EU Court Condemns the EU Legislative Process for Lack of Transparency: Time to Open Up?

Massimo Frigo, Senior Legal Adviser of the International Commission of Jurist’s Europe Programme*

It is sometimes cases on obscure administrative processes that become landmark judgments in the ever constant building of our democratic legal systems. In the US Marbury v. Madison was a case that at the time attracted little attention as the subject matter related to respect of procedures in judicial appointments. This notwithstanding it came to be the legal milestone of constitutional review in the US legal system.

In the European Union one of these cases was decided on 22 March: Emilio De Capitani v. Parliament. As it will be outlined below, it is a technical case that goes to the heart of the procedure of one of the fundamental institutions in a democracy: Parliament.

The EU legislative decision-making process

Unlike the United States, the European Union is not a State. However, it retains more and more competence to legislate in areas of everyday life and of crucial constitutional State prerogatives, including in the sphere of justice and home affairs that includes immigration, asylum, border control, and police cooperation.

The legislative process of the EU may be generally simplified in this way: the European Commission, i.e. a body of supposedly independent experts appointed by the European Council (see, the 28, soon 27, heads of State or government of its Member States) and approved by the European Parliament (the only institutions directly elected by EU citizens), has the initiative to table legislation.

Once the proposal is tabled it is the turn of the co-legislators to discuss it, amend it, approve it or reject it. At any moment the European Commission can withdraw the proposal and put an end to the process.

The EU legislators are the European Parliament and the Council of the European Union. The latter consists of the Governments, often in the configuration of the ministries relevant to the legislative piece to be discussed, of the EU Member States. These two bodies must agree on the legislative text, and its potential modifications, and approve it in the same form before it can become law. They can do it in one or two reading sessions.

In the last decades, since this procedure (once called “co-decision” and now the “ordinary legislative procedure”) came to exist, a practical solution to speed up the legislative procedure was found by holding what are called “trilogues”. These are closed meeting among representatives of the Council of the EU, the European Parliament and the European Commission to find a compromise and produce an agreed text that will have to be voted by their respective committees and plenaries into law.

The practice of these trilogues is that no one from the public has access to them nor to any document on the proposed suggestions for compromise. Furthermore, when an agreement is reached, statistically, both the Parliament and the Council almost always approve the agreed compromise into law without further amendments. It is therefore a key moment in the legislative process. And it is absolutely foreclosed to EU citizens and civil society.

The case

Mr De Capitani brought a challenge to the General Court of the European Union, the judicial body competent for cases against EU institutions at first instance, because Parliament, after having consulted the Council and the Commission, refused him access to the part of a document in the legislative process. Specifically this part of the document is the fourth column in a tabled document that reports the compromises reached or suggested during the trilogues, while the first three of them include the original proposal and the positions of the institutions.

The judgment

The General Court ruled that, “contrary to what the Council maintains …, … the trilogue tables form part of the legislative process.” (para 75, , De Capitani)

It pointed out that

78. … it is precisely openness in the legislative process that contributes to conferring greater legitimacy on the institutions in the eyes of EU citizens and increasing their confidence in them by allowing divergences between various points of view to be openly debated. It is in fact rather a lack of information and debate which is capable of giving rise to doubts in the minds of citizens, not only as regards the lawfulness of an isolated act, but also as regards the legitimacy of the decision-making process as a whole … .

The Court dismissed the EU institutions’ exception that non-disclosure was necessary because the document dealt with a draft law in the area of police cooperation. The Court very strongly ruled that

89… the fact … that the documents at issue relate to the area of police cooperation cannot per se suffice in demonstrating the special sensitivity of the documents. To hold otherwise would mean exempting a whole field of EU law from the transparency requirements of legislative action in that field.

Furthermore the Court stressed that

90…. the documents at issue concern a proposal for a draft regulation, of general scope, binding in all of its elements and directly applicable in all the Member States, which naturally concerns citizens, all the more so since at issue here is a legislative proposal directly affecting the rights of EU citizens, inter alia their right to personal data protection …, from which it follows that the legislative proposal could not be regarded as sensitive by reference to any criterion whatsoever … .

