EU Criminal Law 9781849464581, 9781474203401, 9781509904167

This is the second edition of EU Criminal Law which, since its initial publication in 2009, has become a key point of re

268 92 10MB

English Pages [805] Year 2022

Table of contents :
Preface
Contents
Table of Cases
1. History, Principles and Institutions The Constitu tionalisation of EU Criminal Law
I. Introduction
II. Background: The Community and Criminal Law before Maastricht
III. The Third Pillar: The Institutional Framework
IV. The Third Pillar and the Constitutional Principles of the Community: The Contribution of the Court of Justice
V. The Politics of the Third Pillar: Member States’ Security Ambitions versus Institutional Checks and Limits
VI. The Lisbon Treaty and the Constitutionalisation of EU Criminal Law: Institutions, Principles and Rights
VII. Legal Basis Disputes and Contested Competence
VIII. Sovereignty Concerns and the Persistence of National Diversity
IX. The Interplay between EU Criminal Law and Upholding the Rule of Law
X. Conclusion
2. Substantive Criminal Law From Securitised to Functional Criminalisation
I. Introduction
II. Before Lisbon: The Interplay between Community Law and National Criminal Law
III. The Constitutional Politics of Criminalisation before Lisbon: The Competence Question
IV. EU Competence to Criminalise after Lisbon: Securitised and Functional Criminalisation
V. The Relationship between Criminal and Administrative Law
VI. Extending EU Competence to Criminalise Elsewhere in the Treaty
VII. Contesting EU Competence in Substantive Criminal Law: The Lissabon-Urteil
VIII. Policy Responses to the EU Competence to Criminalise after Lisbon
IX. EU Criminalisation Challenges and Prospects for Law Reform
X. Conclusion
3. Ne Bis in Idem and Conflicts of Jurisdiction
I. Introduction
II. Legislation on Ne Bis in Idem at the European Level
III. Transnational Ne Bis in Idem: Scope and Content
IV. Concurrent Jurisdiction
V. Application of Ne Bis in Idem to Criminal and Administrative Proceedings Concerning the Same Facts
VI. Conclusion
4. Mutual Recognition and Mutual Trust
I. Introduction
II. Mutual Recognition and Mutual Trust: Origins and Legal Architecture
III. Mutual Trust, Legality and Dual Criminality: From Advocaten voor de Wereld to Grundza
IV. Mutual Trust, Fundamental Rights and Proportionality: Radu
V. Mutual Trust and the Primacy and Autonomy of EU Law: From Melloni to Opinion 2/13
VI. Mutual Trust as a Challenge to Fundamental Rights and Constitutional Identity: The Response from the ECtHR and National Constitutional Courts
VII. A Paradigm Change by the Court of Justice: The Dialogical and Interactive Model of Scrutinising Mutual Trust in Aranyosi
VIII. Aranyosi as a Catalyst for Calm in the Battle for Authority and Primacy
IX. Contesting the Parameters of Mutual Trust after Aranyosi: Fundamental Rights
X. Contesting the Parameters of Mutual Trust after Aranyosi: The Rule of Law
XI. Mutual Trust through a Judicially Developed Level Playing Field: Autonomous Concepts
XII. Conclusion
5. Legislating for Human Rights The EU Legal Framework on the Rights of Individuals in Criminal Proceedings
I. Introduction
II. The Rocky Road towards EU Law on the Rights of the Defendant before Lisbon
III. The Lisbon Breakthrough: The Emergence of an Express EU Competence to Legislate on Criminal Procedure
IV. The Renewed Momentum towards EU Procedural Rights in the Light of Lisbon
V. The Content of EU Procedural Rights
VI. The Relationship between EU Secondary Law on Defence Rights and National Law
VII. The Relationship of EU Secondary Law with the ECHR and the Charter
VIII. Enhancing Defence Rights through Effective Enforcement
IX. Effectiveness through Interpretation: Autonomous Concepts
X. Conclusion: Towards a Paradigm Change in Europe’s Area of Criminal Justice
6. The Place of the Victim in Europe's Area of Criminal Justice
I. Introduction
II. Victims' Rights in EU Criminal Law: A Typology
III. The Place of the Victim in Europe's Area of Criminal Justice: Constitutional Implications
IV. The Impact of EU Law on Victims' Rights on National Criminal Justice Systems
V. The Impact of Victims' Rights on Justice in Europe
VI. Conclusion
7. The Uneasy Relationship between EU Criminal Law and Citizenship of the EU
I. Introduction
II. Citizenship in EU Criminal Law
III. EU Criminal Law in EU Citizenship
IV. Conclusion: Towards a Paradigm Change in Citizenship and EU Criminal Law
8. Bodies, Offices and Agencies
I. Introduction
II. Europol
III. Eurojust
IV. OLAF
V. The EPPO
VI. Other Bodies: Counter-terrorism, Migration, Informality and the Legacy of 'Cross-Pillarisation'
VII. Inter-agency Cooperation
VIII. Controlling Bodies by Other Bodies and Agencies
IX. Conclusion: Extending the Field of Enforcement in the EU?
9. Databases
I. Introduction
II. Centralised Databases
III. Decentralised Mechanisms of Data Exchange Amongst National Authorities
IV. The Privatisation of Information Exchange
V. Privacy and Protection of Personal Data in the Post-Lisbon Era
VI. Conclusion: What is the Future for Privacy and Data Protection in an Era of Security?
10. The EU and the Global Governance of Crime
I. Introduction
II. Governing Crime via Global Multilateral Treaties: The EU and the UN
III. Governing Crime via Regional Multilateral Treaties: The EU and the Council of Europe
IV. Governing Crime via 'Soft' Law: The EU and the FATF
V. Governing Crime via 'Global Administrative Law': The EU and the UN Security Council
VI. Globalisation of Criminal Law through Synergy between 'Hard' Law, 'Soft' Law, 'Global Administrative Law' and Supranational Law: The Case of 'Foreign Fighters'
VII. Conclusion
11. The External Dimension of Mutual Trust Transatlantic Counter-terrorism Cooperation
I. Introduction
II. Transatlantic Counter-terrorism Cooperation: A Typology of EU–US Agreements and their Impact on European Values
III. The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation
IV. Conclusion
12. EU Criminal Law after Brexit
I. Introduction
II. Before Brexit: The Ambivalent Relationship between the UK and European Criminal Law
III. The Run-up to Brexit: Political versus Operational Considerations
IV. After Brexit: The EU-UK Trade and Cooperation Agreement
V. Conclusion
Bibliography
Index

Recommend Papers

EU Criminal Law 9781472564719, 9781841135854

EU Criminal Law is perhaps the fastest-growing area of EU law. It is also one of the most contested fields of EU action,

180 113 2MB Read more

The Legitimacy of EU Criminal Law 9781509919741, 9781509919772, 9781509919765

This book traces the history of the EU competence, EU policy discourse and EU legislation in the field of criminalisatio

156 50 4MB Read more

EU Justice and Home Affairs Law. Volume II: EU Criminal Law, Policing, and Civil Law [5 ed.] 9780198890232

Lacking parts: Bibliography Index

116 64 4MB Read more

Limits to EU Powers: A Case Study of EU Regulatory Criminal Law 9781509903351, 9781509903382, 9781509903368

Pursuant to the precepts of EU law, EU policy-makers are bound to ensure that any EU legislation must fall within the re

159 65 17MB Read more

Limits to EU Powers: A Case Study of EU Regulatory Criminal Law (Hart Studies in European Criminal Law) [Reprint ed.] 150993474X, 9781509934744

PRAISE FOR THE BOOK “…essential reading for anyone interested in the existence and exercise of EU powers in the field of

163 0 4MB Read more

EU Pension Law 9789048544530

How does the EU affect national pensions and what is the legal EU framework for cross-border pensions?

99 40 1MB Read more

The Emergence of EU Criminal Law: Cybercrime and the Regulation of the Information Society 9781474201872, 9781849467278

Criminal law can no longer be neatly categorised as the product and responsibility of domestic law. That this is true is

156 32 2MB Read more

EU Law Beyond EU Borders: The Extraterritorial Reach of EU Law 0198842171, 9780198842170

This book addresses the impact of EU law beyond its own borders, the use of law as a powerful instrument of EU external

614 8 1MB Read more

Criminal Law 1614009746

180 89 58MB Read more

The Principle of Mutual Trust in EU Criminal Law 9781509924547, 9781509924578, 9781509924561

This book develops a conceptual framework of the principle of mutual trust in EU criminal law. Mutual trust is a househo

154 88 5MB Read more

EU Criminal Law
9781849464581, 9781474203401, 9781509904167

Author / Uploaded
Valsamis Mitsilegas

0 0 0
Like this paper and download? You can publish your own PDF file online for free in a few minutes! Sign Up

File loading please wait...

Citation preview

EU CRIMINAL LAW Second Edition This is the second edition of EU Criminal Law which, since its initial publication in 2009, has become a key point of reference in the field. The second edition is updated and substantially expanded to take into account the significant growth of EU criminal law as a distinct legal field and the impact of the entry into force of the Lisbon Treaty on European integration in criminal matters. The book offers a holistic and in-depth analysis of the key elements of European integration in criminal matters, including EU powers and competence to criminalise, the evolution of judicial co-operation under the principles of mutual recognition and mutual trust, EU action in the field of criminal procedure including legislation on the rights of the defendant and the victim, the evolving role of European bodies and agencies (such as Europol, Eurojust and the European Public Prosecutor’s Office), the development of EU-wide surveillance mechanisms, and the external (including post-Brexit) dimension of EU criminal law. Covering all aspects of EU criminal law, with clear explanation and rigorous analysis, this book will give scholars, students, policy makers and legal practitioners interested in the subject a strong understanding of this fascinating but complex field. Volume 110 in the Series Modern Studies in European Law

Modern Studies in European Law Recent titles in this series: Sixty Years of European Integration and Global Power Shifts: Perceptions, Interactions and Lessons Edited by Julien Chaisse Fundamental Rights and Mutual Recognition in the Area of Freedom, Security and Justice: A Role for Proportionality? Ermioni Xanthopoulou Law and Judicial Dialogue on the Return of Irregular Migrants from the European Union Edited by Madalina Moraru, Galina Cornelisse and Philippe De Bruycker Framing Convergence with the Global Legal Order: The EU and the World Edited by Elaine Fahey EU Citizenship at the Edges of Freedom of Movement Katarina Hyltén-Cavallius The Internal Market 2.0 Edited by Sacha Garben and Inge Govaere New Directions in European Private Law Edited by Mateja Durovic and Takis Tridimas Standing to Enforce European Union Law before National Courts Hilde Ellingsen The Relative Authority of Judicial and Extra-Judicial Review: The EU Courts, the Boards of Appeal and the Ombudsman Michal Krajewski Responsive Human Rights: Vulnerability and the ECtHR Corina Heri The Architecture of Fundamental Rights in the European Union Šejla Imamovic The EU and its Member States’ Joint Participation in International Agreements Edited by Nicolas Levrat, Yuliya Kaspiarovich, Christine Kaddous and Ramses A Wessel The UN Convention on the Rights of Persons with Disabilities and the European Union: The Impact on Law and Governance Carmine Conte EU Criminal Law, Second Edition Valsamis Mitsilegas For the complete list of titles in this series, see www.bloomsbury.com/uk/series/modern-studies-in-european-law

EU Criminal Law Second Edition

Valsamis Mitsilegas

HART PUBLISHING Bloomsbury Publishing Plc Kemp House, Chawley Park, Cumnor Hill, Oxford, OX2 9PH, UK 1385 Broadway, New York, NY 10018, USA 29 Earlsfort Terrace, Dublin 2, Ireland HART PUBLISHING, the Hart/Stag logo, BLOOMSBURY and the Diana logo are trademarks of Bloomsbury Publishing Plc First published in Great Britain 2022 Copyright © Valsamis Mitsilegas, 2022 Valsamis Mitsilegas has asserted his right under the Copyright, Designs and Patents Act 1988 to be identified as Author of this work. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage or retrieval system, without prior permission in writing from the publishers. While every care has been taken to ensure the accuracy of this work, no responsibility for loss or damage occasioned to any person acting or refraining from action as a result of any statement in it can be accepted by the authors, editors or publishers. All UK Government legislation and other public sector information used in the work is Crown Copyright ©. All House of Lords and House of Commons information used in the work is Parliamentary Copyright ©. This information is reused under the terms of the Open Government Licence v3.0 (http://www.nationalarchives.gov.uk/doc/ open-government-licence/version/3) except where otherwise stated. All Eur-lex material used in the work is © European Union, http://eur-lex.europa.eu/, 1998–2022. A catalogue record for this book is available from the British Library. Library of Congress Cataloging-in-Publication data Library of Congress Control Number: 2021952796 ISBN: HB: 978-1-84946-458-1 ePDF: 978-1-50990-416-7 ePub: 978-1-50990-417-4 Typeset by Compuscript Ltd, Shannon To find out more about our authors and books visit www.hartpublishing.co.uk. Here you will find extracts, author information, details of forthcoming events and the option to sign up for our newsletters.

PREFACE This book comes more than a decade after the publication of its first edition, EU Criminal Law, in 2009. Since then, a lot has changed. The entry into force of the Lisbon Treaty has led to the normalisation, or as I argue constitutionalisation, of EU criminal law, moving from the pre-Lisbon intergovernmental institutional framework to the ordinary constitutional framework of EU law. It can be said that EU criminal law has since come of age. The EU has acted on a number of new and important areas of competence – legislating on defence rights and the establishment of a European Public Prosecutor’s Office (EPPO) are key examples in this regard. Moreover, the operation of EU criminal law on the ground, most notably through the application of the principle of mutual recognition in criminal matters and in particular through the emblematic European Arrest Warrant system, has raised a number of questions on the relationship between EU criminal law and the citizen, the protection of fundamental rights and the rule of law, leading to a growing and important body of case law in the Court of Justice of the European Union, and increasingly in the European Court of Human Rights and in national courts. In this manner, EU criminal law questions become essentially constitutional questions which necessitate answers in order to define the fundamental rights and rule of law benchmarks in the European Union and its Member States. And of course, Brexit has happened. This second edition takes full account of these developments. The number of chapters has doubled in size compared to the first edition (there are 12 chapters in this edition). All chapters in the first edition have been substantially revised and expanded. There are now three chapters devoted to external relations (Chapters 10–12), including a chapter specifically devoted to Brexit. The chapter on mutual recognition is now accompanied by three new chapters on defence rights, the rights of victims, and EU criminal law and EU citizenship (Chapters 5–7). The chapter on agencies now includes a detailed analysis of the establishment of the EPPO. And there is now a specific chapter on ne bis in idem and conflicts of jurisdiction. I would like to take this opportunity to thank a number of friends and colleagues for their support and input in developing this second edition, and my ideas and arguments on EU criminal law more broadly. Sinead Moloney and her colleagues at Hart Publishing have shown unwavering support and patience during the completion of this volume. I would also like to thank them for their stellar work and commitment towards the development of the Hart Studies on European Criminal Law series, which has succeeded in publishing cutting-edge scholarship in the field and, like the first edition of this book and hopefully this edition, has contributed to defining EU criminal law as a distinct and dynamic academic discipline. I would also like to thank Jon Lloyd for outstanding copyediting on this very demanding second edition – his care and attention to the clarity and consistency of the manuscript have been exemplary.

vi Preface This book further owes a lot to the work, ideas and commitment of academic, s cholarly and policy communities working in the field of EU criminal law. The European Criminal Law Academic Network (ECLAN) is a prime example of such an academic community. I have benefited enormously from my interactions with colleagues in ECLAN and would like to thank my colleagues and friends on the Management Committee, including Pedro Caeiro and my ECLAN fellow coordinators Katalin Ligeti and Anne Weyembergh, for their generosity, spirit and unparalleled insights into the field. Ideas and arguments in this volume have also developed through interactions and dialogue with scholars and students in a number of institutions across Europe, which have emerged as hubs for advanced and innovative thinking in the field of EU criminal law. I would like to take this opportunity to salute colleagues at the Universities of Bologna, Catania, Coimbra, Ferrara, Luxembourg, Paris (Paris 1 Panthéon Sorbonne), Thessaloniki, ULB, Uppsala and the European University Institute for their engagement with EU criminal law, and I thank them for the opportunities given to me to present and discuss ideas and arguments with outstanding colleagues and students. I have also benefited from discussions with colleagues at the European Commission’s Expert Group on EU Criminal Policy. Last, but not least, I would like to pay tribute to the positive impact my interaction with students and early career researchers has had on the development of this volume. The time since the first edition of this volume saw the launch of the annual PhD conference of ECLAN, which gives scholars and research students the opportunity to discuss cutting-edge issues in EU criminal law. I have benefited enormously from organising and participating in these events and engaging with the ideas of early career researchers, who are arguably the future of EU criminal law. I would also like to thank in particular my Queen Mary LLM students on EU criminal law, discussions with whom always help to focus the mind, and the outstanding cohort of Queen Mary PhD students working in the field. Clementina Salvi provided excellent editorial support during the finalisation of the manuscript. It is an honour for me that two of my former PhD students – now alumni with outstanding career trajectories who have already established their own stellar reputations in the field – have worked with me to develop parts of this volume: Dr Fabio Giuffrida, now Policy Officer, Directorate-General for Justice and Consumers at the European Commission, who co-authored the chapters on agencies and ne bis in idem with me, and Dr Niovi Vavoula, now Lecturer in Migration and Security at Queen Mary, who co-authored the chapter on databases with me and provided excellent research assistance during earlier stages of the development of this volume. The usual disclaimers, of course, apply. The volume takes into account developments up to August 2021. Valsamis Mitsilegas London, August 2021

CONTENTS Preface�� v Table of Cases��xi 1. History, Principles and Institutions: The Constitutionalisation of EU Criminal Law��1 I. Introduction�� 1 II. Background: The Community and Criminal Law before Maastricht�� 1 III. The Third Pillar: The Institutional Framework�� 5 IV. The Third Pillar and the Constitutional Principles of the Community: The Contribution of the Court of Justice�� 17 V. The Politics of the Third Pillar: Member States’ Security Ambitions versus Institutional Checks and Limits�� 24 VI. The Lisbon Treaty and the Constitutionalisation of EU Criminal Law: Institutions, Principles and Rights�� 29 VII. Legal Basis Disputes and Contested Competence�� 47 VIII. Sovereignty Concerns and the Persistence of National Diversity�� 67 IX. The Interplay between EU Criminal Law and Upholding the Rule of Law�� 77 X. Conclusion�� 87 2. Substantive Criminal Law: From Securitised to Functional Criminalisation��89 I. Introduction�� 89 II. Before Lisbon: The Interplay between Community Law and National Criminal Law�� 90 III. The Constitutional Politics of Criminalisation before Lisbon: The Competence Question�� 95 IV. EU Competence to Criminalise after Lisbon: Securitised and Functional Criminalisation��114 V. The Relationship between Criminal and Administrative Law��120 VI. Extending EU Competence to Criminalise Elsewhere in the Treaty��121 VII. Contesting EU Competence in Substantive Criminal Law: The Lissabon-Urteil��125 VIII. Policy Responses to the EU Competence to Criminalise after Lisbon��127 IX. EU Criminalisation Challenges and Prospects for Law Reform��130 X. Conclusion��146

viii Contents 3. Ne Bis in Idem and Conflicts of Jurisdiction��148 Valmasis Mitsilegas and Fabio Giuffrida I. Introduction��148 II. Legislation on Ne Bis in Idem at the European Level��150 III. Transnational Ne Bis in Idem: Scope and Content��152 IV. Concurrent Jurisdiction��171 V. Application of Ne Bis in Idem to Criminal and Administrative Proceedings Concerning the Same Facts��180 VI. Conclusion��191 4. Mutual Recognition and Mutual Trust��196 I. Introduction��196 II. Mutual Recognition and Mutual Trust: Origins and Legal Architecture��196 III. Mutual Trust, Legality and Dual Criminality: From Advocaten voor de Wereld to Grundza��202 IV. Mutual Trust, Fundamental Rights and Proportionality: Radu��207 V. Mutual Trust and the Primacy and Autonomy of EU Law: From Melloni to Opinion 2/13��212 VI. Mutual Trust as a Challenge to Fundamental Rights and Constitutional Identity: The Response from the ECtHR and National Constitutional Courts��218 VII. A Paradigm Change by the Court of Justice: The Dialogical and Interactive Model of Scrutinising Mutual Trust in Aranyosi��223 VIII. Aranyosi as a Catalyst for Calm in the Battle for Authority and Primacy��226 IX. Contesting the Parameters of Mutual Trust after Aranyosi: Fundamental Rights��230 X. Contesting the Parameters of Mutual Trust after Aranyosi: The Rule of Law��235 XI. Mutual Trust through a Judicially Developed Level Playing Field: Autonomous Concepts��242 XII. Conclusion��252 5. Legislating for Human Rights: The EU Legal Framework on the Rights of Individuals in Criminal Proceedings��254 I. Introduction��254 II. The Rocky Road towards EU Law on the Rights of the Defendant before Lisbon��255 III. The Lisbon Breakthrough: The Emergence of an Express EU Competence to Legislate on Criminal Procedure��257 IV. The Renewed Momentum towards EU Procedural Rights in the Light of Lisbon��259 V. The Content of EU Procedural Rights��260 VI. The Relationship between EU Secondary Law on Defence Rights and National Law��284

Contents ix VII. The Relationship of EU Secondary Law with the ECHR and the Charter��287 VIII. Enhancing Defence Rights through Effective Enforcement��289 IX. Effectiveness through Interpretation: Autonomous Concepts��292 X. Conclusion: Towards a Paradigm Change in Europe’s Area of Criminal Justice��294 6. The Place of the Victim in Europe’s Area of Criminal Justice��296 I. Introduction��296 II. Victims’ Rights in EU Criminal Law: A Typology��297 III. The Place of the Victim in Europe’s Area of Criminal Justice: Constitutional Implications��305 IV. The Impact of EU Law on Victims’ Rights on National Criminal Justice Systems��308 V. The Impact of Victims’ Rights on Justice in Europe��315 VI. Conclusion��318 7. The Uneasy Relationship between EU Criminal Law and Citizenship of the EU��320 I. Introduction��320 II. Citizenship in EU Criminal Law��320 III. EU Criminal Law in EU Citizenship��336 IV. Conclusion: Towards a Paradigm Change in Citizenship and EU Criminal Law��346 8. Bodies, Offices and Agencies��349 Valsamis Mitsilegas and Fabio Giuffrida I. Introduction��349 II. Europol��350 III. Eurojust��391 IV. OLAF��419 V. The EPPO��435 VI. Other Bodies: Counter-terrorism, Migration, Informality and the Legacy of ‘Cross-Pillarisation’��465 VII. Inter-agency Cooperation��473 VIII. Controlling Bodies by Other Bodies and Agencies��475 IX. Conclusion: Extending the Field of Enforcement in the EU?��477 9. Databases��480 Valsamis Mitsilegas and Niovi Vavoula I. Introduction��480 II. Centralised Databases��481 III. Decentralised Mechanisms of Data Exchange Amongst National Authorities��523 IV. The Privatisation of Information Exchange��548 V. Privacy and Protection of Personal Data in the Post-Lisbon Era��601 VI. Conclusion: What is the Future for Privacy and Data Protection in an Era of Security?��608

x Contents 10. The EU and the Global Governance of Crime��612 I. Introduction��612 II. Governing Crime via Global Multilateral Treaties: The EU and the UN��613 III. Governing Crime via Regional Multilateral Treaties: The EU and the Council of Europe��627 IV. Governing Crime via ‘Soft’ Law: The EU and the FATF��631 V. Governing Crime via ‘Global Administrative Law’: The EU and the UN Security Council��638 VI. Globalisation of Criminal Law through Synergy between ‘Hard’ Law, ‘Soft’ Law, ‘Global Administrative Law’ and Supranational Law: The Case of ‘Foreign Fighters’��655 VII. Conclusion��656 11. The External Dimension of Mutual Trust: Transatlantic Counter-terrorism Cooperation��658 I. Introduction��658 II. Transatlantic Counter-terrorism Cooperation: A Typology of EU–US Agreements and their Impact on European Values��659 III. The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation��663 IV. Conclusion��691 12. EU Criminal Law after Brexit��693 I. Introduction��693 II. Before Brexit: The Ambivalent Relationship between the UK and European Criminal Law��693 III. The Run-up to Brexit: Political versus Operational Considerations��698 IV. After Brexit: The EU–UK Trade and Cooperation Agreement��702 V. Conclusion��721 Bibliography��724 Index��757

