Data Retention: AG opinions on the latest CJEU cases on national laws

 

Lorna Woods, Professor of Internet Law, University of Essex

 

Introduction

 

Advocate General Campos Sanchez-Bordana has handed down his opinions in three more cases (SpaceNet and Telekom Deutschland (Joined Cases C-793/19 and C-794/19), GD v Commissioner of the Garda Síochána (Case C-140/20) and VD and SR (Joined Cases C-339/20 and C-397/20)) which concern the retention of communications data, and constitute the latest instalment of a saga that started – ineffectually as far as rights-based arguments are concerned – in the unsuccessful Irish challenge to the Treaty base chosen for the Data Retention Directive (Directive 2006/24/EC) (Ireland v European Parliament and Council (Case C-301/06)). 

 

The Data Retention Directive, which provided for communications data retention, effectively within the scope of the exceptions found in Article 15 of the e-Privacy Directive (Directive 2002/58/EC) to the principle of communications confidentiality, was struck down in Digital Rights Ireland (Joined Cases C-293/12 and C-594/12) (discussed here).  Building on the principles there, a series of cases developed the constraints on what was permitted by Article 15 e-Privacy Directive, notably: Tele2 Sverige and Watson (Joined cases C-203/15 and C-698/15) (discussed here and here), La Quadrature du Net and Others (Joined cases C-511/18, C-512/18 and C-520/18) and Privacy International (Case C-623/17) (discussed here). Points of detail have been added in Ministerio Fiscal (Case C-207/16) (discussed here) and HK v Prokuratuur (Case C-746/18).  The principles underpin the data transfer cases: Schrems I and Schrems II. As well as recommending that the Court continue with its approach, maintaining the gap between it and the European Court of Human Rights, the Opinion of the Advocate General indicated a certain irritation with the national courts unwilling to apply clear principles and necessitating more Grand Chamber rulings on this topic.  In other words, not much is new here, but rather a re-iteration of the principles and distinctions on which this juriprudence has been built.

 

The Cases

 

SpaceNet and Telekom Deutschland concern the German legislation requiring internet service providers to retain communications data. Reflecting to some degree the concerns highlighted in the CJEU’s previous jurisprudence, the German law had excluded the communications data of certain help lines from the regime, the data collected was retained for a comparatively short period, and there were safeguards against misuse of the retained data. SpaceNet and Telekom Deutschland had each challenged this law on the basis of the CJEU’s jurisprudence.

 

GD v Commissioner of the Garda Síochána arises from a murder case, the prosecution of which was based on communications data retained and accessed via legislation that provided for mass retention of data. The defendant challenged the admissibility of this data arguing it was contrary to EU law requirements.

 

Joined cases VD and SR also concern criminal prosecution for financial offences, based on communications data. This time the data retention was based on national law implementing Directive 2003/6/EC, as well as Regulation 596/2014, rather than concerning the e-Privacy Directive. These rules allowed access to existing communications data held by telecommunications operators. The reference raised the question of these rules’ compliance with the fundamental rights of Article 7 and 8 EU Charter, as interpreted by the case law on the e-Privacy Directive.

 

In each case, the Advocate General suggested that the Court hold that the national laws were incompatible with Charter rights, re-iterating that the relevant provisions

‘must be interpreted as precluding national legislation which obliges providers of publicly available electronic communications services to retain traffic and location data of end users of those services on a precautionary, general and indiscriminate basis for purposes other than that of safeguarding national security in the face of a serious threat that is shown to be genuine and present or foreseeable’ (Spacenet, para 84)

 

In all three opinions, he re-stated the conditions found in La Quadrature du Net, para 128. This principle was specifically applied to investigations into insider dealing or market abuse (ie not national security) in VD and SR (para 97). In GD it added that access to such data legitimately retained must be subject to prior independent authorisation, and that the temporal effect of the ruling could not be limited (so that the ruling had prospective effect only) (GD, para 82 – see to similar effect VD and SR, para 97). The Advocate General also noted that there was a distinction between the approach of the CJEU and the European Court of Human Rights, but that the jurisprudence of that Court provided a base level and the requirements of the Charter could be higher than those of the Convention.

 

Comment

 

The jurisprudence has built on a series of, generally binary, distinctions, the most basic of which is that between EU and national competence, given that Article 4(2) TEU requires the EU to respect Member States’ essential state functions, including maintaining law and order. It specifically states:

 

“national security remains the sole responsibility of each Member State”.

 

Many Member States use data retention and the analysis of data as part of their fight against terrorism and in support of national security. On this basis it has been argued that national laws providing for such schemes fall outside the competence of the EU, and in SpaceNet a number of governments intervened to make the same argument again.  This argument in the words of the Advocate General has been “emphatically rejected” (SpaceNet, para 32), citing La Quadrature du Net, though this position is more clearly seen in Privacy International and had already been established in Tele2 Sverige and Watson (and could be seen as implicit in the distinctions employed in Ireland v European Parliament and Council). While Article 4 TEU does exclude national security from the scope of EU law, it is to be narrowly understood - applicable to the activities of intelligence agencies for the purposes of safeguarding national security. This seems to be a well-established principle and unlikely to be disturbed now, no matter the representations of the Member States.

 

Another longstanding distinction made in the case law is between content of communications and communications data (meta data), including traffic data (which seemingly also includes the subscriber name and the IMEI address of the mobile device according to Ministerio Fiscal, paras 40-42) and location data.  Mass acquisition of the content of communications goes to the essence of the right and cannot be justified. The Court has accepted that the acquisition of communications data in principle could be justified, as can be seen in Tele2 Sverge and Watson, Privacy International and La Quadrature du Net, suggesting that the intrusion cause by mass acquisition of communications data is less intrusive than knowledge of content. Whether – given the harm attributed to this collection: the possibility of creating detailed profiles on individuals – this is wholly true is debatable.  Note, however, that the Court has accepted that some sorts of data may be seen as less sensitive – notably identity and IP addresses in the context of criminal investigations.