The Court then dealt with the assertion that access to these documents could increase public pressure on the representatives of the EU institutions involved in the trilogue procedure:

98… in a system based on the principle of democratic legitimacy, co-legislators must be held accountable for their actions to the public. If citizens are to be able to exercise their democratic rights they must be in a position to follow in detail the decision-making process within the institutions taking part in the legislative procedures and to have access to all relevant information … Thus, the expression of public opinion in relation to a particular provisional legislative proposal or agreement agreed in the course of a trilogue and reflected in the fourth column of a trilogue table forms an integral part of the exercise of EU citizens’ democratic rights, particularly since … such agreements are generally subsequently adopted without substantial amendment by the co-legislators.

Finally, while allowing still the possibility for certain situations (“duly justified cases”) of non-disclosure for co-legislators, including Parliament (para 112, De Capitani), the Court closed by rejecting also the argument raised by Parliament that making public documents of the trilogue would have taken away the nature of these meetings as a “space to think” . The Court unmistakably reminded Parliament that these meetings are essential parts of the legislative procedure and not “spaces to think” and as such must be subject to the required level of publicity (para 105, De Capitani).

Conclusion: a more democratic EU?

The European Union does not enjoy today the best image in terms of transparency, accountability and democratic processes. Its institutions have been openly attacked from many different quarters for their lack of transparency and the bureaucratic nature of their procedures. Most of these attacks are populist fear-mongering that simply aims at finding a scapegoat to gain political traction, votes and, hence, power. However, as we have seen, some critiques of the EU structure cannot be simply dismissed as political nonsense and one of them is about the legislative process in the EU that affects the lives of almost 500 million people.

The De Capitani ruling throws a breath of fresh air to these institutions and, importantly, demonstrates that, while some institutions of the EU may be criticised for lack of transparency and obedience to the rule of law, there are institutions, notably the EU courts, that can address the problem within.

This ruling can still be subject to appeal before the Court of Justice of the EU. In the meantime and this notwithstanding, the crucial question is whether and how the ruling will be implemented. Will the Parliament, the Council, i.e. the Governments of the Member States, and the Commission open up to democratic scrutiny in legislative process?

The answer to this question will be vital for the EU to withstand any criticism that it does not obey the rule of law and democratic accountability. This is why this case is a turning point for the EU rule of law structure. Much of the legitimacy of the EU as a rule of law based supra-national organisation lies in what its institutions are going to do next. And we’d better be watching…

*Reblogged with permission from the Opinio Juris blog

Barnard & Peers: chapter 5, chapter 9

Photo credit: Walsall College

The Commission’s power of initiative: the CJEU sets important constraints

 

Steve Peers

As every EU politics or law student learns, a key feature of the Commission’s role as the ‘motor’ of EU integration is its near-monopoly on making proposals for EU action. But does that near-monopoly – which the Commission likes to call its ‘right of initiative’ – imply a corresponding power to withdraw proposals? And if so, are there any constraints on such a power? The CJEU answered these questions in an important judgment today.

Background

The case concerned a proposal for framework legislation on ‘macro-financial assistance’ for non-EU countries. This type of assistance helps out non-EU countries which are in severe economic difficulties, for instance helping them to make an imminent loan payment. It obviously helps the economies of the countries concerned, thus indirectly helping EU companies that export to them; and it undoubtedly cements the political relationship between the EU and those countries.

Before the Treaty of Lisbon, such aid was granted on the basis of the EU’s ‘residual powers’, which are now provided for in Article 352 TFEU. However, that Treaty created a specific ‘legal base’ for the EU to adopt rules on macro-economic support for third states: Article 212 TFEU, which provides for the use of the ‘ordinary legislative procedure’ to adopt legislation on this. The Treaty of Lisbon also created an Article 213 TFEU, which allows assistance to be granted in urgent cases without going through a full legislative process.

In 2011, the Commission proposed ‘framework legislation’ on macro-financial assistance, which would have given it the power to decide on the crucial question of which third countries receive this money. The Commission’s decisions on this issue would be controlled by means of the variant of the ‘comitology’ rules known as the ‘examination procedure’, which gives Member States’ experts’ the power to block draft Commission decisions. There’s no significant role for the European Parliament (EP) in that process.

The Commission’s suggestions did not satisfy the EP or the Council. The EP suggested instead that Commission Decisions on which countries receive macro-financial help be subject to ‘delegated acts’: Commission decisions which can be blocked by either the Council or the EP. For its part, the Council position was that each decision to grant aid to a third country had to be subject to the ordinary legislative procedure. The two institutions began negotiations, and eventually agreed to use the ordinary legislative procedure to this end.