TABLE OF CASES ECJ, CJEU A v Staatsanwaltschaft Offenburg (Case C-9/16), ECLI:EU:C:2017:483, 21 June 2017��522 A and Others (Staatsanwaltschaft Wien) (Case C-584/19), ECLI:EU:C:2020:1002, 8 December 2020��251 Achughbabian v Prefet du Val-de-Marne (Case C-329/11), [2011] ECR I-12695, ECLI:EU:C:2011:807, 6 December 2011�� 92 Advocaten voor de Wereld VZW v Leden van de Ministerraad (Case C-303/05) ECLI:EU:C:2006:552, A-G’s opinion, 12 September 2006��204, 206 Advocaten voor de Wereld VZW v Leden van de Ministerraad (Case C-303/05) [2007] ECR I-3633, ECLI:EU:C:2007:261, 3 May 2007�� 11, 39, 201, 202, 203–6, 222, 321, 323 Afton Chemical Ltd v Secretary of State for Transport (Case C-343/09), [2011] 1 CMLR 16, ECLI:EU:C:2010:419, 8 July 2010��564 AK and Others v Sąd Najwyższy, CP v Sąd Najwyższy and DO v Sąd Najwyższy (Independence of the Disciplinary Chamber of the Supreme Court) (Case C-585/18, C-624/18 and C-625/18) ECLI:EU:C:2019:982, 19 November 2019��237 Åklagaren v Hans Åkerberg Fransson (Case C-617/10) ECLI:EU:C:2013:105, 26 February 2013��35, 36, 46, 47, 182–3, 185, 187, 193, 288, 318 Amsterdam Bulb BV v Produktschap voor Siergewassen (Case 50/76) [1977] ECR 137, [1977] 2 CMLR 218, ECLI:EU:C:1977:13, 2 February 1977�� 93 Aranyosi (Pál) and Căldăraru (Robert) v Generalstaatsanwaltschaft Bremen (Joined Cases C-404/15 and C-659/15 PPU) [2016] QB 921, [2016] 3 CMLR 13, 42 BHRC 551, ECLI:EU:C:2016:198 (Grand Chamber) 5 April 2016�� 17, 219, 223–5, 226, 227, 228, 230, 231, 234, 235, 236, 237, 238, 239, 240, 241, 242, 247, 251, 252, 284, 704 Ardic (Case C-571/17 PPU) ECLI:EU:C:2017:1026, 22 December 2017��292 ASBL ‘Ligue des Droits Humains’ (Case C-817/19) (pending)��592 Asociaţia ‘Forumul Judecătorilor din Romania’ et al (Joined Cases C-83/19, C-127/19, C-195/19, C-291/19, C-355/19 and C-397/19) ECLI:EU:C:2021:393, 18 May 2021��83–4

xii Table of Cases Associacao Sindical dos Juizes Portugueses v Tribunal de Contas (ASJP) (Case-64/16) [2018] 3 CMLR 16, [2018] CEC 1216, ECLI:EU:C:2018:117, 27 February 2018��236, 238, 240, 247 AY (Case C-268/17) ECLI:EU:C:2018:602, 25 July 2018��160 Balaž (Case C-60/12) ECLI:EU:C:2013:733, 14 November 2013��310 Berlusconi, Adelchi, Dell’Utri and Others (Joint Cases C-387/02, C-391/02 and C-403/02) [2005] ECR I-3565, [2005] 2 CMLR 32, ECLI:EU:C:2005:270 (Grand Chamber), 3 May 2005��24, 31, 94–5, 122 Bickel and Franz (Case C-274/96) [1998] ECR I-7637, [1999] 1 CMLR 348, ECLI:EU:C:1998:563, 24 November 1998�� 92 Bob-Dogi (Case C-241/15) [2016] 1 WLR 4583, [2017] 3 CMLR 40, ECLI:EU:C:2016:385, 1 June 2016�� 17, 243, 248 Bonda (Case C-489/10) ECLI:EU:C:2011:845, A-G’s opinion, 15 December 2011��182 Bonda (Case C-489/10) ECLI:EU:C:2012:319, 5 June 2012�� 181–2, 183, 185, 193, 278 Bouchereau (Pierre Roger) (Case 30/77) [1978] QB 732, [1977] ECR 1999, [1977] 2 CMLR 800, ECLI:EU:C:1977:172, 27 October 1977��344 Bourquain (Case C-297/07) [2008] ECR I-9425, ECLI:EU:C:2008:708, 11 December 2008��157, 158, 165–6, 170 Bundesrepublik Deutschland (Notice Rouge d’Interpol) (Case C-505/19), [2021] 3 CMLR 26, ECLI:EU:C:2021:376, 12 May 2021��154, 158 Bundesrepublik Deutschland (Case C-222/20) (pending)��592 Calfa (Case 48/96) [1999] ECR I-11, [1999] 2 CMLR 1138, ECLI:EU:C:1996:6, 19 January 1999�� 91 Casati (Guerrino) (Case C-203/80) [1981] ECR 2595, ECLI:EU:C:1981:261, 11 November 1981�� 91, 92, 298 Commission v Council (Case C-176/03) ECLI:EU:C:2005:311, A-G’s opinion, 26 May 2005��102 Commission v Council (Case C-176/03) (Environmental Crime) [2005] ECR I-7879, [2005] 3 CMLR 20, ECLI:EU:C:2005:542, 13 September 2005�� 49, 100–102, 103, 104, 106, 111, 115, 117–8, 131 Commission v Council (Case C-91/05) [2008] ECR I-3651, [2008] 3 CMLR 5, ECLI:EU:C:2008:288, 20 May 2008��111 Commission v Council (Case C-440/05) (Ship-Source Pollution) ECLI:EU:C:2007:393, A-G’s opinion, 28 June 2007��108, 110–112, 113 Commission v Council (Case C-440/05) (Ship-Source Pollution) [2007] ECR I-9097, [2008] 1 CMLR 22, ECLI:EU:C:2007:625 (Grand Chamber), 23 October 2007�� 49, 108–109, 110–112, 113, 115, 117 Commission v Council (Titanium Dioxide) (Case C-300/89) [1991] ECR I-2867, [1999] 3 CMLR 359, ECLI:EU:C:1991:244, 11 June 1991�� 57, 61, 308 Commission v Council (the Philippines case) (Case C-377/12), ECLI:EU:C:2014:1903 (Grand Chamber), 11 June 2014��696

Table of Cases xiii Commission v European Central Bank (Case C-11/00) [2003] ECR I-7417, ECLI:EU:C:2003:395, 10 July 2003��420 Commission v European Investment Bank (Case C-15/00) [2003] ECR I-7281, ECLI:EU:C:2003:396, 10 July 2003��420 Commission v Greece (Case C-68/88) [1989] ECR 2965, [1991] 1 CMLR 31, ECLI:EU:C:1989:339, 21 September 1989�� 93–4, 419 Commission v The Netherlands (Case C-50/06) [2007] ECR I-4383, [2007] 3 CMLR 8, ECLI:EU:C:2007:325, 7 June 2007��343 Commission v Poland (Case C-791/19 R) ECLI:EU:C:2020:277, order of 8 April 2020��237 Commission v SGL Carbon AG (Case C-301/04 P) [2006] ECR I-5915, [2006] 5 CMLR 15, ECLI:EU:C:2006:432, (29 June 2006)��278 Commission v Violetti and Others (Case T-261/09 P) EU:T:2010:215, 20 May 2010��430 Commission and Parliament v Council (Case C-137/12) ECLI:EU:C:2013:675, 22 October 2013��696 Covaci (Gavril), Criminal Proceedings against (Case C-216/14) ECLI:EU:C:2015:305, A-G’s opinion, delivered on 7 May 2015��261, 285, 286, 288 Cowan v Trésor Public (Case 186/87) [1989] ECR 195, [1990] 2 CMLR 613, ECLI:EU:C:1989:47, 2 February 1989�� 91, 298, 299 Czech Republic v European Parliament and Council (Case C-482/17) ECLI:EU:C:2019:1035 (Grand Chamber), 3 December 2019�� 48–9, 63 Da Silva Jorge (Joao Pedro Lopes) (Case C-42/11) ECLI:EU:C:2012:151, A-G’s opinion, 20 March 2012��328 Da Silva Jorge (Joao Pedro Lopes) (Case C-42/11) ECLI:EU:C:2012:517 (Grand Chamber), 5 September 2012�� 32, 33, 327–8 DB v Consob (Case C-481/19) ECLI:EU:C:2021:84, 2 February 2021��121 Dell’Orto (Giovanni) (Case C-467/05) [2007] ECR I-5557, [2007] 3 CMLR 29, ECLI:EU:C:2007:395, 28 June 2007��314 Deutsche Post and Germany v Commission (Joined Cases C-463/10 P and C-475/10 P) [2011] ECR I-9639, ECLI:EU:C:2011:656, 13 October 2011��429 Di Puma and Zecca (Joined Cases C-596/16 and C-597/16) ECLI:EU:C:2018:192, 20 March 2018�� 189–90 Digital Rights Ltd v Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung, Michael Seitlinger, Christof Tschohl and Others (Joined Cases C-293/12 and C-594/12, UE:C:2013:845) A-G’s opinion, 12 December 2013��563 Digital Rights Ltd v Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung, Michael Seitlinger, Christof Tschohl and Others (Joined Cases C-293/12 and C-594/12) [2015] QB 127, [2014] 3 CMLR 44, ECLI:EU:C:2014:238 (Grand Chamber), 8 April 2014��390, 501, 509, 513, 562–8, 569, 570, 571, 572, 573, 574, 575, 578, 586, 608, 673, 687

xiv Table of Cases DK (Case C-653/19) ECLI:EU:C:2019:1024, 28 November 2019��279 Dorobantu (Case C-128/18) ECLI:EU:C:2019:857, 15 October 2019�� 227, 229, 230, 232, 233, 235 Dworzecki (Case C-108/16 PPU) ECLI:EU:C:2016:346, 24 May 2016��17, 292 Dzivev (Petar) (Case C-310/16) ECLI:EU:C:2018:623, A-G’s opinion, 25 July 2018�� 44 Dzivev (Petar) (Case C-310/16) ECLI:EU:C:2019:30, 17 January 2019��44, 289 ‘EEA Case’. See United Kingdom v Council (Case C-431/11) El-Dridi (alias Soufi) (Case C-61/11 PPU) [2011] ECR I-03015, [2011] 3 CMLR 6, ECLI:EU:C:2011:268, 28 April 2011�� 92 Environmental Crime. See Commission v Council (Case C-176/03) EP (Case C-467/18) ECLI:EU:C:2019:765, 19 September 2019��266 Eredics and Sapi (Case C-205/09) [2010] ECR I-10231, ECLI:EU:C:2010:623, 21 October 2010��314 European Commission v European Parliament and Council (Case C-43/12) ECLI:EU:C:2013:534, A-G’s opinion, 10 September 2013�� 51 European Commission v European Parliament and Council (Case C-43/12) ECLI:EU:C:2014:298 (Grand Chamber), 6 May 2014�� 50–52, 129 European Commission v Kadi (Joined Cases C-584/10 P, C-593/10 P and C-595/10 P) ECLI:EU:C:2013:176, (Kadi II) A-G’s opinion, 19 March 2013��651–2 European Commission v Kadi (Joined Cases C-584/10 P, C-593/10 P and C-595/10 P) [2014] 1 CMLR 24, [2014] All ER (EC) 123, ECLI:EU:C:2013:518, (Kadi II) 18 July 2013�� 452, 649–50, 652–5 European Parliament v Council and Commission (Cases C-317/04 and C-318/04) [2006] ECR I-4721, [2006] 3 CMLR 9, ECLI:EU:C:2006:346, 30 May 2006��104, 660 European Parliament v Council (Case C-130/10) ECLI:EU:C:2012:472 (Grand Chamber), 19 July 2012��54–61 European Parliament v Council (Case C-658/11) ECLI:EU:C:2014:2025, 24 June 2014��63–7 European Parliament v Council (Joined Cases C-317/13 and C-679/13) ECLI:EU:C:2015:223, 16 April 2015��258 European Parliament v Council (Case C-540/13) ECLI:EU:C:2015:224, 16 April 2015��258 European Parliament v Council (Case C-263/14) ECLI:EU:C:2016:435, 14 June 2016�� 63 Facebook Ireland and Schrems (Case C-311/18) ECLI:EU:C:2019:1145 (Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems; ‘Schrems II’), A-G’s opinion, 19 December 2019�� 681–8, 689 Facebook Ireland and Schrems (Case C-311/18) [2021] 1 WLR 751, [2021] 1 CMLR 14, ECLI:EU:C:2020:559 (Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems; ‘Schrems II’), 16 July 2020��385, 681, 688–92

Table of Cases xv Federal Republic of Germany v Telekom Deutschland GmbH (Case C-794/19) (in progress)��585 Filev and Osmani (Case C-297/12) ECLI:EU:C:2013:569, 19 September 2013�� 92 Forster v Hoofddirectie van de Informatie Beheer Groep (Case C-158/07) [2008] ECR I-08507, [2009] 1 CMLR 32, ECLI:EU:C:2008:630, 18 November 2008��326 Foto-Frost v Hauptzollamt Lubeck-Ost (Case 314/85) [1987] ECR 4199, [1988] 3 CMLR 57, ECLI:EU:C:1987:452, 22 October 1987��452 Franchet and Byk v Commission of the European Communities (Case T-48/05) EU:T:2008:257, 8 July 2008��430–1 Gambino and Hyka (Case C-38/18) ECLI:EU:C:2019:628, 29 July 2019��304 Garlsson Real Estate and Others (Case C-537/16) ECLI:EU:C:2018:193, 20 March 2018�� 188–9, 190, 191, 193, 194 Gasparini and Others (Case C-467/04) ECLI:EU:C:2006:406, A-G’s opinion, 15 June 2006�� 155, 169, 170 Gasparini and Others (Case C-467/04) [2006] ECR I-9199, [2007] 1 CMLR 12, ECLI:EU:C:2006:610, 28 September 2006�� 155, 161, 192 Gavanozov I (Case C-324/17) ECLI:EU:C:2019:312, A-G’s opinion 11 April 2019��251 Gavanozov I (Case C-324/17) ECLI:EU:C:2019:892, 24 October 2019��251 Gavanozov II (Case C-852/19) ECLI:EU:C:2021:346, A-G’s opinion 29 April 2021��253 GD v Commissioner of the Garda Siochana, Minister for Communications, Energy and Natural Resources, Attorney General (Case C-140/20) (in progress)��585 Generálna prokuratura Slovenskej republiky v XY (Case C-919/19) ECLI:EU:C:2021:650, A-G’s opinion, 3 June 2021��330 Generalstaatsanwaltschaft Berlin (Extradition vers l’Ukraine) (Case C-398/19) ECLI:EU:C:2020:1032, 17 December 2020��335, 336 Gestoras Pro Ammnistia v Council (Case C-354/04 P) [2007] ECR I-5179, ECLI:EU:C:2007:115, 27 February 2007�� 11 Gestoras Pro Amnistia v Council (Case T-333/02) (not published)��15, 16 Giovanardi (Case C-79/11) ECLI:EU:C:2012:448, 12 July 2012��314 Google Spain and Google (Case C-131/12) [2014] QB 1022, [2014] 3 CMLR 50, ECLI:EU:C:2014:317, 13 May 2014��683 Gözütok (Huseyn) and Brügge (Klaus), Criminal Proceedings againt (Cases C-187/01, C-385/01) ECLI:EU:C:2002:516, A-G’s opinion, 19 September 2002��170, 192 Gözütok (Huseyn) and Brügge (Klaus), Criminal Proceedings againt (Cases C-187/01, C-385/01) [2003] ECR I-1345, ECLI:EU:C:2003:87, 11 February 2003�� 153–4, 155, 156, 158, 161, 164, 168, 169–170 Greek Maize Case. See Commission v Greece (Case C-68/88) Grundza (Case 289/15) ECLI:EU:C:2017:4, 11 January 2017�� 202, 206–7

xvi Table of Cases Gueye and Sanchez (Joined Cases C-483/09 and C-1/10) [2011] ECR I-8263, [2012] 1 WLR 2672, ECLI:EU:C:2011:583, 15 September 2011��313, 314 HK v Prokuratuur (Case C-746/18) ECLI:EU:C:2020:18, A-G’s opinion, 21 January 2020��583 HK v Prokuratuur (Case C-746/18) ECLI:EU:C:2021:152, 2 March 2021��583 International Association of Independent Tanker Owners (Intertanko) v Secretary of State for Transport (Case C-308/06) [2008] ECR I-4056, [2008] 2 Lloyds Rep 260, [2008] 3 CMLR 9, ECLI:EU:C:2008:312, 3 June 2008 ��205 International Management Group v Commission (Case T-110/15) EU:T:2016:322 425, 26 May 2016��425–6 IR (Case C-649/19) ECLI:EU:C:2021:75, 28 January 2021��285 Ireland v European Parliament and Council of the European Union (Case C-301/06) [2009] ECR I-593, [2009] 2 CMLR 37, ECLI:EU:C:2009:68, 10 February 2009��562 Jeremy F (Case C-168/13 PPU) ECLI:EU:C:2013:358, 30 May 2013�� 17, 201, 215 JR and YC (Joined Cases C-566/19 PPU and C-626/19 PPU) ECLI:EU:C:2019:1077, 12 December 2019��248 Jyske Bank Gibraltar Ltd v Administración del Estado (Case C-212/11) ECLI:EU:C:2012:607, A-G’s opinion��551 JZ v Prokuratura Rejonowa Łodź –Środmieście (Case C-294/16 PPU) ECLI:EU:C:2016:610, 28 July 2016��17, 201 Kadi (Yassin Abdullah) v Commission (Case T-85/09) [2010] ECR II-5177, [2011] 1 CMLR 24, ECLI:EU:T:2010:418, 30 September 2010��650 Kadi (Yassin Abdullah) v Council and Commission (Case T-315/01) [2005] ECR II-3649, ECLI:EU:T:2005:332, 21 September 2005�� 19, 20, 452, 645, 647, 650, 651 Kadi (Yassin Abdullah) and Al Barakaat International Foundation v Council and Commission (Kadi I) (Joined Cases C-402/05 P and C-415/05) [2008] ECR I-6351, [2008] 3 CMLR 41, ECLI:EU:C:2008:461, 3 September 2008�� 53–4, 59, 61, 62, 452, 643, 645–8, 649, 650, 654 Kadi II. See European Commission v Kadi (Joined Cases C-584/10 P, C-593/10 P and C-595/10 P) Katz (Győrgy) v Sós (István Roland) (Case C-404/07) [2008] ECR I-7607, ECLI:EU:C:2008:553, 9 October 2008�� 314–5, 318 Kol v Land Berlin (Case C-285/95) [1997] ECR I-3069, [1997] 3 CMLR 1175, ECLI:EU:C:1997:280, 5 June 1997��341 Kolev and Others (Case C-612/15) ECLI:EU:C:2018:392, 5 June 2018�� 31–2, 43, 44, 46, 285, 288, 289 Kolpinghuis Nijmegen BV (Case 80/86) [1987] ECR 3969, [1989] 2 CMLR 18, ECLI:EU:C:1987:431, 8 October 1987�� 95 Kossowski (Piotr) (Case C-486/14) ECLI:EU:C:2016:483 (Grand Chamber), 29 June 2016��156, 158, 159, 170

Table of Cases xvii Kovalkovas (Case C-477/16 PPU), ECLI:EU:C:2016:861, 10 November 2016�� 17, 243, 245 Kozlowski (Case C-66/08) ECLI:EU:C:2008:253, A-G’s view, 28 April 2008��322 Kozlowski (Case C-66/08) [2008] ECR I-06041, [2008] 3 CMLR 26, ECLI:EU:C:2008:437 (Grand Chamber), 17 July 2008�� 17, 321, 322, 323, 324, 325, 326, 327, 328 Kraajenbrink (Case C-367/05) [2007] ECR I-6619, ECLI:EU:C:2007:444, 18 July 2007��161–2 Kreil v Bundesrepublik Deutschland (Case C-285/98) [2000] ECR I-69, [2002] 1 CMLR 36, ECLI:EU:C:2002:2, 11 January 2000��338 Kretzinger (Case C-288/05) [2007] ECR I-6441, [2007] 3 CMLR 43, ECLI:EU:C:2007:441, 18 July 2007��162–3, 164, 165, 167 L and P (Openbaar Ministerie) (Indépendance de l’autorité judiciaire d’émission) (Joined Cases C-354/20 PPU and C-412/20 PPU) ECLI:EU:C:2020:925, A-G’s opinion, 12 November 2020��240, 241 L and P (Openbaar Ministerie) (Indépendance de l’autorité judiciaire d’émission) (Joined Cases C-354/20 PPU and C-412/20 PPU) ECLI:EU:C:2020:1033, 17 December 2020��237, 238, 239, 240 Land Baden-Württemberg v Tsakouridis (Case C-145/09) ECLI:EU:C:2010:322, A-G’s opinion, 8 June 2010�� 337–40, 341 La Quadrature du Net and Others v Premier Ministre and Others (Joined Cases C-511/18, C-512/18 and C-520/18) [2021] 1 WLR 4457, [2021] 1 CMLR 31, ECLI:EU:C:2020:791 (Grand Chamber), 6 October 2020��564, 575–6, 577–82, 584, 720 Land Baden-Württemberg v Tsakouridis (Case C-145/09) [2010] ECR I-11979, [2011] 2 CMLR 11, ECLI:EU:C:2010:708, 23 November 2010��336–7, 340, 342, 344 Lanigan (Case C-237/15 PPU) [2016] QB 252, [2016] 1 CMLR 16, ECLI:EU:C:2015:474 (Grand Chamber), 16 July 2015��215 Leifer and Others (Case C-83/94) [1995] ECR I-3231, ECLI:EU:C:1995:329, 17 October 1995��338 Leymann and Pustovarov (Case C-388/08 PPU) [2008] ECR I-8993, ECLI:EU:C:2008:669, 1 December 2008��210, 323 M (Case C-398/12) ECLI:EU:C:2014:1057, 5 June 2014��156, 157, 158, 163 Mantello (Gaetano) (Case C-261/09) [2010] ECR I-11477, ECLI:EU:C:2010:683, 16 November 2010��156, 163, 200, 210 MAS and MB (Case C-42/17) ECLI:EU:C:2017:936 (Taricco II), 5 December 2017�� 31, 39, 41–3, 44, 94, 288 Melki (Aziz) and Abdeli (Sélim) (Joined Cases C-188/10 and C-189/10) [2010] ECR I-5667, [2011] 3 CMLR 45, [2010] ECLI:EU:C:2010:363 (Grand Chamber), 22 June 2010��522 Melloni v Ministerio Fiscal (Case C-399/11) ECLI:EU:C:2012:600, A-G’s opinion, 2 October 2012��214, 215

xviii Table of Cases Melloni v Ministerio Fiscal (Case C-399/11) [2013] QB 1067, [2013] 2 CMLR 43, ECLI:EU:C:2013:107 (Grand Chamber), 26 February 2013��35, 40, 46, 83, 212–3, 214, 215, 217, 218, 219, 220, 232, 233, 286 Menci (Case C-524/15) ECLI:EU:C:2017:667, A-G’s opinion, 12 September 2017��187 Menci (Case C-524/15) [2018] 3 CMLR 12, ECLI:EU:C:2018:197, 20 March 2018��185–6, 187, 188, 189, 190, 191, 194 Miasto Łowicz and Prokurator Generalny (Cases C-558/18 and C-563/18) ECLI:EU:C:2020:234, 26 March 2020��238 Milev (Case C-310/18 PPU) ECLI:EU:C:2018:732, 19 September 2018��284 Minister for Justice and Equality v LM (Defaillances du systeme judiciaire) (Case-216/18 PPU) ECLI:EU:C:2018:586, 25 July 2018��235–6, 240, 241, 246, 247 Minister for Justice and Equality v RO (Case C-327/18 PPU) ECLI:EU:C:2018:733, 19 September 2018��719 Ministerio Fiscal (Case C-207/16) ECLI:EU:C:2018:300, A-G’s opinion, 3 May 2018��575 Ministerio Fiscal (Case C-207/16) ECLI:EU:C:2018:788 (Grand Chamber), 2 October 2018��574–5, 580, 581, 683 Miraglia (Case C-469/03) [2005] ECR I-2009, [2005] 2 CMLR 6, ECLI:EU:C:2005:156, 10 March 2005�� 154, 155, 156, 158, 159, 161 ML (Generalstaatsanwaltschaft, – Conditions of Dentention in Hungary) (Case C-220/18 PPU) ECLI:EU:C:2018:589, 25 July 2018��230–2, 233, 235 MM (Case C-414/20), ECLI:EU:C:2021:4, 13 January 2021��248 Möllendorf and Möllendorf-Niehuus (Case C-117/06) [2007] ECR I-8361, [2008] 1 CMLR 11, ECLI:EU:C:2007:596, 11 October 2007��648 Moro (Case C-646/17) ECLI:EU:C:2019:489, 13 June 2019��264 NJ (Case C-489/19 PPU) ECLI:EU:C:2019:849, 9 October 2019��248 NS v Secretary of State for the Home Department and ME and Others v Refugee Applications Commissioner and Minister for Justice, Equality and Law Reform (Joined Cases C-411/10 and C-493/10) [2011] ECR I-13905, ECLI:EU:C:2011:865 (Grand Chamber), 21 December 2011��207 Nunes de Matos (Case C-186/98) [1999] ECR I-4883, [1999] 2 CMLR 1403, ECLI:EU:C:1999:376, 8 July 1999�� 94 Oesterreichischer Rundfunk (Case C-195/06) [2007] ECR I-8817, ECLI:EU:C:2007:613, 18 October 2007��292 OG (Public Prosecutor’s Office of Lübeck) and PI (Public Prosecutor’s Office of Zwickau) (Joined Cases C-508/18 C-82/19 PPU) ECLI:EU:C:2019:337, A-G’s opinion, 30 April 2019��245, 246

