United Kingdom to support the relevant costs associated with the European Union's work in this policy area.

33. The SPS Agreement should be subject to a joint governance mechanism.

There is also a difference in territorial scope, in that a food standards agreement would not apply to Northern Ireland, the Windsor Framework/Northern Ireland Protocol addressing this issue already there. A UK financial contribution is expressly mentioned.

Again, the issues of costs, dynamic alignment, dispute settlement and decision-making are addressed as part of the section on emissions trading and the carbon border adjustment mechanism:

34. The European Commission and the United Kingdom share the view that a functioning link between carbon markets would address many of the issues raised in respect of trade and a level playing field and would give effect to Article 392(6) of the Trade and Cooperation Agreement. This link should not constrain the European Union and the United Kingdom from pursuing higher environmental ambition, consistent with their international obligations.

35. Therefore, the United Kingdom and the European Commission should work towards establishing a link between carbon markets by way of a European Union-United Kingdom agreement linking the United Kingdom Emission Trading Scheme (UK ETS) and the European Union Emission Trading System (EU ETS).

36. Regarding its territorial scope, this agreement should be appropriately articulated with the provisions of the Windsor Framework.

37. The agreement to link the UK ETS and EU ETS should create the conditions for goods originating in our jurisdictions to benefit from mutual exemptions from the respective European Union and United Kingdom Carbon Border Adjustment Mechanisms subject to compliance with the relevant provisions of European Union and United Kingdom legislation.

38. In terms of material scope, the agreement should cover all aspects of the functioning of an ETS link.

39. The sectors falling in the scope of the ETS linking agreement should be clearly defined to avoid risks of carbon leakage and competitive distortions. Among others, this scope should include the sectors of electricity generation, industrial heat generation (excluding the individual heating of houses), industry, domestic and international maritime transport and domestic and international aviation. The agreement should provide for a procedure to further expand the list of sectors to be covered by the linking agreement.

40. Within that scope, the agreement should ensure the dynamic alignment of the United Kingdom with the relevant European Union rules underpinning the functioning of the ETS link, giving due regard to the United Kingdom's constitutional and parliamentary procedures.

41. The United Kingdom cap and the United Kingdom reduction pathway will be guided by the United Kingdom's Climate Change Act obligations and Nationally Determined Contributions. They should be at least as ambitious as the European Union cap and the European Union reduction pathway.

42. The agreement should provide for an appropriate financial contribution from the United Kingdom to support the relevant costs associated with the European Union's work in this policy area.

43. The agreement should be subject to a dispute resolution mechanism with an independent arbitration panel that ensures the Court of Justice of the European Union is the ultimate authority for all questions of European Union law.

44. To ensure that it can put forward its view, the United Kingdom should be involved at an early stage and contribute appropriately for a country that is not a member of the European Union to the decision-shaping process of European Union legal acts in the fields covered by the obligation to dynamically align. The European Commission should consult the United Kingdom at an early stage of policy-making. These rights would not extend to participation in the work of the Council or its preparatory bodies.

45. The agreement should be subject to a joint governance mechanism.

[update, July 16 2025: the Commission has proposed a negotiation mandate for treaties on SPS and energy policy linkage]

There is rather less ambition as regards temporary entry and stay of businesspeople:

46. The United Kingdom and the European Commission will set up dedicated dialogues on the implementation of the Trade and Cooperation Agreement, as regards entry and temporary stay of natural persons for business purposes, including the sponsorship scheme, and the recognition of professional qualifications.

As for competition law cooperation, the common understanding refers to a recently agreed treaty, which was already foreseen in the TCA:

47. The European Commission and the United Kingdom recognise the mutual benefit of cooperation in competition enforcement. In this context and in implementing the level playing field provisions of the Trade and Cooperation Agreement, the European Commission and the United Kingdom welcome the successful conclusion of negotiations for a competition cooperation agreement between the European Union and the United Kingdom.

As it happens, the Commission has since proposed the signature and conclusion of this treaty.

Moving on to justice and home affairs, the common understanding encourages more use of the provisions in the TCA. On irregular migration, a hot topic on both sides, there are five paragraphs which effectively amount to very little:

57. The European Commission and the United Kingdom underline their commitment to deepen co-operation on challenges posed by irregular migration – including action to tackle people smuggling and to deepen information sharing to control and manage migration at our respective external borders – while remaining committed to ensuring international protection for those who need it.

Upstream Migration

58. The United Kingdom and the European Commission will deepen cooperation on the external dimension of migration across key geographies, as part of a whole of route approach. They recognise the benefit of increased mutual sharing of information, country expertise and analysis enabling better coordination. They will also work more closely in multilateral fora, processes and dialogues, including the European Union's Global Alliance to Counter Migrant Smuggling, and through exploring United Kingdom participation in the Khartoum and Rabat Processes.

Working together on practical solutions and returns

59. The European Commission and the United Kingdom should work together on practical and innovative approaches to reduce irregular migration. This includes work to share best practices and operational information on key issues like returns to third countries, and to explore possible deterrence mechanisms and other innovative solutions, in line with national, European Union and international law. This would be underpinned by closer cooperation across key networks such as the European Migration Network and agencies, including the European Union Agency for Asylum and Frontex, and respective United Kingdom authorities. They should work together to prevent irregular Channel crossings.

Bolstering United Kingdom and European Union border security including through law enforcement cooperation

60. The United Kingdom and the European Commission should bolster their operational and strategic cooperation to tackle the challenges posed by irregular migration along key routes and at external borders, including through their agencies, law enforcement and judicial cooperation, and information sharing capabilities. This includes through enhanced cooperation with Europol and its European Migrant Smuggling Centre.

