The reform of Europol: modern EU agency, or intergovernmental dinosaur?

Introduction

The EU’s police cooperation agency, Europol, has played a major role in the development of Justice and Home Affairs cooperation in the EU from an early stage. Europol was originally set up informally, then on the basis of a 1995 Convention, subsequently replaced by a Council Decision in 2009. While its powers have gradually been expanded, so has the controversy about its accountability and the adequacy of its data protection rules. Since it is a creature of the former 'third pillar' (the previous special rules on policing and criminal law) it is something of a 'dinosaur' in institutional terms, being an essentially intergovernmental body.

With the entry into force of the Treaty of Lisbon, the European Parliament (EP) now has joint powers with the Council as regards the adoption of a Regulation governing Europol, and the Treaty now refers expressly to the importance of ensuring accountability to both national parliaments and the EP. Furthermore, the EU institutions agreed in 2012 a ‘Common Understanding’ on standard rules which would apply to the governance of EU agencies. To expand Europol’s powers further, while addressing the issues of governance, accountability and data protection, the Commission proposed a new Regulation reconstituting Europol in 2013.

At the most recent Justice and Home Affairs Council, ministers agreed the Council’s position on the Commission’s proposal.  Since the European Parliament also recently agreed its own position, this clears the way for negotiations to take place between the two institutions for a final deal, once the EP is fully operational again following the recent elections. This is therefore a good time to examine the progress of discussions on the proposed Regulation so far.

It should be noted that Ireland has opted in to this proposed Regulation, while the UK and Denmark have opted out. The UK’s objections are due to the proposals to place national law enforcement bodies to comply with Europol’s requests to start investigations, and to supply information to Europol without a national security exception. However, as discussed further below, the Council’s and EP’s positions on the proposal address these issues, raising the possibility that the UK will opt in after adoption of the Regulation.

Europol’s powers

First and foremost, the Commission failed in its attempt to merge together Europol with the European Police College. The Commission thought it was a good idea to merge the two, given the overlap of their subject-matter. There has never been a merger of EU agencies before, for essentially political reasons: Member States fight bitter battles to host EU agencies, and so are reluctant to let one go once they have one. However, unusually, in this case the original host of the European Police College, the UK, was rather keen to kick the agency out, as it was planning to sell the space where the College was located and declared itself unable to find a new one.

So there was a golden opportunity to merge these two agencies, but neither the European Parliament nor the Council wanted to take it. In light of the Commission’s inflexible insistence on its proposal, an unprecedented group of 25 Member States tabled an initiative to amend the previous Decision establishing the European Police College, which was subsequently adopted. This new Regulation simply moves the College to Budapest. The Council has requested the Commission to make a separate proposal making further changes to the Police College, but it remains to be seen whether the Commission will do so, or whether it will continue to sulk about the failure of its original suggestion for a merger.

The Commission’s second main objective related to Europol itself. It cannot carry out ‘coercive powers’, according to the Treaties, and all three institutions agree that a clause to this effect should appear in the new Regulation.  So it is destined to remain an agency which gathers and analyses information, and it is only able to do the latter to the extent that it does the former. As dinosaurs go, Europol is clearly a herbivore, not a carnivore.

But the Commission nonetheless hoped to give Europol some sharper teeth. So it proposed two key amendments: a clarification of Member States’ obligation to give information to Europol, and an enlargement of Europol’s access to national databases. In parallel to this, the Commission’s proposal removed the detailed rules on the structure of data processing that existed in the Europol Decision (and before that, in the Europol Convention). In place of these very specific rules on analysis files and the Europol Information System, et al, there would instead be general provisions on data processing, which would be centred upon an obligation to ensure ‘privacy by design’.

The Council weakened the proposed rules which required national authorities in principle to act upon Europol’s request to initiate investigations. However, this issue is mainly symbolic, since there was no absolute obligation to act, under the Commission’s proposals (authorities could ‘decide not to comply’ with a request, on any grounds).

Furthermore, the Council did not accept the Commission’s proposal to allow Europol to contact national authorities directly in all cases, without going through the ‘Europol national units’ (the official points of contact between Europol and national forces). Instead, it simply provided (as at present) for the possibility for Member States to allow this. It also reinserted the current provisions which allow national authorities to refuse requests for information from Europol on grounds of national security, current investigations or intelligence activities.

However, the Council agreed with the proposal to give Europol a list of other new powers, and added new provisions giving Europol the power to assist with Schengen evaluations, as well as the evaluation of candidate Member States. It also specified that Member States have to allow their Financial Intelligence Units (special units dealing with money laundering) to collaborate with Europol. Finally, it wants to extend the fields of crime which Europol deals with to include war crimes and genocide as well as insider trading.

For its part, the EP, like the Council, voted against strengthening the provisions relating to Europol requests to Member States, although it did agree to Europol’s direct contact with national authorities (under certain conditions). It also agreed to retain the provisions allowing authorities to refuse requests from information from Europol.

Furthermore, the EP wants to reinsert the existing conditions relating to Europol’s participation in joint investigation teams, whereas the Commission (and the Council) want to provide only for general rules in this respect.

Data processing and data protection

Europol’s powers are inevitably closely linked with the data processing and data protection rules that apply to its processing of personal data. On this point, the Commission’s main objective with its proposal was to enhance the data protection framework of Europol by ensuring that its data protection supervisor was fully independent and had effective powers.

To this end, the Commission suggested more detailed rules on data processing and more data protection rights for individuals. The rules on external transfers of data outside the EU, which currently allow Europol itself to sign treaties with the Council’s approval, would be replaced by the general external relations rules of EU law (treaty negotiations carried out by the Commission, treaties concluded by the Council after consent by the EP). In general, the rules on transferring data to third States would be modelled on the rules in the EU data protection directive (see the recent post on this blog), allowing for transfers in principle only where a third State’s data protection has been judged ‘adequate’, with limited derogations from this rule. The supervisory powers currently held by a Joint Supervisory Board would be transferred to existing European Data Protection Supervisor (EDPS), which has data protection supervisory power as regards most EU agencies.   