Table of Cases xix OG (Public Prosecutor’s Office of Lübeck) and PI (Public Prosecutor’s Office of Zwickau) (Joined Cases C-508/18, C-82/19 PPU) ECLI:EU:C:2019:456 (Grand Chamber), 27 May 2019��211, 239, 240, 241, 244–5, 246, 247, 248–9, 595, 703 Ognyanov (Atanas) (Case C-554/14) [2017] QB 732, [2017] 2 WLR 1249, ECLI:EU:C:2016:835, 8 November 2016�� 33–4, 201 Okrazhna prokuratura – Varna (Criminal Proceedings v DR (Case C-845/19) and TS (Case C-863/19)), ECLI:EU:C:2021:229, A-G’s opinion, 24 March 2021��116 OMPI (Organisation des Modjahedines du peuple d’Iran v Council) v Council (Case T-228/02) [2006] ECR II-4665, ECLI:EU:T:2006:384, 12 December 2006�� 16, 23, 650 Onuekwere v Secretary of State for the Home Department (Case C-378/12) [2014] 1 WLR 2420, [2014] 2 CMLR 46, ECLI:EU:C:2014:13, 16 January 2014��347 Openbaar Ministerie, Criminal Proceedings against AZ (Case C-510/19) [2021] 2 CMLR 6, [2021] CEC 1059, ECLI:EU:C:2020:953, 24 November 2020��251 Opinion 1/15 of the Court on the agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data (PNR) ECLI:EU:C:2016:656, 8 September 2016��385, 390 Opinion 1/15 on the EU–Canada PNR Agreement, ECLI:EU:C:2017:592, 26 July 2017��543, 578, 586, 587, 590, 591, 599, 718 Ordre des Barreaux Francophones et Germanophone v Council (Case C-305/05) [2007] ECR I-5305, [2007] 3 CMLR 28, ECLI:EU:C:2007:383, 26 June 2007��584 Orsi and Baldetti (Joined Cases C-217/15 and C-350/15) ECLI:EU:C:2017:264, 5 April 2017��160 Österreichischer Rundfunk (Joined Cases C-465/00, C-138/01 and C-139/01) [2003] ECR I-4989, [2003] 3 CMLR 10, ECLI:EU:C:2003:294, 20 May 2003��687 Özcelik (Case C-453/16 PPU) ECLI:EU:C:2016:783, A-G’s opinion, 19 October 2016��244 Özcelik (Case C-453/16 PPU) ECLI:EU:C:2016:860, 10 November 2016�� 17, 243, 244 Öztürk (Case C-373/02) [2004] ECR I-3605, ECLI:EU:C:2004:232, 28 April 2004��246 Parliament v Council (Case C-540/03) [2006] ECR I-5769, [2006] 3 CMLR 28, ECLI:EU:C:2006:429, 27 June 2006��204, 205 People’s Mojahedin Organization of Iran v Council (PMOI II) (Case T-256/07) [2008] ECR II-3019, [2009] All ER (EC) 1221, ECLI:EU:T:2008:461, 23 October 2008��651

xx Table of Cases Petruhhin, (Case C-182/15) [2017] QB 299, [2017] 1 CMLR 28, ECLI:EU:C:2016:630, 6 September 2016��331–2, 333, 334 PF (Prosecutor General of Lithuania) (Case C-509/18) ECLI:EU:C:2019:457 (Grand Chamber) 27 May 2019��595 Pfeiffer et al v Deutsches Rotes Kreuz (Cases C-397/01 to C-403/01) [2004] ECR I-8835, [2005] 1 CMLR 44, ECLI:EU:C:2004:584, 5 October 2004��22, 23 ‘Philippines Case’. See Commission v Council (Case C-377/12) PI (Case C-648/20 PPU) ECLI:EU:C:2021:187, 10 March 2021��251 PI v Oberburgermeisterin der Stadt Remscheid (Case C-348/09) ECLIE:EU:C:2012:123, A-G’s opinion, 6 March 2012�� 336, 340–2 PI v Oberburgermeisterin der Stadt Remscheid (Case C-348/09) [2012] 3 CMLR 662, ECLI:EU:C:2012:300 (Grand Chamber), 22 May 2012��115, 340, 342–6, 347, 348 Piotrowski (Case C-367/16) ECLI:EU:C:2018:27, 23 January 2018��202 Pisciotti (C-191/16) ECLI:EU:C:2018:222, 10 April 2018��331, 332, 333, 335 Placanica, Palazzse, and Sorricchio (Cases C-338/04, C-359/04 and C-360/04) [2007] ECR I-1891, [2007] 2 CMLR 25, ECLI:EU:C:2007:133, 6 March 2007�� 91 Poltorak (Case C-452/16, PPU) ECLI:EU:C:2016:858, 10 November 2016��17, 243 Popławski (Daniel Adam) (Case C-579/15) ECLI:EU:C:2017:503, 29 June 2017�� 33–34, 202 Popławski II (Case C-573/17) ECLI:EU:C:2019:530, 24 June 2019��34, 202 Powszechny Zakład Ubezpieczeń na Życie SA (Case C-617/17) ECLI:EU:C:2018:976, A-G’s opinion, 29 November 2018��164 Powszechny Zakład Ubezpieczeń na Życie SA (Case C-617/17) ECLI:EU:C:2019:283, 3 April 2019��164 Presidenza del Consiglio dei Ministri (Case C-129/19) ECLI:EU:C:2020:566, 16 July 2020��299 ‘Prestige Case’ (2013) 10 Eurojust News 14��173 Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others (Case C-623/17) ECLI:EU:C:2020:5, AG’s opinion, 15 January 2020��576 Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others (Case C-623/17) ECLI:EU:C:2020:790 (Grand Chamber), 6 October 2020��576–7, 584, 720 Prosecutor General of Lithuania (Case C-509/18 PF) ECLI:EU:C:2019:457, 27 May 2019��245 Pupino (Maria) (Case C-105/03) ECLI:EU:C:2004:712, A-G’s opinion, 11 November 2004�� 22 Pupino (Maria) (Case C-105/03) [2006] QB 83, [2005] ECR I-5285, [2005] 2 CMLR 63, ECLI:EU:C:2005:386, 16 June 2005��11, 14, 19, 20–23, 24, 33, 39, 94, 312–3, 315, 318

Table of Cases xxi Queen (on the Application of M and Others v Her Majesty’s Treasury (Case C-340/08) [2010] ECR I-3913, ECLI:EU:C:2010:232, 29 April 2010��648 Radu (Ciprian Vasile) (Case C-396/11) ECLI:EU:C:2012:648, A-G’s opinion, 18 October 2012�� 39, 207–11 Radu (Ciprian Vasile) (Case C-396/11) ECLI:EU:C:2013:39, 29 January 2013�� 210–11, 213 Raugevicius (Case C-247/17) ECLI:EU:C:2018:898, 13 November 2018�� 331, 333–4 RH (Case C-8/19 PPU) ECLI:EU:C:2019:110, Order of the Court, 12 February 2019��279 Richardt and Les Accessoires Scientifiques SNC (Case C-367/89) [1991] ECR I-4621, [1992] 1 CMLR 61, ECLI:EU:C:1991:376, 4 October 1991��338 Rothley v European Parliament (Case C-167/02P) [2004] ECR I-3149, [2004] 2 CMLR 11, ECLI:EU:C:2004:193, 30 March 2004��427 Ruska Federacija (Case C-897/19 PPU) ECLI:EU:C:2020:262, 2 April 2020��77, 335 Rutili v Ministre de l’interieur (Case 36/75) [1975] ECR 1219, [1976] 1 CMLR 140, ECLI:EU:C:1975:137, 28 October 1975��343 Sagor (Case C-430/11) ECLI:EU:C:2012:777, 6 December 2012�� 92 Schrems (Maximilian) v Data Protection Commissioner (Case C-362/14) [2016] QB 527, [2016] 2 CMLR 2, ECLI:EU:C:2015:650 (Schrems I), 6 October 2015��385, 390, 490, 564, 671–4, 681, 687, 688, 690, 692, 719, 720 Schrems II. See Facebook Ireland and Schrems (Case C-311/18) Scialdone (Case C-574/15) ECLI:EU:C:2018:295, 2 May 2018�� 94 Segi v Council (Case C-355/04 P) [2007] ECR I-1657, ECLI:EU:C:2007:116, 27 February 2007�� 11 Segi v Council (Case T-338/02) [2004] ECR II-1647, [2007] 1 CMLR 8, ECLI:EU:T:2004:171, 7 June 2004��15, 16 Ship-Source Pollution Case. See Commission v Council (Case C-440/05) Sigma Orionis v Commission (Case T-48/16) EU:T:2018:245, 3 May 2018��427, 433 Siragusa v Regione Sicilia (Case C-206/13) ECLI:EU:C:2014:126�� 47 Sison v Council (Case T-47/03) [2007] ECR I-1233, [2007] 2 CMLR 17, ECLI:EU:C:2007:75, 1 February 2007�� 15, 19, 20, 23 Skanavi and Chryssanthakopoulos (Case C-193/94) [1996] ECR I-929, [1996] 2 CMLR 372, ECLI:EU:C:1996:70, 29 February 1996��91, 299 Sleutjes (Case C-278/16), ECLI:EU:C:2017:757, 12 October 2017��285 Spain v Eurojust (Case C-160/03) [2005] ECR I-2077, ECLI:EU:C:2005:168, 15 March 2005��15, 409 Spasic (Case C-129/14 PPU) ECLI:EU:C:2014:739, A-G’s view, 2 May 2014��167 Spasic (Case C-129/14 PPU) ECLI:EU:C:2014:586, 27 May 2014�� 166, 167, 168, 169, 170, 186, 194, 332

xxii Table of Cases Sut (Case C-514/17) ECLI:EU:C:2018:1016, 13 December 2018��201 Taricco and Others (Case C-105/14) ECLI:EU:C:2015:293, A-G’s opinion, 30 April 2015�� 38 Taricco and Others (Case C-105/14) ECLI:EU:C:2015:555, 8 September 2015��31, 35–42, 44, 47, 94, 288, 448 Taricco II. See MAS and MB (Case C-42/17) Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v Tom Watson, Peter Brice and Geoffrey Lewis (Joined Cases C-203/15, C-698/15) ECLI:EU:C:2016:572, A-G’s opinion, 19 July 2016��571, 573 Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v Tom Watson, Peter Brice and Geoffrey Lewis (Joined Cases C-203/15, C-698/15) ECLI:EU:C:2016:970 (Grand Chamber), 21 December 2016�� 501, 509, 513, 568–73, 574, 575, 576, 577, 578, 579, 580, 582, 586, 683, 720 TG, UF (Case C-603/19) ECLI:EU:C:2020:774, 1 October 2020��303 Tillack v Commission of the European Communities (Case T-193/04R) [2004] ECR II-3575, [2004] 3 CMLR 44, ECLI:EU:T:2004:311, 15 October 2004��427, 428 Tillack v Commission of the European Communities (Case T-193/04) [2006] ECR II-3995, [2007] 1 CMLR 5, ECLI:EU:T:2006:292, 4 October 2006��279, 379, 425, 427, 428–30, 431, 454 Tillack v Commission of the European Communities (Case C-521/04 P(R)) [2005] ECR I-3103, [2005] 2 CMLR 37, ECLI:EU:C:2005:240, 19 April 2005��427, 428 Toshiba Corporation and Others (Case C-17/10) ECLI:EU:C:2011:552, A-G’s opinion, 8 September 2011��164 Toshiba Corporation and Others (Case C-17/10), ECLI:EU:C:2012:72 (Grand Chamber), 14 February 2012��164 TR (Generalstaatsanwaltschaft Hamburg) (Case C-416/20 PPU), ECLI:EU:C:2020:1042, 17 December 2020��290 Tranca (Ianos), Reiter (Tanja), Opria (Ionel) (Joined Cases Cases C-124/16, C-188/16, and C-213/16) ECLI:EU:C:2017:228, 22 March 2017��285, 292 Tupikas (Case C-270/17 PPU) ECLI:EU:C:2017:628, 10 August 2017��292 Turansky (Case C-491/07) [2008] ECR I-11039, ECLI:EU:C:2008:768, 22 December 2008��155–6, 158, 159 ‘Turkey Case’. See United Kingdom v Council (Case C-81/13) United Kingdom v Council (Case C-482/08) [2010] ECR I-10413, ECLI:EU:C:2010:631, 26 October 2010��507 United Kingdom v Council (Case C-431/11) ECLI:EU:C:2013:589, 26 September 2013 (‘EEA Case’)��696

Table of Cases xxiii United Kingdom v Council (Case C-81/13) ECLI:EU:C:2014:2449, 18 December 2014 (‘Turkey Case’)��696 UY v Staatsanwaltschaft Offenburg (Case C-615/18) ECLI:EU:C:2020:376, 14 May 2020��264 Van Esbroeck (Case C-436/04) ECLI:EU:C:2005:630, A-G’s opinion, 20 October 2005��161 Van Esbroeck (Case C-436/04) [2006] ECR I-2333, [2006] 3 CMLR 6, ECLI:EU:C:2006:165, 9 March 2006�� 151, 160–1, 162, 170, 171 Van Straaten v the Netherlands and Italy (Case C-150/05) ECLI:EU:C:2006:381, A-G’s opinion, 8 June 2006��154 Van Straaten v the Netherlands and Italy (Case C-150/05) [2006] ECR I-9327, ECLI:EU:C:2006:614, 28 September 2006�� 154–5, 161 Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen (Joined Cases C-92/09 and C-93/09) [2010] ECR I-11063, ECLI:EU:C:2010:662 (Grand Chamber), 9 November 2010��564 Wolzenburg (Dominic),(Case C-123/08) ECLI:EU:C:2009:183, A-G’s opinion, 24 March 2009��325 Wolzenburg (Dominic) (Case C-123/08) [2009] ECR I-9621, [2010] 1 CMLR 33, ECLI:EU:C:2009:616, 6 October 2009��322–4, 325, 326, 328, 333 X (Case C-60/02) [2004] ECR I-651, [2004] ETMR 37, ECLI:EU:C:2004:10, 7 January 2004�� 95 X (European arrest warrant – Double criminality) (Case C-717/18), ECLI:EU:C:2020:142, 3 March 2020��206 X (Mandat d’arret europeen – Ne bis in idem) (Case C-665/20 PPU) ECLI:EU:C:2021:339, 29 April 2021��163, 168 XD (Case C-625/19 PPU) ECLI:EU:C:2019:1078��249 Yusuf (Ahmed Ali) and Al Barakaat International Foundation v Council and Commission (Case T-306/01) [2005] ECR II-3533, [2005] 3 CMLR 49, ECLI:EU:T:2005:331, 21 September 2005��19, 645 ZB (Case C-627/19 PPU) ECLI:EU:C:2019:1079, 12 December 2019��249 Zdziaszek (Case C-271/17 PPU) ECLI:EU:C:2017:629, 10 August 2017��292 ECHR A and B v Norway (App Nos 24130/11 and 29758/11) [2016] ECHR 987, (2017) 65 EHRR 4, 19 ITL Rep 868, 15 November 2016�� 184–5, 187, 189, 190, 191 Advisory opinion concerning the recognition in domestic law of a legal parent-child relationship between a child born through a gestational surrogacy arrangement abroad and the intended mother – Requested by the French Court of Cassation (Request no P16-2018-001), [2019] ECHR 281, 10 April 2019)��194

xxiv Table of Cases AT v Luxembourg (App No 30460/13) [2015] ECHR 367, 9 April 2015��265, 266 Avotiņš v Latvia (App No 17502/07) (2017) 64 EHRR 2, [2016] ECHR 440, (Grand Chamber) 23 May 2016�� 219, 226, 228 Ben Faiza v France (App No 31446/12) [2018] ECHR 153, 8 February 2018��580 Big Brother Watch and Others v UK (App Nos 58170/13, 62322/14 and 24960/15) [2018] ECHR 722, (Grand Chamber) Judgment of 13 September 2018��577, 585 Bivolaru and Moldovan v France (App Nos 40324/16 and 12623/17) judgment of 25 March 2021��228 Bosphorus Hava Yolları Turizm ve Ticaret Anonim Şirketi v Ireland (App No 45036/98) (2005) 42 EHRR 1, [2005] ECHR 440 (Grand Chamber) 30 June 2005��226 Camilleri v Malta (App No 42931/10) (2013) 57 EHRR 32, [2013] ECHR 281, 22 January 2013��179 Centrum for Rattvisa v Sweden (App No 35252/08) [2021] ECHR 440, (Grand Chamber) 25 May 2021��585 Chernov v Ukraine (App No 16432/10) [2020] ECHR 895, 10 December 2020��163 Coeme and Others v Belgium (App Nos 32492/96, 32547/96, 32548/96, 33209/96 and 33210/96) [2000] ECHR 250, ECHR 2000-VI�� 38 Dayanan v Turkey (App No 7377/03) [2009] ECHR 2278, 13 October 2009��263 El Haski v Belgium (App No 649/08) (2013) 56 EHRR 31, [2012] ECHR 2019, 25 September 2012��281 Engel and Others v the Netherlands (App Nos 5100/71, 5101/71, 5102/71, 5354/72, 5370/72) Series A no 22, (1979-80) 1 EHRR 647, [1976] ECHR 3, 8 June 1976��181, 182, 183, 185, 188, 275, 278 Gäfgen v Germany (App No 22978/05) (2011) 52 EHRR 1, 28 BHRC 463, [2010] Crim LR 865, [2010] ECHR 759, 1 June 2010��281 Glantz v Finland (App No 37394/11) [2014] STC 2263, [2014] ECHR 495, 20 May 2014��163 Grande Stevens v Italy (App No 18640/10) [2014] ECHR 230, 4 March 2014�� 183, 185, 187 Haralampiev v Bulgaria (App No 29648/03), 24 April 2012��213 Kapetanios et al v Greece (App Nos 3453/12, 42941/12 and 9028/13) [2015] ECHR 453, 30 April 2015��163 Khodorkovskiy v Russia (App No 5829/04) [2011] ECHR 841, 31 May 2011��279 Leander v Sweden (App No 9248/81) (A/116) (1987) 9 EHRR 433, [1987] ECHR 4, 26 March 1987��563 McFarlane v Ireland (App No 31333/06) (2011) 52 EHRR 20, [2010] ECHR 1272, (10 September 2010)�� 46 Medenica v Switzerland (App No 20491/92) [2001] ECHR 395, 14 June 2001��213 Mihalache v Romania (App No 54012/10) [2019] ECHR 530, 8 July 2019��153, 158 Murray v United Kingdom (App No 18731/91) (1996) 22 EHRR 29, [1996] ECHR 3, (Grand Chamber) 8 February 1996��280, 281

Table of Cases xxv Muršić v Croatia (App No 7334/13) (2017) 65 EHRR 1, 42 BHRC 439, [2016] ECHR 927, (Grand Chamber) 20 October 2016��234 Nada v Switzerland (App No 10593/08) (2013) 56 EHRR 18, 33 BHRC 453, [2012] ECHR 1691, 12 September 2012��654 Nykanen v Finland (App No 11828/11) [2014] ECHR 494, 20 May 2014��163 OAO Neftyanaya Kompaniya Yukos v Russia (App No 14902/04) (2012) 54 EHRR 19, 14 ITL Rep 229, [2011] ECHR 1342, 20 September 2011�� 38 Osterlund v Finland (App No 53197/13) [2015] ECHR 150, 10 February 2015��163 Pakelli v Germany (App No 8398/78) Series A No 64, (1984) 6 EHRR 1, [1983] ECHR 6, 25 April 1983��272 Pirozzi v Belgium (App No 21055/11) [2018] ECHR 337, 17 April 2018�� 226, 228, 242 Quaranta v Switzerland (App No 12744/87) [1991] ECHR 33, 24 May 1991��272 Ramishvili and Kokhreidze v Georgia (App No 1704/06) [2009] ECHR 153, 27 January 2009��279 Rinas v Finland (App No 17039/13) [2015] ECHR 88, 27 January 2015��163 Romeo Castańo v Belgium (App No 8351/17) [2019] ECHR 542, 9 July 2019�� 227, 228, 230 Rotaru v Romania (App No 28341/95) (2000) 8 BHRC 43, [2000] ECHR 192, 4 May 2000��563 S and Marper v UK (App No 30562/04) (2009) 48 EHRR 50, 25 BHRC 557, [2008] Po LR 403, [2008] ECHR 1581, 4 December 2008��495, 540, 564, 565 Salabiaku v France (App No 10519/83) (A/141-A), (1991) 13 EHRR 379, [1988] ECHR 19, 7 October 1988��279 Salduz v Turkey (App No 36391/02) (2009) 49 EHRR 19, 26 BHRC 223, [2010] Crim LR 419, [2008] ECHR 1542, 27 November 2008��259, 267 Saunders v UK (App No 19187/91) (1997) 23 EHRR 313, 2 BHRC 358, [1996] ECHR 65 (Grand Chamber) 17 December 1996��280 Scoppola v Italy (No 2) (App No 10249/03) (2010) 51 EHRR 12, [2009] ECHR 1297, (Grand Chamber) 17 September 2009�� 38 Sejdovic v Italy (App No 56581/00) [2004] ECHR 620, (2004) 42 EHRR 360, 10 November 2004��213 Strategies et communications et Dumoulin v Belgium (App No 37370/97) [2002] ECHR 598, 15 July 2002�� 46 Svinarenko and Slyadnev v Russia (App Nos 32541/08 and 43441/08) 37 BHRC 628, [2014] ECHR 790 (Grand Chamber) 17 July 2014��279 Szabó and Vissy v Hungary (App No 37138/14) (2016) 63 EHRR 3, [2016] ECHR 579, 12 January 2016��572 Tarakhel v Switzerland (App No 29217/12) (2015) 60 EHRR 28, [2015] Imm AR 282, [2014] ECHR 1435 (Grand Chamber) 4 November 2014��218 Tillack v Belgium (App No 20477/05) (2012) 55 EHRR 25, [2008] ECHR 190127 November 2007 (final version 27 February 2008)��430

xxvi Table of Cases Weber and Saravia v Germany (App No 54934/00) (2008) 46 EHRR SE5, (2000) 8 BHRC 43, [2006] ECHR 1173, 29 June 2006��563 Zakharov v Russia (App No 47143/06) 39 BHRC 435, (2016) 63 EHRR 17, [2015] ECHR 1065, (Grand Chamber) 4 December 2015��509, 572 Zolotukhin (Sergey) v Russia (App No 14939/03) (2012) 54 EHRR 16, 26 BHRC 485, [2009] ECHR 252 (Grand Chamber) 10 February 2009�� 163, 183, 185 BELGIUM Court of Cassation of Belgium, No P.13.2082.N, Judgment of 1 December 2015 (Yahoo! case)��593 Court of First Instance Antwerp (Belgium), ME20.F1.105151-12, Judgment of 27 October 2016 (Skype case)��593 CZECH REPUBLIC 2011/03/22 Pl. ÚS 24/10, www.concourt.cz/clanek/pl-24-10, Constitutional Court��561 FRANCE Bourquain (1961), Military Tribunal�� 157, 158, 165 Decision No 393099 Conseil d’État, Judgment of 21 April 2021��583 GERMANY Ausl 301 AR 95/18, Karlsruhe Higher Court, 17 February 2020��241 Ausl 301 AR 104/19, Karlsruhe Higher Court, 27 November 2020��241 Bundesverfassungsgericht – 1 BvR 1215/07, (anti-terrorism databases case) judgment of 24 April 2013�� 47 BVerfG, 2 BvE 2/08, Gauweiler, Die Linke v Act of Approval of the Lisbon Treaty (‘Lisbon’), 30 June 2009��118 BVerG, judgment of 1 December 2020–2 BvR 1845/18 – Rn 1-85, www.bverfg.de/e/rs20201201_2bvr184518.html (EAW III Decision)��229, 230 Decision 1 BvR 256/08, 1 BvR 263/08, 1BvR 586/08 (2 March 2010) German Constitutional Court��560 Decision of 30 June 2009 (2 BvE 2/08, 5/08, 2 BvR 1010/08, 1022/08, 1259/08, 182/09)�� 69, 125–6

Table of Cases xxvii Judgment of BVerG 2017 2, BvR 424/17 (EAW II Decision)��228 Kretzinger, Landgericht Augsburg; on appeal Bundesgerichtshof��162 Order of the Second Senate of 15 December 2015–2 BvR 2735/14 (EAW I Decision), BverfG��220–3 Puigdemont case – Higher Regional Court of Schleswig-Holstein] July 12, 2018, 1 Ausl (A) 18/18 (20/18), Neue Juristische Wochenschrift 93, 2019 (Ger), Judgment of July 12, 2018��207 Solange II – Wünsche Handelsgesellschaft, Re (22 October 1986) BVerfGE 73, 339��222 Solange III – BverfG 2 BvR 2735/14, 15 December 2015��222 GREECE Areios Pagos, Case 1/2011, Supreme Ct��167 IRELAND Dwyer (Record No 2019/18), Supreme Court��585 Minister for Justice and Equality v Artur Celmer [2018] IEHC 119, 12 March 2018��235 Minister for Justice and Equality v Artur Celmer (No 5) [2018] IEHC 639, 19 November 2018��241 ITALY Constitutional Court, Order No 24, 2017�� 39 Constitutional Court, ruling of 23 January 2019, No 20�� 43 Constitutional Court, ruling of 20 February 2019, No 63�� 43 Constitutional Court, ruling of 10 May 2019, No 112�� 43 Constitutional Court, Order of 10 May 2019, No 117�� 43 Kretzinger judgment of 25 January 2001, Tribunale di Ancona��162 Kretzinger judgment of 22 February 2001, Corte d’appello di Venezia (Court of Appeal, Venice��162 NETHERLANDS RK 20/771 13 / 751021-20, Amsterdam District Court, 10 February 2021��241 RK 20/3065 and 13/751520-20, Amsterdam District Court, 27 January 2021��242

xxviii Table of Cases POLAND Bonda (Łukasz Marcin), Criminal Proceedings against, Sąd Najwyższy, 27 September 2010��181 Judgment of the Supreme Court, Chamber of Labour and Social Insurance of 5 December 2019��237 ROMANIA Decision No 1258 of 8 October 2009, Constitutional Court��561 SPAIN STC 13/2017 of 30 January 2017, Constitutional Court��290 UNITED KINGDOM Assange v Swedish Prosecution Authority [2012] UKSC 22, [2012] 2 AC 471, [2012] 3 WLR 1, [2012] 4 All ER 1249��310 Bucnys v Ministry of Justice, Lithuania [2013] UKSC 71, [2014] AC 480, [2013] 3 WLR 1485, [2014] 2 All ER 235��310 Dabas v High Court Of Justice, Madrid [2007] UKHL 6, [2007] 2 AC 31, [2007] 2 WLR 254, [2007] 2 All ER 641�� 14

1 History, Principles and Institutions The Constitutionalisation of EU Criminal Law I. Introduction The evolution of the constitutional framework of EU criminal law has been a contested and gradual process. Criminal law is inextricably linked with state sovereignty and the exercise of state power, with states being reluctant to cede sovereignty and power to a supranational organisation. Although inevitably Community law has had an impact on national criminal justice systems, the European Union (EU) first acquired express competence in the field of criminal law following the entry into force of the M aastricht Treaty, which established an intergovernmental framework of action under the so-called ‘third pillar’. Criminal law has been largely normalised constitutionally following the entry into force of the Lisbon Treaty, although, as will be seen below, a degree of resistance to the ‘Lisbonisation’ of criminal law remains. This chapter will provide a detailed analysis of the constitutional evolution of EU criminal law by focusing primarily on history, principles and institutions, It will chart the evolution of the field from the early days when the Community was not granted express competence in the field of criminal law, to the intergovernmental EU criminal law model introduced by the Maastricht Treaty and in place until the entry into force of the Lisbon Treaty, which aimed to normalise EU criminal law and align the field constitutionally with more traditional areas of EU action. In addition to examining the evolution of the Treaty framework, the chapter will examine in detail the contribution of the Court of Justice of the European Union (CJEU) towards the constitutionalisation of EU criminal law and will h ighlight the intersection of broader constitutional issues, such as upholding fundamental rights and the rule of law, with the development of a legitimate and credible system of EU criminal law.