Since the Commission objected to this aspect of the EP/Council deal in principle, it withdrew its proposal before the institutions could adopt the legislation concerned. The Council responded by taking the rare step of suing the Commission. While the Council was supported by ten Member States, the EP did not intervene on either side – despite the huge stakes for that institution.

The judgment

The Court’s judgment started out by accepting that the Commission’s power to make proposals gives it a corollary power to withdraw them. However, that power did not constitute a ‘right of veto’ in the legislative process, since that would upset the principle of institutional balance and conferral of powers. In short, the Commission has the power to withdraw proposals – but that power is constrained.

So how exactly is that power constrained?  The Court ruled that the Commission had to give the EP and the Council its reasons for such withdrawals, which must include ‘cogent evidence or arguments’. Such withdrawal decisions must be subject to judicial review, in the form of actions for annulment. However, it was sufficient to give those reasons to a Council working party and an EP/Council negotiation meeting.

As for the substantive grounds for withdrawing its proposal, the CJEU ruled that the amendment which the EP and Council wanted would have changed an ‘essential element’ of the proposal, and would have been irreconcilable with the ‘objective’ of improving the efficiency of EU policy in this area. Next, the CJEU ruled that there was no infringement of the principle of democracy, since it was inherent in the Commission’s right of initiative that it could withdraw proposals as long as the Council had not yet acted. So the Commission did not infringe the principles of conferral of powers and institutional balance.

Finally, the Court considered a separate issue: whether the manner of the Commission withdrawing its proposal breached the principle of ‘sincere cooperation’ between the EU institutions. On this point, the Court ruled that the Commission could not be criticized for withdrawing its proposal at a very late stage in the Council/EP negotiations, since only then had it become clear that the co-legislators would insist that the ordinary legislative procedure had to be used for the approval of each new macro-financial assistance decision. Moreover, the Commission had attempted to reconcile the position of the other institutions, and had proposed compromises. It seems implicit from the Court’s analysis here that the EP’s position (delegated acts instead of a comitology process) would not have altered the essential elements of the proposal.

Comments

First of all, what are the immediate consequences of this judgment? The failure of the legislative process in this case didn’t stop the EU granting macro-financial assistance to third States. In practice, in the absence of framework legislation on this subject, the EU has been adopting individual legislative measures to assist each country – which is exactly what the Commission objected to in the first place.

What procedure should govern such decisions, as a matter of principle? The CJEU seems to adopt the Commission’s view that efficiency is the main criterion. There is indeed a good argument for efficiency in the specific context of macro-economic assistance – since the bills usually have to be paid imminently, and the third country concerned is often in desperate straits. But the Commission and Court don’t refer to this specific context, and don’t balance the need for efficiency against the contrary case for full democratic control.

For example, one recent major beneficiary of EU macro-financial assistance has been Ukraine, and the EU’s relations with that country have been highly controversial. Ideally, there should be a full democratic debate on whether the EU should support that country’s economy, allowing those who sympathise with Putin’s Russia or who have other reasons to criticize the Ukrainian government to debate the merits of that assistance with those who support that government. Perhaps a good compromise would have been an agreement by the Commission to make a full legislative proposal whenever a significant minority (say a quarter of the Member States and/or a quarter of the Members of the European Parliament) indicate a wish to debate the merits of giving macro-financial assistance to a particular third State.

Secondly, the broader consequences of today’s judgment concern the relations between the EU’s three political institutions. The judgment has both procedural and substantive dimensions. Procedurally, it seems very easy to justify a Commission withdrawal: it need only inform EP/Council ‘trialogue’ (negotiation) meetings, or a Council working party of its intentions. Here the Court is legitimising these informal elements of EU governance (thanks to Ron Patz for raising this point). However, with respect, its approach is not convincing. Since a legislative proposal affects the EP as well as the Council, informing a Council working party cannot be sufficient. In fact, informing a trialogue committee shouldn’t be sufficient either, since there are many MEPs and Member States not represented there (the Council Presidency negotiates on behalf of all Member States as represented in the Council).

More broadly, the Commission should have to justify its withdrawals openly to the general public. It usually does this when it withdraws proposals as part of its work programme, but the principle of openness (as set out in the Treaties) justifies it becoming a legal rule, applying to every case of withdrawal. The best practice would be to adopt a formal Commission Decision to withdraw each proposal published in the EU’s Official Journal, giving effect to the principle of active transparency.