 

The Court suggested in Ministerio Fiscal that the intrusion was less (perhaps to enable itself to justify taking a different approach from Tele2 Sverige and Watson), though it was unclear as to whether this was to do with the type of data in issue or because of the limited amount of data involved (and its severability from other data). In its ruling, the Court confirmed that access to retained data which reveals the date, time, duration and recipients of the communications, or the locations where the communications took place, must be regarded as a serious interference since that data allows precise conclusions to be drawn about the private lives of the persons concerned (para 60), suggesting it is what you can do with the data that is important rather than the amount of data.  The Court has suggested in other contexts that certain types of data are less important: see the data involved in PNR cases (Opinion 1/15, especially para 151, discussed here). In the current opinions, the Advocate General reiterated the position in La Quadrature du Net as regards IP addresses and identity (Spacenet, paras 81-82; VD and SR, para 80) but did not elaborate further.  The question about small sets of eg location data remains open. 

 

This possibility of profiling and its impact on users has led the Court to develop stringent conditions for the collection of data which are based on two interlinking sets of distinctions: that between general and targeted measures, and between national security and the fight against crime (with a sub-division between serious and other sorts of crime).  For all three cases, the Advocate General re-iterated the general principles established by the case law to date- though it is worth noting that he relied for preference on La Quadrature du Net (as a judgment which synthesised or summarised preceding case law), rather than other landmark cases – notably Tele2 Sverige and Watson – perhaps because (in the eyes of some) La Quadrature du Net allowed some State measures that would not seem on first glance to fall within Tele 2 Sverige and Watson – and which the Advocate General described as “supplementary qualifications” (GD, para 4). So, “general and indiscriminate retention of traffic and location data can be justified only by the objective of safeguarding national security”, which is distinct and more serious or important than the other objectives listed in Article 15 e-Privacy Directive (GD, para 36, Spacenet, para 37, VD and SR, para 75, each citing La Quadrature du Net). In sum, provided all the other conditions are satisfied, national security threats justify indiscriminate data retention, whereas serious crimes only suffice to legitimise targeted data retention.

 

Of course, this begs the question of what falls within national security for the purposes of Article 15 and what constitutes serious crime. According to Ministero Fiscal, the boundary between crime and serious crime falls to be determined by the Member States. While respecting national procedural autonomy, this might be open to manipulation or interpreted broadly (as the special, expansive definition of serious crime in the Investigatory Powers Act – when the UK was still a member of the EU – suggests). The Court in La Quadrature du Net suggested that national security

 

“encompasses the prevention and  punishment of activities capable of seriously destabilizing the fundamental constitutional, political, economic or social structures of a country and, in particular, of directly threatening society, the population or the State itself” (para 135). 

 

In VD and SR the Advocate General emphasised that the two types of measures – those aimed at safeguarding national security and those which are aimed at combatting crime – cannot have the same scope as otherwise the distinctions in La Quadrature du Net (with regard to the possibility of indiscriminate surveillance) would have no purpose and the fundamental rights protections would likely be undermined – and this is true no matter how serious the crime (VD and SR, paras 83-86).

 

As regards targeting, the Court has suggested that this need not be at the level of the individual but could relate to localities or to groups – suggestions which may raise all manner of social, political as well as technical questions (and see here, Interpol’s distinctions). As the Advocate General pointed out, it is not the responsibility of the CJEU to draft compliant regimes; this is the responsibility of the Member States.

 

La Quadrature du Net imposed conditions on national security and generalised surveillance, as well as on targeted surveillance for serious crime. In Privacy International, the CJEU restated its position that national legislation must develop objective criteria for both the acquisition of a particular dataset from a service provider and its actual use by the relevant authorities (see paras 78-81). Moreover, it seems that these conditions apply not just to traffic and location data, but also provisions regarding the preventive retention of IP addresses, subscriber information and other measures aimed at combatting serious crime. But, there are questions about the extent to which various sorts of safeguards may compensate for other weaknesses in the system (and this same question can be seen in respect of the European Court of Human Right’s jurisprudence where it blends lawfulness with safeguards and safeguards with proportionality, effectively reducing the scrutiny over acquisition in favour of control over use – an approach which does not deal with the chilling effect of Government access to and storage of data). The Advocate General here rejects this blurring of safeguards over access with control over acquisition and retention:

 

“for the Court, ‘the retention of traffic and location data constitutes, in itself … an interference with the fundamental rights to respect for private life and the protection of personal data’. In this regard ‘access to such data is a separate interference’ with those fundamental fights, irrespective of the subsequent use made of it.

 

For the present purposes it is therefore irrelevant that the data protection arrangements for retained data provided for in the German legislation (a) provide effective safeguards to protect those data; (b) place rigorous and effective limits on access conditions, restricting the circle of people who can access the data; and (c) allow the retained data to be used solely for the purposes of investigating serious offences and preventing specific risks to life or a person’s freedom or to the security of the state.

 

The truly decisive element is that, … , the retention obligation at issue is not in itself subject to any specific conditions.” (paras 74-76)

 

Limited retention periods constitute another such safeguard; as the German Government argued in Spacenet, it means that less detailed profiles might be drawn – and in this seems similar to the approach of the Advocate General in HK v Prokuratuur (para 82). While the Court agreed that the period of data retention was a relevant factor in determining the severity of the intrusion, however, it took the view that traffic and location data are generally sensitive because they allow for far-reaching conclusions about private life and that therefore should only be permitted in relation to serious crime (and presumably the protection of national security).  The Advocate General noted in Spacenet that a limited retention period cannot justify a general retention requirement (in relation to crime) (para 66). Moreover, the time period must be considered alongside the quantity of data retained and the techniques available for analysis (Spacenet, para 70).

 

While acquisition, storage and access of data constitute different infringements (and real-time access may give rise to different levels of intrusion from analysis of historic data), there are questions about the links between them. If retention may be justified only for serious crime, presumably access is likewise limited (the Court did not discuss this point in Ministerio Fiscal). This link was discussed in VD and SR. The legislation permitted access to existing records, but did not provide a basis for storage in the first instance. While the French Government argued that the market manipulation legislation implicitly allowed for data retention, the Advocate General argued that these existing records “can only be ‘lawfully existing records’, that is to say those compiled in accordance with Directive 2002/58” (VD and SR, para 62, emphasis in original).