II. Background: The Community and Criminal Law before Maastricht Over the years, there have been a number of factors influencing common action in criminal matters among EU Member States. One of these factors has traditionally been

2 History, Principles and Institutions the emergence of areas of criminality which were of common concern to Member States and which were perceived as necessitating cooperation. Outside the EU framework, such cooperation has been longstanding within the intergovernmental framework of the Council of Europe.1 This has led to the adoption of a series of hard and soft law instruments in the criminal justice field, a number of which are still influential in the development of internal EU law.2 It was the preference for intergovernmental cooperation within the Council of Europe that reportedly blocked French plans in the late 1970s and early 1980s to establish an ambitiously named ‘European judicial area in criminal matters’ covering primarily judicial cooperation in criminal matters in the fields of terrorism.3 However, the 1970s did witness Member States’ efforts to explore the establishment of channels of cooperation between their law enforcement authorities in areas of common concern such as terrorism. A prime example has been the establishment of TREVI, a network of law enforcement officials meeting on an informal basis to discuss action on counter-terrorism issues.4 The remit of TREVI (and its organisational chart) – which, however, remained an informal structure with no clear legal framework or standing under Community law – expanded in the 1980s, especially in the light of the emergence of new areas of criminality such as drugs and organised crime as areas of common interest for Member States.5 The focus on drug trafficking as a threat in the 1980s also led to efforts for action within the Community law framework, in particular in the field of external action, as demonstrated by the involvement of the Community in the negotiation and signature of the 1988 United Nations (UN) Vienna Convention.6 Another factor leading to the emergence of EU criminal law has been the development of EU internal market law. Already in the 1980s, it had become evident in cases brought before the Court in Luxembourg that the focus of the Community on economic matters did not stop Community action having criminal law implications or being associated with the criminal law choices in Member States.7 Moreover, calls for the abolition of internal frontiers in the single market – a central objective of the Commission and subsequently of the Community in the 1980s and early 1990s – and steps take to achieve these objectives created a ‘spill-over effect’ of law and policy to broader issues to the economy/market, including criminal law.8 A key to this spill-over process has been the abolition of internal frontiers and the goal of free movement. The achievement of free movement brought about the realisation of the need to look at the implications of this freedom and of the abolition of borders for issues such as immigration and crime. This link had already been made to some extent by the Commission in its 1985 White 1 See V Mitsilegas, J Monar and W Rees, The European Union and Internal Security (Palgrave, 2003) 19–22. 2 See in particular in the field of data protection; see ch 9. On the relationship between EU and Council of Europe instruments covering similar topics, see ch 10. 3 ‘Espace Judiciaire Pénal Européen’: see A Weyembergh, L’Harmonisation des Législations: Condition de l’Espace Pénal Européen et Révélateur de ses Tensions (Éditions de l’Université de Bruxelles, 2004) 13–15. 4 See Mitsilegas, Monar and Rees (n 1) 22–24. For more on TREVI, including bibliographical references, see chapter 4. 5 ibid 25. 6 See V Mitsilegas, Money Laundering Counter-measures in the European Union: A New Paradigm of Security Governance versus Fundamental Legal Principles (Kluwer Law International, 2003) 52–54. 7 For more on this, see ch 2. 8 See Mitsilegas, Monar and Rees (n 1) 27–31.

Background: The Community and Criminal Law before Maastricht 3 Paper on the completion of the internal market.9 It was put forward more forcefully in the Palma Document,10 whose conclusions were endorsed by the Madrid European Council in 1989.11 The Document asserted that the achievement of an area without internal frontiers could involve, when necessary, the approximation of laws, adding that the abolition of internal borders affects a whole range of matters, including combating terrorism, drug trafficking and other illicit trafficking; improved law enforcement cooperation; and judicial cooperation. In the latter context, it was noted that judicial cooperation in criminal matters should be intensified in order to combat terrorism, drug trafficking, crime and other illicit trafficking, and that the harmonisation of certain provisions should be studied.12 Another significant development involving the abolition of borders in the 1980s, this time outside the Community legal framework, was the 1985 Schengen Agreement between the Benelux countries, France and Germany, leading to the adoption of the 1990 Schengen Implementing Convention, which included a wide range of provisions on immigration, asylum, border controls and police cooperation, including the establishment of the Schengen Information System.13 Schengen can be viewed as a compensation for freedom: the abolition of internal frontiers (including physical frontiers) among the participating states would be combined with further integration between these states in the fields of immigration and criminal law, thus leading to a strong external border compensating for the lack of internal borders. This model of closer integration between a number of Member States outside the Community framework was a pioneering step at the time and resulted in a momentum towards extending such closer integration within the EU. As will be seen below, the Schengen acquis is integrated into EU law, which is indicative of the influence of the Schengen logic on the development of the EU as an ‘Area of Freedom, Security and Justice’ (AFSJ). The influence of the Schengen logic is dominant in the development of EU immigration and borders law, but it is also visible in the development of EU criminal law principles, in particular by the Court of Justice: when interpreting the operation of EU criminal law, the Court has repeatedly examined criminal law in conjunction with free movement within the framework of an ‘area’ of freedom, security and justice.14 Calls for further integration in relation to criminal matters were also linked with political events external to the Community at the end of the 1980s, namely the fall of the Berlin Wall. The collapse of the Soviet Bloc led to a number of concerns in 9 ‘Completing the Internal Market: White Paper from the Commission to the European Council’ COM (1985) 310, 14 June. The Commission considered that matters such as the coordination of rules concerning extradition were essential for the removal of internal frontier controls; see PA Weber-Panariello, The Integration of Matters of Justice and Home Affairs into Title VI of the Treaty on European Union: A Step Towards More Democracy?, EUI Working Paper RSC No 95/32, European University Institute, Florence, 5. 10 The Palma Document was prepared by a Coordinators’ Group set up by the European Council and composed of 12 high-ranking officials, a chairman and the vice-president of the Commission to coordinate Member States’ actions with regard to free movement. See Weber-Panariello (n 9) 8–9. 11 Council Doc 89/1, 27 June 1989, http://europa.eu/rapid/pressReleasesAction.do?reference=DOC/89/1& format=HTML. 12 The Palma document is reproduced in E Guild and J Niessen, The Developing Immigration and Asylum Policies in the EU (Nijhoff, 1996) 443–48. 13 On the Schengen Information System, see ch 9. 14 This is particularly the case with regard to the Court’s case law on the European Arrest Warrant and ne bis in idem; see chs 3 and 4.

4 History, Principles and Institutions Western Europe. These were linked most notably to fears that political instability in Eastern Europe and the lack of a stable legal and constitutional framework in countries in transition would lead to the increase of criminogenic factors therein and the export of criminality from the East to the West. These concerns resulted in calls – in particular by Member States such as Germany fearing that they would be the most affected by these developments – towards greater EU cooperation and integration in criminal matters. In this context, countries like Germany attempted to render domestic concerns into EU issues,15 at the same time creating considerable impetus towards the development of European integration in the field. Lack of trust towards Eastern European countries – which subsequently became candidate countries with now many of them progressing to become full EU Member States – continued in the 1990s and the 2000s, during the enlargement process and led to the Schengen logic increasing in political capital in accession negotiations and beyond, with compliance with the Schengen acquis becoming a central requirement for accession to the EU.16 The end of the Cold War also had broader implications for the reconfiguration of security threats globally. The shift from the emphasis on military threats to the securitisation of broader phenomena was well documented early on by international relations scholars.17 In the EU and beyond, one element of this securitisation shift has been the elevation of forms of criminality as threats which require urgent and concerted response by governments.18 Security threats in this context have assumed a chameleon nature over the years, from drug trafficking in the 1980s to organised crime in the 1990s and terrorism in the 2000s.19 At the EU level, such securitisation of crime has largely acted as a factor justifying further EU integration in criminal matters and has led to the adoption of a plethora of legal and policy initiatives. In this context, particular focus has been placed on the transnational elements of the perceived threats, which are deemed to require a common EU approach, with Member States not being able to address these challenges solely at the national level.20 The securitisation of crime and the focus on the transnational are also increasingly acting as a motor for the emergence of the EU as a global security actor speaking with ‘one voice’ and influencing the development of global standards in the field.21 In this process, as will be seen in a number of instances in this book, the emergence of both internal and external EU criminal law is marked by a strong emphasis on security objectives. 15 On Germany’s influence on developing police cooperation (and immigration and asylum law cooperation) as a response to developments in Eastern Europe, see J Monar, ‘Justice and Home Affairs: Europeanization as a Government-Controlled Process’ (2003) 119 Proceedings of the British Academy 309, 320–22. 16 See section VIII.D below. 17 See in particular B Buzan, People, States and Fear: An Agenda for International Security Studies in the PostCold War Era (Harvester Wheatsheaf, 1991); B Buzan, ‘New Patterns of Global Security in the Twenty-First Century’ (1999) 67 International Affairs, 431. In the context of securitisation and crime, see D Bigo, Polices en Réseaux. L’Experiénce Européenne (Presses de Sciences Po, 1996). 18 On the securitisation process, see B Buzan, O Waever and J de Wilde, Security: A New Framework for Analysis (Lynne Rienner, 1998); and O Waever, ‘Securitization and De-securitization’ in RD Lipschutz (ed), On Security (Columbia University Press, 1995) 46–86. 19 On this changing focus in the context of the development of money laundering counter-measures, see V Mitsilegas, ‘Countering the Chameleon Threat of Dirty Money: “Hard” and “Soft” Law in the Emergence of a Global Regime against Money Laundering and Terrorist Finance’ in A Edwards and P Gill (eds), Transnational Organised Crime: Perspectives on Global Security (Routledge, 2003) 195–211. 20 On the concept and role of transnational crime, see Mitsilegas (n 6) 19–21. 21 See ch 10.

The Third Pillar: The Institutional Framework 5

III. The Third Pillar: The Institutional Framework The above factors became increasingly relevant in negotiations to amend the EC Treaty as a follow-up to the Single European Act. In these negotiations, the issue of whether the Community competence should extend to criminal law – and Justice and Home Affairs more generally – proved to be extremely contested. The final compromise came with the adoption of the Maastricht Treaty, which introduced a three-pillar structure for the EU. The primary function of this structure was, on the one hand, to include within the EU’s remit controversial areas such as foreign and security policy and Justice and Home Affairs, but, on the other hand, to ensure that EU action in these sovereignty sensitive fields would not be under the supranational elements of the first pillar, but would be subject to a more intergovernmental legal framework.22 This pillar structure was retained until the entry into force of the Lisbon Treaty, with EU action in criminal matters largely confined (but increasingly not limited to) the third pillar. This section will provide with an overview and analysis of the evolution of the third pillar from Maastricht to Amsterdam and Lisbon. The specificities of the former third pillar and the current Lisbonised framework will be examined from three perspectives: institutions, instruments and principles.

A. The Maastricht Treaty In the Maastricht Treaty, provisions relating to EU criminal law were included in Title VI of the EU Treaty entitled ‘Provisions on cooperation in the fields of Justice and Home Affairs’ (or, as it is better known, the former third pillar).23 For the first time, the Treaty established EU competence in the field of Justice and Home Affairs, including judicial cooperation in criminal matters, customs cooperation and police cooperation for the purposes of preventing and combating terrorism, unlawful drug trafficking and other serious forms of international crime, including the establishment of a European Police Office (Europol).24 Moreover, the Treaty contained a legal basis for establishing a Co-ordinating Committee consisting of senior officials and contributing to the preparation of the Council’s ‘discussions’, as well as giving opinions for the attention of the Council.25 It has been argued that in this manner, the Maastricht third pillar

22 For a critique of the Maastricht Treaty, see, inter alia, D Curtin, ‘The Constitutional Structure of the Union: A Europe of Bits and Pieces’ (1993) 30 CML Rev 17; see also R Dehousse, ‘From Community to Union’ in R Dehousse (ed), Europe after Maastricht: An Ever Closer Union? (Law Books in Europe, 1994) 5–15. 23 For an overview of the Maastricht third pillar, see: P-C Müller-Graff, ‘The Legal Bases of the Third Pillar and its Position in the Framework of the Union Treaty’ (1994) 31 CML Rev 493; D O’Keeffe, ‘Recasting the Third Pillar’ (1995) 32 CML Rev 893; G Barrett, ‘Cooperation in Justice and Home Affairs in the European Union: An Overview and a Critique’ in G. Barrett (ed), Justice Cooperation in the European Union (Institute of European Affairs, Dublin, 1997) 3–48; M Anderson, M den Boer, P Cullen, W Gilmore, C Raab and N Walker, Policing the European Union (Clarendon Press, Oxford, 1995), in particular 200–17; and the contributions in J Monar and R Morgan (eds), The Third Pillar of the European Union: Cooperation in the Fields of Justice and Home Affairs (European Interuniversity Press, 1994). 24 Article K.1, in particular paras (7)–(9). 25 Article K.4.

6 History, Principles and Institutions consolidated and formalised earlier law enforcement initiatives.26 These initiatives, along with extra-EU mechanisms of cooperation such as the Council of Europe and Schengen, have thus been accurately characterised as ‘laboratories’ of European integration in the field of Justice and Home Affairs.27 However, the provisions on the form of EU action in criminal matters remained extremely weak. The opening provision of the Maastricht third pillar, Article K, referred to ‘cooperation in the fields of Justice and Home Affairs’, and not to a common policy on Justice and Home Affairs (as has been the case with both first pillar policies, such as the Common Agricultural Policy) and second pillar initiatives (see the Common Foreign and Security Policy (CFSP)). As has been noted, this approach and contrast ‘suggested the much less ambitious objective of cooperation in making effective national policies which would remain unchanged’.28 Moreover, Article K.1 merely declared that Member States must regard a number of areas in Justice and Home Affairs as ‘matters of common interest’. The emphasis here was not on integration, but on ‘matters of common interest’. Moreover, the emphasis was on Member States, with no explicit reference to the EU as an actor in the third pillar.29 Further, the extent to which the EU could take legally binding action in these areas of ‘common interest’ was both limited and unclear. The main legally binding instrument provided for by the Maastricht third pillar was the instrument of Conventions which clearly mirrored intergovernmental cooperation under international law fora such as the United Nations and the Council of Europe.30 The Council could also adopt the seemingly non-legally binding ‘joint positions’ and ‘Joint Actions’, the legally binding character of which is unclear and has been contested.31 Thus, while in principle the Maastricht third pillar established a degree of competence for the EU in the field of Justice and Home Affairs, including criminal matters, the powers given to the EU to exercise such competence remained significantly limited and unclear. The reluctance of – at least certain – Member States to communitarise Justice and Home Affairs was also reflected in the extremely limited role given to EU institutions in the third pillar, most notably in the area of criminal law. The Commission was not granted a right of initiative with regard to measures on the main areas relating to criminal matters, with the initiative only being granted to Member States.32 The European Parliament was also granted an extremely limited role: it was to be ‘regularly informed of discussions’ in third pillar areas; the Presidency would merely ‘consult’ the Parliament ‘on the principal aspects of activities’ in the third pillar; and it could ‘ask questions or make recommendations’.33 The only provision on the European Court of Justice (ECJ) 26 M den Boer, ‘Europe and the Art of International Police Co-operation: Free Fall or Measured Scenario?’ in D O’Keeffe and Twomey (eds), Legal Issues of the Maastricht Treaty (Wiley Chancery, 1994) 279–294, at 281. 27 See J Monar, ‘The Dynamics of Justice and Home Affairs: Laboratories, Driving Factors and Costs’ (2001) 39 Journal of Common Market Studies 747. 28 E Denza, The Intergovernmental Pillars of the European Union (Oxford University Press, 2004) 194. Note also art K.2(2), which stated that Title VI would not affect the exercise of the responsibilities incumbent upon Member States with regard to the maintenance of law and order and the safeguarding of internal security. 29 See in this context the observation of Müller-Graf ((n 23) 507), who noted that the provisions of the third pillar do not even mention the EU as a separately acting agent in the relevant fields of policy. 30 Article K.3(2)(c). 31 For the view that Joint Actions are not legally binding, see Müller-Graf (n 23) 509; for the contrary view under certain circumstances, see O’Keeffe (n 23) 914. 32 These are the areas referred to in arts K.1(7)–(9) and K.3(2). 33 Article K.6.

The Third Pillar: The Institutional Framework 7 did not grant jurisdiction via the Treaty, but mentioned that third pillar conventions adopted under the third pillar might provide for such jurisdiction to interpret their provisions and to rule on any disputes regarding their application.34 Unsurprisingly, given the extent of the limits to the Community method, decision-making in the Council would – with limited exceptions – take place by unanimity.35

B. The Amsterdam Treaty i. Background The operation of the former third pillar demonstrated the weaknesses and limits of the compromise reached in Maastricht. Legislative production was not abundant and mainly took the form of conventions, which proved to be extremely cumbersome to ratify.36 A number of Joint Actions were adopted, some of them providing definitions of key concepts for EU criminal law such as organised crime, but their legal status was unclear and their implementation prospects were questionable.37 Enforcement and judicial control of third pillar law were minimal following the very limited Treaty provisions. The same applied to democratic control and transparency, with the European Parliament being essentially marginalised. An assessment of the Maastricht third pillar in 1995 pointed out the inactivity in the field and noted that: Many of the reasons for this inactivity or lack of concrete progress are to be found in the structure of the Third Pillar itself. Other failures to achieve consensus seem to derive from an unwillingness to change the patterns of inter-governmental cooperation existing prior to the entry into force of the Third Pillar. A further disturbing trend is that the Third Pillar structure seems to have in no way assisted in making intergovernmental cooperation in this area more transparent, precisely at a time when transparency has become one of the major concerns at Union and Community level.38

The deficiencies of the Maastricht third pillar were discussed in the intergovernmental conference leading to the adoption of the Amsterdam Treaty.39 Central to the debate were again issues of competence, the institutional framework and the question of whether to 34 Article K.3(2)(c). 35 Article K.4(3). 36 See, for example, the Europol Convention, which was signed in 1995 and entered into force in 1999; see ch 4. 37 For an analysis of the Joint Action on organised crime, see V Mitsilegas, ‘Defining Organised Crime in the European Union: The Limits of European Criminal Law in an Area of Freedom, Security and Justice’ (2001) 56 European Law Review 565. 38 O’Keeffe (n 23) 894. 39 For a diplomat’s view of the Treaty of Amsterdam negotiations, including the provisions on Justice and Home Affairs, see B McDonagh, Original Sin in a Brave New World: An Account of the Negotiation of the Treaty of Amsterdam (Institute of European Affairs, 1998); for a similar account of the UK position, see S Wall, A Stranger in Europe: Britain and the EU from Thatcher to Blair (Oxford University Press, 2008). On the Amsterdam Intergovernmental Conference and Justice and Home Affairs, see H Labayle, ‘La Coopération Européenne en Matière de Justice et d’Affairs Intérieures et la Conférence Intergouvernmentale’ (1997) 33 Revue Trimestrielle du Droit Européen 1; on the Intergovernmental Conference (IGC), see further J. Grünhage, ‘The 1996/97 Intergovernmental Conference: A Survey of the Process’ in J Monar and W Wessels (eds), The European Union After the Treaty of Amsterdam (Continuum, London and New York, 2001).9–30.

8 History, Principles and Institutions transfer matters falling under the third pillar to the Community pillar.40 The different national approaches on these matters did not stop the adoption of significant changes to the third pillar in Amsterdam: Maastricht third pillar areas of immigration, asylum, borders and civil law were ‘communitarised’, forming part of Title IV of the EC Treaty;41 and the third pillar itself, now entitled ‘Provisions on police and judicial cooperation in criminal matters’, was revamped and strengthened.42 The Amsterdam provisions were subject to some limited amendments by the Nice Treaty, in particular regarding the role of the European Union Agency for Criminal Justice Cooperation (Eurojust) and enhanced cooperation, formed the basis of the institutional framework until 2009. The latter included detailed provisions on competence and the types of common action in the fields of police cooperation, judicial cooperation in criminal matters, and criminal law approximation.43 Significantly, these forms of common action were required to achieve a general EU objective ‘to provide citizens with a high level of safety within an area of freedom, security and justice by developing common action among the Member States in the fields of police and judicial cooperation in criminal matters and by preventing and combating racism and xenophobia’.44

ii. The AFSJ and the Incorporation of the Schengen Acquis The institutional developments in the third pillar brought about in Amsterdam must be viewed in the context of the express reference to the development of the EU as an ‘Area of Freedom, Security and Justice’, which was elevated to the status of a EU objective. According to Article 2 TEU, the EU’s objectives included ‘to maintain and develop the Union as an area of freedom, security and justice, in which the free movement of persons is assured in conjunction with appropriate measures with respect to external border controls, asylum, immigration and the prevention and combating of crime’ (emphasis added). The inclusion of this objective, which was also visible in both Title IV of the EC Treaty (the ‘communitarised’ Maastricht third pillar)45 and Title VI TEU (the remaining third pillar dealing with criminal matters)46 was significant, in that it formed the framework within which EU action on Justice and Home Affairs, including criminal law, would be interpreted. While the concept of the ‘area’ is not clear, and the r elationship 40 See in this context the Progress Report on the IGC of June 1996, Doc CONF 360/1/96 REV 1, Brussels, 17 June 1996, www.consilium.europa.eu/uedocs/cms_data/docs/cig1996/03860-r1en6.pdf. 41 And customs cooperation moving to a separate EC Treaty provision: art 135. On art 135 and criminal law, see ch 2. 42 On the evolution of Justice and Home Affairs matters in the Amsterdam Treaty, see Denza (n 28); J Monar, ‘Justice and Home Affairs in the Treaty of Amsterdam: Reform at the Price of Fragmentation’ (1998) 23 European Law Review 320; H Labayle, ‘Un Espace de Liberté, de Sécurité et de Justice’ (1998) 34 Revue Trimestrielle du Droit Européen 813; J Kuijper, ‘The Evolution of the Third Pillar from Maastricht to the European Constitution: Institutional Aspects’ (2004) 41 CML Rev 609; D Kostakopoulou, ‘The Area of Freedom, Security and Justice and the European Union’s Constitutional Dialogue’ in C Barnard (ed), The Fundamentals of EU Law Revisited. Assessing the Impact of the Constitutional Debate (Oxford University Press, 2007) 153–92; and M den Boer, ‘An Area of Freedom, Security and Justice: Bogged Down by Compromise’ in D O’Keeffe and P Twomey (eds), Legal Issues of the Amsterdam Treaty (Hart Publishing, 1999) 303–22. For a h istorical overview of the evolution of EU Justice and Home Affairs, see W de Lobkowicz, L’Europe et la Sécurité Intérieure. Une Élaboration par Étapes (La Documentation Francaise, 2002). 43 Articles 29–31 TEU. 44 Article 29(1) TEU. On specific areas of criminal law competence under art 29, see ch 2. 45 Article 61 EC. 46 Article 29 TEU.