Addressing challenges and abuses of visa policy

61. In addition to these enhanced efforts, the European Commission and the United Kingdom will explore closer cooperation to address challenges related to visa policy such as exchanging analysis on visa abuse by third country nationals.

It’s striking that the common understanding does not even mention the previous agreement for the UK to cooperate with Frontex, the EU border agency.

Finally, the common understanding limits its territorial scope in footnotes:

(1) : Unless otherwise provided, the territorial scope of the cooperation envisaged by this Common Understanding will be in line with the scope of Article 774 of the Trade and Cooperation Agreement.

(2) : In line with Article 520(5) of the Trade and Cooperation Agreement, the territorial scope of the SPS Agreement could be extended to cover the territories referred to in Article 774(2) of the Trade and Cooperation Agreement.

Article 774 TCA provides that in principle the TCA only applies to the UK (although note the specific references to Northern Ireland in the common understanding), while Article 774(2) provides for parts of it to apply to the Channel Islands and the Isle of Man. There is no mention of Gibraltar, which is excluded from the TCA by virtue of its Article 774(3); there is equally no mention of the separate treaty on Gibraltar that the EU and UK are negotiating. The Rock that dare not speak its name.

The overall legal relationship

As noted already, the TCA announced itself as the permanent template for the UK/EU relationship. Even though it had to co-exist with the more integrationist withdrawal agreement, the withdrawal agreement was the past and the TCA was the future, boldly going to a ‘dualist’ international law model separated from substantive EU law, its principles and its courts.

But now, the reset agreement makes little reference back to the TCA, besides the extension of the fisheries and energy provisions. Will treaties on youth mobility, and on food standards and emission standards/carbon border adjustment and the electricity market, take the form of ‘supplementary agreements’ to the TCA at all? Even if they do, they will not resemble the TCA legal framework that much – given that with the treaties on food standards, emission standards/carbon border adjustment and the electricity market, the current UK government has pragmatically accepted the integration/market access trade-off (as regards dynamic alignment and the CJEU) that the previous government rejected as ideologically unacceptable (under the TCA, that is).

And the question may also be asked whether these treaties, and the youth mobility treaty, will be subject to the principle of direct effect, ie invocability by individuals in courts, given that the social security rules in the TCA are already subject to an exception on this point.

Next, to what extent will all these treaties be connected? The extensions of parts of the TCA will remain connected to that treaty (with all its internal disconnections) of course, but will the other treaties be connected to the TCA – and/or each other? Inevitably this issue arises because some UK opposition parties have pledged to terminate the treaties concerned if they are elected to government; so the conditions for their termination will be relevant. This might also be relevant to negotiating these treaties – ie the UK (or EU) can’t have its pudding until it’s eaten its dinner.

Finally, it’s notable how many Rubicons have been crossed with this reset deal. As noted already, the UK now accepts the market access/integration trade-off. But the EU now accepts agreeing this trade-off with the UK in limited fields: the UK can have one foot several steps up the Barnier escalator, but the other one firmly on the ground. The EU has also accepted a Swiss-like complex legal relationship with the UK, having opposed it in principle for years. (In fact, the EU already conceded this point when agreeing the TCA; but that treaty hid its legal complexity better than the reset deal does). The UK has accepted an agreement with the EU as regards movement of (some) EU citizens; although it might claim this arrangement will simply resemble its youth mobility treaties with many other countries, the extent of that similarity will be dependent upon the details of the final deal. Above all, the EU, having accepted freer movement of some goods and demanded the freer movement of some people, can no longer lecture the UK on cherry-picking or cake-eating – what with all the crumbs and cherry juice smeared across the EU’s own mouth.

High Trust Arrangements in a Low Trust Context: The Rwanda Policy’s impact on the Common Travel Area

 

 

Professor Colin Murray, University of Newcastle, and Professor Steve Peers, Royal Holloway University of London

Photo credit: Zairon, via Wikimedia Commons

Introduction

The latest spat between the UK and Ireland over the knock-on consequences of the UK’s Rwanda policy exposes the tangled web of EU law and Common Travel Area (CTA) arrangements which now cover the interactions between both countries’ immigration policies. This post considers these interactions and proposals of the Irish Government to legislate in light of the Irish High Court decision in A v Minister for Justice.

The Realities of the CTA post-Brexit

The CTA has been a remarkably durable feature of relations between the UK and Ireland for over a century. In the immediate aftermath of a bloody war of independence, both countries recognised the mutual benefits of facilitating people moving across their new borders. And even at the height of the Brexit referendum campaign, pro-Brexit campaigners lined up to downplay any concerns around the land border because the CTA would continue after Brexit. Even if it was not, of itself, capable of ensuring an open border on the island of Ireland, the CTA was generally accepted as providing an important ongoing element of UK-Ireland relations. This always underplayed how difficult it was going to be to make these arrangements work post Brexit.

The CTA arrangement has been operable for so long on the basis that it works on two levels; unrestricted movement can take place between the parts of the CTA because each part enforces broadly comparable external rules of entry. For decades, the two states aligned their immigration policy and enforced a shared list of excluded individuals. After both joined the EEC at the same time, these arrangements were augmented by a range of EU law, but Ireland and the UK continued to jointly operate opt outs to let them maintain distinct elements of immigration policy and to provide more legal entitlements to each other’s citizens than they did to other EU citizens (see here).