This makes clear that matters pertaining to communications confidentiality are not easily to be displaced. In any event, even if such ‘implicit authorisation’ were to be accepted, “such retention would be subject to the same conditions as would necessarily apply if it were based on any other EU legislative provision”. That is, all EU legislation must comply with the requirements of the EU Charter and the Court’s interpretation of the requirements of Article 7 and 8, arising in the context of the e-Privacy Directive, do not apply to Article 7 and 8 only in the context of that directive but more generally. This recognition is important given the increasing acquisition of data by the private sector and its sharing with the public sector with the aim of delivery of public services of all kinds. For this reason, the requirement of approval of access requests by an independent body (seen also in GD in the context of the e-Privacy Directive) also arose in relation to the insider dealing and market manipulation legislation (para 95).  We might see in this the beginnings of a general approach to constraining state surveillance activities; it will be interesting to see the extent to which the Court pulls through concerns about profiling from this group of cases through to, for example, PNR.  There is a new reference pending challenging the broad nature of PNR data collected in Directive 2016/681/EU (Ligue des droits humans (Case C-817/19) – the hearing for this case is discussed here). The next question is where the boundary is between concerns about profiling in the context of national security and combatting crime, and profiling to support data-driven public service delivery more generally. This distinction does not yet seem to have been considered.

 

Barnard & Peers: chapter 9

JHA4: chapter II:7

Photo credit: EFF-Graphics, via Wikicommons

The CJEU Gets Brexit Done: New Judgment on Extradition from Ireland to the UK after Brexit

 

 

Professor Steve Peers, University of Essex

 

The CJEU this week delivered its first judgment on the impact of Brexit (as far as the EU side is concerned) since the UK has left the EU – swiftly following last week’s Advocate General’s opinion (which I discussed here; I’ve adapted some of that blog post in this one) in response to fast tracked questions referred from the Irish Supreme Court (on appeal from the Irish High Court’s judgment).

 

Background

The Court’s judgment concerns extradition from Ireland to the UK under both the withdrawal agreement and the EU/UK Trade and Cooperation Agreement (TCA). The former treaty provides that the internal EU legal framework for simplified extradition – the European Arrest Warrant (EAW) law – still applied between the UK and EU during the transition period set out in that agreement, which lasted from 1 February 2020 to the end of that year. (As an exception, three Member States refused to hand over their own citizens, but Ireland was not one of them). 

After that point, the separation provisions of the withdrawal agreement applied: the EAW law still applies if a fugitive was arrested on the basis of that law before the end of the transition period. If the EAW was issued before that date, but the fugitive was not arrested in time on the basis of the EAW law, the subsequent TCA provides that its extradition rules – which are similar, but not identical, to the EAW law – apply. (The TCA rules also apply to extradition requests first sent after the transition period ended, and the judgment in this case is also relevant by analogy to those requests too).  

The case is about two fugitives arrested in Ireland on the basis of British EAWs, who challenged their extradition to the UK. Both EAWs were issued during the transition period, but one EAW led to an arrest before the end of that period, hence the separation provisions kicked in, and the EAW law applies fully to the case. In the other case, the arrest took place after the end of this period, and so the TCA rules apply. The fugitive in the former case was already convicted and sentenced to eight years in prison, whereas the fugitive in the latter case was subject to a pending prosecution for fourteen alleged criminal offences.

Both two fugitives argued that they could not be subject to these rules in the two treaties, because even though Ireland agreed to both treaties in the EU Council, that country did not exercise a formal opt in as set out in the Justice and Home Affairs protocol relating to Ireland (and previously also applying to the UK) attached to the EU Treaties. If they had been successful, their challenge would have complicated not only extradition but other forms of criminal law cooperation between Ireland and the UK set out in the withdrawal agreement and TCA, in both directions (ie Irish requests to the UK too). It could also have impacted on criminal law cooperation between the UK and Denmark, which has a similar (but not identical) opt in protocol. (Criminal law cooperation would not entirely have ended, however, because there are other international treaties that would have applied as a default, although they do not simplify cooperation as much as the treaties with the EU do).

Judgment of the Court

The judgment first examines the scope of Article 50 TEU, noting that it has the twin objectives of ‘first, enshrining the sovereign right of a Member State to withdraw from the European Union and, secondly, establishing a procedure to enable such a withdrawal to take place in an orderly fashion’ (referring to the Wightman judgment, discussed here). The Court continued:

50      It is in order to be able to attain that objective effectively that Article 50(2) TEU confers on the European Union alone competence to negotiate and conclude an agreement laying down the detailed rules for withdrawal, since that agreement is intended to regulate, in all the areas covered by the Treaties, all questions relating to the separation between the European Union and the State withdrawing from it.

51      It was therefore pursuant to that competence that the European Union was able to negotiate and conclude the Withdrawal Agreement, which provides, inter alia, in relations with the United Kingdom, for the continued application of a significant part of the EU acquis, in order to reduce uncertainty and, to the extent possible, minimise disruption caused by the fact that, on the date of withdrawal, the Treaties cease to apply to the departing State, as is apparent from point 4 of the guidelines adopted by the European Council at its special meeting of 29 April 2017 following the United Kingdom’s notification under Article 50 TEU.

The Court also noted that there may be a contradiction between the procedure for the EU Council to conclude an international treaty in other circumstances – which may entail a unanimous vote – and a withdrawal agreement, where Article 50 TEU provides for a qualified majority vote. In the Court’s view, it followed that:

54      Since the withdrawal agreement is intended to cover all of the fields and issues referred to in paragraph 50 above, and since it is not possible to add to Article 50(2) TEU legal bases laying down procedures which are incompatible with the procedure laid down in paragraphs 2 and 4 of that article (see, to that effect, judgment of 2 September 2021, Commission v Council (Agreement with Armenia), C‑180/20, EU:C:2021:658, paragraph 34 and the case-law cited), it must be concluded that only Article 50 TEU, as an autonomous legal basis independent of any other legal basis set out in the treaties, can ensure that all of the fields falling within the scope of those treaties are treated consistently in the Withdrawal Agreement, thus enabling the withdrawal to take place in an orderly manner.

Furthermore, there would be ‘uncertainty’ because Ireland, having agreed to participate in the EAW system with the UK, ‘would be treated as if it had never participated in it’. This outcome ‘would be difficult to reconcile with the objective of reducing uncertainty and limiting disruption so as to enable an orderly withdrawal’.