Indeed, it’s disturbing that the Court conceives of the EU system purely in terms of the institutions’ accountability to each other, rather than to the public generally. The Court’s dismissal of the ‘democratic principles’ argument is far too brief, failing to place that principle on an equal footing (never mind a superior footing) with the institutional rules on the Treaty. The better approach would have been to interpret the lacuna in the Treaties regarding withdrawal of Commission proposals in light of this democratic principle, emphasising the key role which that principle gives to the EU institutions with a greater claim to electoral legitimacy.

On the other hand, the Court does confirm that there must be judicial control of the withdrawal of Commission proposals. The application of the annulment procedure means that not only the Council, but also the EP and individual Member States can sue the Commission for withdrawing a proposal. Other parties are likely to lack standing to do so, except for a limited number of cases where Article 263 TFEU confers it to bring challenges to non-legislative acts. The alternative possibility of bringing proceedings via national courts to challenge withdrawals appears unworkable at first sight.

What are the substantive constraints to the Commission’s withdrawal of its proposals? The CJEU hints that there might be additional constraints after the Council has ‘acted’; presumably this refers to the Council adoption of its first reading position. Only a minority of EU legislative proposals go past this first reading – and half of those have in practice been agreed between the EP and Council already at that stage. It’s not clear what additional constraints might then exist, besides those set out in the Treaty (for instance, it’s easier to amend a Commission proposal in some cases after first reading). It’s also possible that the Court would take a different approach to non-legislative measures, or those subject to a special legislative procedure.

So let’s focus on the usual case – a withdrawal of a proposal for a legislative act pursuant to the ordinary legislative procedure, before the Council adopts its first reading position. The Court did not suggest that a change in the essential elements of a Commission proposal was the only ground to withdraw a proposal. Presumably it is still open to the Commission to withdraw proposals on other salient grounds, in particular the most common grounds for withdrawal: where the proposal is obsolete, or there is no chance of its adoption.

However, the existence of judicial review must mean that the Commission’s assessment in this regard could be open to challenge. The Court might also be called upon to clarify in another case what constitutes a change in the ‘essential elements’ of a proposal, where (for instance) the EP and Council want to widen or narrow that proposal’s scope significantly. There is no reason why the ‘essential elements’ rule is restricted to cases where the objective is improving the efficiency of EU actions, since there are many other possible objectives for EU action.

What other grounds for withdrawal exist? It seems implicit in the judgment that the Commission cannot simply argue that it has changed its mind, otherwise judicial review would have no purpose. There must be substantive reasons justifying that change of mind. Would it be sufficient that there is a new Commission? This is obviously a live issue, given that the Juncker Commission recently withdrew a number of proposals (for instance, the ‘circular economy’ proposals) on the grounds that it had changed its legislative priorities, and wished to start the process from scratch (see discussion here).  At first sight, since the proposals can always be redrafted during the legislative procedure, this is not a sound enough reason to withdraw a proposal, in light of today’s judgment – and there is still time to bring an annulment action against these withdrawals.  There might conceivably be an argument that a new Commission has more flexibility to withdraw proposals – but that begs questions as to whether it has a genuine democratic mandate, in particular if the Commission President did not campaign on the basis that the proposals in question should be withdrawn.

Finally, it might be arguable that today’s judgment has implications not only for the Commission, but for the ‘sincere cooperation’ during the legislative procedure between the EP and the Council. For instance, the EP and Council have been far apart for years as regards a proposal for maternity leave. As I recently pointed out (see here), the EP has shown recent signs of willingness to negotiate, which the Council has rejected.  For its part, the Commission has done little to try and broker a compromise, but has simply resorted to threatening to withdraw the proposal if there is no deal. Can the EP sue the Council for its intransigence? Can it sue the Commission if it follows through on its threat to withdraw the proposal, having played no constructive role in the talks? If the EU institutions and Member States make frequent use of the possibilities opened up by today’s judgment, this judicial intervention into the legislative process raises many such important questions.