The Council would amend the proposal to add a general power to process personal data in order to facilitate information exchange between Europol, other EU bodies, third countries, Member States and international organisations. Also, the Council would impose an absolute obligation for Europol to inform Member States about information concerning them. The Council would also allow for broader derogations from the normal rules as regards the transfers of data to third countries, adding grounds relating to legal claims and the combating of criminal offences.

As for data protection rules, the Council would strengthen the proposal by banning the selection of a group persons purely on the basis of a ‘sensitive’ ground, such as racial origin. It would also add a requirement for Europol to notify its data protection officer and the EDPS in the event of a security breach. Europol would also have to inform data subjects of the time period for the processing of their data, and the right to make requests to Europol for erasure, et al of that data.

However, the Council would drop the requirement for Europol to report on its processing of sensitive data every six months to the EDPS. Also, Europol would have to comply with any Member State’s objection to the release of data which it provided to Europol. A data subject’s request for correction et al of personal data would have to be funnelled through a national authority, rather than addressed directly to Europol, and the Council would include very broad grounds for Europol to refuse such requests.

The Council is also keen to amend the institutional ‘architecture’ regarding data protection in the Commission’s proposal. It would cut back a little on the proposed powers of the EDPS, and impose the condition that it considers law enforcement concerns when it communicates with data subjects. National data protection bodies would have the power to comment on the draft annual report of the EDPS before its conclusion. More generally, the EDPS would have further obligations to consult national data protection bodies, and the Council wants to establish a Cooperation Board that would have a large number of advisory powers.

For its part, the EP would subject all access to personal data by Europol to general rules of necessity and proportionality and the adoption of specific rules setting out data protection principles.  The categories of personal data which could be processed would be more tightly restricted, and the EP does not support anything similar to a general power to process personal data to facilitate relations with the Member States, et al. There would be a requirement to carry out an impact assessment before data processing operations.

The EP would ban access to Europol data by OLAF, the EU’s anti-fraud body, and also would impose a ban on processing of data obtained by means which breach human rights. Pre-existing treaties with third states relating to the processing of personal data would have to be renegotiated within five years. The EDPS would have to be consulted before treaties with third States are negotiated. 

While the EP broadly agrees with the Council regarding the derogations from the external transfer rules, it wants to require Europol’s Executive Director to consider the record of the third country concerned before authorising the use of these derogations. The EP also agrees with the Council on a clause regarding notification of a data breach to the EDPS, although its version is more detailed, and the EP also wants a clause on notification of such breaches to the data subject. Finally, the EP wants more detail in the annual report by the EDPS, and proposes more cooperation between the EDPS and national authorities, although it does not support the Council’s idea of creating a Board.

Governance

First of all, as regards Europol’s management board, in accordance with the Common Understanding on EU Agencies, the Commission proposed that it have two representatives, alongside one from each Member State. However, both the EP and Council want to cut this back to one representative (as at present). Moreover, the EP (based on the Common Understanding, which refers to full EP members on agencies’ management boards) proposes to let an observer from its Joint Parliamentary Scrutiny Group (see below) attend meetings of the Management Board. Both the EP and the Council want to drop the proposed clause (based on the Common Understanding) which would require Member States to limit turnover in the Board. 

The EP supports the Commission’s proposal to ‘aim to achieve a balanced representation between men and women’ on the board, but the Council does not. 

Next, the Council and Commission agree that (in accordance with the Common Understanding) members of the Management Board should have standard terms of four years. However, the EP wants their term of office to be set by each Member State.

Furthermore, the Council wants the chair of the Management Board to come (as at present) from one of the three Member States which is jointly holding the Council Presidency, whereas the Commission and the EP reject this. Finally, the EP wants all members of the Management Board to sign a declaration of interests, for such declarations to be published, and for the Commission to have the power to object to draft Management Board decisions on fundamental legal or policy grounds. These proposals are based on the Common Understanding.

Secondly, the Council wants to retain its current powers to appoint Europol’s Executive Director and the Deputy Executive Directors, instead of shifting this power to the Management Board as the Commission proposes, in accordance with the Common Understanding on agencies (the EP agrees with the Commission). But the Council does not want to share this power with the EP.

Thirdly, the Commission proposed the creation of a new Executive Board as part of the management structure. The EP rejects this idea completely, whereas the Council can accept it on condition that the Management Board agrees unanimously to create it, leaving it to the Board (rather than the Regulation) to set out the details.

Finally, the Council wants to curtail the scope of the future reviews of the Regulation, while the EP wants to enhance them to include the provisions on parliamentary accountability. The Commission and EP support the possibility of a future amendment or repeal of the Regulation, while the Council wants to drop this possibility. It should be noted that the Common Understanding refers to the possibility of disbanding an agency.

Parliamentary accountability

Currently, the EP can receive reports on Europol, plays a role as regards the budget, is consulted upon implementing measures and can hold hearings with the Director. Due to concerns about ensuring more effective parliamentary accountability for Europol’s actions, the Commission proposed a number of reforms, in particular sending the EP and national parliaments more reports, and involving the EP more in the process of choosing the (Executive) Director.

In response, the Council insists upon separate references to the EP and national parliaments. It would also delete many of the proposed powers for the EP, in particular dropping the proposed obligation for the Executive Director to report to the EP and the obligation for the candidate to be Executive Director to make a statement before the EP.

Conversely, the EP would enhance the parliamentary role in the Regulation, in particular by creating a Joint Parliamentary Scrutiny Group, which would comprise members of both the EP and national parliaments. In its view, references to the EP in the proposal should be replaced by references to this group. There would also be greater powers for the Joint Parliamentary Scrutiny Group as regards the process of appointing the Executive Director. 