Post Brexit, the immediate concern was over the UK’s commitment to the CTA. Once Brexit happened, the common external arrangement would no longer be operative, because EU citizens could continue to move freely into Ireland (whereas they would face new restrictions on moving directly to the UK). They could, however, then use the CTA to move into the UK, thereby circumventing the UK’s new immigration policy.  UK ministers, however, remained confident that they could deal with this issue by immigration enforcement away from the border (by requiring banks, landlords, etc to require individuals provide proof of status before accessing services). They therefore signed up to a new CTA deal with Ireland in 2019.

The latest spat in post-Brexit relations between the UK and Ireland, however, involves the necessary corollary of some of the concerns being raised before Brexit took effect. Once the UK set about tightening its restrictions on immigration, and particularly abandoning safeguards around refugees that it had implemented under EU law, would there be a displacement effect as people turned to Ireland instead to process asylum claims. This led to the claims by Ireland’s Justice Minister, Helen McEntee, that not only was there a sharp rise in asylum applications in Ireland in recent months, that 80% of new applicants were now crossing the land border from Northern Ireland. There has not been any evidence published to support this figure (a fact emphasised by some coalition government ministers from other parties, perhaps more alive to the consequences of ramping up these tensions for the CTA).

Groups like the Irish Refugee Council have pointed out that simply because the number of in-country applications has risen, this does not mean that all of those individuals have crossed the land border (people in the country on a different immigration status can make decisions to apply for asylum on the basis of a change in the circumstances of their home country, for example). But the impression that the UK Government’s Rwanda policy has had a direct knock on impact on Ireland, which needs to be addressed, has become central to ministerial thinking.

The position in Ireland

EU asylum law framework

The problem for Ireland is how to enforce returns to the UK, especially in light of the legislation closing off of routes to claim asylum in the UK. The starting point is that Ireland is bound by aspects of EU asylum law, having exercised the possibility to opt in to parts of it. In particular, Ireland opted into the first phase asylum procedures Directive, adopted in 2005, but not the second phase asylum procedures Directive, adopted in 2013 (the ‘2013 Directive’), both of which contain slightly different rules (optional for Member States) on ‘safe third countries’ – ie countries that asylum seekers could arguably make their applications in instead, other than their countries of origin or the country where they are applying now.

The ‘safe third country’ rules in the Directives refer to non-EU countries. If the argument is that the asylum seeker should have applied in an EU Member State or a Schengen associate (Norway, Iceland, Switzerland, Liechtenstein), a different set of rules (the ‘Dublin rules’) apply instead, which determine in detail which Member State is considered responsible for the application, how transfers of asylum-seekers to give effect to the responsibility rules work, and what rights asylum-seekers have to challenge the potential transfers. Ireland has opted in to the current version of those rules – the 2013 version of the Dublin Regulation, known as ‘Dublin III’ – which states that rather than apply those rules to transfer an asylum seeker to another Member State which is responsible, a Member State can choose (as an option) to send an asylum seeker to a non-EU country instead, in accordance with the ‘safe third country’ rules in the 2013 Directive. (One way for Ireland to get around difficulties sending asylum seekers back to the UK would be to revert to the Dublin rules and try to send more of them back to other Member States under those criteria; but that will not always work, for instance because there may not be enough evidence to apply those rules, or the responsibility for the Member State which they first entered illegally to deal with the asylum-seeker may have timed out).

Ireland intends to opt in to the 2024 versions of the Dublin Regulation and the procedures law – which will now become a Regulation – after they are formally adopted, which is scheduled for May 14 (on the details of the new Regulations, see here and here). The procedures Regulation will change the ‘safe third country’ rules again. However, this will not have an immediate impact, since these new Regulations will not apply until mid-2026. So the focus here is the current law.

According to the recent Irish High Court judgment, Ireland had ‘safe third country’ rules at several points previously, but reintroduced the possibility in 2020, when an omnibus law on Brexit amended the International Protection Act 2015 to provide again for ‘safe third countries’ to be designated. Obviously this legal change had the UK in mind – given that the Dublin rules ceased to apply to the UK at the end of 2020, when the Brexit transition period expired. Indeed, the Irish government promptly used these new powers to designate the UK as a ‘safe third country’.

EU ‘safe third country’ rules

The 2005 ‘safe third country’ rules, which apply to Ireland as such, state that a Member State can apply the concept ‘only’ if ‘the competent authorities are satisfied that a person seeking asylum will be treated in accordance with the following principles in the third country concerned:’

a) life and liberty are not threatened on account of race, religion, nationality, membership of a particular social group or political opinion;

b) the principle of non-refoulement in accordance with the Geneva [Refugee] Convention is respected;

c) the prohibition of removal, in violation of the right to freedom from torture and cruel, inhuman or degrading treatment as laid down in international law, is respected; and

d) the possibility exists to request refugee status and, if found to be a refugee, to receive protection in accordance with the Geneva Convention.

The Directive goes on to state that ‘[t]he application of the safe third country concept shall be subject to rules laid down in national legislation, including:’

a) rules requiring a connection between the person seeking asylum and the third country concerned on the basis of which it would be reasonable for that person to go to that country;

b) rules on the methodology by which the competent authorities satisfy themselves that the safe third country concept may be applied to a particular country or to a particular applicant’, which must ‘include case-by-case consideration of the safety of the country for a particular applicant and/or national designation of countries considered to be generally safe’;

c) rules in accordance with international law, allowing an individual examination of whether the third country concerned is safe for a particular applicant which, as a minimum, shall permit the applicant to challenge the application of the safe third country concept on the grounds that he/she would be subjected to torture, cruel, inhuman or degrading treatment or punishment.