 

Barnard & Peers:  chapter 3, chapter 5, chapter 8

So long, and thanks for all the fish: the CJEU clarifies international law and institutional issues applying to fisheries

 

Steve Peers

The EU’s fisheries policy is controversial both within the EU and outside it, due to its impact on both fish stocks and the livelihoods of fishing communities. Until the Treaty of Lisbon, its application was essentially the sole preserve of the Council. The European Parliament (EP) tried to obtain joint control of some of the external aspects of the policy by claiming that its consent was needed for international fisheries treaties that impacted the EU budget significantly, but the CJEU rejected this challenge.

Following the Treaty of Lisbon, however, the EP has joint decision-making power internally over agriculture and fisheries policies, since Article 43(2) TFEU states that the ordinary legislative procedure now applies to the adoption of legislation in this field. However, certain aspects are still reserved to the Council, with the European Parliament only consulted, namely ‘measures on fixing prices, levies, aid and quantitative limitations and on the fixing and allocation of fishing opportunities’ (Article 43(3)).

As regards fishing, this provision is used each year just before Christmas, to determine the annual allocation of fish between Member States. It’s safe to say that the tone of these usually bitter negotiations never induces fisheries ministers to kiss each other under the mistletoe.  

What exactly is the dividing line between the areas where the EP shares power with the Council, and where fisheries ministers are left to hold acrimonious discussions among themselves? There are pending cases on the dividing line as regards internal EU measures. But today the CJEU ruled on the division of powers externally, in a case which also raised interesting issues of international law.

The judgment

Today’s judgment concerned a Council Decision which awarded Venezuelan fishermen the possibility to fish in the waters of French Guiana (which is a constituent part of French territory). This confirmed what those fishermen had been doing for some time before. The EU had felt it was necessary to put this practice on a more formal footing, but the rather left-wing Venezuelan government did not want to sign a treaty with such dastardly agents of global capitalism.

So the EU adopted an apparently unilateral Decision on this issue. The Council believed that it fell within the scope of Article 43(3), so the EP only had to be consulted, while the EP and the Commission argued that it fell within the scope of Article 43(2), so that the EP had the power of consent. The rules on the EP’s role in the approval of international treaties to which the EU becomes a party are set out in Article 218 TFEU. Basically the EP has the power of consent whenever a treaty concerns an issue regulated by the ordinary legislative procedure (ie fisheries law generally), but is only consulted when a treaty falls within the scope of other decision-making rules internally (ie the non-legislative procedure that applies when the EU fixes and allocates fishing opportunities). (In fact, the rules on the EP’s role in approving international treaties are slightly more complicated, but only this basic distinction is relevant to today’s judgment).

But was the Council Decision an international agreement in the first place? The Advocate-General’s opinion argued that it was not. Rather, it was a unilaterally binding declaration, an interesting form of international law. In fact such legal creatures are so rare that international law had not yet clarified whether international organisations like the EU could adopt them. In the Advocate-General’s view, they could. But that left the awkward question of how exactly the EU could adopt one as a matter of its internal law, since Article 218 clearly only refers to agreements concluded by the EU (or on behalf of the EU by its Member States). She considered various options, but ultimately argued that the relevant provisions of Article 218, including the powers of the EP to give its consent and receive information on negotiations, as well as the special jurisdiction of the CJEU, applied by analogy.

In the Court’s view, however, the Decision did constitute an international agreement. It based itself on the relevant rules of the UN Convention on the law of the sea, to which the EU and its Member States (but not Venezuela) are parties, and confirmed its position in the recent ruling on the Hague Convention on child abduction (discussed here), that treaties could be concluded in two steps. In this case, the EU had extended an offer, which Venezuela was free to accept, reject or suggest changes to. It had chosen to accept.  

As for the internal division of powers, both the Advocate-General and the Court reached the same conclusion: the Parliament’s argument was correct. In the Court’s view, the main powers relating to agriculture and fisheries set out in Article 43(2) concerned ‘policy decision[s] that must be reserved to the EU legislature’. In contrast, Article 43(3) provided for ‘measures of a primarily technical nature’ to implement the legislation adopted in the field. Applying that distinction to this case, the ‘treaty’ with Venezuela set out only a general framework, which had then been implemented by further measures based on Article 43(3). So that ‘treaty’ could not itself be based on Article 43(3); rather it was subject to the consent of the European Parliament, as it was based on Article 43(2).