Comments

The EP and the Council agree broadly on the modest extension of Europol powers, including in particular the removal of provisions relating to the European Police College and retaining the current limits on Europol’s powers as regards national authorities, so these will likely be the least controversial issues to negotiate. It is striking that these institutions did not take the opportunity either to reduce the agencies’ costs by means of a merger, or at least to increase their efficiency by means of co-location.

As regards data protection, there are significant differences between the EP and the Council as regards: the broadening or tightening of the grounds for data processing; the details as regards notification of security breaches; the rights of data subjects; the architecture of data protection authorities; and the grounds to refuse a data subject’s requests. Both support some further powers for national authorities.

Two specific points should be highlighted here. First of all, the Council’s suggestion of a general power for Europol to process personal data in order to facilitate information exchange has to be rejected on legal grounds, since this is far too broad and imprecise a legal basis on which to justify the exchange of personal data. The EP has the better approach: if (as all the institutions agree) EU legislation should no longer regulate the details of Europol’s databases and analysis files, there need to be strong and specific data protection principles in the Regulation instead.

Secondly, while both the EP and the Council agree on a general derogation from the external transfer rules for the combating of criminal offences, this exception is likely to become the rule, since combating criminal offences is Europol’s whole raison d’etre.

As for governance and accountability, the main issues are the extent of parliamentary powers, and also the nature of those powers (ie, whether there should be separate or joint roles for the EP and national parliaments). It is striking that the Council is keen to have a joint data protection supervisory body, but not a joint parliamentary body, whereas the EP’s preferences are the other way around.  Remarkably, the Council’s removal of the (Executive) Director’s obligation to report to the EP would actually mean less parliamentary accountability on this point than under the current Decision.

Also, the EP and the Council differ as regards: whether there should be an executive board; the role of Council as compared to the Management Board in appointing the executive director; retaining a special status for the Council Presidency chairing the Management Board; rules on conflict of interest; other aspects of the composition and functioning of the Management Board (term, turnover, gender equality, Commission control, conflict of interests); and the review and possible disbanding of Europol.

On these issues, the Council’s suggestion to go backwards, by eliminating any role for the EP questioning the Executive Director, is simply antedivulian. It flies in the face of the specific reference to parliamentary accountability in the Treaties, given the obvious importance that parliamentary questioning of an agency director can play in ensuring that body’s accountability.

The Council’s attempts to defend the status quo can also be seen in its approach to the appointment of the (Executive) Director and the composition and chairing of the Management Board. The more modern approach of the EP as regards gender equality, declarations of interests, scrutiny by the Commission, and review or disbanding of Europol, should be preferred. Furthermore, accountability surely demands a single parliamentary observer on the Management Board, given that 28 Member States will each have a voting member to advocate their interests.

It is striking that two years after agreeing standard rules on EU agencies, in a bid to forestall future conflicts and difficult negotiations, all three agencies have taken a ‘pick and mix’ approach to the Common Understanding, each selecting certain points that they like from these common principles and rejecting those which they dislike.

Overall, it is clear that the Council’s preference is for Europol to remain an essentially intergovernmental body, with merely another incremental increase in its powers, a modest enhancement of the data protection rules, and no significant change in either its governance or parliamentary accountability. The EP agrees that the increase in its powers should be limited, but is pushing instead for a modernisation of the agency in light of the Treaty of Lisbon and the Common Understanding, as regards stricter data protection rules, reforming its governance, and greater accountability. Time will tell whether the Council will succeed in preserving this intergovernmental dinosaur. 

Reforming EU data protection law: the Council takes its first baby steps

Steve Peers

The EU’s controversial data protection rules, currently in the form of a Directive dating back to 1995, would be reformed profoundly if a Regulation proposed by the Commission is adopted. Talks on this proposal have been underway since January 2012, with no immediate end in sight. However, in June, for the first time the Council (consisting of Member States’ justice ministers) has agreed its position on part of the proposal. Of course, the Council still has to agree its position on the rest of the text, and then negotiate with the European Parliament, which adopted its position on the entire text this spring. But at least this recent partial Council deal offers the first opportunity to assess the direction of negotiations.

Furthermore, this is a good occasion to assess whether the new legislation might impact upon the application of the controversial Google Spain judgment.

The partial Council deal

The Council deal only concerns the question of how the new EU rules will apply to non-EU countries. However this issue is of great importance in light of the ever-growing use of the Internet and social media, since the EU rules are potentially liable to apply worldwide.

To place the deal in context, it is necessary to look at four different things: (a) the current rules in the 1995 Directive, as interpreted by the CJEU; (b) the 2012 proposal; (c) the Council’s position; and (d) the EP’s position.

In each case, I will look at two different aspects which were addressed by the Council deal. First, when do the standard EU data protection rules apply, even where the company processing data is based outside the EU? Secondly, when do the special rules on external relations apply?

The current rules

Currently Article 4 of the 1995 Directive states firstly that the standard rules apply to a data controller established in a Member State. According to the CJEU in Google Spain, that concept applies at least where a non-EU company has established a subsidiary in a Member State, and that subsidiary carries out activities linked to the business model of the parent company. The current rules go on to say that if the controller is established on the territory of more than one Member State, it must comply with the national law of each of those States.

Furthermore, the standard rules in the 1995 Directive apply where a Member State’s national law applies by virtue of public international law, and where the controller is not established on EU territory, but uses equipment located on a Member State’s territory, unless that equipment is used only for the purposes of transit. This raises the question of whether the use of ‘cookies’,  for instance, amounts to the use of equipment on a national territory, since those cookies are installed on a Member State’s computer.