Next, Member States must:

a) inform the applicant accordingly; and

b) provide him/her with a document informing the authorities of the third country, in the language of that country, that the application has not been examined in substance.

Finally, if the non-EU country concerned ‘does not permit the applicant for asylum to enter its territory, Member States shall ensure that access to a procedure is given in accordance with the basic principles and guarantees described in’ the Directive.

The 2013 Directive is similar, except for adding ‘there is no risk of serious harm as defined in Directive 2011/95/EU [the EU Directive on definition of refugee and subsidiary protection status] to the list of principles that must apply in the non-EU country, and providing that the applicant must be permitted to argue that the non-EU country ‘is not safe in his or her particular circumstances’ and ‘to challenge the existence of a connection between him or her and the third country in accordance with’ the Directive.

The impact of designating a country as a ‘safe third country’ is that the application is inadmissible on the merits – on the assumption that it will be considered on the merits in the other country instead, because it is presumed that the asylum-seeker will apply for asylum in that country after being expelled there. The case will be fast-tracked, and it may be harder to stay on the territory in the event of an appeal against the decision than in some other cases.

The Court of Justice has ruled several times on the interpretation of the ‘safe third country’ rules in the 2013 Directive: Cases C-564/18, C-821/19, and C-924/19 and C-925/19 PPU, inter alia ruling that the principle does not apply to transit countries, and that Hungary had not fully provided for the guarantees related to the ‘safe third country’ concept’ required by the Directive in its national law.

The High Court judgment

The Irish High Court judgment ruled that the Irish government’s designation of the UK as a ‘safe third country’ was unlawful; but it did not rule on whether or not the UK was actually safe. This apparent paradox stems from the nature of administrative law, which often concerns itself with whether the public administration followed the correct procedure, rather than the merits of the decision – in part because courts are often more willing to review the procedure which a government applied to take a decision than the merits of that decision, which are seen as to some extent a matter of political discretion. So it’s possible that after a court quashes a government measure as unlawful on procedural grounds, the government could back and lawfully adopt the same decision again, provided that it now does so following the correct procedure. (And to knock on the head another common misconception: a minister taking an unlawful decision does not mean that the minister has committed a crime)

So why was the designation of the UK as a ‘safe third country’ unlawful? Mainly because the Irish law from 2020 providing the powers to designate such countries was not fully consistent with EU law, particularly because it did not provide the guarantees required in the 2013 Directive, which is cross-referenced in the Dublin III Regulation. (As noted above, the CJEU came to a very similar conclusion regarding Hungary’s lack of full application of those guarantees, but oddly the High Court judgment makes no reference to this case law). Also, there had not been a continual review of the position in the UK.

However, this did not mean – despite a popular misconception on this point – that the High Court judgment ruled that the UK was unsafe because of the UK’s Rwanda policy. In fact the judgment is at pains to point out that it was not reaching any conclusion on the Rwanda policy one way or another.

The Irish government’s response

The Irish government has announced plans to adopt legislation to designate the UK as a ‘safe third country’. Depending on the content, this may be sufficient to address the specific reasons why the High Court found that the previous designation was unlawful. But this is not the end of the story, because, as we have seen, the High Court did not get into the merits of whether the UK was ‘safe’ or not, particularly in light of the Rwanda policy, which has moreover developed since. Any fresh legislation could be challenged on those grounds. It’s even possible, if fresh challenges are brought, that an Irish court may want to send questions to the CJEU on this or other aspects of interpretation of the ‘safe third country’ rule. (Incidentally, as the Irish High Court did not rule on the merits of whether or not the UK was 'safe', the Irish government - unlike the UK recently - is not legislating to overturn a court judgment on whether another country is 'safe').

Furthermore, there are other elements to the EU rule, not discussed much in the High Court ruling. As noted above, there must be a ‘connection’ between the asylum seeker and the non-EU country (a point notably missing from the Rwanda policy, on the UK side), and the case law says that mere transit is not enough to create a connection. The two asylum-seekers concerned by the previous High Court judgment had been deemed to have spent enough time in the UK to have a ‘connection’, but that will arguably not be the case for all asylum-seekers who might make their way via the UK to Ireland.

Another point – also scrapped on the UK side in the Rwanda policy – is that the asylum-seeker must be readmitted by the non-EU country. The EU rules thus aim to avoid the very limbo that thousands of asylum-seekers are subject to in the UK, where their cases are inadmissible but with no country willing or obliged to decide their applications on the merits. While the High Court judgment refers to UK willingness to readmit asylum seekers previously (see para 44), the UK has now announced that it is not willing to do so, perhaps because it views the CTA arrangements as not binding. This obviously creates a further issue on the EU side (on the readmission/’safe third country’ nexus in EU law, see the pending Case C-134/23).

Immigration Policy for the whole of the UK?

As well as the Irish dimension to this argument, there is also a Northern Irish aspect. Notwithstanding the current wrangling, many question marks hang over the UK’s policy under the Illegal Migration Act 2023, as extended by the Rwanda Act 2024, and particularly over how they apply in the context of Northern Ireland. As part of the EU-UK Withdrawal Agreement the UK committed to ensuring no diminution of rights and equality protections operative in Northern Ireland law as a result of EU law because of Brexit (Windsor Framework, Article 2). It did so to avoid any claim that Brexit jeopardised the rights provisions of the Belfast/Good Friday Agreement 1998, some of which had come to rely upon EU law in practice. This concession headed off a lightning-rod argument for opposition to Brexit in the Northern Ireland context, and enabled the deal to proceed.