Comments

On the international law issue, the Advocate-General’s analysis is more convincing than the Court’s, given the clear unwillingness of Venezuela to engage in any formal negotiations along its failure to ratify the UN Convention on the law of the sea, which the CJEU relied on so heavily. Nor is the Court’s use of the language of contract law very convincing. True, Venezuela’s application for fisheries authorisations might be described as the acceptance of an offer, but what is the consideration? Why should Venezuela’s actions be characterised in light of a treaty it had not ratified? Possibly the relevant rules reflect customary international law on the law of the sea which apply to Venezuela, but the Court does not make that argument.

Nor is its analysis of the text of the Law of the Sea Convention very convincing. The relevant clause refers to making ‘agreements or other arrangements’ regarding surplus fish. Could not a unilateral binding declaration constitute a form of ‘other arrangement’? Possibly that interpretation has been rejected by the Law of the Sea tribunal or by experts in that field of law (I confess that I’m not one), in accordance with the sources of international law as defined in the UN Charter. But if that is the case, the Court needs to bolster its interpretation by citing such evidence.

The distinction between the forms of international obligation matters mainly as regards the EU’s internal law. If the Decision was a unilateral binding declaration, the CJEU would have the awkward job of deciding whether the EU can adopt such measures, and if so how. Since the Court didn’t have to address these issues today, they must be considered open. But if it is every necessary to consider them in future, there is much to recommend the Advocate-General’s very thorough analysis of both of these points.

As for the internal decision-making rules, the judgment is more convincing, particularly in light of the Advocate-General’s arguments that Article 43(3) cannot apply to everything concerning fishing opportunities, since that would render the main legislative powers set out in Article 43(2) superfluous.

The broader implications of this judgment remain to be seen. But it’s an early indication that the Court is inclined to tilt in favour of a broad interpretation of the scope of the EP’s legislative and treaty approval powers over agriculture and fisheries following the entry into force of the Treaty of Lisbon.

 

Barnard & Peers: chapter 5

Reforming EU data protection law: the Council takes its first baby steps

Steve Peers

The EU’s controversial data protection rules, currently in the form of a Directive dating back to 1995, would be reformed profoundly if a Regulation proposed by the Commission is adopted. Talks on this proposal have been underway since January 2012, with no immediate end in sight. However, in June, for the first time the Council (consisting of Member States’ justice ministers) has agreed its position on part of the proposal. Of course, the Council still has to agree its position on the rest of the text, and then negotiate with the European Parliament, which adopted its position on the entire text this spring. But at least this recent partial Council deal offers the first opportunity to assess the direction of negotiations.

Furthermore, this is a good occasion to assess whether the new legislation might impact upon the application of the controversial Google Spain judgment.

The partial Council deal

The Council deal only concerns the question of how the new EU rules will apply to non-EU countries. However this issue is of great importance in light of the ever-growing use of the Internet and social media, since the EU rules are potentially liable to apply worldwide.

To place the deal in context, it is necessary to look at four different things: (a) the current rules in the 1995 Directive, as interpreted by the CJEU; (b) the 2012 proposal; (c) the Council’s position; and (d) the EP’s position.

In each case, I will look at two different aspects which were addressed by the Council deal. First, when do the standard EU data protection rules apply, even where the company processing data is based outside the EU? Secondly, when do the special rules on external relations apply?

The current rules

Currently Article 4 of the 1995 Directive states firstly that the standard rules apply to a data controller established in a Member State. According to the CJEU in Google Spain, that concept applies at least where a non-EU company has established a subsidiary in a Member State, and that subsidiary carries out activities linked to the business model of the parent company. The current rules go on to say that if the controller is established on the territory of more than one Member State, it must comply with the national law of each of those States.

Furthermore, the standard rules in the 1995 Directive apply where a Member State’s national law applies by virtue of public international law, and where the controller is not established on EU territory, but uses equipment located on a Member State’s territory, unless that equipment is used only for the purposes of transit. This raises the question of whether the use of ‘cookies’,  for instance, amounts to the use of equipment on a national territory, since those cookies are installed on a Member State’s computer.

As for external transfers, the current rules provide (Article 25) that in principle data can only be transferred if there is an ‘adequate level of protection’ in the third country concerned. The Commission can adopt decisions either finding that there is, or is not, an adequate level of protection. By way of derogation (Article 26), Member States must nonetheless allow (unless their national law provides otherwise) external transfers to take place if: the data subject has given unambiguous consent; the transfer is necessary to perform a contract with the data controller or to implement pre-contractual measures which the data subject requested; the transfer is necessary to conclude or perform a contract in the interest of the data subject as a third party; the transfer is ‘necessary or legally required on important public interest grounds’ or related to legal claims; the transfer is in the data subject’s ‘vital interests’; or the transfer is from a register which provides information to the public or to persons with a legitimate interest.