As for external transfers, the current rules provide (Article 25) that in principle data can only be transferred if there is an ‘adequate level of protection’ in the third country concerned. The Commission can adopt decisions either finding that there is, or is not, an adequate level of protection. By way of derogation (Article 26), Member States must nonetheless allow (unless their national law provides otherwise) external transfers to take place if: the data subject has given unambiguous consent; the transfer is necessary to perform a contract with the data controller or to implement pre-contractual measures which the data subject requested; the transfer is necessary to conclude or perform a contract in the interest of the data subject as a third party; the transfer is ‘necessary or legally required on important public interest grounds’ or related to legal claims; the transfer is in the data subject’s ‘vital interests’; or the transfer is from a register which provides information to the public or to persons with a legitimate interest.

A Member State may authorise an external transfer to a country with an inadequate level of protection if the data controller can offer ‘adequate safeguards’, in particular arising from contractual clauses. The Commission can decide that certain standard contractual clauses offer such protection. 

The 2012 proposal

The 2012 proposal (Article 3) suggests that the new Regulation should apply first of all where a controller or processor is established in the EU. Secondly, it should apply where the data controller is not established in the EU, but the data subjects reside in the Union, and the data controller either offers them goods or services, or monitors their behaviour. Thirdly, as before, it would apply where a Member State’s national law applies by virtue of public international law. The provision concerning the ‘use of equipment’ would be dropped.

As regards external transfers, the 2012 proposal maintains the basic structure of the current rules, but elaborates upon it. So there are more details on what the Commission has to take into account when assessing the adequacy of a third State, including judicial redress and supervisory authorities. Adequacy decisions taken pursuant to the 1995 Directive would remain in force.

External transfers would be permitted on the basis of binding corporate rules, or standard contractual rules adopted by the Commission or a national supervisory authority, or individually negotiated contractual rules authorised by a national supervisory authority. Otherwise transfers would require approval by a supervisory authority. Pre-existing authorisations by a supervisory authority would remain valid.

A new clause would elaborate upon the content of binding corporate rules that would be adopted unilaterally. These would require the approval of a supervisory authority.

Finally, further derogations would be permitted. Compared to the current rules, these would be optional, not mandatory. The new proposal would clarify that consent could only be given after the data subject had been warned of the risks, and that transfers in the data subject’s interest could only be given if the data subject were unable to consent. There would be a new ground of external transfers in the data controller’s or processor’s legitimate interest, subject to safeguards being in place. The concept of the ‘public interest’ justifying such transfers would be further clarified in national or EU law.

The Council position

As regards the standard rules, the Council would amend the Commission proposal to clarify that the rules will apply whether or not the data controller offers goods or services for payment. However, as regards monitoring of behaviour, the rules will only apply if the data controller monitors behaviour within the EU.

For external transfers, the Council would add further detail to the rules regarding the assessment of the adequacy of third states, including a specific reference to participation in regional or multilateral data protection treaties. The Council also wants to give an advisory role to the planned new European Data Protection Board in this process. The Council would require the Commission to monitor the application of its adequacy decisions, and empower it to revoke them. However, the Commission would no longer have the power to adopt a decision specifying that a third State had inadequate protection.

The Council would also permit external transfers to take place on the basis of a code of conduct or a certification mechanism. Transfers in the private interest of the data processor or controller would be subject to a possible override in the data subject’s interests. The Commission would lose powers to define the public interests reasons for transfers, and Member States would gain more powers on this point.  

The EP position

The EP would amend the Commission proposal so that, where the controller or processor is established within the EU, it would not matter where the data was processed. Also, the standard rules would apply to the offering of goods or services or monitoring by data controllers or data processors, and would apply to any sort of monitoring of data subjects, not only the monitoring of behaviour. Unlike the Council, the EP would not limit the monitoring clause to behaviour within the EU. However, like the Council, the EP would apply the rules even if goods or services are not offered for payment.

As for external transfers, the EP agrees with the Council that the Commission should monitor its adequacy decisions, and that there should be a role for the new Board.  However, the EP wants to apply a ‘sunset clause’ to pre-existing adequacy decisions, and retain the power for the Commission to adopt ‘inadequacy’ decisions.

Similarly, pre-existing authorisations of contractual clauses would expire soon after the new rules were adopted, although the EP agrees with the Council that a form of certification process should justify external transfers. For binding corporate rules, the EP wants to ensure consultation of workers where their data is involved, and apply the rules to sub-contractors (the Council approaches the latter issue by referring to groups of companies). As regards the derogations, the EP would reject the idea of transfers in the legitimate interests of controllers.

Finally, the EP has proposed a new ‘Snowden clause’ which would mean that national courts could not recognise the decisions of non-EU courts which ordered the disclosure of personal data. However, this rule would be ‘without prejudice’ to mutual assistance treaties or any other international agreements between a non-EU state and the EU or any Member State.

Comments

One important point should be addressed at the outset: what is the result of the recent EP election on the EP’s position? In the EU system, proposed legislation does not fall simply because there is an election for the EP, or because there will be a new Commission as from November. Rather, the newly elected EP traditionally holds a vote at an early stage to decide whether to reaffirm the positions taken by the previous legislature. Usually it reaffirms almost all of the prior legislature’s positions. It should be recalled that the EP’s position on the data protection Regulation was adopted by a huge majority, and so despite the increase in the number of populist MEPs, a majority in favour of approving the EP’s prior position on this proposal should in principle not be hard to find.

For its part, the incoming Commission will decide whether to withdraw some of its pending proposals, but is very rare for an incoming Commission to withdraw a proposal which is actively under discussion in the Council and EP, such as the data protection proposal.

Moving on to the substance of the issues, as regards the application of the standard rules, all three institutions agree to keep the rule on establishment, extending it to data processors also. The EP’s suggested amendment regarding the location of the data processing is merely a clarification, which is probably not necessary.

The three institutions all agree to drop the ‘use of equipment’ clause, to keep the clause on public international law, and to add a new clause regarding goods and services and monitoring. The EP and the Council also agree that the ‘goods and services’ clause will apply even where there is no payment made. The institutions differ as regards extending the new clause also to data controllers, and differ as regards the exact scope of the monitoring of behaviour.