But now that these arrangements are in place, and operative, it means that Northern Ireland has a separate (and higher) floor of rights protections than the remainder of the UK. It is arguable that many aspects of EU law applicable to asylum seekers, and providing protections for them (including the Trafficking Directive), continue in full effect in Northern Ireland post Brexit. As pointed out in previous posts (here and here) the courts have the ability to disapply statutes insofar as they conflict with the Windsor Framework arrangements. In other words, this casts doubt on whether the UK Government’s flagship policy on asylum seekers can apply equally in all parts of the UK. The issue has already been argued before the Northern Ireland High Court with regard to the Illegal Migration Act (judgment is pending). Even if the Rwanda Act closes off many legal challenges, asylum seekers within Northern Ireland are therefore likely to try to use the Windsor Framework to challenge any deportations under these measures for the foreseeable future. 

Conclusions

Amid the tangle post-Brexit arrangements, both countries appear to be talking at cross purposes. For the UK Government, Brexit removed its obligations to comply with the Dublin III regulations and the arrangements thereunder for return of asylum seekers to other EU countries (and it cites the restrictions on it being able to enforce the return of individuals to France post Brexit as evidence of this). For the Irish Government, the Dublin III process might have been used when both countries were EU Member States, but the underlying CTA relationship sprang back into full effect (although conditioned by its own EU obligations) once the overlaying EU law was removed post Brexit. In reality, so much of the CTA relies on shared understandings and reciprocal nods, that there is considerable scope for misinterpretation. Indeed, two countries which were engaging with each other in the close collaborative relationship that the CTA requires might well have been expected to publicly make the appropriate arrangements in advance of Brexit taking effect (but that, alas, is not where UK-Ireland relations are at – see Professor Bernard Ryan here).

Elections loom in both Ireland and the UK, and many politicians in both countries have decided that there are votes to be won in looking tough on immigration. When refugees and asylum-seekers are at issue, however, it is difficult to ignore the fact that both countries process a relatively low number of asylum claims on a European level. But both countries are at loggerheads over policies which increasingly put the CTA arrangements in jeopardy and which seek to ignore the fact that conflict and persecution necessarily create more refugees. Both, it has to be concluded, would like this to be someone else’s problem.

Data Protection, the UK and the EU: the draft adequacy decisions

 

Lorna Woods, Professor of Internet Law, University of Essex

 

Background

 

Under the General Data Protection Regulation (GDPR) and the data protection Law Enforcement Directive (LED) personal data may not be transferred outside the EU unless adequate safeguards are in place (eg via standard contractual clauses). The most comprehensive way this can be demonstrated – and the easiest for individual controllers and processors – is via an adequacy decision under Article 45 GDPR and Article 36(3) LED respectively.  So far, twelve countries have, either fully or partially, been deemed adequate for GDPR purposes, including Andorra, Argentina, Canada (commercial organisations), Guernsey, Israel, Switzerland, and most recently, Japan – though note that in respect of its decision for Japan extra safeguards were required. While the Commission had found the US to be adequate, the Court of Justice disagreed (in the Schrems II judgment, discussed here).

 

With the UK now Brexited, it falls to be considered as a third country for data protection purposes and appropriate arrangements for data transfers need to be in place.  The UK Government planned for an adequacy decision, but by the end of the transitional period the Commission had not completed its assessment. A stop-gap measure was agreed in the EU-UK Trade and Cooperation Agreement (agreed by the EU and the UK on December 24, 2020: see overview of that agreement here) so that data flows between the two remain unrestricted either: (a) for a period of 4 months from 1  January 2021 (with an automatic extension for two further months unless either the UK or the EU objects); or (b) until an adequacy decision is granted by the Commission, whichever is earlier and always provided the UK makes no substantive changes to its data protection laws.  The European Data Protection Supervisor (EDPS) however expressed some concern about this agreement.

 

On 19th February, the European Commission published two draft decisions in respect of the adequacy of the UK for data protection purposes, one in relation to the GDPR, the other for the LED.  While the decisions are of interest because of the Brexit context, they are also the first decisions drafted since the Schrems II decision and therefore may provide illumination on the Commission’s response to that decision. (Update, June 28 2021: the Commission has now officially adopted the final adequacy decisions for the UK, See the update at the end of this blog post). 

 

The Decisions

 

The decisions are long, the GDPR decision being longer than that in relation to the LED, so no doubt commentators are still reading and reflecting on the detail. The following intial comments can be made. The decisions follow a broadly similar structure.  Both identify the context and the principles to be applied in their first paragraphs. For the GDPR this was Rec 104 GDPR, the jurisprudence of the CJEU, notably Schrems II and the EDPB “Adequacy Referential”; in relation to the LED Decision the Court’s case law is relevant, as is the specific “Adequacy Referential” the EDPB only recently adopted (02/02/2021) in relation to the LED. While adequacy might be the same, the context in relation to the GDPR and the LED differs, and different legal provisions are in issue.  The main body of the decision in each case reviews the UK system.  In its over view of the constitutional framework, the draft decision emphasises the Human Rights Act and the fact that the UK is a signatory to the European Convention on Human Rights as well as the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (“Convention 108”). 

 

These international agreements are important to the Commission in providing some stability to the UK’s ongoing data protection commitments. In its press release, the Commission commented that while it has left the EU,

 

… the UK remains a member of the European “privacy family”. Continued adherence to such international conventions is of particular importance for the stability and durability of the proposed adequacy findings.

 

This is perhaps particularly important given the UK government’s stated aim to take its own approach to data protection, and the fact that under Brexit legislation the Government has considerable latitude to change the law in primary legislation by statutory instrument. Although the decision notes this power, it does not dwell on the possible implications (see GDPR decision [13] and [16]; LED Decision [12]-[15]).