As for the TCA, which was concluded on the basis of Article 217 TFEU (the power for the EU to conclude association agreements), the Court recalled its case law that Article 217 ‘empowers the European Union to guarantee commitments towards third countries in all the fields covered by the TFEU’. It followed that:

58      Agreements concluded on the basis of that provision may therefore contain rules concerning all the fields falling within the competence of the European Union. Given that, under Article 4(2)(j) TFEU, the European Union has shared competence as regards Title V of Part Three of the TFEU [ie EU competence as regards justice and home affairs], measures falling within that area of competence may be included in an association agreement based on Article 217 TFEU, such as the TCA.

Did the inclusion of extradition issues within the TCA require an additional legal basis relating to criminal law cooperation, besides that of an association agreement? While the case law states that the competence over association agreements can be used ‘only on condition that that measure relates to a specific area of EU competence and is also founded on the legal basis corresponding to that area’, that case law ‘concerned not the conclusion of an association agreement but the adoption of a decision on the position to be taken, on behalf of the European Union, within a body set up by such an agreement’; in such circumstances, where a decision could be adopted ‘by qualified majority without the participation of the European Parliament… the addition of a specific legal basis was necessary in order to ensure that any more stringent procedural requirements specific to the area concerned would not be circumvented’. This is distinct from an association agreement as such:

62      By contrast, since the conclusion of an agreement such as the TCA does not relate to a single specific area of action but, on the contrary, a wide range of areas of EU competence with a view to achieving an Association between the European Union and a third State, and the conclusion of such an agreement requires, in any event – in accordance with point (a)(i) of the second subparagraph of Article 218(6) TFEU and the first sentence of the second subparagraph of Article 218(8) TFEU – a unanimous vote and the consent of the European Parliament, there is no risk, as regards the conclusion of such an agreement, of more stringent procedural requirements being circumvented.

Nor did the prior case law on using multiple legal bases where a measure pursues multiple objectives apply, in the Court’s view. The Court recalled its case law taking a broad view of the scope of the EU’s development policy powers, and extended that approach to cover association agreements:

65      Those considerations also apply mutatis mutandis to association agreements whose objectives are designed in a broad manner, in the sense that the measures required in order to pursue those objectives concern a wide range of areas of EU competence.

66      That is precisely the case with regard to the TCA, since, as the Council submitted in its observations, in order to ensure an appropriate balance of rights and obligations between the parties to the agreement and to secure the unity of the 27 Member States, that agreement had to have a sufficiently wide scope.

67      Accordingly, in view of the wide scope of the TCA, the context of its adoption and the unequivocal declarations made by all the institutions and Member States involved throughout the negotiations on the withdrawal of the United Kingdom from the European Union, the inclusion in that agreement, alongside rules and measures falling within many other areas of EU law, of provisions falling within Title V of Part Three of the TFEU forms part of the general objective of that agreement, which is to establish the basis for a broad relationship between the Parties, within an area of prosperity and good neighbourliness characterised by close and peaceful relations based on cooperation, respectful of the Parties’ autonomy and sovereignty.

68      The surrender mechanism established by the TCA contributes to the pursuit of that objective, the Parties having indicated, in recital 23 thereof, that their cooperation relating to, inter alia, the investigation, detection and prosecution of criminal offences and the execution of criminal penalties would enable the security of the United Kingdom and the European Union to be strengthened. It follows that the TCA cannot be regarded as pursuing a number of objectives or as having several components, within the meaning of the case-law referred to in paragraph 63 above.

 

Comments

First of all, the Court’s approach to the scope of Article 50 is a logical application of its prior ruling that the purpose of Article 50 is partly to provide for an ‘orderly withdrawal’, as the Treaties cease to apply to the withdrawing State (note that the cessation of the Treaties to that country is not just an assertion in European Council guidelines, as the Court seems to imply, but is set out in Article 50 itself). This logically entails that the withdrawal agreement has a broad scope, covering ‘all the areas covered by the Treaties’ – because the withdrawal may raise issues as regards ending membership in any of those areas. The judgment implicitly confirms competence to conclude the transition period (‘the continued application of a significant part of the EU acquis’), also referring to ‘all questions relating to the separation’, in the context of ‘reduc[ing] uncertainty and, to the extent possible, minimis[ing] disruption’ (emphasis added). 

Although there is no reference to the potentially permanent system set up by the Northern Ireland protocol – which goes beyond purely transitional or ‘winding up’ rules – the Court’s judgment does point toward that direction, notably the reference to applying some EU law and to ‘all questions’ concerning withdrawal.

Secondly, as for association agreements such as the TCA, the judgment builds upon prior case law, and reflects the requirement for unanimity of Member States in the Council to conclude them – which is an even stronger guarantee for Member States than as regards development policy treaties (which can be concluded by a qualified majority in the Council). It appears, however, that the specific provisions in an association agreement should be linked to the objective of that particular agreement – although note that the Court’s description of the broad general objective of the TCA is not a frolic by the judges, but comes from the purpose of the treaty as agreed by the parties (see Article 1 of the TCA), which was quoted earlier in the judgment.

Finally, it is notable that while the Court confirms that the withdrawal agreement had to be concluded by the EU without participation of the Member States (para 50: ‘Article 50(2) TEU confers on the European Union alone competence to…’ – emphasis added), the Court does not comment on the fact that – unusually for association agreements – the TCA was also concluded by the EU without the Member States also becoming parties alongside it. However, the overall tenor of the judgment seems favourable to the EU only being a party to this agreement too (see the Council legal service opinion on this point). Given the Court’s explicit reference to the shared competence of the EU over justice and home affairs, it might reasonably be inferred from this judgment that, as the Council legal service argued, the EU alone may conclude association agreements when they include provisions on shared competence – or the Council may instead to conclude them alongside the Member States in such cases. 

Of course, the EU and the UK continue to argue about the interpretation, application and revision of the Northern Ireland protocol to the withdrawal agreement. Nevertheless, the Court’s firm conclusion that the EU had extensive powers to conclude the two key treaties relating to Brexit should address most or all complications that some had argued limited the powers of the EU to conclude those treaties. In that sense, at least as far as the EU is concerned, the Court of Justice has Got Brexit Done.