As for the external transfers rules, all three institutions would keep the current basic structure. They differ as regards: the ‘Snowden clause’ (although this rule is very weak, in light of its exceptions for any international treaties); whether the Commission can adopt an ‘inadequacy decision’ (it has never done so); sunset clauses for prior authorisations; whether private interests can justify external transfers; and the process of determining when the public interest can justify them.

Taken as a whole, the impact of the new rules depends on how the current rules are interpreted. There is no reason to doubt that the ‘establishment’ clause would be interpreted the same way as it was in Google Spain, ie applying at least where a subsidiary’s activity is linked to a non-EU parent company’s business model. But there is no case law clarifying what the ‘use of equipment’ means, and so it is not easy to assess what removal of this clause will mean in practice.

Instead the focus will be on what it means to offer goods or services (whether or not for payment), and what it means to monitor an individual. These concepts are clarified in the preamble, which indicates that the ‘offering goods or services’ rule will apply where there a website seeks to sell its products or services, and its online activity is particularly directed towards EU citizens (in light of the currency or language used). So the intention is apparently not to cover a non-profit body like Wikipedia, or a social network or search engine which does not charge for its services (although some such entities would be covered by the ‘establishment’ rule).

What about ‘monitoring’? Here, the preamble suggests that the new clause applies when an individual’s Internet activities are tracked with a view to profiling him or her. There is no suggestion in the preamble that keeping records of a person’s use of social networks would count as monitoring.  But if that is not the intention, it would be better for the EU legislature to rule it out more expressly. In any event, it is difficult to see how the Council’s limitation regarding the monitoring of behaviour within the EU would work in practice, in light of the nature of the Internet.

As regards the external transfer clauses, their importance depends on whether the standard clauses apply. The greater the number of businesses covered by the standard rules, the less important the external transfer rules are – and vice versa.

It is clear that the external transfer clauses will remain broadly similar to the current rules, so any corporate or NGO strategies regarding these clauses would only need to be amended modestly, rather than be overhauled. The biggest issues may be the EP’s insistence on its ‘Snowden clause’ and its rejection of the idea that external transfers can take place in the data controller’s interest, although the former clause is weak and data controllers can usually pursue their interests by means of obtaining consent or establishing a contractual relationship.

Much of the most difficult work as regards the negotiation of the new rules remains to be done. In fact, it is rather peculiar to negotiate a new law by defining its territorial scope before agreeing on its main substance.

While a vast number of issues will arise in the forthcoming negotiations, the following are particularly relevant to the fallout from the Google Spain decision, in particular as regards its possible impact on social networks and Wikipedia: the interpretation of a ‘data processor’ (which would be particularly significant if the EP gets its way and the entire clause on territorial scope applies to data processors); the possible application of the ‘household exception’ to user-generated content; the exception for journalism; and the definition of the grounds for processing personal data (notably consent and the controller’s legitimate interests).

Barnard & Peers: chapter 9 

“I’ll rest when I’m dead”: the CJEU rules that holiday pay can be inherited

 

Steve Peers

Unfortunately, all of us have to die someday. More unfortunately still, some people die during their working life, without having a chance to enjoy a well-earned retirement. This raises (among many other things) the question of whether their employment law rights can be inherited.

EU law does not regulate the substantive inheritance law of each Member State. However, EU law does apply where there are cross-border aspects to an inheritance, as regards taxation (where the free movement of capital could be relevant) and as regards the choice of law and civil jurisdiction (which is subject to a Regulation applicable from 2015).

But what about employment law and inheritance? EU law has regulated a number of aspects of employment law, but does not specify what happens in the event of death. This CJEU has now ruled that, at least as regards the right to annual leave pursuant to the working time Directive, employment law rights can be inherited.

The judgment

Article 7(1) of the working time Directive states that every worker is entitled to at least four weeks’ paid leave, ‘in accordance with’ national conditions for entitlement and granting of leave. Article 7(2) states that this minimum period ‘may not be replaced by an allowance in lieu, except where the employment relationship is terminated’.

Previous CJEU judgments in cases such as Schultz-Hoff and Stringer, established that where workers cannot take their annual leave due to sickness, the right to four weeks’ paid annual leave accrued pursuant to the Directive had to be carried over. In the Bollacke judgment, the worker died after a long sickness. When he died, 140 days’ leave was due to him, and his wife (his sole heir) claimed that she had inherited this entitlement.

Although the national legislation implementing the Directive was silent on the issue of whether the allowance in lieu for unused holidays could be inherited, the higher German courts had ruled that it could not. So a lower German court asked the CJEU to interpret the Directive on this point.

According to the Court, the allowance could be inherited. It began by reiterating that paid holiday was a ‘particularly important principle’ of EU social law from which there is no derogation. Crucially, it asserted that the holiday and the payment for it were ‘two aspects of a single right’. Next, Article 7(2) of the Directive did not contain any conditions besides ending employment and having accrued holiday pay. Finally, inheriting the right to accrued holiday pay was essential to ‘ensure the effectiveness’ of the right, because otherwise an ‘unintended occurrence…beyond the control of both the worker and the employer’, would extinguish that right.

Also, the national court had asked whether the worker had to make an application first in order to obtain the back pay. The CJEU reiterated that Article 7(2) of the Directive did not provide for extra conditions, so no such requirement could be applied.

Comments

The Court’s judgment could have consequences for the interpretation of other EU employment law, and even for EU law more generally. While the Court confines its interpretation to a specific provision of the working time Directive, its judgment could form the basis for a prima facie argument that rights can be inherited pursuant to other EU employment law. Most obviously, this reasoning would apply to back pay due pursuant to the Directive on insolvent employers, and to compensation relating to any breach of other EU health and safety legislation – recalling that the working time Directive forms part of that corpus of legislation, and that the death of the worker might in fact have resulted from such a breach.