 

The decision also considers the data protection framework, specifically covering geographic and material scope, safeguards and rights, oversight, onward transfers, access by public bodies as well as duration and review of the decisions.  Much of this latter part reflects the GDPR, which given the history of the legislation, is hardly surprising, a point the decision notes while re-emphasising the importance of the ECHR and Convention 108 [GDPR decision 18]; similar comments are made as regards the LED (LED Decision [22]).  On the whole the discussion of the Data Protection Act notes that there is little difference between it and requirements of the GDPR, though some points where the DPA is not that clear (what are the safeguards for historical and statistical processing, which can data brokers presume that you just want a credit score see e.g [73]-[74]) are not raised – these may be small points within a generally acceptable framing. The Commission does note the exception for ‘the maintenance of effective immigration control’ which had been the subject of (unsuccessful) challenge. The Commission recognises that the exception is formulated broadly, but nonetheless accepts it based on the conditions limiting its scope (see [65]). Whether the EDPB takes a similar approach remains to be seen; certainly some MEPs have been critical.

 

The decisions also considered mechanisms for redress and oversight (provided in Parts 5 and 6 DPA, common to both). It refers to the ability of a data subject to: complain to (and about) the ICO; to bring a claim against controllers and processors for material and non-material damages; and to bring a claim in UK courts under the UK’s Human Rights Act 1998 and ultimately in the European Court of Human Rights.

 

The Commission decision seems to recognise the UK’s data protection authority (the Information Commissioner’s Officer, or ICO) as an effective oversight body (though the ICO is no longer described as “independent” in the DPA following the Brexit amendments to Art 51 GDPR, replacing ‘independent public authorities’ with the words ‘the Commissioner’), flagging the fines imposed on British Airways and Marriot as examples of regulatory practice, as well as noting the investigation into Cambridge Analytica. There are also references to the number of cases investigated, seemingly a factor in the Commission’s assessment. There is no mention of the fact that many of the codes that are part of the implementation regime are not yet drafted (eg journalism code).  Others have been critical of the ICO, notably in relation to its action against real time bidding and the ad tech sector (and also in relation to the possibility of complaining about the ICO). In relation to the law enforcement sector, the ICO has had limited success in enforcing the DPA (in relation to information access requests) against the police and concerns have been raised about the way the police deployed Microsoft Office 365 (which backs up to the United States), as well as police use of rape victims’ data stored on mobile phones so that the Victims’ Commissioner proposed that victims should have access to free legal advice to protect their privacy.  In this there might be differences between the law and practice.

 

In general, onward transfer of data might be a concern, especially if the UK signs up to trade agreements which make provisions restricting transfer of data problematic (this was part of the issue in the Japan decision). In this section (GDPR decision [75]-[82]), while there is plenty of detail about the UK system, there is less direct comparison with the requirements of Schrems II (and the LED Decision is similar). Moreover, the discussion accepts the safeguards in relation to the transfer of data to the UK for law enforcement purposes; yet, the EDPB has expressed concerns.

 

One of the big concerns surrounding the UK adequacy agreement related to the operations of the security and intelligence services, surveillance and national security. Presumably in an attempt to head off challenges in the light of Schrems II and other decisions on surveillance, the Commission devotes a considerable amount of space to a description of the UK arrangements.  The use of personal data for law enforcement purposes and in the context of national security lie outside the GDPR; even for personal data within the GDPR a general exemption applies for national security or defence purposes, though the Commission noted this must be applied on a case by case basis rather than as a blanket exception (see [66]-[69]).

 

The issue of access to data by public authorities in the public interest is dealt with in a separate section (para [112] onwards), with the decision noting that the baseline is set in Schrems II as well as the more recent cases of Privacy International (Case C-623/17) and La Quadrature du Net (Cases C-511-12/18 and C-520/18) – which were discussed here.  While the decision states the principles applying to an interference with an individual’s right to privacy and to data protection, it does so at a general level and does not engage with the case law surrounding mass surveillance and bulk collection of data, despite its citation of La Quadrature du Net. It instead focuses on the oversight mechanisms and formal controls, as well as the right of an individual to bring action before a court.

 

The EDPB by contrast specifically notes that in the view of the CJEU completely indiscriminate data retention would offend against the principle of necessity; it moreover states that necessity and proportionality both need to be demonstrated (rather than asserted). Nonetheless, the decision engages in a thorough overview of the regime both as far as the ICO’s powers are concerned as well as the processes set up under the Investigatory Powers Act (IPA). It concludes (at [268]) that any interference with the fundamental rights of the individuals whose personal data are transferred from the European Union to the United Kingdom by United Kingdom public authorities for public interest purposes, in particular law enforcement and national security purposes, will be limited to what is strictly necessary to achieve the legitimate objective in question, and that effective legal protection against such interference exists.

 

It does not consider the partial nature of the response to the Tele2/Watson ruling (discussed [195] – and here on this blog), in which the Government specifically introduced a separate definition of serious crime to cover metadata and failed to deal with the issue of informing subjects of surveillance operations. It seems to accept the practices of the agencies even though there are a number of cases suggesting illegality in the light of the ECHR.  Given the criticisms of the US regime in Schrems II, there are some suggestions that this aspect of the decision might be subject to challenge.