A Member State may authorise an external transfer to a country with an inadequate level of protection if the data controller can offer ‘adequate safeguards’, in particular arising from contractual clauses. The Commission can decide that certain standard contractual clauses offer such protection. 

The 2012 proposal

The 2012 proposal (Article 3) suggests that the new Regulation should apply first of all where a controller or processor is established in the EU. Secondly, it should apply where the data controller is not established in the EU, but the data subjects reside in the Union, and the data controller either offers them goods or services, or monitors their behaviour. Thirdly, as before, it would apply where a Member State’s national law applies by virtue of public international law. The provision concerning the ‘use of equipment’ would be dropped.

As regards external transfers, the 2012 proposal maintains the basic structure of the current rules, but elaborates upon it. So there are more details on what the Commission has to take into account when assessing the adequacy of a third State, including judicial redress and supervisory authorities. Adequacy decisions taken pursuant to the 1995 Directive would remain in force.

External transfers would be permitted on the basis of binding corporate rules, or standard contractual rules adopted by the Commission or a national supervisory authority, or individually negotiated contractual rules authorised by a national supervisory authority. Otherwise transfers would require approval by a supervisory authority. Pre-existing authorisations by a supervisory authority would remain valid.

A new clause would elaborate upon the content of binding corporate rules that would be adopted unilaterally. These would require the approval of a supervisory authority.

Finally, further derogations would be permitted. Compared to the current rules, these would be optional, not mandatory. The new proposal would clarify that consent could only be given after the data subject had been warned of the risks, and that transfers in the data subject’s interest could only be given if the data subject were unable to consent. There would be a new ground of external transfers in the data controller’s or processor’s legitimate interest, subject to safeguards being in place. The concept of the ‘public interest’ justifying such transfers would be further clarified in national or EU law.

The Council position

As regards the standard rules, the Council would amend the Commission proposal to clarify that the rules will apply whether or not the data controller offers goods or services for payment. However, as regards monitoring of behaviour, the rules will only apply if the data controller monitors behaviour within the EU.

For external transfers, the Council would add further detail to the rules regarding the assessment of the adequacy of third states, including a specific reference to participation in regional or multilateral data protection treaties. The Council also wants to give an advisory role to the planned new European Data Protection Board in this process. The Council would require the Commission to monitor the application of its adequacy decisions, and empower it to revoke them. However, the Commission would no longer have the power to adopt a decision specifying that a third State had inadequate protection.

The Council would also permit external transfers to take place on the basis of a code of conduct or a certification mechanism. Transfers in the private interest of the data processor or controller would be subject to a possible override in the data subject’s interests. The Commission would lose powers to define the public interests reasons for transfers, and Member States would gain more powers on this point.  

The EP position

The EP would amend the Commission proposal so that, where the controller or processor is established within the EU, it would not matter where the data was processed. Also, the standard rules would apply to the offering of goods or services or monitoring by data controllers or data processors, and would apply to any sort of monitoring of data subjects, not only the monitoring of behaviour. Unlike the Council, the EP would not limit the monitoring clause to behaviour within the EU. However, like the Council, the EP would apply the rules even if goods or services are not offered for payment.

As for external transfers, the EP agrees with the Council that the Commission should monitor its adequacy decisions, and that there should be a role for the new Board.  However, the EP wants to apply a ‘sunset clause’ to pre-existing adequacy decisions, and retain the power for the Commission to adopt ‘inadequacy’ decisions.

Similarly, pre-existing authorisations of contractual clauses would expire soon after the new rules were adopted, although the EP agrees with the Council that a form of certification process should justify external transfers. For binding corporate rules, the EP wants to ensure consultation of workers where their data is involved, and apply the rules to sub-contractors (the Council approaches the latter issue by referring to groups of companies). As regards the derogations, the EP would reject the idea of transfers in the legitimate interests of controllers.

Finally, the EP has proposed a new ‘Snowden clause’ which would mean that national courts could not recognise the decisions of non-EU courts which ordered the disclosure of personal data. However, this rule would be ‘without prejudice’ to mutual assistance treaties or any other international agreements between a non-EU state and the EU or any Member State.