The Third Pillar: The Institutional Framework 9 between the three elements of ‘freedom, security and justice’ is contested,47 it is important to note that the conception of the EU as an ‘area’ (or espace in French) is reminiscent of earlier initiatives, in particular the Schengen Area (espace Schengen).48 In this context, it is noteworthy that the introduction of the development of the EU as an ‘Area of Freedom, Security and Justice’ was accompanied in Amsterdam by the incorporation of the Schengen acquis into Community/Union law.49 The latter was a complex process generating a raft of issues, such as what constitutes the acquis, how to allocate this and subsequent Schengen-building measures between pillars, and of course issues relating to variable geometry, ie, non-participating Member States and participating non-EU Member States.50 However, it also signified the affirmation of the Schengen logic within the EU framework.51 Linked to the Schengen logic, the EU as an ‘area’ of freedom, security and justice was based on the objective of free movement in an area without internal frontiers, thus entailing a reconfiguration of territoriality at both the national and the EU level. While this reconfiguration of territoriality was particularly relevant in the field of EU immigration and borders law, most notably with regard to practices of inclusion and exclusion,52 it will be seen that it also had implications for the development of EU criminal law, both by the legislator and by the Court of Justice – in particular when the latter has had to approach the relationship between national legal orders under mutual recognition in criminal matters, and Schengen-related matters such as ne bis in idem.53

iii. The Institutional Framework a. Decision-Making Intergovernmental elements in the third pillar remained in Amsterdam, although the role of the EU institutions was in general enhanced in comparison with Maastricht.54 47 On different takes on the concept of the ‘Area of Freedom, Security and Justice’, see H Lindahl, ‘Finding a Place for Freedom, Security and Justice: The European Union’s Claim to Territorial Unity’ (2004) 29 European Law Review 461; and P Twomey, ‘Constructing a Secure Space: The Area of Freedom, Security and Justice’ in O’Keeffe and Twomey (n 42) 351–74. 48 See Labayle (n 42) 824. See also the discussion in Mitsilegas, Monar and Rees (n 1) 84–86. 49 See the Protocol Integrating the Schengen Acquis into the Framework of the European Union; for the subsequent definition of the Schengen acquis, see the Decision 1999/435 (OJ L176, 10 July 1999, 1) corrected by Decision 2000/645 [2001] OJ L9, 13 January, 24. 50 On the incorporation of Schengen into EC/EU law, see S Peers, ‘Caveat Emptor? Integrating the Schengen Acquis into the European Union Legal Order’ (1999) 2 Cambridge Yearbook of European Legal Studies 87; M den Boer, ‘The Incorporation of Schengen into the TEU: A Bridge Too Far?’ in Monar and Wessels (n 39) 296–320; and D Thym, ‘The Schengen Law: A Challenge for Legal Accountability in the European Union’ (2002) 8 European Law Journal 218. 51 Unsurprisingly, the incorporation of the Schengen acquis into the EC/EU framework was strongly supported by the Benelux countries; see Benelux Memorandum on the Intergovernmental Conference, Doc CONF 3844/96, Brussels, 5 May 1996, 10, www.consilium.europa.eu/uedocs/cms_data/docs/ cig1996/03844en6.pdf. 52 In this context, see E Guild, ‘Moving the Borders of Europe’, Inaugural Lecture, University of Nijmegen, http:/cmr.jur.ru.nl/cmr/docs/oratie.eg_pdf; C Groenendijk, E Guild and P Minderhoud (eds), In Search of Europe’s Borders (Brill, 2003); D Bigo and E Guild (eds), Controlling Frontiers: Free Movement into and within Europe (Ashgate, 2005); D Kostakopoulou, ‘Is There an Alternative to “Schengenland”?’ (1998) 46(5) Political Studies 886. 53 For an analysis of this case law, see ch 3. 54 For a comparison of a number of institutional aspects, see A Dashwood, ‘Issues of Decision-Making in the European Union after Nice’ in A Arnull and D Wincott (eds), Accountability and Legitimacy in the European Union (Oxford University Press, 2002) 13–40.

10 History, Principles and Institutions As far as decision-making is concerned, unanimity in the Council remained for the vast majority of third pillar law.55 The European Parliament, while in an enhanced position in comparison to the situation under Maastricht, continued to have an extremely limited role: it was merely consulted in the adoption of Framework Decisions, decisions and conventions.56 Thus, law-making in the third pillar remained firmly with Member States, which obtained a further reassurance on checking the EU’s reach in criminal matters by retaining the Maastricht provision that the third pillar would ‘not affect the exercise of responsibilities incumbent upon Member States with regard to the maintenance of law and order and the safeguarding of internal security’.57 However, as an opening to Member States which supported further integration in criminal matters, the Treaty – as amended in Nice – included provisions expressly allowing enhanced cooperation in the third pillar.58 Moreover, Amsterdam also included a passerelle provision,59 which was reformulated to state that the Council may decide unanimously after consulting the European Parliament to transfer action in areas mentioned in Article 29 TEU to Title IV of the EC Treaty.60 The Commission – which also embarked on a series of Court challenges contesting the legality of the choice of third pillar legal bases for EU criminal law harmonisation instruments61 – proposed the use of this provision after the rejection of the Constitutional Treaty (which largely ‘communitarised’ decision-making in criminal matters by abolishing the third pillar), but the proposal was not taken on board by Member States.62 b. Instruments Although the decision-making arrangements remained in essence intergovernmental, the Amsterdam Treaty strengthened significantly the legal instruments under the third pillar. Conventions, which were introduced by Maastricht, remained in the Treaty,63 although their use post-Amsterdam was minimal. Amsterdam introduced a series of new instruments for the third pillar. A new instrument was the Common Position ‘defining the approach of the Union to a particular matter’.64 Common positions were

55 Article 34(2) TEU. The exception is measures necessary to implement third pillar Decisions which are adopted by qualified majority (art 34(2)(c)). 56 Article 39(1) TEU. Parliament also must be regularly informed of discussions on the third pillar by the Presidency and the Commission, and may ask questions of the Council and make recommendations (art 39(2) and (3)). The role of the European Parliament is even more limited in the negotiation and conclusion of third pillar international agreements under arts 24 and 38 TEU; for details, see ch 6. 57 Article 33. See also art 64(1) EC in Title IV. See art K.2(2) of the Maastricht Treaty. 58 Articles 40, 40a and 40b TEU. 59 See the passerelle in Article K.9 of the Maastricht Treaty, which, however, did not apply to judicial cooperation in criminal matters, customs and police cooperation. 60 Article 42 TEU. Member States will adopt that decision in accordance with their constitutional requirements. 61 See ch 2. 62 On the Commission passerelle proposals and the evolution of Member States’ reactions, see House of Commons Home Affairs Committee, Justice and Home Affairs Issues at European Union Level, 3rd Report, session 2006–07, HC 76-I, paras 328–33; and V Mitsilegas, ‘Constitutional Principles of the European Community and European Criminal Law’ (2006) 8 European Journal of Law Reform 301, 308–09. 63 Article 34(2)(d). 64 Article 34(2)(a).

The Third Pillar: The Institutional Framework 11 particularly relevant in the context of EU external action, with the Treaty stating that Member States must defend them within international organisations and at international conferences.65 The Court of Justice has applied the duty of loyal cooperation to Common Positions, holding this to mean in particular that ‘Member States are to take all appropriate measures, whether general or particular, to ensure fulfilment of their obligations under European Union law’.66 The Court has not excluded the possibility for Common Positions to have legal effects vis-a-vis third parties.67 Third pillar measures which the Treaty introduced expressly as legally binding were Decisions, which exclude legal approximation and do not entail direct effect,68 and Framework Decisions for the purposes of legal approximation.69 The introduction of Framework Decisions, which constituted the main form of third pillar law-making post-Amsterdam, considerably strengthened third pillar law. Framework Decisions were very similar to first pillar Directives – according to the Treaty, they were binding upon the Member States as to the result to be achieved, but left the choice of form and methods to the national authorities.70 The main difference with Directives was that Framework Decisions did not entail direct effect.71 However, as will be seen below, this did not stop the Court from stressing the legally binding character of third pillar law and boosting efforts to implement it in Member States.72 Moreover, the Court has confirmed the discretion of the Council to choose which third pillar legal instrument to adopt: in a case involving the Framework Decision on the European Arrest Warrant, the Court upheld the legislative choice of a Framework Decision as a form of third pillar law-making against arguments that this was the wrong choice of instrument and that the Council should have adopted a convention.73 The strengthening of the third pillar legal instruments was also confirmed by the elements of Maastricht which were not included in the Treaty, namely joint positions and, in particular, Joint Actions. The disappearance of Joint Actions from the Treaty resulted in a number of complex questions, especially regarding the status of Joint Actions adopted under the Maastricht procedures post-Amsterdam, their effects and their judicial scrutiny by the ECJ.74 While a number of proposals to replace Joint Actions by Framework Decisions were tabled by the Commission, these proposals – covering important aspects of criminal law harmonisation such as organised crime and

65 Article 37 TEU. 66 Case C-354/04 P, Gestoras Pro Amnistia et al v Council [2007] ECR I-5179, paragraph 52; and Case C-355/04 P, Segi et al v Council, ECR [2007] I-6157, para 52. Here the Court applied its earlier Pupino ruling (see below). 67 Gestoras and Segi; see the analysis below. 68 Article 34(2)(c). 69 Article 34(2)(b). 70 ibid. 71 ibid. 72 See the analysis on the Pupino judgment below. 73 Case C-303/05, Advocaten voor de Wereld VZW v Leden van de Ministerraad [2007] ECR I-3633. For an analysis of this, see ch 3. 74 On the uncertainty as to whether a measure of secondary law survives the repeal of its legal basis, see N Fennelly, ‘The Area of “Freedom, Security and Justice” and the European Court of Justice: A Personal View’ (2000) 49 International and Comparative Law Quarterly 10, at 12.

12 History, Principles and Institutions racism and xenophobia – have not yet been formally adopted.75 This exacerbates legal uncertainly, especially in the light of the unclear legal status of Joint Actions. c. Initiative Intergovernmental elements were also retained in the Amsterdam Treaty with regard to the right of initiative. While the Commission was granted a right of initiative in the third pillar, this right was shared with Member States, with any Member State having the right to table a proposal for a third pillar instrument.76 While the majority of third pillar proposals post-Amsterdam were tabled by the Commission, initiatives by Member States did not cease to exist. One form of Member State initiatives involved a number of Member States (at times consecutive EU presidencies) acting together to table proposals on matters perceived quite close to state sovereignty and thus rather ‘intergovernmental’ – examples in this context include a series of Member States’ sole or joint initiatives promoting mutual recognition in criminal matters,77 as well as initiatives that can be seen at times as a response to or pre-emption of more integrationist proposals by the Commission.78 Another form of intervention involved initiatives by one Member State, usually at the time of its holding of the EU Presidency. From an EU law and policy perspective, Member States initiatives presented a number of challenges: being prepared at times by civil servants in domestic interior or justice ministries whose job was to table draft domestic law, their structure and drafting left much to be desired in comparison to proposals prepared by expert EU law staff in the Commission; there was minimal consultation; their tabling could clash with the Commission’s timetable as outlined in its annual work programmes; and they could reflect a very narrow agenda or attempts to export a matter of purely domestic interest at the EU level.79 On some of these grounds, a number of Member State initiatives over the years failed to be adopted.80

75 For details on this, see ch 2. 76 Article 34(2). 77 These include proposals for the adopted Framework Decisions on the mutual recognition of: financial penalties (France, Sweden and the UK, Council Doc 19710/01, Brussels, 12 July 2001, and accompanying Explanatory Memorandum (EM) ADD 1, Brussels, 16 July 2001); confiscation orders (Denmark, Council Doc 9955/02, Brussels, 14 June 2002, and EM in ADD 1, Brussels, 2 July 2002); and freezing orders (France, Sweden and Belgium, Council Doc 13986/00, Brussels, 30 November 200 and EM in ADD 1, Brussels, 22 December 2000). They also include more recent proposals such as the proposal on the recognition and supervision of suspended sentences and alternative sanctions (Germany and France, Council Doc 5325/07, Brussels, 15 January 2007 and EM in ADD 1, Brussels, 1 February 2007); and the proposal on a common approach on judgments in absentia for mutual recognition purposes (Slovenia, France, the Czech Republic, Sweden, Slovakia, the UK and Germany, Council Doc 5213/08, Brussels, 14 January 2008 and EM in ADD 1, Brussels, 30 January 2008). On mutual recognition, see ch 3. 78 The example of the evolution of Eurojust is characteristic in this context; see ch 4. 79 On this point, see H Nilsson, Decision-Making in EU Justice and Home Affairs: Current Shortcomings and Reform Possibilities, Sussex European Institute Working Paper No 57, November 2002, 4. 80 Examples of aborted presidency initiatives include a Spanish initiative for a Convention on the suppression by customs administrations of illicit drug trafficking on the high seas (Council Doc 5382/02, Brussels, 4 February 2002); a Greek initiative for a Framework Decision on the prevention and control of trafficking in human organs (Council Doc 6290/03, Brussels, 13 February 2003); and, more controversially, a Greek initiative for a Framework Decision on the application of the ne bis in idem principle (Council Doc 6356/03,

The Third Pillar: The Institutional Framework 13 d. The Role of the CJEU The Treaty Framework Another significant limitation to the Commission’s powers under the third pillar was that it did not have a right to institute infringement proceedings against Member States, which was particularly relevant in cases of the misimplementation or nonimplementation of third pillar law. This limitation on the Commission’s role as ‘guardian of the Treaties’ presented considerable challenges in ensuring the timely and appropriate implementation of third pillar instruments by Member States, with Member States’ implementation records in the third pillar being consistently criticised by the Commission.81 The absence of infringement proceedings was not the only limit to judicial control in the third pillar.82 The role of the CJEU was strengthened in comparison with the situation under Amsterdam, but remained subject to significant limitations. The Court’s third pillar jurisdiction was delineated by (then) Articles 46(b) and 35 TEU.83 The Court did have jurisdiction to give preliminary rulings on the validity and interpretation of Framework Decisions and decisions, on the interpretation of conventions, and on the validity and interpretation of the measures implementing them.84 However, such jurisdiction was subject to acceptance by Member States85 – and not all Member States declared acceptance.86 This limitation of the preliminary ruling jurisdiction – introduced largely at the insistence of the UK, which, unsurprisingly, did not accept such jurisdiction thus far87 – was extremely detrimental, in that it limited the avenues of cooperation between Luxembourg and national courts, and deprived national courts of Brussels, 13 February 2003; on the issues resulting from the non-harmonisation of ne bis in idem across the EU, see ch 3). An example of a ‘watered-down’ proposal is the Spanish initiative on the setting up of a network of contact points of national authorities responsible for private security (Council Doc 5135/02, Brussels, 29 January 2002), which ended up as a Council Recommendation (OJ C153, 27 June 2002, 1). 81 For criticism of Member States’ implementation of third pillar measures, see European Commission, ‘Report on Implementation of The Hague Programme for 2007’, COM (2008) 373 final, Brussels, 2 July 2008; and for more details, see the accompanying Commission Staff Working Document SEC (2008) 2048, Brussels, 2 July 2008. 82 On the role of the ECJ in the third pillar, see A Arnull, ‘Taming the Beast? The Treaty of Amsterdam and the Court of Justice’ in O’Keeffe and Twomey (n 42) 109–22; Dashwood (n 54); S Peers, ‘Salvation outside the Church: Judicial Protection in the Third Pillar after the Pupino and Segi Judgments’ (2007) 44 CML Rev 883; Denza (n 28); Fennelly (n 74); A Albors-Llorens, ‘Changes in the Jurisdiction of the European Court of Justice under the Treaty of Amsterdam’ (1998) 35 CML Rev 1273. 83 See also art 2(1) of the Protocol on the Schengen acquis. For further details, see Peers (n 82). 84 Article 35(1). Note the strengthening of the provision with regard to the pre-existing instrument of Conventions in comparison to Maastricht, which left the determination of ECJ jurisdiction to the specific Conventions and did not include a general Treaty provision establishing such jurisdiction. 85 Via a declaration: art 35(2). Even if they accept jurisdiction, Member States can allow references only by courts and tribunals against whose decisions there is no judicial remedy under national law. This is similar to the limitation of the Court’s jurisdiction in Title IV; see art 68 EC. 86 Not all Member States made a Declaration under Article 35(2) TEU, including Denmark, Ireland and the UK. According to the Court of Justice, no official information was available in March 2008 with regard to Declarations by Bulgaria, Cyprus, Estonia, Malta, Poland, Romania and Slovakia. The remaining 17 Member States have made such Declarations with varying content. For details (including the relevant OJ references), see note by the ECJ Research and Documentation Service, ‘Jurisdiction of the Court of Justice to Give Preliminary Rulings on Police and Judicial Cooperation in Criminal Matters’, March 2008, http://curia.europa/eu/en/ instit/txtdocfr/txtsenvigueur/art35.pdf. 87 On UK resistance, see Denza (n 28) 317.

14 History, Principles and Institutions the ability to influence the development of EU law by sending to Luxembourg questions that were shaped in their domestic legal systems.88 There may also have been an impact on the consistency of the interpretation of EU law by national courts, although, as has been demonstrated by the interpretation of the European Arrest Warrant by the House of Lords, denying the right to send references to Luxembourg did not stop domestic courts from taking into account Luxembourg interpretation of third pillar law and applying it in their domestic context.89 The Court also established jurisdiction to review the legality of Framework Decisions and decisions on the grounds of lack of competence, infringement of an essential procedural requirement, infringement of the Treaty or of any rule of law relating to its application, or misuse of powers; however, standing was limited to Member States and the Commission, and was not extended to individuals.90 The Court also had jurisdiction to rule under certain conditions on any dispute between Member States regarding the interpretation or application of third pillar instruments, and on similar disputes between Member States and the Commission regarding the interpretation of conventions only.91 However, mirroring Member States’ willingness to keep domestic operational action in criminal matters out of bounds, the Court did not have jurisdiction ‘to review the validity or proportionality of operations carried out by the police or other law enforcement services of a Member State or the exercise of the responsibilities incumbent upon Member States with regard to the maintenance of law and order and the safeguarding of internal security’.92 This represented a considerable limitation of judicial control on operational action under the third pillar.93 Judicial Protection The limits to the Court’s jurisdiction raised a number of concerns regarding the capacity of the third pillar framework to provide effective judicial protection for affected individuals. The issue of judicial protection arose most prominently in the context of EU counter-terrorism measures: along with their significant human rights implications, these measures present considerable legal complexity as they may transcend one pillar and represent cross-pillar initiatives, while also representing a merging of internal with external EU criminal law, and involve the incorporation of international commitments into EU law. In this context, a distinction can be made between two categories of situations: instances where the EU legislator did not have any discretion in implementing 88 On this point, see also Arnull (n 82) 118. 89 See in particular the case of Dabas v High Court of Justice, Madrid [2007] UKHL 6, where the House of Lords referred to Pupino to interpret the domestic Extradition Act 2003 in the light of the Framework Decision on the European Arrest Warrant. For details, see V Mitsilegas, ‘Drafting to Implement EU Law: The European Arrest Warrant in the United Kingdom’ in H Xanthaki (ed), Legislative Drafting: A Modern Approach. Essays in Honour of Sir William Dale (Routledge, 2008) 199–212. For accurate predictions on the effect of ECJ third pillar preliminary rulings on UK courts, see Denza (n 28) 317; and Arnull (n 82) 118. On the erga omnes effects of preliminary rulings, see K Lenaerts, ‘The Rule of Law and the Coherence of the Judicial System of the European Union’ (2007) 44 CML Rev 1625, 1641–45. 90 Article 35(6). Arnull has criticised the failure to grant to individuals standing with regard Decision: Arnull (n 82) 119. 91 Article 35(7). 92 Article 35(5). 93 It has been argued that the practical effect of Article 35(5) may be limited as the provision is concerned with national, and not EU, measures. See A Arnull, The European Union and its Court of Justice, 2nd edn (Oxford University Press, 2006) 134.

The Third Pillar: The Institutional Framework 15 UN measures; and instances where the EU legislator had some degree of discretion in implementation by specifying individually the persons, groups and entities affected.94 The first category of cases will be examined in Chapter 10.95 In the second category, two important cases concerning judicial protection arose involving the adoption of a crosspillar Common Position which implemented Resolution 1373(2001) of the UN Security Council (UNSC) on terrorist finance.96 Individuals and organisations affected by this Common Position sought recourse to the Court of First Instance97 and, on appeal, to the Court of Justice.98 Central to these cases was the question of effective judicial protection and remedies to challenge the inclusion of those concerned within the scope of EU restrictive measures. The Court of Justice upheld the Court of First Instance’s ruling with regard to the applicant’s action for damages: based on then Articles 46 and 35 TEU (with the Court stating that the latter ‘confers no jurisdiction on the Court of Justice to entertain any action for damages whatsoever’),99 as well as then Article 41(1) TEU (on compensation for damages caused by EU institutions),100 the Court confirmed that no action for damages is provided for in the third pillar. However, it did go one step further when examining the issue of effective judicial protection in the context of preliminary rulings. In a striking judgment, it applied its first pillar case law on the right to make a reference for a preliminary ruling to the third pillar,101 stating that this right exists ‘in respect of all measures adopted by the Council, whatever their nature or form, which are intended to have legal effects in relation to third parties’.102 On the basis of this substantive test, and notwithstanding the fact that Article 35 did not confer ECJ jurisdiction in this regard, the Court held that ‘it has to be possible to make subject to review by the Court a Common Position which, because of its content, has a scope going beyond that assigned by the EU Treaty to that kind of act’.103 The Court would have jurisdiction to find ‘that the Common Position is intended to produce legal effects in relation to third parties, to accord it its true classification and to give it a preliminary ruling’.104 It would also have jurisdiction to review the lawfulness of Common Positions under the conditions set out in then Article 35(6) TEU.105 94 On this distinction, see Court of First Instance, Case T–47/03, Sison v Council [2007] ECR I-1233, paras 147–50. 95 For an analysis of the issues raised by the relationship between international law and EU law for judicial protection, see ch 8. 96 Council Common Position 2001/931 adopted under Articles 15 and 34 TEU ‘on the application of specific measures to combat terrorism’ [2001] OJ L344, 28 December, 93. This Common Position has been amended a number of times since to update the lists of individuals and organisations affected by it; for the latest version at the time of writing, see Council Decision (CFSP) 2018/475 of 21 March 2018 updating the list of persons, groups and entities subject to Articles 2, 3 and 4 of Common Position 2001/931/CFSP on the application of specific measures to combat terrorism, and repealing Decision (CFSP) 2017/1426 [2019] OJ L79, 22 March, 26. 97 Cases T-338/02 ECR [2004] II–1647 (Segi) and T-333/02 (Gestoras). 98 ibid. 99 ibid para 46. 100 ibid para 47. The Court referred to its judgment in the case Spain v Eurojust; see ch 4. 101 The Court has also applied on a number of occasions the admissibility rules of Article 234 EC to third pillar cases; see Peers (n 82) 887–88. 102 Segi and Gestoras (n 97) para 53. 103 ibid para 54. 104 ibid. 105 ibid para 55.

16 History, Principles and Institutions The Court’s judgments in Gestoras Pro Amnistia and Segi represented a clear effort to address the criticism that it was reluctant to go beyond the Treaty constraints and provide effective judicial protection to individuals affected by far-reaching restrictive measures, such as their inclusion on terrorist lists,106 which were adopted with little scrutiny.107 The substantive test adopted could address the practice of Member States in the Council choosing to adopt restrictive measures with human rights implications by choosing a form of instrument, such as Common Positions, whose legal status was unclear and which were subject to minimal judicial scrutiny on the basis of the letter of the EU Treaty – this may also be the case in particular in cases of a combined second and third pillar legal basis.108 The Court indicated its willingness to look behind the formal classification of a measure and to provide a mechanism for review for measures affecting the rights of individuals irrespective of such classification, albeit in a decentralised manner, via the preliminary rulings route.109 According to the Court, this avenue constituted a remedy, and ironically for the applicants, their claim that there was no effective judicial protection at the EU level was rejected.110 Another source of judicial protection concerns proved to be not the letter of Title VI (and Title IV for that matter), but the implementation of these provisions in practice. It was thought that the conduct of preliminary ruling proceedings in Luxembourg, in particular their lengthy duration, was not appropriate for cases involving Justice and Home Affairs matters, which involve situations such as individuals in custody and require speedy resolution.111 The President of the Court subsequently presented to the Council a request by the Court to amend its Statute with a view to instituting an

106 For a critical overview of the development of EU terrorist lists, see E Guild, ‘The Uses and Abuses of Counter-terrorism Policies in Europe: The Case of the “Terrorist Lists”’ (2008) 46(1) Journal of Common Market Studies 173. 107 A degree of willingness to provide some avenues for judicial review had been demonstrated a few months earlier by the Court of First Instance in Case T-228/02 OMPI v Council [2006] ECR II-4665. The Court dismissed the applicant organisation’s action for annulment of the Common Position as inadmissible, ruling that neither the second nor the third pillar contains provisions for action for annulment (paras 45–54, with the Court stressing in para 54 that these pillars provide a ‘limited system of judicial review’). However, the Court did accept jurisdiction to hear an action for annulment directed against a Common Position adopted on the basis of arts 15 and 34 TEU ‘only strictly to the extent that, in support of such an action, the applicant alleges an infringement of the Community’s competences’ (para 56). In this context, the Court found the application to be unfounded. It then went on to examine issues of judicial protection with regard to first pillar measures implementing the Common Position. For commentaries on OMPI, see Guild (n 106); and C Eckes, ‘Case Note’ (2007) 44 CML Rev 1117. 108 The impact of the judgment on Member States’ discretion to choose the form of legislative action in the third pillar remains to be seen. It must be recalled in this context that the Court has accepted a wide range of discretion in the European Arrest Warrant case. However, there is a significant difference as that case involved the choice between two legally binding measures (a Convention and a Framework Decision). The solution may be different if the legal classification of a measure has a substantial impact on judicial protection. 109 On this point, see also Peers (n 82) 898. 110 Segi and Gestoras (n 97) para 57. Commentators called the Court’s rulings a ‘Pyrrhic victory’ for the applicants; see A Johnston, ‘The European Union, the Ongoing Search for Terrorists’ Assets and a Satisfactory Legal Framework: Getting Warmer or Colder?’ (2007) 66 Cambridge Law Journal 523, 523–25. 111 This issue was highlighted inter alia in a discussion paper presented by the Court in 2006 where it was noted that the average duration of preliminary ruling procedures has been reduced from 25.5 months in 2003 to 20.4 months in 2005. See V Skouris, President of the Court of Justice, ‘Treatment of questions referred for a preliminary ruling concerning the area of freedom, security and justice’, Council Doc 13272/06, Brussels, 28 September 2006, 2.