 

One final point to note about the decision is that it is expressed to be valid for four years, in the interests of ‘future proofing’ the arrangements. While the Commission is under an obligation to keep under review the other adequacy arrangements (art 45(3) GDPR), in no other case as yet is there a time limit to the decision. This may reflect concerns regarding the UK government’s plans for data protection in the future; the EDPS suggested however that ‘any substantial deviation that would result in lowering the level of protection would constitute an important obstacle to a finding of adequacy’. Does this hint that backsliding in and of itself might be seen as a problem?

 

What Next?

 

The announcement from the Commission that it had published draft decisions finding the UK to meet the adequacy standard for both instruments was therefore greeted positively by the UK government and the ICO as well as by industry.  On the whole, the decision focussed on the positive aspects of the UK regime, emphasising where there was protection rather than where the weaknesses lie. This is understandable; no system is perfect and the requirement is not to replicate exactly the GDPR and the LED. Moreover, given the similarities of the UK regime at the moment, it would set a very high standard if the UK were not to be seen as adequate – where would this leave the position vis a vis other countries (eg Japan)? 

 

Yet, this is not yet a done deal; the EDPB will publish its opinion as required under Article 70 GDPR which, though not binding, will be influential (as was also the case in the Japan adequacy decision).  The decision must also be submitted to the Article 93 Committee and be made available to the European Parliament and the Council under the comitology procedures.  Further, there is still a risk that, in the light of earlier litigation (eg Digital Rights Ireland, Schrems I, Tele2/Watson and Schrems II – see discussion of the first two cases here and here), any adequacy decision could be challenged focussing on that difficult topic of national security and the extent to which the State is allowed to carry out surveillance in bulk.  While the bulk of challenges have come from privacy activists, there remains the possibility that the European Parliament could, were it so minded, mount such a challenge (which would reduce some of the standing issues); individual regulatory authorities could also bring litigation.

Adequacy Decisions – Update (June 30, 2021)

The European Union has adopted the adequacy decisions in respect of the UK, available here. The decision comes just in time to avoid the need to use Standard Contractual Terms and Binding Corporate rules for transfers to the UK from the EU; the stop gap measure would have reached its end at 30th June 2021. The news has been well-received but a couple of points are worth noting.

 

First, the UK’s current regime implements the GDPR and the LED, however imperfectly and it would therefore have been somewhat surprising if the political institutions at EU level did not recognise this as adequate. Indeed, the Adequacy Agreement specifically refers to this point [recital 12, 16]. The UK government’s emphasis on developing its own data policy against this background is unfortunate; the challenges to key elements of the GDPS in the TIGGR particularly so. The decision is also predicated upon the UK’s adherence to the European Convention of Human Rights and submission to the jurisdiction of the European Court of Human Rights. Continued adherence to such international obligations is therefore a particularly important element of the assessment on which this Decision is based. [recital 277]

 

Secondly, the agreement, unusually, has a sunset clause. It will automatically expire after 4 years and the Commission has the right to review it during this term. Certain points of concern are apparent.  For example, data transfers for the purposes of migration control are excluded by Article 1 from the scope of the adequacy agreement (though the SCCs and BCRs remain available), specifically referring to ORG v SoS for the Home Department [recital 6]; this reflects the concerns surrounding the immigration exemption.  Article 3 contains monitoring arrangements relating to the actual practice of data protection, including examples of when the ICO fails to ensure compliance with the DPA18; where public authorities interfer with the rights of individuals more than is strictly necessary or where there is no legal redress [Article 3(2) and (3)]. These would seem to point to concerns around data sharing by public authorities and limitations on individual rights to facilitate eg big data analytics.

 

Taken together, this suggests that the adequacy agreement is not a done-deal for ever more and that particularly some parts of the EU have concerns about the current government’s plans to reduce protection.  There remains the question of what those outside the EU political institutions will do. A challenge to the Adequacy Agreement remains possible, notwithstanding its attempt to deal with the problem of mass surveillance. It remains the fact that the UK surveillance regime would in future pass the adequacy threshold set down in Schrems I.

 

Barnard & Peers: chapter 26

Photo credit: By Christoph Scholz - EU Puzzle mit Grossbritannien (link to licence)

Bringing the Panopticon Home: the UK joins the Schengen Information System

 

Steve Peers

Over two hundred years ago, British philosopher Jeremy Bentham devised the concept of the ‘Panopticon’: a prison designed so that a jailer could in principle watch any prisoner at any time. His theory was that the mere possibility of constant surveillance would induce good behaviour in prison inmates. In recent years, his idea for a panopticon has become a form of shorthand for describing developments of mass surveillance and social control.

The EU’s forays in this area began with the creation of the Schengen Information System (SIS) in the 1990s. The SIS is a well-known EU-wide database containing enormous amounts of information used by policing, immigration and criminal law authorities.  

Until now, the UK has not had any access to the SIS. But this week, the EU Council finally approved the UK’s participation in the System, thereby linking the EU’s most iconic database with the intellectual home of the panopticon theory. What are the specific consequences and broader context of this decision?

Background

The main purpose of the Schengen system is to abolish internal border checks between EU Member States, as well as some associated non-EU States.  At the moment, the full Schengen rules apply to all EU Member States except the UK, Ireland, Cyprus, Romania, Bulgaria and Croatia. Those rules also apply to four associates: Norway, Iceland, Switzerland and Liechtenstein.

All of the Member States are obliged ultimately to become part of the Schengen system, except for the UK and Ireland. Those two Member States negotiated an exemption in the form of a special Protocol at the time when the Schengen rules (which originated in the Schengen Convention, ie a treaty drawn up outside the EU legal order) were integrated into the EU legal system, as part of the Treaty of Amsterdam (in force 1999).