 

 

Barnard & Peers: chapter 26

JHA4: chapter II:2, chapter II:3

Photo credit: Jimmy Harris, via Wikimedia commons

Extradition from Ireland to the UK after Brexit: the scope of EU powers

 

Professor Steve Peers, University of Essex

What are the legal implications of Brexit? This is a huge issue, with many different elements, but for the first time, the CJEU will soon be ruling on it – at least as far as the EU side is concerned – subsequent to the UK leaving the EU.

A recent CJEU Advocate General’s opinion suggests answers to fast tracked questions referred from the Irish Supreme Court (on appeal from the Irish High Court’s judgment), concerning extradition from Ireland to the UK under both the withdrawal agreement and the EU/UK Trade and Cooperation Agreement (TCA). The former treaty provides that the internal EU legal framework for simplified extradition – the European Arrest Warrant (EAW) law – still applied between the UK and EU during the transition period set out in that agreement, which lasted from 1 February 2020 to the end of that year. (As an exception, three Member States refused to hand over their own citizens, but Ireland was not one of them).

After that point, the separation provisions of that treaty applied: the EAW law still applies if a person was arrested on the basis of that law before the end of the transition period. If the EAW was issued before that date, but the fugitive was not arrested in time on the basis of the EAW law, the subsequent TCA provides that its extradition rules – which are similar, but not identical, to the EAW law – apply. (The TCA rules also apply to extradition requests first sent after the transition period ended, and the judgment in this case would also be relevant by analogy to those requests too).

The new case concerns two fugitives arrested in Ireland on the basis of British EAWs, who are challenging their extradition to the UK. Both EAWs were issued during the transition period, but one of them led to an arrest before the end of that period, hence the separation provisions kicked in, and the EAW law applies to the case. In the other case, the arrest took place after the end of this period, and so the TCA rules apply. The fugitive in the former case has already been convicted and sentenced to eight years in prison, whereas the fugitive in the latter case is subject to a pending prosecution for fourteen alleged criminal offences.

What's the legal issue? The two fugitives argue that they cannot be subject to these rules because even though Ireland agreed to both treaties in the EU Council, that country did not exercise a formal opt in as set out in the Justice and Home Affairs protocol relating to Ireland (and previously also applying to the UK) attached to the EU Treaties. If successful, their challenge could complicate not only extradition but other forms of criminal law cooperation between Ireland and the UK set out in the withdrawal agreement and TCA, in both directions (ie Irish requests to the UK too). It could also impact on criminal law cooperation between the UK and Denmark, which has a similar (but not identical) opt in protocol. (Criminal law cooperation would not entirely end, however, because there are other international treaties that would apply as a default, although they do not simplify cooperation as much as the treaties with the EU do).

The Advocate General’s opinion argues against the fugitives’ attempts to limit the scope of the treaties. First of all, she notes that prior CJEU case law on the competence to adopt EU laws (which extends equally to the competence to conclude international treaties) looks at the ‘predominant purpose’ of the act being adopted to determine what the competence to adopt it should be.

Applying that test to this case, in her view both the power to conclude the withdrawal agreement (Article 50 TEU) and the power to conclude association agreements (Article 217 TFEU, the legal basis to conclude the TCA on the EU side) are broad.

First, the Article 50 competence necessarily includes a wide scope of power to wrap up the legal relationship with the departing Member State, in particular as regards the separation provisions at issue in this case – although she also refers to broad powers over a transition period, during which these EAWs were issued (para 46):

To that end, as the Commission in particular explains, Article 50(2) TEU provides for the competence to conclude a single, comprehensive agreement, based on a single specific procedure, which encompasses all areas covered by the Treaties that are relevant to the withdrawal. Such an agreement covers the bringing to a conclusion of procedures conducted on the basis of EU law, which are ongoing at the time of withdrawal, as regards the withdrawing State. That requires detailed rules and arrangements in a vast number of different areas falling within the EU acquis. In order to ensure an orderly withdrawal in the interests of the European Union, its Member States and indeed the withdrawing State, those rules and arrangements may include transition periods during which, for limited periods after the withdrawal takes effect, EU law continues to apply to the withdrawing State.

While the rules in the withdrawal agreement ‘cover many different policies, including, in particular, the surrender regime in criminal cases’, and ‘[o]rdinarily, to conduct those policies the European Union would act under specific powers and would be required to respect restrictions on those powers, such as Protocol No 21’ (paras 49-50, footnote omitted):

However, in the light of the aim of the Withdrawal Agreement all of those specific policies are necessarily ancillary to the predominant overarching objective of providing a comprehensive regime for the transition from membership of the European Union to third-country status. This is an extremely broad objective in the sense that it must be possible for the measures required for its pursuit to concern a very wide variety of specific matters. Indeed, the agreement must be able to deal with the full range of matters covered by EU law.

This would have caused particular complications where the withdrawal agreement provided for powers exercised by unanimous voting, given that Article 50 foresees instead qualified majority voting in the Council to conclude such an agreement. In her view, this could not ‘be resolved by excluding from a withdrawal agreement matters requiring incompatible procedures because Article 50(2) TEU does not provide for any exceptions to the arrangements for a withdrawal’. More broadly, she justifies this interpretation by referring to ‘the exceptional situation of a withdrawal’: the UK example ‘has demonstrated’ that ‘such broad arrangements have to be made under intense political pressure and within a very short time frame’, and ‘[r]equiring unanimity in the Council or excluding certain matters from the general procedure would add complexity to that process and increase the risk that no agreement is reached’.

So the inclusion of specific rules on a subject cannot alter the characterisation of the agreement as a whole. Here the Advocate-General refers back by analogy to case law on development policy treaties (see discussion here), which has taken a similarly broad approach to the EU’s development policy powers, which can cover a wide range of issues that might be relevant to the development of non-EU countries. That case law has carved out an exception if the development policy treaties set out a specific obligation in a specific field which is distinct from development policy cooperation; but the opinion argues that even if that exception also applies to the Article 50 competence, these provisions of the withdrawal agreement do not go beyond the objective of securing an orderly withdrawal process. The attempted comparison with another Advocate-General’s opinion on the Istanbul Convention on violence against women (on which, see the discussion here) is wide of the mark, as the withdrawal agreement is obviously quite different from that treaty.