Comments

One important point should be addressed at the outset: what is the result of the recent EP election on the EP’s position? In the EU system, proposed legislation does not fall simply because there is an election for the EP, or because there will be a new Commission as from November. Rather, the newly elected EP traditionally holds a vote at an early stage to decide whether to reaffirm the positions taken by the previous legislature. Usually it reaffirms almost all of the prior legislature’s positions. It should be recalled that the EP’s position on the data protection Regulation was adopted by a huge majority, and so despite the increase in the number of populist MEPs, a majority in favour of approving the EP’s prior position on this proposal should in principle not be hard to find.

For its part, the incoming Commission will decide whether to withdraw some of its pending proposals, but is very rare for an incoming Commission to withdraw a proposal which is actively under discussion in the Council and EP, such as the data protection proposal.

Moving on to the substance of the issues, as regards the application of the standard rules, all three institutions agree to keep the rule on establishment, extending it to data processors also. The EP’s suggested amendment regarding the location of the data processing is merely a clarification, which is probably not necessary.

The three institutions all agree to drop the ‘use of equipment’ clause, to keep the clause on public international law, and to add a new clause regarding goods and services and monitoring. The EP and the Council also agree that the ‘goods and services’ clause will apply even where there is no payment made. The institutions differ as regards extending the new clause also to data controllers, and differ as regards the exact scope of the monitoring of behaviour.

As for the external transfers rules, all three institutions would keep the current basic structure. They differ as regards: the ‘Snowden clause’ (although this rule is very weak, in light of its exceptions for any international treaties); whether the Commission can adopt an ‘inadequacy decision’ (it has never done so); sunset clauses for prior authorisations; whether private interests can justify external transfers; and the process of determining when the public interest can justify them.

Taken as a whole, the impact of the new rules depends on how the current rules are interpreted. There is no reason to doubt that the ‘establishment’ clause would be interpreted the same way as it was in Google Spain, ie applying at least where a subsidiary’s activity is linked to a non-EU parent company’s business model. But there is no case law clarifying what the ‘use of equipment’ means, and so it is not easy to assess what removal of this clause will mean in practice.

Instead the focus will be on what it means to offer goods or services (whether or not for payment), and what it means to monitor an individual. These concepts are clarified in the preamble, which indicates that the ‘offering goods or services’ rule will apply where there a website seeks to sell its products or services, and its online activity is particularly directed towards EU citizens (in light of the currency or language used). So the intention is apparently not to cover a non-profit body like Wikipedia, or a social network or search engine which does not charge for its services (although some such entities would be covered by the ‘establishment’ rule).

What about ‘monitoring’? Here, the preamble suggests that the new clause applies when an individual’s Internet activities are tracked with a view to profiling him or her. There is no suggestion in the preamble that keeping records of a person’s use of social networks would count as monitoring.  But if that is not the intention, it would be better for the EU legislature to rule it out more expressly. In any event, it is difficult to see how the Council’s limitation regarding the monitoring of behaviour within the EU would work in practice, in light of the nature of the Internet.

As regards the external transfer clauses, their importance depends on whether the standard clauses apply. The greater the number of businesses covered by the standard rules, the less important the external transfer rules are – and vice versa.

It is clear that the external transfer clauses will remain broadly similar to the current rules, so any corporate or NGO strategies regarding these clauses would only need to be amended modestly, rather than be overhauled. The biggest issues may be the EP’s insistence on its ‘Snowden clause’ and its rejection of the idea that external transfers can take place in the data controller’s interest, although the former clause is weak and data controllers can usually pursue their interests by means of obtaining consent or establishing a contractual relationship.

Much of the most difficult work as regards the negotiation of the new rules remains to be done. In fact, it is rather peculiar to negotiate a new law by defining its territorial scope before agreeing on its main substance.

While a vast number of issues will arise in the forthcoming negotiations, the following are particularly relevant to the fallout from the Google Spain decision, in particular as regards its possible impact on social networks and Wikipedia: the interpretation of a ‘data processor’ (which would be particularly significant if the EP gets its way and the entire clause on territorial scope applies to data processors); the possible application of the ‘household exception’ to user-generated content; the exception for journalism; and the definition of the grounds for processing personal data (notably consent and the controller’s legitimate interests).

Barnard & Peers: chapter 9