The Third Pillar and the Constitutional Principles of the Community 17 emergency preliminary ruling procedure.112 Negotiations resulted in a Council Decision amending the Protocol on the Statute of the Court of Justice,113 followed by amendments to the Court’s Rules of Procedure.114 The new framework allowed in particular with regard preliminary rulings in Justice and Home Affairs matters an urgent procedure at the request of the national court or, exceptionally, following the Court’s own motion.115 Rulings were to be given by a designated court chamber, after hearing the Advocate General.116 According to an Information Note published by the Court, the urgent procedure must be requested ‘only when it is absolutely necessary for the Court to give its ruling on the reference as quickly as possible’, including cases where a person is detained or deprived of their liberty and where the answer to the question raised is decisive as to the assessment of the person’s legal situation.117 This new procedure thus contributed significantly towards expediting procedures and achieving legal certainty in cases having a significant impact on fundamental rights.118

IV. The Third Pillar and the Constitutional Principles of the Community: The Contribution of the Court of Justice The beginning of the 2000s witnessed the proliferation of judgments from Luxembourg relating to the third pillar. These judgments – which must be viewed in conjunction with case law by national courts, including constitutional courts – have played a major role in the development of the principles of EU criminal law. A central feature in this context has been the interpretation of the reach of the third pillar provisions (which, as explained above, form a more limited, less supranational framework than the Community law first pillar), and the determination of the applicability of first pillar Community law principles to the third pillar.119 The influence of the Court of Justice120 and, where appropriate, national courts in the development of legal principles for the third pillar 112 Justice and Home Affairs Council Conclusions of 18 September 2007, 15 (Council Doc 12604/07, Presse 194). 113 [2008] OJ L24, 29 January, 42. 114 ibid 39. 115 For details see Rules of Procedure, new Article 104b inserted by the 2008 amendments. 116 Article 104b(5). In cases of extreme urgency, the Chamber may decide to omit the written part of the procedure altogether. See art 104b(4). 117 ‘Information Note on References from National Courts for a Preliminary Ruling. Supplement Following the Implementation of the Urgent Preliminary Ruling Procedure Applicable to References Concerning the Area of Freedom, Security and Justice’, http://curia.europa.eu/instit/txtdocfr/txtsenvigueur/noteppu.pdf. 118 The Court has already applied the expedited procedure in a case involving the European Arrest Warrant. See the judgment of 17 July 2008 in Case C-66/08, Kozlowski [2008] ECR I-06041. For cases decided postLisbon, see Case C-168/13 PPU Jeremy F, ECLI:EU:C:2013:358; Joined Cases C-404/15 and C-659/15 PPU, Aranyosi and Căldăraru, ECLI:EU:C:2016:198; Case C-108/16 PPU Dworzecki, ECLI:EU:C:2016:346; Case C-241/15, Bob-Dogi, ECLI:EU:C:2016:385; Case C-294/16 PPU, JZ, ECLI:EU:C:2016:610; Case C-452/16, PPU Poltorak, ECLI:EU:C:2016:858; Case C-453/16 PPU, Özçelik, ECLI:EU:C:2016:860; Case C-477/16 PPU, Kovalkovas, ECLI:EU:C:2016:861. 119 For details, see Mitsilegas (n 62). 120 The term ‘CJEU’ will be used primarily to refer to the Court, although there will inevitably be references to the Court as ‘ECJ’, given the usage and evolution of the term.

18 History, Principles and Institutions and EU criminal law more broadly will be examined in the relevant sections throughout this book. This section aims to provide a general overview of the development by the Court of such principles by focusing in particular on the application of constitutional principles of (first pillar) Community law to the third pillar.121 In this context, the development of the relationship between both the first and third pillars, but also between EU law and national law, is becoming increasingly significant.

A. Primacy A question that would inevitably emerge in the context of the evolution of third pillar law is whether the latter has primacy over national law, in particular national constitutional law. This issue is especially thorny in the light of the nature of the matters covered by the third pillar, which is at the heart of state sovereignty and has considerable implications for both fundamental rights and national constitutional principles. Not surprisingly, it was national constitutional and supreme courts that had to deal with primacy implications when examining the implementation of a flagship third pillar measure, the European Arrest Warrant Framework Decision, in their domestic legal orders. Different courts gave different solutions in the light of the domestic constitutional and legal framework, but no firm views on primacy have been offered. These courts began to varying degrees a constitutional dialogue with the Court of Justice with regard to the development of EU criminal law. The Court was proactive in ruling on the issue of primacy of first pillar law over third pillar law. In a number of cases, dealing primarily with competence issues and legal basis disputes, it confirmed the primacy of the first pillar based on Article 47 TEU.122

B. Conferral in the Light of Effectiveness The Court has had to rule in a number of high-profile cases on issues of conferral of competence in criminal matters. With the choice of pillars having significant repercussions on the powers of EU institutions, unsurprisingly these cases were prompted by efforts by EU institutions to boost their institutional prerogatives. In all these cases, the Court used first pillar principles and methods in order to allocate the appropriate legal basis. One line of case law concerned challenges by the Commission with regard to the choice of a third pillar legal basis for the adoption of legislation on the definition of criminal offences and the imposition of criminal sanctions, with the Court confirming first pillar competence in certain criminal matters twice: the environmental crime and the ship-source pollution cases.123 In both cases, effectiveness was central in the

121 The term ‘constitutional principles of EC law’ is understood to include ‘systemic principles which underlie the constitutional structure of the Community and define the Community legal edifice’; see T Tridimas, The General Principles of EU Law, 2nd edn (Oxford University Press, 2006) 4. Tridimas referred to these principles as a subcategory of the general principles of Community law. 122 For more details on this, see ch 2. 123 For more details on this, see ch 2.

The Third Pillar and the Constitutional Principles of the Community 19 Court’s reasoning. Rather than treating criminal law as a special case confined to the third pillar, the Court viewed it in the same way as any other field of law – as a means to an end towards the effectiveness of Community law.124 Another case concerned an intervention by the European Parliament challenging the legal basis of an international agreement on passenger name records (PNRs) concluded between the Community and the US under the first pillar. In this case, the Court applied the first pillar criteria in looking at the appropriate legal basis of an instrument, noted the counter-terrorism focus of the agreement and went the opposite way to the previous cases, ruling that the agreement should have been concluded under a third pillar legal basis.125 These cases have had considerable implications for subsequent legislative action in criminal matters.

C. Fundamental Rights Third pillar law is inextricably linked with issues relating to the protection of fundamental rights. Such issues have arisen explicitly or implicitly in all cases involving EU criminal law. As seen above, one category of cases involves issues of fundamental rights, including judicial protection at the EU level, concerning in particular access to the Luxembourg Court and remedies. The Court has increasingly been trying to broaden avenues of judicial protection, with the issue of effective judicial protection becoming increasingly central. Another line of cases involves the implications of third pillar law on the rights of the defendant at the national level. Thus, major cases have involved the application of the European Arrest Warrant,126 the rights of the defendant against the rights of the victim127 and the rights of the defendant in cases involving double jeopardy.128 Two main – and not entirely consistent – trends can be discerned in this context. The first is the Court’s assertions of the centrality of fundamental rights in EU law, including third pillar law (with the Court referring repeatedly to the European Convention on Human Rights (ECHR), but also explicitly to the Charter of Fundamental Rights of the European Union in the European Arrest Warrant case) and the obligations of national courts to take into account and uphold such rights. However, the second tendency of the Court is paradoxically to limit the applicability of these rights by ruling that aspects of third pillar law do not involve substantive criminal law, but procedure; therefore, the special human rights safeguards reserved for criminal law do not apply.129 This is a worrying trend, as it transforms criminal law into a field where 124 For further details, see ch 2. Effectiveness also played a part in the Court’s application of the first pillar principle of indirect effect to the third pillar. As will be seen below, in Pupino the Court linked effectiveness with the duty of loyal cooperation enshrined in Article 10 EC and justified the application of loyal cooperation in the third pillar – and subsequently indirect effect – on the grounds of the effective achievement of this time an EU objective: an ever closer Union as enshrined in Article 1 TEU. 125 On PNRs, see ch 9. 126 See ch 4. 127 See in particular Pupino, below. 128 See chs 5 and 6. 129 Note also the case law of the Court of First Instance regarding freezing orders: the Court has repeatedly held that as a precautionary measure, these measures do not constitute criminal sanctions and do not imply any accusation of a criminal nature (Sison (n 94) para 101; see also Case T–315/01, Kadi v Council [2005] ECR II-3649, para 248; and Case T-306/01, Yusuf and Al Barakaat International Foundation v Council

20 History, Principles and Institutions maximum EU-led enforcement capacity is matched with a shrinking field of applicability of human rights safeguards.130

D. Loyal Cooperation and (In)Direct Effect: The Impact of Pupino As noted above, one of the fundamental differences between first and third pillar law is that, as is stated explicitly in the TEU, Framework Decisions – the main legislative instrument in the third pillar and in general mirroring the design of Directives – do not have direct effect.131 This limitation reflects Member States’ sensitivity with regard to the potential effects of third pillar law. The limitation is significant as it considerably restricts the potential for enforcement of third pillar law by blocking avenues for individuals to challenge their legal position as resulting from EU criminal law before the domestic courts. With the Treaty referring only to direct effect and excluding it in the context of Framework Decisions, however, the question arises as to whether other principles of Community law ensuring the enforcement of EC law in national courts – such as indirect effect – apply to the third pillar. The Luxembourg Court dealt with this issue in the Pupino judgment.132 This case arose after a reference by an Italian court asking to what extent the Italian Code of Criminal Procedure could be interpreted, in the light of a Framework Decision on the standing of victims in criminal proceedings,133 as allowing children allegedly having suffered a number of forms of abuse by their teacher to testify under a special procedure, and not in normal court proceedings, against the teacher. The Italian Code of Criminal Procedure allowed for this possibility for children under 16 only in cases involving sexual offences or offences with a sexual background. The Luxembourg Court was thus asked to decide whether, and in which context, Framework Decisions entail indirect effect.

[2005] ECR II-3533 para 299, in which the Court distinguished between asset freezing and confiscation). However, the Court has referred to the criminal procedure standards developed by the Strasbourg Court as a standard by which to interpret the extent of the obligation for a fair hearing in freezing decisions. See Sison (n 94) para 182. On the Kadi litigation, see ch 10. 130 On this point, see V Mitsilegas, ‘The Transformation of Criminal Law in the “Area of Freedom, Security and Justice”’ (2007) 26 Yearbook of European Law 1. 131 Article 34(2)(b) TEU. It is interesting to note while the judge-made principle of direct effect makes its appearance in the TEU in this ‘negative’ manner. 132 Case C-105/03, Maria Pupino [2005] ECR I-5285. For commentaries on the case, see, inter alia: S Prechal, ‘Direct Effect, Indirect Effect, Supremacy and the Evolving Constitution of the European Union’ in Barnard (n 42) 35–70; Peers (n 82); JR Spencer, ‘Child Witnesses in the European Union’ (2005) 64(3) Cambridge Law Journal 569; M Fletcher, ‘Extending “Indirect Effect” to the Third Pillar: The Significance of Pupino?’ (2005) 30 European Law Review 862; Editorial, ‘The Court of Justice and the Third Pillar’ (2005) 30 European Law Review 773; C Hillgruber, Anmerkung, Juristenzeitung, no.17, 2005, 841–844; D Sarmiento, ‘Un paso más en la constitucionalización del tercer pilar de la Union europea. La sentencia Maria Pupino y el efecto directo de las decisiones marco’ (2005) 10 Revista Electronica de Estudios Internacionales; and, more generally, H Labayle, ‘Architecte ou Spectatrice? La Cour de Justice de l’Union dans l’Espace de Liberté, Sécurité et Justice’ (2006) 42 Revue Trimestrielle du Droit Européen 1. 133 [2001] OJ L82, 22 March, 1.

The Third Pillar and the Constitutional Principles of the Community 21 After asserting jurisdiction,134 the Court accepted that the ‘interpretative obligation’ of national courts under Community law also extended to third pillar Framework Decisions. The Court based its approach to a large extent on the binding character of Framework Decisions. It stressed that the wording of Article 34(2)(b) TEU on Framework Decisions is very closely inspired by that of the third paragraph of Article 249 EC on Directives, with Article 34(2)(b) EU conferring a binding character on Framework Decisions in the sense that they ‘bind’ the Member States ‘as to the result to be achieved but shall leave to the national authorities the choice of form and methods’.135 The Court then asserted that ‘the binding character of Framework Decisions, formulated in terms identical to those of the third paragraph of Article 249 EC, places on national authorities, and particularly national courts, an obligation to interpret national law in conformity’.136 The limits placed on the jurisdiction of the Court do nothing to invalidate that conclusion.137 The Court backed up its conclusion with a further line of argumentation focusing on the need to achieve the objectives of the EU effectively, which is linked to the principle of loyal cooperation. According to the Court, irrespective of the degree of integration envisaged by the Amsterdam Treaty, it is perfectly comprehensible that the authors of the TEU should have considered it useful to make provision, in the context of Title VI of that Treaty, for recourse to legal instruments with effects similar to those provided for by the EC Treaty, in order to contribute effectively to the EU’s objectives.138 As with its case law on ne bis in idem, the Court seems to have adopted a rather ahistorical approach to European integration, effectively arguing that the degree of integration envisaged by Member States when signing the Amsterdam Treaty is irrelevant.139 In this context, the Court stated that it would be difficult for the EU to carry out the task of creating an ever closer Union (enshrined in Article 1 TEU) effectively if the principle of loyal cooperation – which is enshrined in Article 10 of the EC Treaty – were not also binding in the area of police and judicial cooperation in criminal matters.140 On the basis of these arguments, the Court asserted that the principle of conforming interpretation is binding in relation to Framework Decisions.141 Having applied the Community law principle of interpretative obligation to the third pillar, the Court referred to first pillar case law to set out, in a manner similar to the first pillar, the limits and contours of indirect effect.142 The Court reiterated that the interpretative obligation of national courts is limited by general principles of law, such as legal certainty and non-retroactivity, adding that, in particular, those principles prevent that obligation from leading to the criminal liability of persons who contravene the

134 See Pupino (n 132) paras 19–30 of the judgment, in particular on the applicability of art 234 EC to the third pillar. 135 ibid para 33. 136 ibid para 34. 137 ibid para 35. 138 ibid para 36. 139 On the ne bis in idem case law, see ch 3. 140 Pupino (n 132) paras 41 and 42. 141 ibid para 43. 142 For an analysis, see, inter alia, G Betlem, ‘The Doctrine of Consistent Interpretation: Managing Legal Uncertainty’ (2002) 22 Oxford Journal of Legal Studies 397.

22 History, Principles and Institutions provisions of a Framework Decision from being determined or aggravated on the basis of such decision alone, independently of an implementing law.143 However, the Court, following the Opinion of AG Kokott,144 noted that the present case did not concern the extent of criminal liability of the person concerned, but the conduct of the proceedings and the means of taking evidence.145 Further on in the judgment, the Court stated that the principle of conforming interpretation cannot serve as the basis for an interpretation of national law contra legem. However, following its recent judgment in Pfeiffer,146 the Court qualified this limitation by adding that indirect effect does require that, where necessary, the national court consider the whole of national law in order to assess how far it can be applied in such a way as to not produce a result contrary to that envisaged by the Framework Decision.147 Having established the principle and its limits, the Court went on to examine the specific case.148 It confirmed that the achievement of the aims of the Framework Decision on the rights of victims in criminal proceedings require that a national court should be able, in respect of particularly vulnerable victims, to use a special procedure, such as the one provided for already in Italian law.149 However, in the light of the concerns raised regarding the potential impact of such interpretation on the rights of the defendant, the Court added two caveats: that, in the light of the Framework Decision, the adopted conditions for giving evidence must be compatible with the basic legal principles of the Member State;150 and that the national court must ensure that the application of those measures is not likely to ‘make the criminal proceedings against Mrs Pupino, considered as a whole, unfair within the meaning of Article 6 of the [ECHR], as interpreted by the European Court of Human Rights’.151 Pupino was a landmark ruling. The Court did not hesitate to transplant Community law to the third pillar by stating that Framework Decisions entail indirect effect. This is notwithstanding the fact that the third pillar itself excluded the application of direct effect – the basic Community law principle whose limits are inextricably linked to the development of the indirect effect concept by the ECJ. It is also irrespective of the degree of integration the states signatory to the Amsterdam Treaty wished to achieve in criminal matters – the Court disassociated the envisaged degree of integration in Amsterdam from the need to ensure the effective achievement of EU objectives. The reasoning of the Court is noteworthy, especially the emphasis on the principle of loyal cooperation. At that time, the principle was enshrined in Article 10 of the EC Treaty,152 but not in the third pillar – the Court seems to apply loyal cooperation by analogy to the third pillar, 143 Pupino (n 132) paras 44 and 45, including references to the Court’s case law. 144 Opinion delivered on 11 November 2005: [2005] ECR I-5285, para 42. 145 ibid para 46. 146 Cases C-397/01–C-403/01, Pfeiffer et al v Deutsches Rotes Kreuz [2004] ECR I-8835, in particular para 115. For a commentary, see Sacha Prechal, ‘Case Note’ [2005] 42 CML Rev 1445. 147 ibid para 47. See also Fletcher (n 132) 873. 148 Pupino (n 132) paras 50–61. 149 ibid para 56. 150 ibid para 57. The Court referred to art 8(4) of the Framework Decision. 151 Pupino (n 132) para 60. In the preceding paras, the Court stressed the fact that according to art 6(2), TEU, the EU respects fundamental rights and that the Framework Decision must be interpreted in a way that fundamental rights are respected (paras 58 and 59). 152 Under the current rules, the principle of sincere cooperation is enshrined in art 4(3) TEU.

The Third Pillar and the Constitutional Principles of the Community 23 based not on the specific objective of developing the EU as an ‘Area of Freedom, Security and Justice’, but rather on the very general provision of Article 1 TEU calling for the establishment of an ‘ever closer Union’.153 By focusing on the principle of loyal cooperation, the Court not only emphasised the importance of the effective achievement of Treaty objectives (only this time these involve the EU and not the Community);154 similarly to the Pfeiffer ruling,155 the Court also avoided linking indirect effect with the primacy of EU law over national law.156 The Court’s silence in this regard may indicate that, as with the issue of the application of state liability in the third pillar,157 the primacy issue remained open.158 The impact of the application of the interpretative obligation of the national judge in this case is striking. The Luxembourg Court in reality rewrote the Italian Code of Criminal Procedure. Following the Court’s guidance, the domestic judge had little choice but to allow minors in this case to take advantage of the Code’s protective provisions, although they were not covered by the legislation. This led to the criticism that in fact the Court conferred not indirect but direct effect to the Framework Decision, in stark breach of the wording of Article 34 TEU.159 The Court seemed to overcome potential obstacles caused by the argument that adding a category of privileged witnesses to the Italian Code of Criminal Procedure in the face of the silence of the Code in this regard would in fact be contra legem by using the Pfeiffer formula that the national judge must consider national law ‘as a whole’. However, at that time, this raised important questions regarding the impact of such consideration on the internal coherence of national criminal justice systems, whose balance may be disturbed by piecemeal attempts of national 153 See K Lenaerts and T Corthaut, ‘Of Birds and Hedges: The Role of Primacy in Invoking Norms of EU Law’ (2006) 31 European Law Review 287. This reasoning has been heavily criticised by the European Law Review editorial (Editorial (n 132)), where it is stated that art 1 TEU is not subject to the Court’s jurisdiction (art 46 TEU). Fletcher ((n 132) 71) also criticises the emphasis on loyal cooperation by arguing that the third pillar covers cooperation between Member States. However, this seems to be an extremely ‘intergovernmental’ view of the third pillar, whose system indeed shares a number of common features with the first pillar, and laws stemming from it represent a further degree of integration from international law instruments. 154 For an interesting use of the duty of loyal cooperation in the context of first pillar measures with a criminal law dimension, see inter alia the judgments of the Court of First Instance in OMPI (n 107) paras 122 et seq and Sison (n 94) paras 170 et seq. Referring to Pupino, the Court held that on the basis of loyal cooperation, it is in principle for the national courts to ensure the observance of fair hearing rights in the context of EU counter-terrorism listing measures; however, Luxembourg will be involved in cases where the Council bases its initial decision or a subsequent decision to freeze funds on information or evidence communicated to it by representatives of the Member States without it having been assessed by the competent national authority. 155 See Prechal (n 146). 156 See Labayle (n 132) 31. See also Lenaerts and Corthaut ((n 153) 293), who argue that ‘the Court could have avoided this frantic search for a ground for an equivalent provision, if it had recognised that the duty of consistent interpretation is inherent in any hierarchy of norms and thus a simple corollary of the principle of primacy in that it is the easiest way to ensure that no inconsistent national laws are applied over EU law’. 157 Prechal takes the view that the application of loyalty can form the basis of state liability; see Barnard (n 42) 61. 158 Peers ((n 82) 920) argues that primacy or the connected obligation to set aside national law in order to apply Community law does not apply to the third pillar. He makes the valid point that if these principles (and direct effect) applied to the third pillar, the essential distinctions between the first and third pillars would be lost and the intentions of the Treaty authors would clearly be ignored. A diametrically opposite view with regard to supremacy is put forward by Prechal, who also seems to be in favour of disapplication unless fundamental rights or general principles oppose such a disapplication or where the solution of the case would require the application of a Framework Decision – and not national law – to the facts of the case; see Barnard (n 42) 62–63. 159 Sarmiento (n 132).

24 History, Principles and Institutions judges to accommodate EU law demands in specific cases. Judges themselves could be faced with difficult balancing exercises, especially in cases where EU law itself – as in the case of the Framework Decision in question – is drafted in broad terms, having to take into account all complex parameters and interests involved in a criminal trial. In this balancing of competing interests, Pupino raised a number of questions regarding safeguarding the rights of the defendant in the development of the EU as an ‘Area of Freedom, Security and Justice’. In Pupino, it appeared that the interpretation emphasised the rights of the alleged victims at the expense of the rights of the defendant. This approach raised concerns as to whether the position of the defendant could become even worse if the legislative output of the third pillar focused predominantly on enforcement/security aspects rather than instruments protective of rights.160 These concerns were accentuated by the limits posed by the Court in existing case law safeguards regarding indirect effect and criminal law. In Pupino, the Court seemed to transpose all the first pillar safeguards limiting indirect effect in criminal law cases, but then substantially qualified its position by stating that the present case does not involve criminal law per se, but the gathering of evidence, ie, criminal procedure.161 This narrow framing of protection in the criminal justice process raised particular concerns, not only due to the difficulty in disassociating aspects of criminal law from criminal procedure, but, more importantly, because it is questionable to exclude the application of principles such as legal certainty, non-retroactivity and aggravation of a person’s criminal liability from the criminal process and limit them, as the Court did, to ‘the extent of the criminal liability of the person concerned’ in the light of the significant consequences that the criminal process may have for the individual.

V. The Politics of the Third Pillar: Member States’ Security Ambitions versus Institutional Checks and Limits The gradual and contested institutional developments in EU criminal law as reflected in the evolution of the third pillar were combined with increasing activity at the level of politics and strategy by Member State governments. This activity was prominent both within and outside the EU framework. Within the EU framework, governments were proactive in defining strategy and policy targets within the framework of the European Council, which determined the two major political blueprints for the development of

160 In this context, it is noteworthy that in the post-Lisbon era, a series of legislative instruments strengthening individual rights, including the rights to a lawyer, a translator and an interpreter, and the right to the presumption of innocence, have been adopted. See ch 5; V Mitsilegas, ‘Trust-Building Measures in the European Judicial Area in Criminal Matters: Issues of Competence, Legitimacy and Inter-institutional Balance’ in S Carrera and T Balzacq, Security versus Freedom? A Challenge for Europe’s Future (Ashgate, 2006) 287–88. 161 The question arises here of how the Court’s approach in the first pillar cases setting limits to indirect effect to protect the individual, in particular Berlusconi (Cases C-387/02, C-391/02 and C-403/02 [2005] ECR I-3565) will apply to first pillar criminal law after the environmental crime case (for an analysis, see ch 2). Lenaerts and Corthaut ((n 153) 312) are of the view that the limits posed by the Court will be applicable in these cases, assuming that first pillar criminal law will be limited to the determination of criminal liability.