As for association agreements, relying on prior case law (for instance, Demirel), she argues that the power to conclude association agreements is also broad, encompassing special links between a non-EU country and the EU. Although the CJEU has pointed to specific legal competences applying within the framework of an association agreement, the Advocate-General correctly points out that this applies to measures implementing association agreements (referring to the judgment on social security and the association agreement with Turkey). As with Article 50 and development policy, she suggests that the power to conclude association agreements is a broad power encompassing many policy areas; and even if there is an exception relating to further concrete obligations in a specific field, it would again be irrelevant here because the TCA essentially continues the EAW system that previously applied between Ireland and the UK.

Comments

In principle it is too late now to prevent the conclusion of the withdrawal agreement or the TCA – unless time travel is possible. Perhaps people living in 2019 should be (should have been?) braced for an influx of (ex)Tory MPs hoping to prevent their past selves from voting for the same withdrawal agreement that now disgusts them: Owen Paterson driving up in a Randox-branded De Lorean, or a nudus Jacob Rees-Mogg telling a startled plebeian “I need your clothes, your boots and your penny farthing bicycle”.

But in a legal sense it is possible for a court to rule that the conclusion of a treaty (or the adoption of another legal act) was invalid from the outset, or at least (as in this case) that aspects of it have never applied – although it should be noted that the CJEU has in some cases limited the past effect of its judgments in such cases (cf Test-Achats). So even if the fugitives in this case were successful, the Court might take the view that the extradition provisions of the treaties still apply to Ireland on a provisional basis until the formalities of the opt in process are completed – which would seem likely in light of Ireland’s prior agreement to these agreements.

Is the analysis of the Advocate-General rejecting such arguments here convincing? On association agreements, the case law has indeed taken a broad view of their scope, with the guarantee for Member States in such cases consisting of the requirement for unanimity of Member States in the Council to conclude them. As for Article 50, the Wightman judgment of the CJEU has already interpreted that Article to provide for the ‘orderly withdrawal’ of a Member State – and the Advocate-General’s interpretation best reflects that interpretation.

While it does not necessarily follow from her analysis that the potentially permanent system set up by the Northern Ireland protocol is covered by the scope of Article 50 – as it goes beyond purely transitional or ‘winding up’ rules – her opinion points in that direction, referring to an ‘extremely broad’ power to address ‘the full range of matters covered by EU law’ via a ‘comprehensive regime’. If all that is needed is that a provision of the withdrawal agreement have a link with orderly withdrawal from the European Union, it is more easily arguable that the protocol satisfies that test.

Barnard & Peers: chapter 26

JHA4: chapter II:2, chapter II:3

Photo credit: diego_cue, via Wikimedia commons

On Flights, Rock Concerts and the Needle in a Haystack A report from the Court of Justice of the European Union’s oral hearing on the PNR directive

 

 

Christian Thönnes, research assistant at the Department of Public Law of the Max Planck Institute for the Study of Crime, Security and Law in Freiburg.

Christian Thönnes ist wissenschaftlicher Mitarbeiter in der Abteilung Öffentliches Recht des Freiburger Max-Planck-Instituts zur Erforschung von Kriminalität, Sicherheit und Recht.

 

13 July 2021 was a potentially fateful day for the balance of privacy and security in the European Union. The Court of Justice of the European Union (CJEU) held an oral hearing in its preliminary ruling procedure C-817/19. Following a legal challenge undertaken by the Belgian NGO Ligue des Droits Humains, the Constitutional Court of Belgium had submitted ten preliminary questions to the CJEU (arrêt n°135/2019 du 17 octobre 2019). These questions concern the interpretation of Directive (EU) 2016/681 of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (in short: PNR Directive) and its compatibility with EU primary law. The hearing did offer important insights into the court’s thinking. Especially judge-rapporteur Mr. von Danwitz asked the EU Commission many critical questions which do not appear to portend good news for proponents of this unprecedented surveillance measure. After having worked on a similar case for the Berlin-based strategic litigation NGO Gesellschaft für Freiheitsrechte, I attended the oral hearing. I am providing this entry as a brief summary and analysis.

 

This report hopefully encapsulates the high stakes of the case in question: The PNR preliminary ruling procedure could result in a landmark decision, laying the doctrinal groundwork not only generally for the mass retention of travel data in the name of defending security, but more specifically for the deployment of self-learning algorithms in order to pre-emptively detect presumptively suspicious movement patterns. As such, the CJEU has to deal with one of the first EU-wide, large-scale use cases of predictive policing. If the court were to essentially approve of this paradigm shift, a radical expansion of technology-driven surveillance to all sorts of ordinary human behavior, regardless of individual prior suspicion or imminent threat, could ensue. In its national transposition law, the Belgian parliament, for instance, decided to expand the PNR’s scope of application beyond only aviation to international trains, busses and ferries (Doc. parl., Chambre, 20152016, DOC 54-2069/001, p.7). 

 

The PNR Directive: An unprecedented tool of technology-driven mass surveillance

 

The PNR Directives obliges EU Member States to require air carriers to transmit a set of data for each passenger to national security authorities, so-called “Passenger Information Units”. PNR (passenger name record) datasets contain unverified information provided by passengers to the airlines or to a travel agency in order to facilitate the processing of each flight. The exact content of these PNR datasets depends on the commercial needs of each airline. All necessary data categories to be transmitted are defined in the PNR Directive’s Annex I. They encompass clearly-defined data items, for example, date of birth, details of accompanying persons, travel itineraries, or baggage information, but also loosely-defined items such as “general remarks” made by the aviation staff.