The Court’s focus on the effectiveness of the legislation concerned is a general point, and this means that this argument could be taken further, for instance as regards compensation due for breach of the EU’s non-discrimination legislation. This reasoning would equally apply as regards consumer law, a fortiori in cases (for instance, a breach of the product liability directive) where a breach of EU law again led to the person’s death directly.

As for the working time Directive itself, the Court’s insistence that no added conditions could be placed upon the right to accrued holiday pay means that such pay must be granted not only where the worker’s employment ended in the ordinary course of events (due to redundancy, retirement or voluntary departure), but also where the employee was dismissed for cause. This might certainly rankle employers in the case of those former staff members who treated every day as a holiday, or upset the general public in the event of an employee ‘going postal’.

In this context, the Court’s reference to death as an ‘unintended consequence’ beyond the worker’s and employer’s control is unhelpful, since it suggests that there might be cases where accrued holiday pay would not be payable on death. Of course, some workers commit suicide, and some appalling employers are responsible for workers’ deaths. Logically, the back pay should also be payable in both those circumstances (particularly the latter).

How can this judgment be enforced? As noted above, the problem in this case was created by national case law, not legislation, so it will be possible to remedy the problem by means of ‘indirect effect’, ie the national court interpreting that national law to be consistent with the Directive. In Member States where the law expressly limits inheritance of holiday pay, the Directive will be directly effective against public sector employers, but not against private sector employers.

In the latter scenario, workers’ heirs will have to seek compensation from the State based on the Francovich judgment, unless it can be argued that Article 31 of the EU Charter of Rights can be used to suspend the national law in question. The CJEU recently clarified whether the Charter can be used against employers indirectly in this way in the AMS judgment, but in today’s opinion in Fennoll an Advocate-General has rejected the idea as regards Article 31. Time will tell whether the Court accepts this analysis; but it is notable that today’s judgment makes no mention of the Charter at all.

The Court’s ruling that the worker cannot be expected to make a prior application for accrued holiday pay makes sense if one accepts its key finding that such pay can be inherited. It would be unreasonable to expect an employee to make such a claim while seriously ill, and it would simply be impossible in the event of the worker’s sudden death.

So this brings us to the Court’s key finding: does it make sense to say that accrued holiday pay can be inherited? While today’s judgment glosses over this, in previous cases (most recently Lock) the Court of Justice has emphasised strongly the importance of the worker receiving full holiday pay as an incentive to take the holiday, in order to get the rest which the Directive provides for, which is meant to guarantee the worker’s health. But obviously, deceased workers can no longer get the type of rest which the Directive refers to. Having insisted so strongly on the link between the pay and the holiday, the Court now insists on the severability of the two aspects of the right.  

Moreover, as usual the Court ignores the reference in Article 7(1) of the Directive to national conditions for eligibility and grant of holiday pay. Some prior case law does accept that limits can be placed on the carry-over of holiday pay, and therefore upon the accrued pay that can be claimed upon termination of employment. But the Court makes no specific mention of that case law (the KHS judgment) here.

So, with great respect, the Court’s judgment is not terribly convincing in terms of the wording and purpose of the Directive. Nor does the Court explain its reasoning very well in light of prior case law.

But having said that, no one would begrudge Mrs. Bollacke (and others in her situation) from receiving a modest amount of extra inheritance following her bereavement. The judgment is unlikely to have an enormous impact on employers, since most workers live to retirement age. And the ruling can be justified in the broader context of the relationship between workers and employers, since it prevents an unscrupulous employer, knowing that a worker is terminally ill, from artificially delaying proceedings in the hope that the worker’s claim will expire along with the worker.

 

Barnard & Peers: chapter 20

More back-slapping than soul-searching: The European Commission’s reflections on the UN Convention on the Rights of Persons with Disabilities

Dr. Charlotte O’Brien, Lecturer in Law, York Law School, University of York

More than seven years on from signing the UN Convention on the Rights of Persons with Disabilities (UNCRPD), and three and a half years on from conclusion of the Convention, how is the EU doing on protecting the disability rights contained therein? Extremely well, according to the European Commission. So well, in fact, it seems the UNCRPD was barely necessary at all, since the EU was doing the right things anyway. But this self-analysis – in the Commission’s first report on implementation of the UNCRPD – is unsurprisingly partial, in both senses of the word, being both predisposed to the Commission’s viewpoint, and incomplete.

The report is a series of responses to each article of the Convention, capturing some element of EU activity. There is no section addressing the overall picture, or what is missing, or what needs to be done. The focus is on the patchy assemblage of areas in which disability has been (however peremptorily or indirectly) considered by EU law – and not on the significant gaps. It is tricky to differentiate between those activities that the Commission consider to follow from the UNCRPD, and those that were happening anyway, especially as there is a heavy reliance on the EU Disability Strategy. The Strategy document does refer to the UNCRPD several times – but makes only one mention of it in the ‘areas for action’ of accessibility, participation, equality, employment, education and training, social protection and health.

The message does seem to be that substantive Convention duties were largely being discharged, and the Convention has inspired some procedural refinement.  For example, on assessing the Commission’s internal rules and practices, the Commission ‘concluded that they were in line with the letter and the spirit of the CRPD. However, the review highlighted the need to offer additional guidance to services on the application of reasonable accommodations.’

Some of the most significant issues which emerge from, but are not engaged with in, the report are: (i) the difficulty EU institutions have had breaking away from a medical model of disability; (ii) the continued exclusion of disabled migrants from free movement rights; (iii) the limits of discrimination law; (iv) the detrimental impact of the EU-wide austerity agenda on disabled citizens; and (v) the use of non-justiciable measures and initiatives, combined with a dearth of impact evidence. 

(i)  The EU’s persistently medical model of disability

The report states that in the HK Danmark cases the CJEU adopted the UNCRPD definition of disability, combining medical impairment with ‘physical, mental or psychological impairments which in interaction with various barriers’ create limitations that ‘hinder the full and effective participation of the person concerned in professional life on an equal basis with other workers’.