The Politics of the Third Pillar 25 EU Justice and Home Affairs, the five-year plans of action adopted in Tampere in 1999 and The Hague in 2004. Moreover, governments developed a number of Action Plans as a response to events such as 9/11 and the need to provide an imminent reaction to them. Outside the EU framework, the Schengen example was followed by similar concerted action by a number of Member States in the field of police cooperation. Moreover, large Member States met regularly outside the EU framework and discussed priorities in the field. This section will focus on the impact of government initiatives both within and outside the EU legal framework, and will examine the implications of such action in the light of the EU institutional framework in criminal matters prior to the entry into force of the Lisbon Treaty.

A. Action within the EU Framework A major actor influencing the direction of legislation and policy in EU Justice and Home Affairs in general and EU criminal law in particular was the European Council.162 Central to the development of EU action in the field of Justice and Home Affairs was the adoption by the European Council of two detailed, five-year legislative and policy programmes outlined in the Tampere European Council Conclusions in 1999163 and in the successor to Tampere, The Hague Programme of 2004.164 The strategy adopted by the European Council was thus to provide political impetus for the development of the objective to develop the EU as an ‘Area of Freedom, Security and Justice’ via the adoption of target-setting mechanisms outlining long-term, detailed directives for law and policy development.165 The agenda put forward in Tampere, but also to a lesser extent in The Hague, was markedly ambitious, with the programmes calling for the adoption of a plethora of EU legislative measures. However, this ambitious agenda did not sit comfortably with the considerable institutional limitations described earlier in this chapter. What the Member State governments proclaimed in the European Council did not necessarily coincide with the powers they were prepared to grant to the

162 On the role of the European Council in EU Justice and Home Affairs, see J Monar, ‘Decision-Making in the Area of Freedom, Security and Justice’ in Arnull and Wincott (n 54) 63–80. 163 For the text of the Conclusions, see www.europarl.europa.eu/summits/tam_en.htm. On the background, see House of Lords European Union Committee (then Select Committee on the European Communities), Prospects for the Tampere Special European Council, 19th Report, session 1998–99, HL Paper 101; see also Mitsilegas, Monar and Rees (n 1) 91–95. 164 [2005] OJ C53, 3 March, 1. For details, see House of Lords European Union Committee, The Hague Programme: A Five Year Agenda for EU Justice and Home Affairs, 10th Report, session 2004–05, HL Paper 84. On different aspects of The Hague Programme, see also JW de Zwaan and FAN Goudappel (eds), Freedom, Security and Justice in the European Union (TCM Asser Press, 2006); T Balzacq and S Carrera, ‘The Hague Programme: The Long Road to Freedom, Security and Justice’ in Balzacq and Carrera (n 160) 1–34; D Bigo, ‘Liberty, Whose Liberty? The Hague Programme and the Conception of Freedom’ in Balzacq and Carrera (n 160) 35–44; and V Mitsilegas, ‘Operational Co-operation and Counter-terrorism in the EU’ in F Pastore (ed)., Supranational Counter-terrorism: A Test under Duress for EU Principles and Institutions, Centro Studi di Political Internazionale (CeSPI), Rome, Working Paper 22/2005, 10–20. 165 On the target-setting function of Action Plans and Programmes in EU Justice and Home Affairs, see J Monar, Specific Factors, Typology and Development Trends of Modes of Governance in the EU Justice and Home Affairs Domain, NEWGOV Deliverable 01/17, May 2006, www.eu-newgov.org/database/DELIV/ D01D17_Emergence_NMG_in_JHA.pdf.

26 History, Principles and Institutions EU in the third pillar, and nor did it always lead to the political will to translate the European Council mandate into third pillar law. This was particularly the case with measures giving rights to individuals.166 Along with these all-encompassing programmes, the European Council provided further political impetus for developing EU criminal law by the adoption of detailed Action Plans promulgated as a response to phenomena framed as threats in a particular moment. In the 1990s, a major example was the adoption, in 1997, of an Action Plan to fight organised crime.167 In the 2000s, when terrorism replaced organised crime as the major threat in the political vocabulary, the European Council adopted an Action Plan to combat terrorism.168 Both Action Plans were detailed and contained calls for a wide range of EU legislative action, with the terrorism Action Plan also followed by detailed implementation ‘Roadmaps’ and being regularly updated.169 Each major attack in the recent past – in New York, Madrid and London – was followed by a swift intervention by the European Council and calls for the adoption of further measures at the EU level.170 It is noteworthy in this context that in both the cases of organised crime and terrorism, the European Council followed the strategy of framing a wide range of issues – not all of which were closely linked to fighting organised crime or terrorism specifically – as necessary EU responses, with the Action Plans thus calling for (and at times facilitating) the adoption of measures having a much broader scope and which were justified as essential to fight organised crime or terrorism. As will be seen in a number of occasions in this book, the fight against terrorism rationale justified and led to the swift adoption of measures as disparate as the Framework Decision on the European Arrest Warrant,171 the Decision establishing Eurojust,172 and a series of measures boosting police cooperation between the authorities of Member States.173 Moreover, the terrorism Action Plans included measures transcending the third pillar and covering the other two pillars as well, blurring the boundaries between criminal law and the market, as well as between criminal law and foreign policy.174 Framing a wide range of 166 See in particular in this context the failure to adopt the Framework Decision on the rights of the defendant in criminal proceedings, which according to The Hague Programme should have been adopted by the end of 2005. For details on the proposal, see ch 5. 167 [1997] OJ C251/1. This was followed by the so-called ‘Millennium’ Action Plan on the Prevention and Control of Organised Crime [2000] OJ C124/1. On the Action Plan, see Mitsilegas, Monar and Rees (n 1) 88–91; see also WC Gilmore, ‘The EU Action Plan to Combat Organised Crime: The Scope and Implementation of Legal Instruments’ in E Bort and R Keat (eds), The Boundaries of Understanding. Essays in Honour of Malcolm Anderson (University of Edinburgh Social Sciences Institute, 1999) 97–106. 168 Conclusions and Plan of Action of the Extraordinary Meeting on 21 September 2001, www.consilium. europa.eu/ueDocs/cms_data/docs/pressData/en/ec/140.en.pdf. 169 See R Bossong, ‘The Action Plan on Combating Terrorism: A Flawed Instrument of EU Security Governance’ (2008) 46 Journal of Common Market Studies 27. 170 On the EU’s reaction post-9/11, see B Gilmore, The Twin Towers and the Third Pillar: Some Security Agenda Developments, EUI Working Paper Law No 2003/7; and S Douglas-Scott, ‘The Rule of Law in the European Union: Putting the Security into the “Area of Freedom, Security and Justice”’ (2004) 29 European Law Review 219. On the EU response to the Madrid bombings see House of Lords European Union Committee, After Madrid: The EU’s Response to Terrorism, 5th Report, session 2004–05, HL Paper 53. 171 See ch 4. 172 See ch 8. 173 See ch 9. 174 On the nexus between criminal law and the market in EU counter-terrorism efforts, in particular in the context of the fight against terrorist finance, see V Mitsilegas and B Gilmore, ‘The EU Legislative Framework against Money Laundering and Terrorist Finance: A Critical Analysis in the Light of Evolving Global Standards’

The Politics of the Third Pillar 27 measures as essential to fighting terrorism, responding to terrorist attacks with further calls for EU legislation, and revising the relevant Action Plans regularly have all contributed to the adoption of a wide range of EU criminal law measures in the recent past. In examining the outcome of this strategy, two major issues arise: the issue of securitisation and the issue of scrutiny and transparency in the shaping of law and policy. On the first issue, an examination of the sectoral Action Plans on organised crime and terrorism, but also of the general five-year programmes, in particular the Hague Programme, reveals that the primary emphasis of the development of EU action was on security.175 In terms of the sectoral Action Plans, such emphasis is perhaps unsurprising given the fact that, at least in terms of political discourse, these initiatives were the outcome of a securitisation process constituting blueprints for urgent responses to threats perceived to be in need of imminent combat. In terms of action to combat terrorism, the increasing blurring of boundaries between pillars – in particular, the second and third pillars – leads to important issues of accountability and judicial control.176 Moreover, this process of securitisation seeped through the formulation of the general EU strategy on criminal law. A prime example of such spill-over has been the Hague Programme: much less coherent than Tampere, large sectors of the Programme were devoted to specific issues such as boosting of operational action and cooperation, the exchange of personal data for police purposes and the development of interagency cooperation for security purposes.177 On the contrary, The Hague Programme included much less with regard to the protection of fundamental rights in this context. The other matter of concern in the development of the EU policy – and subsequently legislative – agenda in criminal matters, especially in the light of the increasing securitisation in the field, was the lack of detailed scrutiny and transparency of the action of the European Council. While there was, at least with regard to general programmes such as the Hague Programme, some intervention by the EU institutions (and national parliaments) prior to the final adoption of the final documents,178 the development of avenues of meaningful, detailed and open debate on the direction of EU criminal law left much to be desired. In this context, the process of formulating the Stockholm Programme that followed The Hague Programme in 2009 is noteworthy: the process was driven by interior ministers of a number of Member States, who constituted a ‘Future Group’ to prepare recommendations to influence the formulation of the new Programme.179 (2007) 56 International and Comparative Law Quarterly 119; on the nexus between the second and third pillars, see J Monar, ‘Common Threat and Common Response? The European Union’s Counter-terrorism Strategy and its Problems’ (2007) 42 Government and Opposition 292. 175 On Tampere, see the warnings in an editorial entitled ‘The Tampere Summit: The Ties that Bind or the Policemen’s Ball’ (1999) 36 CML Rev 1119; on security and the Hague Programme, see in particular Bigo (n 164) and Mitsilegas (n 164). 176 On judicial control with regard to cross-pillar measures involving the second and third pillars, see above. On the cross-pillar aspect of inter-agency cooperation, see ch 4. 177 On these aspects, see chs 8 and 9. 178 See, for instance, the pre-Hague Commission Communication entitled Area of Freedom, Security and Justice: Assessment of the Tampere Programme and Future Orientations, COM (2004) 401 final, Brussels, 2 June 2004. For examples of national parliamentary scrutiny, see the House of Lords EU Committee Reports on Tampere and The Hague. 179 The Future Group, created in 2007 after the proposal of the German government and the Commission, was co-chaired by the Vice President of the Commission responsible for Justice and Home Affairs and the Minister of the Interior of the acting EU presidency. It brought together the Ministers of the Interior

28 History, Principles and Institutions The dominance of the interior ministries agenda in this context is evident, with the absence of justice ministers being striking.180 More broadly of course, it is clear that the development of key guidelines for future law and policy was largely taking place behind closed doors, mostly involving experts and government officials.

B. Action Outside the EU Framework Issues of transparency and democratic control also arose in instances where the primary impetus for the development of EU law and policy in criminal matters came from outside the EU framework. A prime example of this process has been Schengen. As was mentioned earlier in this chapter, the Schengen Agreement and Convention and their implementing measures were adopted by certain EU Member States outside the Community – and then the EU – law framework. In Amsterdam, the Schengen acquis was effectively imported into the EC/EU legal order, which had to accommodate as a fait accompli a complex legal framework – and a potent logic of compensatory measures – which had been agreed and developed with a minimum of transparency, and outside the EU scrutiny mechanisms.181 Even post-EU incorporation, fundamental aspects of the Schengen mechanism – in particular judging whether a country meets the criteria for becoming a full Schengen member – remained (and continue to remain) essentially intergovernmental, with membership being subject to the agreement of the existing Schengen full members.182 A similar example of action à la Schengen was the recent efforts to introduce the Prüm Convention into EU law, which was concluded by a number of EU Member States again outside the EU framework.183 As with Schengen, far-reaching standards agreed outside the EU framework were introduced into the EU with minimal scrutiny and consultation, in that case by the Council as third pillar legislator, rather than by Member States in the IGC. The Prüm Convention is perhaps more

of the two current trios of presidencies (Germany, Portugal and Slovenia; France, the Czech Republic and Sweden) and a representative of the future presidency trio; it is thus evident that not all Member States took part. Further participants were a common law observer (the UK), the President of the European Parliament Civil Liberties Committee and a representative of the Council General Secretariat. On the setting-up of the Future Group, see M Niemeier, La Sécurité Intérieure dans l’Union Européenne: Après la Présidence Allemande et Avant la Présidence Francaise, Université Robert Schuman, Strasbourg, Collection Securint, Working Paper No 6, 2008. 180 A parallel ‘Future Group’ on Justice was also established in 2007 at the initiative of the Portuguese EU presidency.; the membership logic was similar to the ‘police’ future group. Issues arising from interior and justice ministries were thus seemingly not integrated into a single discussion forum, but discussed separately. Both Reports were discussed at the Justice and Home Affairs Council of 24–25 July 2008 (Council Doc 11653/08 Presse 205) 18 and 24. 181 With the decision on the integration of the Schengen acquis into the Community/Union framework being taken at the 1996 IGC. It is noteworthy that the Schengen Protocol containing rules on the allocation of the acquis in the respective pillars did not provide any role for the European Parliament; see in this context, and more generally on the implications of Schengen and Prüm for the EU democratic deficit, A Weyembergh and V Santamaria, ‘Le Contrôle Démocratique dans l’Espace Pénal Européen’ in M Doni and L.S Rossi, Démocratie, Cohérence et Transparence. Vers une Constitutionnalisation de l’Union Européenne? (Institut d’Etudes Européennes, 2008) 73–92. 182 On the basis of peer reviews conducted by Member States; on these reviews in the context of the increased centrality of evaluation mechanisms in EU criminal law, see the part on the Lisbon Treaty below. 183 On Prüm, see chapter 9.

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 29 striking, in that it arose in a period where European integration in criminal matters had somewhat matured, and the need for greater transparency and democratic control was ascertained repeatedly in the context of the EU constitutional debate.184 Even at this stage of European integration, it seems that the big countries are happy to lead the way outside the EU framework, subject to minimal scrutiny. This happened in particular in the context of the meetings of the G6, namely the UK, France, Germany, Italy, Spain and Poland. At regular meetings, the interior ministers of these countries discussed matters of common interest and reached agreement in principle on fundamental home affairs choices which could subsequently be imported – on the basis of the political strength of the G6 within the EU legal framework. A prime example of such a strategy was the consensus on the need to maximise the exchange of personal data at a meeting at the German Baltic resort of Heiligendamm – a meeting, which as the House of Lords European Union Committee has noted, took place ‘behind closed doors’.185

VI. The Lisbon Treaty and the Constitutionalisation of EU Criminal Law: Institutions, Principles and Rights The entry into force of the Lisbon Treaty constituted a major step towards the constitutionalisation of EU criminal law. The term ‘constitutionalisation’ is understood here within the meaning put forward by Loughlin as the attempt to subject all governmental action within a designated field to the structures, processes, principles and values of a ‘constitution’.186 In the field of EU law, the constitutionalisation of EU criminal law must be viewed from a number of different perspectives, which will be outlined below: from the perspective of the institutional normalisation of decision-making which the post-Lisbon abolition of the third pillar entails; from the perspective of the full application in the field of EU criminal law of the constitutional principles of EU law; and from the perspective of underpinning EU criminal law by a constitutional framework of fundamental rights protection, most notably via the constitutionalisation of the EU Charter of Fundamental Rights in the Lisbon Treaty. The examination of the constitutionalisation of EU criminal law from these perspectives will be accompanied by an analysis of two factors embedding further EU action in the field within the broader EU constitutional framework: the growing emphasis on the correct implementation of EU criminal law by Member States and the enhanced mechanisms for scrutiny and monitoring such implementation at the EU level; and the increased interdependence of various areas of criminal law leading to the emergence of a coherent legal framework on EU criminal justice. As will be seen below, such interdependence appears at the level of interconnection between various EU strands of action, but also – and importantly – at the level of the relationship between EU law and national law, including national constitutional law. 184 On calls for further ‘communautarisation’ of the third pillar, see section VI below. 185 House of Lords European Union Committee, Behind Closed Doors: The Meeting of the G6 Interior Ministers at Heiligendamm, 40th Report, session 2005–06, HL Paper 221. 186 M Loughlin, ‘What is Constitutionalisation?’ in P Dobner and M Loughlin (eds), The Twilight of Constitutionalism? (Oxford University Press, 2010) 47–72.

30 History, Principles and Institutions

A. Institutions The entry into force of the Lisbon Treaty has radically changed the institutional framework underpinning EU criminal law by granting – with few exceptions – EU institutions their full powers in the field and moving to a system of supranational decision-making. The full powers of EU institutions have applied since the entry into force of the Lisbon Treaty vis-a-vis legislation adopted after Lisbon, and from 1 December 2014 (the end of the transitional period provided in the Treaty Protocol on Transitional Provisions)187 for pre-Lisbon third pillar law remaining in force. The first major institutional change involves decision-making, which, for the vast majority of Title V (former Title VI) measures, takes place under the ‘ordinary’ legislative procedure,188 namely co-decision between the Council (which decides by majority voting) and the European Parliament.189 This change has been accompanied by a normalisation of the legal instruments of EU criminal law post-Lisbon, which now take the form of Regulations, Directives, and Decisions.190 The second major institutional change involves the role of the Court of Justice and the ‘communautarisation’ of judicial control. The Court has now full jurisdiction to rule on infringement proceedings in criminal matters.191 The full jurisdiction of the Court in the field of preliminary rulings now applies.192 It has also assumed full jurisdiction to hear actions for compensation for damages193 and the review of legality;194 to review the compliance of legislative acts with the principle of subsidiarity;195 and to review the legality of acts of the European Council and bodies, offices or agencies of the EU intended to produce legal effects vis-a-vis third parties.196 The third major change involves the role of the Commission, which emerges having stronger powers of initiative (albeit still shared with Member States)197 and full powers as ‘guardian of the Treaties’ to monitor the implementation of EU criminal law by

187 Protocol No 36. For an analysis, see section VIII.D on enhanced cooperation below. 188 Exceptions include the adoption of legislation establishing a European Public Prosecutor’s Office under art 86(1) TFEU, which requires unanimity in the Council and the consent of the European Parliament; the adoption of measures on operational cooperation in the field of policing under art 87(3) TFEU, which requires unanimity in the Council and the mere consultation of the European Parliament; the adoption of rules on the operation of national authorities in another Member State in cases of cross-border police and judicial cooperation in criminal matters, which requires unanimity in the Council and consultation of the European Parliament (art 89 TFEU); and the adoption of minimum EU rules in areas of criminal procedure not mentioned in the Treaty which requires unanimity in the Council and the consent of the European Parliament (art 82(2)(d)). In arts 86(1) and 87(3) TFEU, lack of unanimity does not preclude the adoption of legislation under enhanced cooperation. 189 On the ‘ordinary’ legislative procedure see arts 289(1) and 294 TFEU. 190 Article 288(1) TFEU. 191 Articles 258–60 TFEU. 192 On the preliminary ruling jurisdiction under Lisbon, see art 267 TEU. The last paragraph states that such rulings must be given with a minimum of delay in cases involving individuals in custody. 193 Article 268 TFEU. 194 Article 263(4) TFEU. 195 Article 8, Protocol No 2 on the Application of the Principles of Subsidiarity and Proportionality. For further analysis, see below. 196 Article 263(1) TFEU. See also art 277 TFEU. 197 See art 76 TFEU. For further analysis, see section VIII.A on national diversity below.

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 31 Member States.198 The full involvement of EU institutions has had a significant impact on the content, enforcement and development of EU criminal law. The stronger role of the European Parliament in the decision-making process serves to address democratic deficit concerns and may serve to enhance the protection of fundamental rights in the content of secondary EU criminal law adopted post-Lisbon.199 The full involvement of the Commission as guardian of the treaties and the possibility of instituting infringement proceedings will lead to a greater focus on the correct and timely implementation of EU criminal law, including third pillar law.200 On the other hand, allowing courts of all Member States to send questions on the interpretation of EU law to the Court of Justice in Luxembourg on third pillar measures will have a beneficial effect on the development and interpretation of the EU third pillar acquis, especially in cases where national courts seek recourse to the Court of Justice in order to assist with the interpretation of key third pillar law concepts.201

B. Principles i. Direct Effect The constitutionalisation of EU criminal law is also inextricably linked to the full application of the constitutional principles of EU law in the field. A major development post-Lisbon has been the change in the legislative instruments of EU criminal law, with Directives being the main instrument of EU legislative intervention in the field. The use of Directives post-Lisbon means that the principle of direct effect is now applicable to EU criminal law Directives if the conditions of its application are fulfilled. Despite the limits set out by the Court of Justice regarding the application of direct effect in cases involving substantive criminal law,202 the Court has found that a Treaty provision related to criminal law – Article 325 of the Treaty on the Functioning of the European Union (TFEU) – does have direct effect.203 This finding has been further reiterated in MAS and MB (Taricco II)204 and Kolev,205 where the Court explained that ‘that article imposes on the Member States precise obligations, as to the result to be achieved, which are not subject to any condition regarding the application of the rules which that article lays down’.206 Whereas the primary responsibility lies with the national legislature to

198 In particular under art 258 TFEU. The TFEU also introduces in art 70 a more intergovernmental process of evaluation of implementation of Title V policies conducted by Member States in collaboration with the Commission. 199 For an assessment, see V Mitsilegas and N Vavoula, ‘Criminal Law: Institutional Rebalancing and Judicialisation as Drivers of Policy Change’ in F Trauner and A Ripoll Servent (eds), Policy Change in the Area of Freedom, Security and Justice: How EU Institutions Matter (Routledge, 2015) 133–51. 200 See, for instance, the Commission scrutiny of the post-Lisbon defence rights Directives; see ch 5. 201 For further details, see section B below. 202 See Cases C-387/02, C-391/02 and C-403/02, Berlusconi [2005] ECR I-3565. 203 Case C-105/14, Taricco and Others, EU:C:2015:555, para 51. 204 Case C-42/17, MAS and MB, EU:C:2017:936 (Taricco II). 205 Case C-612/15, Kolev and Others, ECLI:EU:C:2018:392. 206 ibid paras 38 and 64 respectively.

32 History, Principles and Institutions adopt the measures necessary to meet those obligations,207 the referring courts must also, without waiting until the national legislation is amended by legislation or by any other constitutional procedure, give full effect to those obligations by interpreting that legislation so far as possible in the light of Article 325(1) TFEU, as interpreted by the Court or, as necessary, disapplying that legislation.208 Moreover, the application of the principle of direct effect may increasingly come into force in view of the change in the content of EU criminal law post-Lisbon, with the Treaty now providing an express legal basis – Article 82(2) TFEU – which has led to the adoption of EU secondary law conferring rights to individuals in criminal proceedings. It is submitted that key provisions in these instruments – including the provision of key rights on access to a lawyer, to a translator and to an interpreter – do entail direct effect, enabling individuals to claim these rights before national courts and thus ensuring the decentralised enforcement of EU criminal law.209

ii. Indirect Effect With regard to the principle of indirect effect after Lisbon, the seminal ruling in Pupino, as examined above, was confirmed in a series of cases concerning the interpretation of the European Arrest Warrant. In Da Silva Jorge,210 the Court was faced with a preliminary reference issued by the French Court of Appeal of Amiens regarding the optional ground for refusing to execute a European Arrest Warrant, under which the executing judicial authority may refuse to execute such a warrant where the requested person ‘is staying in, or is a national or a resident of, the executing Member State’, and that Member State undertakes to enforce that sentence in accordance with its domestic law. The ground was introduced to give particular weight to the possibility of increasing the requested person’s chances of reintegrating into society when the sentence imposed on him expires. Da Silva Jorge resided in France and was married to a French national, but the French legislation restricted the scope of the optional ground to French nationals only. The Court opined that a differentiated treatment between French nationals and nationals of other EU Member States cannot be sustained,211 and that irrespective of the national provisions transposing the European Arrest Warrant Framework Decision that may delimit the scope of the optional ground, nationals of other Member States staying or residing in the national territory cannot be excluded automatically and absolutely irrespective of their connections with it. The principle of indirect effect was key in this context, with the Court highlighting the interpretative duty of the national courts to 207 See ibid para 65, where the Court explained that: ‘The primary responsibility lies with the national legislature to adopt the measures necessary to meet those obligations. It is therefore for the national legislature, where required, to amend the legislation and to ensure that the procedural rules applicable to the prosecutions of offences affecting the financial interests of the European Union are not designed in such a way that there arises, for reasons inherent in those rules, a systemic risk that acts that may be categorised as such offences may go unpunished, and also to ensure that the fundamental rights of accused persons are protected.’ 208 ibid para 66. 209 For confirmation of this point by national constitutional courts and by the CJEU, see ch 5. 210 Case C-42/11 João Pedro Lopes Da Silva Jorge, ECLI:EU:C:2012:517. For further details, see ch 7. 211 ibid para 50

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 33 take into consideration not only the provisions intended to transpose the Framework Decision, but also: [T]he principles and provisions of domestic law governing the conclusions which a court is entitled to draw from the existence of discrimination prohibited under that law, and in particular the principles and provisions enabling that court to alleviate such discrimination until the legislature has taken the measures necessary to eliminate it.212

To that end, the Court took the view that the national court should examine – on the basis of an overall assessment of the objective factors characterising the situation of the requested person – whether there are sufficient connections between the person and the executing Member State, in particular family, economic and social connections, such as to demonstrate that the person requested is integrated into that Member State, so that he is in fact in a comparable situation to that of a national.213 In Da Silva Jorge, the principle of indirect effect as interpreted by the Court led to surrounding the requested person with a protective net, taking into account his personal circumstances to effectively disapply the restrictive French provision and benefit from the more holistic and fundamental rights friendly approach taken in the Framework Decision. As such, the effect of the principle in this context was not towards the maximisation of enforcement as in Pupino, but rather towards broadening the scope of protection to EU nationals who may rely directly on the optional ground even when the national law excludes them from its protective function. However, this does not signify a shift in the Court’s jurisprudence; the judgments in Ognyanov and Poplwaski mark a return to the enforcement approach echoed in Pupino. In Ognyanov,214 the Court was faced with questions on the interpretation of Article 17(1) and (2) of Council Framework Decision 2008/909/JHA on the mutual recognition of judgments imposing custodial sentences.215 The case involved a Bulgarian national, who, having served part of his sentence in Denmark, was transferred to Bulgaria, with the issue arising as to whether a reduction of his sentence by reason of work carried out in custody was possible based on Bulgarian law, although Danish legislation precluded this from being so. The Court found that the obligation to interpret national law in conformity with EU law is ‘inherent’ in the system of the TFEU, since it permits national courts, for the matters within their jurisdiction, to ensure the full effectiveness of EU law when they rule on the disputes before them.216 Drawing from its findings in Pupino and Da Silva Jorge, the Court reiterated that the principle of indirect effect is limited by general principles of EU law, in particular the principle of legal certainty and non-retroactivity, which preclude the

212 ibid para 57. 213 ibid para 58. 214 Case C-554/14 Atanas Ognyanov ECLI:EU:C:2016:835. 215 Council Framework Decision 2008/909/JHA of 27 November 2008 on the application of the principle of mutual recognition to judgments in criminal matters imposing custodial sentences or measures involving deprivation of liberty for the purpose of their enforcement in the European Union [2008] OJ L327, 5 December, 27. 216 Ognyanov (n 214) 59.