 

After their reception by the PIUs, PNR datasets are then automatically compared against databases “relevant for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime” (Art. 6 § 3 letter a), as well as against “pre-determined criteria” (Art. 6 § 3 letter b). The latter are used “to identify ‘unknown’ suspects” (EU Commission PNR Directive Proposal, SEC(2011) 132, p. 12). What exactly these pre-determined criteria are, is not really defined in the PNR Directive’s text. Art. 6 § 4 only lays out that they ought to be “targeted, proportionate and specific”, as well as not based on “a person's race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation”. Their general purpose, however, is to extrapolate suspicious patterns passengers’ flight behaviors. Research (Korff, Passenger Name Records,data mining & data protection:the need for strong safeguards, p. 4; Rademacher, Predictive Policing im deutschen Polizeirecht, AöR 2017, 366, 410-415; Sommerer, Personenbezogenes Predictive Policing, S. 96-98), policy papers and the GFF generally discuss “pre-determined criteria” as a likely product of self-learning algorithms

 

According to Art. 6 § 5, once a “hit” occurs – meaning an automatically generated match between a PNR dataset and either a database or pre-determined criteria – it is “reviewed by non-automated means”. Verified hits can then be transmitted to other national competent law enforcement authorities on a “case-by-case basis” (Art. 6 § 6), or to other Member States (Art. 9) or, under additional conditions, to third countries (Art. 11). These authorities can then decide to take further action under their respective national law. The PNR Directive itself only requires the collection of PNR data for all flights entering and exiting the EU but recognizes Member States’faculty to extend its scope to intra-EU flights. Almost all Member States proceeded to do just that. PNR data are stored for six months in raw form and, after that, for another four-and-a-half years in a (reversibly) pseudonymized form (Art. 12).

 

EU Member States scramble to defend the PNR Directive’s proportionality

 

As always, the hearing opened with opening statements by the parties, Member States and EU institutions. This turned out to be a rather one-sided affair, given the fact the plaintiff’s representative faced a united front of eleven delegations from Member States and EU institutions, all in favor of the PNR Directive. They all defended against the charge that the PNR Directive was a disproportionate affair mainly by providing anecdotal evidence of its usefulness and by characterizing the relevant interferences with fundamental rights as not particularly severe.

 

First of all, many Member States pointed to the CJEU’s recent Opinion 1/15 of 26 July 2017 on the Draft PNR Draft agreement between Canada and the European Union. In that opinion, they argued, the CJEU had not generally prohibited the mass retention of PNR data; neither did it, in principle, object to a five-year retention period. And, they asked, were PNR data not much safer within the realms of the PNR Directive than in Canada, they suggested, as data stored on European servers remain protected by the GDPR and other legal regimes? Member States’ representatives failed to mention, however, that the CJEU considered the Draft PNR Agreement to be incompatible with Articles 7, 8 , 21 and Article 52 § 1 CFR. It did so due to the Draft Agreement’s lack of clear and precise criteria, substantive and procedural, for the automated processing of PNR data. It also criticized the lack of a required link, such as new circumstances of threat, between the Agreement’s stated objective (averting terrorist threats) and the prolonged retention and processing of PNR data (n° 232). As pointed out above, the PNR Directive perpetuates this dissatisfying state of vagueness (see its Art. 6 § 4) and even extends it beyond the Draft Agreement’s scope of serious cross-border crimes to any crime of some (but not necessarily exceeding) gravity, such as fraud (Annex II, Number 7) or the facilitation of unauthorised entry and residence (Number 11).

 

Second, Member States pointed to evidence of the PNR Directive’s effectiveness in combatting crime. The Belgian government, for example, mentioned the interception of human trafficking victims on Belgian airports. The French government lauded the PNR Directive for enabling it to stop and arrest a person running an illegal prostitution ring who was en route to Bangkok, accompanied by several minors. The Polish government talked about detecting illegal imports of cigarettes from Poland to Germany, and about Ukrainian nationals attempting to use flights for illegal immigration. It was striking, however, that all this evidence remained purely anecdotal. Just like the EU Commission in its Evaluation Report, Member States never provided any detailed statistical evidence on the PNR Directive’s contribution to the prevention, detection, investigation or prosecution of terrorism or serious crime. It also remained unclear, throughout the hearing, whether and, if so, how many of the cases provided by Member States could have been detected by previously existing data processing methods.

 

Third, most Member States contended that the PNR Directive did not result in a particularly severe interference with the right to respect for private and family life (Article 7 CFR), and the right to the protection of personal data (Article 8 CFR). The PNR Directive, they opined, prohibited the processing of sensitive personal data (see Article 13 § 4 and Recital 37). Some Member States, like Germany, Ireland, Spain, and Cyprus, leaned into that claim by forcefully asserting that all pre-determined criteria in use were assembled by humans, not by self-learning algorithms. Their opening statements were characterized by emphatic renouncements of such algorithms as processing tools. The Dutch government even went so far as to claim that the PNR Directive prohibited the use of artificial intelligence or self-learning algorithms for the creation of pre-determined criteria. This assertion, however, appears rather implausible at the least. In academic literature, the PNR Directive was seen as a blueprint for the use of self-learning algorithms (see references above). The Directive contains no explicit prohibition of artificial intelligence. The European Parliamentary Research Service mentions the PNR Directive in its report on the use of “Artificial Intelligence at EU borders” (pages 18-19). Artificial intelligence only works when fed with gigantic amounts of data. That is why Article 6 § 2 letter c of the PNR Directive allows “analysing PNR data for the purpose of updating or creating new criteria to be used in the assessments carried out“ [through pre-determined criteria].

 

Judge von Danwitz’ questions

 

Much more interesting than the (quite repetitive) jubilant opening statements was the oral hearing’s second part: questions by the court. The majority of this part was characterized by an exchange between judge-rapporteur Professor von Danwitz and the EU Commission’s representative. Judge von Danwitz structured his questioning into four topics: The statistical reliability (or fallibility) of the PNR system (1), the severity of fundamental rights interferences produced by the PNR Directive (2), discriminatory effects of the PNR system (3), and the overall proportionality of the system (4).

 

(1) Judge von Danwitz began by referencing concerningly high false-positive rates mentioned in the Member States’ respective statements. In its Evaluation Report, the EU Commission writes on page 28 that, in 2019, “0.59% of all passengers whose data have been collected have been identified through automated processing as requiring further examination”. Only 0.11% of all data, however, were verified by humans and then transferred to law enforcement authorities. This suggests, as Judge von Danwitz emphasized, a false-positive rate of more than 81 %. Moreover, it remains uncertain whether the remaining 19 % of datasets were legitimately process, thus making a definitive assessment of the full false-positive rate impossible.  Referencing the COVID pandemic in questioning the PNR system’s suitability for its intended purpose, Judge von Danwitz quipped: “If a PCR test operated with a sensitivity of 19%, I doubt it would be welcomed with open arms” (The original words were spoken in French. Translations are my own). While these numbers may intuitively feel small, consider this: When the German transposition law was adopted, the German government expected roughly 170 million yearly affected flight passengers (Gesetzesbegründung, BT-Drs. 18/11501, S. 23). This would mean that, in Germany alone, 187,000 people could be subjected to false automated suspicion every year.