But this was not unproblematic adoption of a more social model – the Court then conflated impairment with the limitation (i.e. the disability) that ensues following interaction with social and environmental barriers – a confusion repeated in this report. Despite the references to social and environmental barriers, the Advocate General and the Court focused on impairment and barriers were not considered.

The same approach of name-checking the UNCRPD definition without engaging with its substance was taken in the surrogacy case (C-363/12 Z), in which a woman whose medical condition prevented her from carrying children was to have a baby through a surrogate mother and wished to take maternity leave. The exclusion of such women from maternity leave rights presented an ideal opportunity to engage with the idea of socially created disability – as here was a condition that in itself might not be disabling, but on interaction with employment rules became a source of disadvantage, or limitation, in the workplace. But the Court insisted that an impairment must be a disability in itself  - finding that ‘it is not apparent from the order for reference that Ms Z.’s condition by itself made it impossible for her to carry out her work or constituted a hindrance to the exercise of her professional activity.’

It is not just the Court that struggles. The report refers to the ‘social concept of disability’, but relies throughout upon a very medico-economic standpoint – necessarily reflecting the impairment-centric approach of the legislation cited. The General Block Exemption Regulation (a key measure in EU state aid law) defines disability as someone recognized under national law as disabled, or someone who has ‘a recognised limitation which results from physical, mental or psychological impairment’. 

(ii) Cross border mobility

The report is a little evasive and misleading as to the free movement rights of disabled EU citizens. After noting the exclusion of EU migrants form social assistance for the first 3 months in a host state, it goes on to add that ‘if they lawfully reside there for period longer than three months, EU citizens are entitled to social assistance benefits on an equal footing with nationals of the Member State concerned.’ But in the UK, EU migrants have to fit in to one of the categories of Article 7 of Directive 2004/38 of the citizens’ Directive (ie, the grounds for an EU citizen to reside for more than three months in another Member State) in order to be considered lawfully resident. So someone considered economically inactive (and disabled persons are disproportionately more likely to be so considered) will not be entitled to social assistance. The Report does add the caveat that ‘in specific cases where authorities have a reasonable doubt that the EU citizens concerned may become an unreasonable burden on their social assistance system, they may assess the individual situation taking into account all relevant circumstances and the principle of proportionality, and could, on this basis, terminate the right of residence of the persons concerned.’ But, certainly in the UK, refusal of benefits to economically inactive EU migrants is routine, and mandated by law – it is not just in ‘specific cases’. Nor is there recourse to a discretionary assessment of ‘all the relevant circumstances’ or use of ‘proportionality’.

Disabled persons are also disproportionately more likely to be in receipt of special non-contributory benefits (SNCBs), but following the CJEU’s judgment in Case C-140/12 Brey, they cannot rely on this entitlement to argue that they are self sufficient and not reliant on social assistance, and so can also be excluded from equal access to SNCBs. Equal access to benefits in the host state is not the only obstacle. The social security coordination regime also excludes social assistance and SNCBs from exportation rules, so that recipients are helped by neither home nor host state.

(iii) The limits of discrimination law

Disability equality rights are limited to Directive 2000/78, the employment equality Directive, which ensures equality on grounds of disability, age, sexual orientation and religion as regards employment and occupation. The report notes that in 2008 the Commission put forward a proposal to extend non-discrimination beyond employment, and merely concludes that ‘the proposal is under negotiation in the Council, where the unanimous vote of the Member States is required for its adoption’. It does not enter into the protracted, tortuous route it has taken, or its period of dormancy, or its recent revival, the continued Council controversy, or the apparently vanishing likelihood of unanimous approval ever being reached. As of this month, the disability provisions as a whole were still one of the ‘outstanding issues’.

(iv) Austerity and poverty

In pushing an austerity agenda, the EU draws upon the logic of flexicurity and activation, to pressure Member States into reducing their welfare expenditure and focus on pushing the disabled into the workplace. The Report notes that the position of the Disability Strategy is that ‘quality jobs [are] the best protection against poverty for disabled people’. However, welfare retrenchment strategies tend not to promote ‘quality’ jobs, but any jobs, and penalize those whose circumstances make it harder for them to find work.  The report notes that severe material deprivation increased amongst disabled people between 2010 and 2011, from 10.9 to 12%; an increase 2.75 times greater than that experienced by non-disabled people.  But the report does not suggest a response to this disability-inflated poverty risk increase or connect it to social protection policies. Moreover, many welfare reforms will have only started to bite since 2011.

On top of this, there are important questions about the disproportionate impact of poverty upon persons with disabilities, who without financial means may be more likely to be disempowered through family-based support or institutionalization. On being asked in the European Parliament about the prospects of increased institutionalization, Commission Vice-President Viviane Reding has suggested that the remedy lies in the Commission’s employment policies, which in the context of persons requiring substantial care, and in an employment environment still very poorly adapted to disability, seems to be an example of ardent ideological faith rather than realistic projection.

(v) Measures without impact evidence

The report is replete with references to not-easily-actionable sources, and softer measures, such as those which ‘encourage Member States’, without explanation as to the degree – or the success – of ‘encouragement’. It relies fairly heavily on the Charter of Fundamental Rights, but does not engage with the question of if and how disabled people can actually access the rights declared within, given the limitations built into the Charter and the wariness of courts to find it can create any right that does not exist elsewhere. The Charter could well still prove a valuable interpretative prism – but it would be helpful had the report engaged in the practical utility question. Where more clearly justiciable instruments are referred to, the relevant text as it affects disabled people is often plucked from recitals, suggesting that they do not reside in the more easily invoked Article based provisions, and raising questions over the degree to which individuals can rely solely on recitals.