The UK and Ireland are not entirely excluded from the Schengen system. In fact, they negotiated the option to apply to join only some of the Schengen rules if they wished. Their application has to be approved by the Council, acting unanimously. The UK and Ireland essentially chose to opt in to the Schengen rules concerning policing and criminal law, including the SIS, but not the rules concerning the abolition of internal border controls and the harmonisation of rules on external borders and short-term visas.

The UK’s application to this end was approved in 2000 (see Decision here), and Ireland’s was approved in 2002 (see Decision here). But in order to apply each Decision in practice, a separate subsequent Council decision was necessary, because the Schengen system cannot be extended before extensive checks to see whether the new participant is capable of applying the rules in practice.  On that basis, most of the Schengen rules which apply to the UK have applied from the start of 2005 (see Decision, after later amendments, here). The exception is the rules on the SIS, which the UK was not then ready to apply. After spending considerable sums trying to link to the SIS, the UK gave up trying to do so, on the basis that the EU was anyway planning to replace the SIS with a second-generation system (SIS II). There’s a lot of further background detail in the House of Lords report on the UK’s intention to join the SIS (see here), on which I was a special advisor. (Note that Ireland does not apply any of the Schengen rules in practice yet).

It took ages for the EU to get SIS II up and running, and it finally accomplished this task by April 2013 (see Decision here). The UK had planned to join SIS II shortly after it became operational, but this was complicated by the process of opting out of EU criminal law and policing measures adopted before the entry into force of the Treaty of Lisbon, and simultaneously opting back in to some of them again, on December 1^st 2014 (see discussion of that process here). This included an opt back in to the SIS rules.

Once that particular piece of political theatre concluded its final act, the EU and the UK returned to the business of sorting out the UK’s opt in to SIS II in practice. This week’s decision completed that process, giving the UK access to SIS II data starting from March 1^st. The UK can actually use that data, and enter its own data into the SIS, from April 13^th.

Consequences

What exactly does participation in the SIS entail? The details of the system are set out in the 2007 Decision which regulates the use of SIS II for policing and criminal law purposes. There are also separate Regulations governing the use of SIS II for immigration purposes and giving access to SIS II data for authorities which register vehicles. The former Regulation provides for the storage of ‘alerts’ on non-EU citizens who should in principle be denied a visa or banned from entry into the EU, while the latter Regulation aims to ensure that vehicles stolen from one Member State are not registered in another one. The UK participates in the latter Regulation, but not the former, since it could only have access to Schengen immigration alerts if it fully participated in the Schengen rules on the abolition of internal border controls. On current plans, this will happen when hell freezes over.

The SIS II Decision provides for sharing ‘alerts’ on five main categories of persons or things: persons wanted for arrest for surrender or extradition purposes (mainly linked to the European Arrest Warrant); missing persons; persons sought to assist with a judicial procedure; persons and objects who should be subject to discreet checks or specific checks (ie police surveillance); and objects for seizure or use as evidence in criminal proceedings. There are also rules on the exchange of supplementary information between law enforcement authorities after a ‘hit’. For instance, if the UK authorities find that a European Arrest Warrant has been issued for a specific person, they could ask for further details from the authority which issued it.

On the other hand, the SIS does not, as is sometimes thought, provide for a basis for sharing criminal records or various other categories of criminal law data, although the EU has set up some other databases or information exchange systems dealing with such other types of data. (On criminal records in particular, see my earlier blog post here). The main point of setting up the second-generation system was to extend the SIS to new Member States (although in the end a new system wasn’t actually necessary for that purpose), and to provide for new functionalities such as storing fingerprints, which will likely be put into effect in the near future.

In practice, the UK’s participation in SIS II is likely to result in the Crown Prosecution Service receiving more European Arrest Warrants (EAWs) to process, and in more efficient processing of EAWs which the UK has issued to other Member States. It will also be easier, for instance, to check on whether a car or passport stolen in the UK has ended up on the continent, or vice versa.

Broader context

As noted already, while the UK is only now joining the SIS, the System has been around for many years, and has proved to be the precursor of many EU measures in this field. Indeed, as EU surveillance measures go, the SIS turned out to be a ‘gateway drug’: the friendly puff that led inexorably to the crack den of the data retention Directive.

Of course, interferences with the right to privacy can be justified on the basis of the public interest in enforcement of criminal law and ensuring public safety – if the interference is proportionate and in accordance with the law. Compared to (for instance) the data retention Directive and the planned passenger name records system, the SIS is highly targeted, focussing only on those individuals involved in the criminal law process, or police surveillance, or banned from entry from the EU’s territory. The legitimacy of the system therefore depends upon the accuracy and legality of the personal data placed in to it, and the connected data protection rules. On this point, the EU and national data protection supervisors have reported that many data subjects do not even know about the data held on them in SIS II, and they have produced a guide to help them with accessing their data in the system.

There’s an inevitable tension between the EU’s goal to set the world’s highest data protection standards, on the one hand, while also developing multiple huge databases, information exchange systems and surveillance laws, on the other.  It’s as if the brains of the utilitarian Jeremy Bentham and the libertarian John Stuart Mill were both battling for control of the same body – forcing it to draw up plans for the Panopticon at the same time as it was storming the Bastille. If this tension manifested itself in fiction, it would probably take the form of a comedy about a vegetarian butcher, or a virgin porn star. But the need to ensure that measures to protect our security do not remove all our liberty is not a laughing matter.

 

*This blog post is linked to ongoing research on the upcoming 4^th edition of EU Justice and Home Affairs Law (forthcoming, OUP).

 

Image credit: nytimes.com

Barnard & Peers: chapter 25