 

In fact, these EU numbers are no anomaly. Similar false-positive rates have been reported by Member States: In a GFF case before the Administrative Court of Wiesbaden (docket number 6 K 806/19.WI), the Bundeskriminalamt, which functions as the German PIU, reported that 31,617,068 processed PNR datasets yielded 237,643 automatic matches. After human review, only 910 matches remained, resulting in a false-positive rate of 99.6%. Out of these 910 matches, 396 investigations went dry because the affected flight passengers were not identical with the actual wanted persons –leading to even more serious false suspicions. This rate, mind you, only pertains to database matches – one is left to imagine the error rate of the much more volatile matching procedure against pre-determined criteria.

 

As Judge von Danwitz pointed out, there is a statistical reason for such high rates: Base rate fallacy. Base rate fallacy denotes the phenomenon that when you are looking for very rare incidents in very large datasets, even extremely sophisticated detection tools will likely yield more false-positives than true-positives. Out of all EU flight passengers, extremely few will be actual terrorists or serious offenders – European law enforcement is looking for the proverbial needle in a haystack. Adding more hay to the stack will not allow them to find more needles – needles remain just as rare and elusive.

 

Confronted with this criticism, the EU Commission pointed to the legislator’s limited responsibility for mathematical limits: "There are mathematical limits and errors, but the legislator is not required to conduct mathematical demonstrations.".

 

(2) Judge von Danwitz then proceeded to refute the Member States’ and EU institutions’ claim that, since the PNR Directive does not result in the processing of particularly sensitive data, it does not constitute particularly severe interferences with Articles 7 and 8 CFR. In so doing, he drew an explicit comparison with telecommunications data which were the subject of Digital Rights Ireland, another landmark CJEU decision on mass data retention. While acknowledging that telecommunications data may per se contain more sensitive information than passenger data, he pointed out that, when determining the severity of interferences, one must also take into account the scale and method of processing: Firstly, while Directive 2006/24/EC intended that the majority of telecommunications data be accessible but remain unscrutinized, the PNR Directive provides for the automated analysis of every single PNR dataset. Secondly, Judge von Danwitz emphasized that the deployment of data mining through self-learning algorithms intensified the severity of the interference (thus also casting aside the renouncements put forth by many Member States).

 

The EU Commission agreed with Judge von Danwitz’ analysis in principle (“Oui, certainement, la gravité de l’ingérence est déterminée dans la manière où le Data Mining se fait.") but contended that there were different degrees of Data Mining ("Il y a Data Mining et Data Mining."). They claimed that the safeguards included in the PNR Directive rendered the Data Mining at hand rather minor.

 

(3) Judge von Danwitz then turned to the lack of clear criteria for the individual review of automated matches by non-automated means, as per Article 6 § 5. He pointed out that this vagueness opened room for discrimination. When the EU Commission responded that discrimination was prohibited under Article 6 § 4, Judge von Danwiz replied that indirect discriminations certainly remained possible – which the EU Commission admitted (“un risque de discrimination indirecte existe toujours"). Judge von Danwitz then asked why the EU legislator did not include more provisions in the text in order to mitigate the risk of indirect discrimination – given the extremely high false-positive rate of over 80 %. The EU Commission responded that there were limits to the specificity that can reasonably be expected from any legislator (“tout législateur a des limites lorsque l’on doit réglementer une activité minutieuse et détaillée"). Responding to this, the European Data Protection Supervisor proposed a reversal of the burden of proof as a possible solution, but this was rejected by the EU Commission because, according to them, that would presuppose that “everyone is automatically a victim”. 

 

(4) Judge von Danwitz’ fourth line of questioning turned on the overall proportionality of the PNR system. His questions mainly focused on the (lack of a) link between the occasion for mass data retention – taking a flight – and the PNR Directive’s stated purpose – combatting terrorist offences and serious crime. The lack of clear criteria buttressing this link was one of the CJEU’s main sources of concern in its Opinion 1/15 (see n°217). The EU Commission responded that criminals specifically use the convenience of international air travel to orchestrate their crimes. Judge von Danwitz proceeded by pointing out that the notion that locations and behaviors suitable for crime should be subjected to mass surveillance was stretchable to an almost unlimited extent. “Why not rock concerts?”, he asked. “Why not museum visits?”. Surprisingly, the EU Commission basically agreed with him, saying that yes indeed, rock concerts could be prone to drug-related offenses (“I don’t have any police experience, but I could imagine that there could be much drug-related crime occurring at rock concerts.”).

 

Lingering doubts regarding the PNR system’s proportionality

 

By no means can this report paint a full picture of what was said during the oral hearing or what is to be considered when assessing the mass surveillance of flight passengers. For example, other questions raised by the Advocate General Pitruzzella concerned the vagueness around which databases would be “relevant” and could therefore be used for comparison (von Danwitz asked whether Facebook databases could be used), whether the unanimous extension of the PNR Directive’s scope to intra-EU flights was warranted or excessive, and whether the five-year-retention period was disproportionate. Advocate General Pitruzzella also inquired about external oversight of pre-determined criteria and whether false-positives were systematically used in order to improve algorithms (to which some Member States replied in the affirmative).

 

In my opinion though, the hearing shone a light on the PNR Directive’s manifold constitutional weaknesses. The EU Commission and Member States did not succeed in dispelling my lingering doubts about its underdeterminacy, its questionable suitability and effectiveness, its unchecked potential to produce large-scale discrimination. But chief among these weaknesses is the Directive’s sheer excessiveness: It is just disproportionate to take ordinary human behavior and use it as an opportunity to unleash an unprecedented degree of technology-fueled surveillance upon hundreds of millions of European flight passengers and to sift through mountains of useless, potentially discriminatory data, just to – maybe, kind of – detect a handful of criminals.

 

Photo credit: Juke Schweizer, via Wikimedia Commons