Some of the activities cited are conspicuously outcome-light – such as the preparation of the now-stymied Directive extending non-discrimination law, or the mandates to draft accessibility standards for the built environment issued in 2007 and 2010. The report notes that they have not yet led to the standards being drafted, and does not offer any insight into whether attempts are being made to do so. While pointing to (excellent) reports by the Fundamental Rights Agency on issues such as rights to independent living and political participation, the report does not highlight the conclusions or recommendations of those reports, or suggest what follow up action is to be taken. The frequent references to the European Disability Strategy, and associated awareness campaigns (33 mentions of raising awareness), lead us to ask what effects these are actually having, and how the Commission is measuring the impact of its activities.  The report does list the Commission’s generic data gathering activities, but there is no mention of indicators of the success of its own policies and ‘soft’ measures.

As anyone who has been through the recent Research Excellence Framework process in a UK university will know, impact is not simply about saying you will make things available, or tell people stuff. We have to show that doing so makes a difference; it does not seem unreasonable to expect the same of the Commission. Such a task might avoid the pitfall of constructing a complacent defence of the status quo, and might instead encourage an active identification of things that need changing.

Some of the ideas presented here are developed in more detail in ‘Article 26: Integration of persons with disabilities’ in Peers, Hervey, Kenner and Ward (eds), Commentary on the EU Charter of Fundamental Rights (Hart: Oxford, 2014), and ‘Union citizenship and disability: restricted access to equality rights and the attitudinal model of disability’ in D. Kochenov (ed) Citizenship and Federalism in Europe, CUP, forthcoming.

Barnard & Peers: chapter 9, chapter 20 

The CJEU enhances the EU’s role as an external actor

Steve Peers

In today’s judgment in Commission v Council, the CJEU ruled that the EU’s partnership treaties with third States must be adopted using EU powers relating to development and trade (common commercial policy) even if those treaties include provisions relating to transport, the environment and readmission. Due to its broad concept of development policy, the Court’s judgment will entail an increase in the EU’s ability to obtain its external policy objectives.

Background

The EU has been signing development policy treaties (and adopting development policy legislation) for a long time, but its formal powers in this field date back to the original TEU (Maastricht Treaty), in force in 1993. When adopting development policy measures, the Council votes by a qualified majority, meaning that a Member State might be outvoted.

There have been several ‘generations’ of EU development policy treaties, each of them wider in scope than the last. The key previous ruling on the scope of the EU’s development policy is a 1996 CJEU ruling concerning an agreement with India. In the Court’s view, the concept of development policy was a broad one, extending beyond the traditional sphere of poverty relief to such areas as energy and culture, as long as the relevant provisions of the treaty did not set out ‘concrete obligations’. If they did, then other EU legal bases, possibly entailing unanimous voting, or the participation of the Member States in the treaty might be required.

Since then, there is another new generation of EU development treaties (now called partnership agreements), extending even further in scope. Member States have insisted that these treaties need their involvement alongside the EU, and also that the treaties concerned need other legal bases to  be adopted.

While today’s judgment concerned a treaty with the Phillippines, the EU has also agreed or is negotiating similar treaties with many other Asian countries, most notably China.

The judgment

According to the Court of Justice, the provisions in the partnership treaty concerning transport and the environment are essentially ‘declarations’, and so do not entail concrete obligations. So the development policy legal base is enough to cover them.

Furthermore, the Court ruled that the treaty provisions on readmission fell within the scope of development policy. This was because while although the commitment in the partnership agreement to accept each party’s own nationals who were present without authorisation, and to negotiate a treaty to this effect, was binding, it was not sufficiently detailed to constitute a ‘concrete obligation’.

Comments  

The consequence of the judgment is that partnership agreements with similar clauses cannot any longer be subject to separate decisions approving them as regards immigration issues, due to the opt-outs of the UK, Ireland and Denmark on such issues. Therefore this judgment continues a general trend in which the Court narrowly interprets the terms of these opt-outs (see the previous posts regarding recent judgments on social security and transport safety). This limitation of the opt-out is the most obvious consequence of the judgment, since the voting rule in Council and the involvement of Member States in signing the treaty were not contested.

However, this is a distinct question from whether EU association agreements need to be subject to the same procedure for separate decisions (which is currently the case) if they contain such clauses on immigration issues. But the case for separate decisions as regards the immigration provisions of association agreements has obviously been weakened by analogy by this judgment. It should be noted that the Court found that all of the ‘migration management’ provisions of the partnership treaty, not just the specific provision on readmission, fell within the scope of the development policy powers.

The Court’s ruling as regards the transport and environment provisions is unsurprising, in light of the previous judgment on the scope of development policy (which the Court reaffirmed). Furthermore, it would be possible, in light of the Court’s ruling on the immigration issues, to include in partnership agreements some specific commitments as regards (for instance) signing further treaties on climate change or aviation liberalisation, since they would not constitute a concrete obligation.

The judgment is more questionable as regards readmission. The Court rightly did not accept the Advocate-General’s opinion that a merely political link between readmission and development was sufficient to bring the former issue within the scope of the latter. Rather, it narrowed the scope of the notion of a ‘concrete obligation’, thereby widening the scope of the notion of development policy. So a legal commitment is not necessarily a concrete obligation: it depends on how specific that commitment is.

More broadly, arguably this judgment opens up scope for the EU to insist on more specific human rights obligations as part of its partnership agreements. An obligation to sign key human rights treaties, and/or to pass certain legislation improving human rights domestically, is arguably not concrete enough within the meaning of this judgment.

Overall, the consequence of this judgment is that the EU’s development policy is broader than had previously been understood to be the case, with the result that the EU can insist upon more obligations on behalf of its partners without this entailing institutional complications on the EU end. The Court’s judgment therefore makes it easier for the EU to insist that more countries adhere to its external policy objectives, and so makes the countries‘ development more conditional upon compliance with the EU’s goals.

Barnard & Peers: chapter 24, chapter 26