34 History, Principles and Institutions determination or aggravation of criminal liability of individuals.217 The Court held that the obligation to interpret national law in conformity with EU law would mean that Mr Ognyanov cannot qualify, under Bulgarian law, for a reduction in sentence by reason of work carried out during his period of detention in Denmark, because that matter is wholly within the competence of Denmark. However, that obligation would not cause the criminal liability of Mr Ognyanov to be determined or aggravated, or alter, to his disadvantage, the length of the sentence imposed on him in the judgment in Denmark.218 In addition, the principle cannot serve as the basis for an interpretation of national law contra legem.219 The requirement to interpret national law in conformity with EU law includes the obligation, on national courts, including those ruling as courts of last instance, to alter, where necessary, settled case law if that case law is based on an interpretation of national law that is incompatible with the objectives of a Framework Decision.220 In the present case, since the interpretation towards a reduction of sentence by reason of work carried out in custody stemmed from interpretation of Bulgarian legislation by the Supreme Court of Appeal, the practical effect of the applying the principle would be to disapply that interpretation on its own authority. These findings were further reiterated in the case of Poplawski,221 which concerned the interpretation of the optional ground of the European Arrest Warrant Framework for non-execution in favour of persons residing in the territory of the requested Member State. The Court took note of its findings in the previous cases222 and stated that the obligation for the Netherlands to execute the European Arrest Warrant or, in the event of a refusal, to execute the sentence pronounced by the Polish authorities did not determine or aggravate Mr Poplawski’s liability, which stemmed from the Polish judgment.223 As such, the competent national court, by taking the whole body of domestic law into consideration and applying the interpretative methods recognised by it, is obliged to interpret the provisions of national law at issue, so far as possible, in the light of the wording and the purpose of the Framework Decision.224 In the present case, this means that when a Member State refuses to execute a European Arrest Warrant, the judicial authorities of the executing Member State are themselves required to ensure that the sentence pronounced against that person is actually executed.225

217 ibid paras 63–64. 218 ibid para 65. 219 ibid para 66. 220 ibid para 67. 221 Case C-519/15 Daniel Adam Popławski, ECLI:EU:C:2017:503. 222 ibid paras 25–36. 223 ibid para 37. 224 See also the follow-up ruling in Poplawski II, where the CJEU held that the principle of the primacy of EU law does not require a national court to disapply a provision of national law which is incompatible with the provisions of a Framework Decision, the legal effects of which are preserved in accordance with art 9 of Protocol (No 36) on transitional provisions, annexed to the treaties, since those provisions do not have direct effect – the authorities of the Member States, including the courts, are nevertheless required to interpret their national law, to the greatest extent possible, in conformity with EU law, which enables them to ensure an outcome that is compatible with the objective pursued by the Framework Decision concerned. See Case C-573/17 Poplawski II ECLI:EU:C:2019:530. 225 ibid para 43.

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 35

iii. Primacy, Effectiveness and Constitutional Identity: From Melloni to Taricco A key question following the entry into force of the Lisbon Treaty has been whether EU criminal law, including secondary law, has primacy over national law, including national constitutional law. The CJEU has confirmed primacy in two different strands of case law: in the Melloni litigation, the CJEU confirmed the primacy of EU secondary law on mutual recognition in criminal matters (the Framework Decision on the European Arrest Warrant) over national constitutional law); and in the Taricco litigation, the CJEU evoked primacy based on Article 325 TFEU on the protection of the EU’s financial interests. In both cases, primacy was linked with the effectiveness of EU law, with the Court emphasising in Taricco in particular the link between giving effect to primacy and the disapplication of domestic law. However, both Melloni and Taricco raised serious constitutional identity concerns in EU Member States,226 leading to a judicial backlash from national constitutional courts. The interplay between primacy and constitutional identity in the case of Melloni,227 where the CJEU confirmed the applicability of the principle of primacy of secondary EU third pillar law over national constitutional law, will be analysed in detail elsewhere in this volume,.228 This chapter will focus more extensively on the Taricco litigation and the lessons it provides for the relationship between primacy, effectiveness and disapplication on the one hand and national constitutional identity concerns on the other. In the first Taricco case,229 the key question that the Court of Justice decided to answer was the extent to which national rules in relation to limitation periods for criminal offences in Italy were in compliance with EU law, and in particular with EU law on the protection of the EU’s financial interests. The Court followed a three-step approach to answer this question: first, it identified specific EU law obligations in the field; second, it determined the effect of these obligations on national law; and, third, it assessed the compatibility of compliance by national authorities with these obligations with fundamental rights and, in particular, with the principle of legality. In terms of the first step, namely the identification of specific EU law obligations, the Court established such obligations as emanating from both secondary and primary EU law. On the one hand, the Court found (by reference to its ruling in Fransson)230 that Directive 2006/112, read in conjunction with Article 4(3) TEU on the principle of loyal cooperation, imposes on Member States ‘not only … a general obligation to take all legislative and administrative measures appropriate for ensuring collection of all the VAT due on their territory,

226 For a view of constitutional identity understood as the product of an interactive process creating or interpreting constitutional sources see G van der Schyff, ‘Member States of the European Union, Constitutions, and Identity: A Comparative Perspective’ in C Callies and G van der Schyff (eds), Constitutional Identity in a Europe of Multilevel Constitutionalism (Cambridge University Press 2020) 328. For a critical view of the use of constitutional identity by national courts as a means of attacking the supremacy of EU law, see F Fabbrini and A Sajo, ‘The Dangers of Constitutional Identity’ (2019) 25 European Law Journal 457. 227 Case C-399/11, Melloni v Ministerio Fiscal, ECLI:EU:C:2013:107. 228 See ch 4. 229 Taricco and Others (n 203). 230 Case C-617/10, Åklagaren v Åkerberg Fransson, EU:C:2013:105, para 25.

36 History, Principles and Institutions but … also fight against tax evasion’.231 Furthermore, also by reference to Fransson, the Court reiterated that: Article 325 TFEU itself obliges the Member States to counter illegal activities affecting the financial interests of the European Union through effective deterrent measures and, in particular, obliges them to take the same measures to counter fraud affecting the financial interests of the European Union as they take to counter fraud affecting their own interests.232

Again, this stressed the importance of the principle of assimilation.233 The Court recalled its finding in Fransson that: [T]here is … a direct link between the collection of VAT revenue in compliance with the EU law applicable and the availability to the EU budget of the corresponding VAT resources, since any lacuna in the collection of the first potentially causes a reduction in the second. (Emphasis added)234

The Court noted that: Although the Member States have freedom to choose the applicable penalties … in order to ensure that all VAT revenue is collected and, in so doing, that the financial interests of the European Union are protected in accordance with the provisions of Directive 2006/112 and Article 325 TFEU … criminal penalties may nevertheless be essential to combat certain serious cases of VAT evasion in an effective and dissuasive manner. (Emphasis added)235

The Court further recalled the duty of Member States: [U]nder Article 2(1) of the PFI Convention … to take the necessary measures to ensure that conduct constituting fraud affecting the European Union’s financial interests is punishable by effective, proportionate and dissuasive criminal penalties, including, at least in cases of serious fraud, penalties involving deprivation of liberty.236

In a move which is also significant for the determination of the mandate of the E uropean Public Prosecutor’s Office (EPPO),237 the Court further found that the concept of ‘fraud’ as defined in Article 1 of the PFI Convention ‘covers revenue derived from applying a uniform rate to the harmonised VAT assessment bases determined according to EU rules’, a conclusion which ‘cannot be called into question by the fact that VAT is not collected directly for the account of the European Union’.238 The Court confirmed that the offences in the present case (inter alia, conspiracy to commit offences in relation to VAT and VAT evasion amounting to several million euros) ‘constitute cases of serious fraud affecting the European Union’s financial interests’,239 and confirmed that ‘such cases of serious fraud are punishable by criminal penalties which are, in particular, effective and dissuasive’ and that ‘the measures adopted in that respect must be the

231 Taricco

and Others (n 203) para 36. (n 230) para 26. 233 ibid para 37. 234 ibid para 38. 235 ibid para 39. 236 ibid para 40. 237 For an analysis, see ch 8. 238 Fransson (n 230) 41. 239 ibid para 42. 232 Fransson

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 37 same as those which the Member States adopt in order to combat equally serious cases of fraud affecting their own financial interests’.240 Having established obligations under EU law, the Court went on to spell out the effect of these obligations on national authorities. It noted that ‘the national provisions at issue … have the effect, given the complexity and duration of the criminal proceedings leading to the adoption of a final judgment, of neutralising the temporal effect of an event interrupting the limitation period’.241 Crucially, it added that: [I]f the national court concludes that the application of the national provisions in relation to the interruption of the limitation period has the effect that, in a considerable number of case[s], the commission of serious fraud will escape criminal punishment, since the offences will usually be time-barred before the criminal penalty laid down by law can be imposed by a final judicial decision, it would be necessary to find that the measures laid down by national law to combat fraud and any other illegal activity affecting the financial interests of the European Union could not be regarded as being effective and dissuasive, which would be incompatible with Article 325(1) TFEU, Article 2(1) of the PFI Convention as well as Directive 2006/112, read in conjunction with Article 4(3) TEU.242 … In the event that the national court concludes that the national provisions at issue do not satisfy the requirement of EU law that measures to counter VAT evasion be effective and dissuasive, that court would have to ensure that EU law is given full effect, if need be by disapplying those provisions and thereby neutralising the consequence referred to in paragraph 46 above, without having to request or await the prior repeal of those articles by way of legislation or any other constitutional procedure. (Emphasis added)243

The Court stressed in this context that: [T]he Member States’ obligation to counter illegal activities affecting the financial interests of the European Union through dissuasive and effective measures, and their obligation to take the same measures to counter fraud affecting those interests as they take to counter fraud affecting their own financial interests, are obligations imposed, inter alia, by EU primary law, namely Article 325(1) and (2) TFEU.244 Those provisions of EU primary law impose on Member States a precise obligation as to the result to be achieved that is not subject to any condition regarding application of the rule, which they lay down.245 The provisions of Article 325(1) and (2) TFEU therefore have the effect, in accordance with the principle of the precedence of EU law, in their relationship with the domestic law of the Member States, of rendering automatically inapplicable, merely by their entering into force, any conflicting provision of national law.246

Thus, the Court here confirmed that Article 325 TFEU has direct effect and primacy over national law, which leads to the disapplication of conflicting national law.

240 ibid

para 43. para 46. para 47. 243 ibid para 49. 244 ibid para 50. 245 ibid para 51. 246 ibid para 52. 241 ibid 242 ibid

38 History, Principles and Institutions In the third step of its response to the national court, the Court of Justice found that the disapplication of the national provisions in question would be compatible with the principle of legality as enshrined in Article 49 of the Charter of Fundamental Rights. [T]he sole effect of the disapplication of the national provisions at issue would be to not shorten the general limitation period in the context of pending criminal proceedings, to allow the effective prosecution of the alleged crimes, and to ensure, if necessary, that penalties intended to protect the financial interests of the European Union and those intended to protect the financial interests of the Italian Republic are treated in the same way.247

Such a disapplication of national law: [W]ould in no way lead to a conviction of the accused for an act or omission which did not constitute a criminal offence under national law at the time when it was committed … nor to the application of a penalty which, at that time, was not laid down by national law. On the contrary, the acts which the accused are alleged to have committed constituted, at the time when they were committed, the same offence and were punishable by the same criminal penalties as those applicable at present.248 The case law of the European Court of Human Rights in relation to Article 7 [ECHR] … support[s] that conclusion. Thus according to that case law, the extension of the limitation period and its immediate application do not entail an infringement of the rights guaranteed by Article 7 of that convention, since that provision cannot be interpreted as prohibiting an extension of limitation periods where the relevant offences have never become subject to limitation.249

The judgment in Taricco has a major impact on the relationship between EU law and national criminal law. The Court confirmed in the strongest possible terms that national sovereignty in criminal matters is limited in order to ensure the effective enforcement of EU law. Taricco is significant in this context because it confirms that the obligation of national authorities to disapply national law may stem directly from a Treaty provision which is seen as having direct effect. Effectively, the Court here granted the principle of assimilation, as enshrined in Article 325 TFEU, direct effect. It has thus sent a very powerful message regarding the obligation of Member States to ensure the effective protection of the EU budget.250 It confirmed that Article 325 TFEU has direct effect and primacy over national law, thereby placing obligations on national authorities to ensure the effectiveness of the fight against fraud in the strongest possible terms. Taricco is also of broader significance in confirming the inclusion of VAT fraud within the scope of the PFI Convention and had an impact in the inclusion of VAT within the scope of the post-Lisbon EU Directive on fraud, which in turn forms the basis for the mandate and competence of the EPPO.251 However, the significance of Taricco is broader than strictly 247 ibid para 55. 248 ibid para 56. 249 ibid para 57, omitting references to Coëme and Others v Belgium, App Nos 32492/96, 32547/96, 32548/96, 33209/96 and 33210/96, § 149, ECHR 2000-VI; Scoppola v Italy (No 2) [GC], App No 10249/03, § 110 and the case law cited therein, 17 September 2009; and OAO Neftyanaya Kompaniya Yukos v Russia, App Nos 14902/04, §§ 563, 564 and 570 and the case law cited therein, 20 September 2011. 250 See also the Opinion of Advocate General Kokott, who called for the referring court to refrain from applying a provision if that provision were to reflect a ‘systemic shortcoming’ which prevents the achievement of an outcome consistent with EU law – Opinion delivered on 30 April 2015, para 11. 251 For details, see chs 2 and 8.

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 39 the field of the protection of the EU’s financial interests. The Court has opened the door for the disapplication of national law which is not in compliance with the achievement of objectives contained in primary law provisions when these provisions are deemed to impose precise obligations, thus extending the principle of functional criminalisation at the level of national enforcement. It remains to be seen whether the Taricco approach will be applicable with regard to Treaty provisions which, unlike Article 325 TFEU, do not necessarily include references to the principle of assimilation. Last, but not least, Taricco has a very significant impact on domestic criminal justice choices and the protection of fundamental rights. In a manner reminiscent of its case law in Pupino252 and Advocaten voor de Wereld,253 the Court narrowly interpreted the scope of substantive criminal law, finding that the principle of legality is not affected because the national provisions in question (here on limitation periods) do not involve substance, but procedure. However, there is a very thin line between substance and procedure in this context, and Taricco has the effect of effectively overturning domestic criminal justice choices, and in this manner lowering the level of fundamental rights protection at the national level in the name of the effective fight against fraud. The Court’s ruling in Taricco I caused a commotion in Italy. It has resulted in a vivid academic debate and critique,254 and in a flurry of litigation in domestic courts, culminating in an intervention by the Italian Constitutional Court,255 a further ruling by Luxembourg and further debate and critique.256 Rather than electing to have the final say on the issue – with the likely outcome that the Constitutional Court would find EU law as interpreted by the CJEU in Taricco contrary to the Italian Constitution, thereby instigating a direct constitutional clash between the two Courts – the Constitutional Court decided to refer the case back to Luxembourg in the form of a reference for a preliminary ruling.257 The core of this reference was the compatibility of the ruling in Taricco I with the principle of legality. The Italian Constitutional Court stated unequivocally that it was convinced that an individual could not have reasonably considered, prior to the judgment given in the Taricco case, that Article 325 TFEU required the courts to disregard the relevant articles of the Italian Criminal Code in situations in which this would have resulted in an exemption from punishment in a considerable

252 Case C-105/03 Pupino [2005] ECR I–5285. For an analysis, see V Mitsilegas, ‘Constitutional Principles of the European Community and European Criminal Law’ (2006) 8 European Journal of Law Reform 301. 253 See in particular Advocaten voor de Wereld VZW v Leden van de Ministerraad and the Court’s departure from Advocate General Sharpston’s Opinion in Radu; for an analysis, see ch 4. 254 See A Bernardi (ed), I Controlimiti (Jovene Editore, 2017). 255 See F Vigano, ‘Supremacy of EU Law vs (Constitutional) National Identity: A New Challenge for the Court of Justice from the Italian Constitutional Court’ (2017) 7 European Criminal Law Review 103. 256 S Manacorda, ‘The Taricco Saga: A Risk or an Opportunity for European Criminal Law?’ (2018) 9 New Journal of European Criminal Law 4; V Manes, ‘Some Lessons from the Taricco Saga’ (2018) 9 New Journal of European Criminal Law.12; F Viganò, ‘Melloni Overruled? Considerations on the “Taricco II” judgment of the Court of Justice’ (2018) 9 New Journal of European Criminal Law, 18–23; R Sicurella, ‘Effectiveness of EU Law and Protection of Fundamental Rights: The Questions Settled and the New Challenges after the ECJ Decision in M.A.S. and M.B. Case (C-42/17)’ (2018) 9 New Journal of European Criminal Law 24; F G iuffrida, ‘Taricco Principles beyond Taricco: Some Thoughts on Three Pending Cases (Scialdone, Kolev, Menci)’ (2018) 9 New Journal of European Criminal Law 31; V Mitsilegas, ‘Judicial Dialogue in Three Silences’ (2018) 9 New Journal of European Criminal Law 38; V Manes and M Caianiello, Introduzione al Diritto penale Europeo. Fonti, Metodi, Istituti, Casi (Giappichelli, 2020) 25–30. 257 Italian Constitutional Court, Order No 24, 2017.

40 History, Principles and Institutions number of cases involving serious fraud.258 It considered necessary to ask whether the Court of Justice took the view that the national courts should apply the rule even where it conflicts with a supreme principle of the Italian legal system, expressly adding that it thought this was not the case.259 The Italian Constitutional Court made an explicit reference to national constitutional identity and stated its conviction (confirmation of which was sought by the Court of Justice) that the rule inferred from Article 325 TFEU was only applicable if it is compatible with the constitutional identity of the Member State, and that it falls to the competent authorities of that Member State to carry out such an assessment.260 While the approach of the Italian Constitutional Court may be viewed as being in direct contrast to the CJEU approach in Taricco I, a more careful reading of the ruling reveals a more conciliatory approach.261 The Italian Constitutional Court seemed to be at pains to confirm the CJEU emphasis on upholding the effectiveness of Article 325 TFEU. It stated that ‘it is certainly not for this Court to attribute to Article 325 TFEU a meaning different from that which it was found to have by the Court of Justice; it is in fact its duty to take note of that meaning and to decide whether it could have been appreciated by the individual who carried out the acts of relevance under criminal law’.262 The Court added that it did not doubt that the rule applies to the systematic impunity which the legal rules governing the suspension of limitation periods entails for tax fraud, but added that the concept remains by its very nature ambiguous, and in any case cannot be substantiated through interpretation.263 The Court confirmed explicitly that it cannot be excluded that national law can and must be disregarded if this is required in specific cases by European law.264 In distinguishing Taricco I from Melloni, the Italian Constitutional Court stated that it did not call into question the meaning which the Court of Justice has ascribed to Article 325 TFEU.265 The Court chose to frame its questions to Luxembourg with a focus on the compatibility of Taricco I with the principle of legality as a supreme principle of the constitutional order or an inalienable human right recognised by the national Constitution. It did not refer to Luxembourg questions relating to the interpretation of Article 325 TFEU per se, thereby confirming the CJEU’s remarkable ruling that Article 325 TFEU entails direct effect. Therein lies the second silence in this judicial dialogue, this time by the Italian Constitutional Court. In view of the framing of the questions by the Italian Constitutional Court, the CJEU was faced with an important dilemma: to insist on upholding its ruling in Taricco I tout court, emphasising the effectiveness and primacy of EU law, or to accommodate the concerns raised by the referring court on the protection of the principle of legality, thereby undermining these very principles and its own authority. In its answer to the Italian Constitutional Court (a ruling which will be referred to in this commentary

258 Point

5. 6. 260 Point 7. 261 See Mitsilegas (n 256). 262 Point 5. 263 ibid. 264 ibid. 265 Point 8. 259 Point

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 41 as Taricco II),266 the CJEU attempted a careful balancing act. It started by reiterating the key principles established in Taricco I: the direct effect of Article 325(1) and (2) TFEU;267 the duty of disapplication of national provisions incumbent upon national courts;268 and the finding that the extension of limitation period does not infringe the principle of legality.269 However, the CJEU then visibly tried to find a space to accommodate the concerns raised by the Italian Constitutional Court. It did so in four steps. The first step was to accept that there is a degree of leeway given to national authorities in view of the fact that the protection of the EU’s financial interests is a matter of shared competence within the meaning of Article 4(2) TFEU;270 the second step was to focus on the temporal element of the facts in question, stating that Italy was at the time of the proceedings free to provide that limitation rules fall under substantive criminal law – prior to EU harmonisation, which has since occurred partially via the PIF Directive;271 the third step was to reiterate the general obligation of national courts under Taricco I to respect the fundamental rights of the defendant when they have to decide to disapply national criminal law provisions272 and to restate the Fransson finding that national courts free to apply national standards provided that the level of protection provided for by the Charter, as interpreted by the Court, and the primacy, unity and effectiveness of EU law are not thereby compromised;273 and the fourth step was to give space to the national legal system to apply the principle of legality in national proceedings. The CJEU gave space to the national legal order by going into a detailed examination of the elements of the principle of legality in EU law, focusing on foreseeability, precision and non-retroactivity,274 and by stating that these requirements also apply in the Italian legal system to the limitation rules for criminal offences relating to VAT.275 It stated that it is for the national court to assess the compatibility of the obligation to disapply with the principle of legality: if the national court finds that there would be a conflict, it would not be obliged to comply with that obligation, even if compliance with the obligation allowed a national situation incompatible with EU law to be remedied.276 In this way, the CJEU allowed Italian courts to apply the principle of legality as a substantive criminal law principle defined largely under national law in proceedings occurring before the adoption of the PIF Directive. The Court thus accommodated national constitutional and criminal law concerns, while at the same time avoiding engaging with the argument of the Italian Constitutional Court regarding primacy and national constitutional identity. Nor does Taricco II include any reference to Melloni in that regard. Herein lies the third silence in the Taricco judicial dialogue, a silence which reflects a pragmatic approach and a desire to avoid head-on constitutional confrontation while leaving room

266 Taricco

II (n 204) judgment of 5 December 2017. para 38. para 39. 269 ibid para 42. 270 ibid para 43. 271 ibid para 44–45. 272 ibid para 46. 273 ibid para 47. 274 ibid para 51–57. 275 ibid para 58. 276 ibid para 59–61. 267 ibid 268 ibid

42 History, Principles and Institutions from the CJEU perspective for the application of EU constitutional law principles such as primacy and effectiveness in the future.277 The dialogue between the CJEU and the Italian Constitutional Court in the Taricco litigation can be seen as reaching a successful outcome from the perspective of both Courts. On the one hand, the Italian Constitutional Court ensured that its position on the legality principle is not jeopardised, at least for cases occurring before the adoption of the EU PIF Directive. On the other hand, the CJEU maintained (at least on paper) the basic principles put forward in Taricco I. In a spirit of mutual accommodation, based not only on the two Courts’ findings but also on their silences, a direct constitutional clash was avoided. This does not mean that every single issue arising from the Taricco litigation has been clarified. The meaning and scope of the principle of legality, and the relationship between EU law and Article 49 of the Charter of Fundamental Rights and national law remain to be further clarified. Also unclear is the impact of EU harmonisation on limitation periods on the conceptualisation of the principle of legality in national law. Moreover, the Taricco litigation leaves a number of questions unanswered regarding the effectiveness of EU and national action to combat fraud against the EU budget. The Taricco I reference can be seen as a cry for help from a lower court in Italy, with the referring judge feeling helpless in view of the way in which national law on limitation periods operated to lad to impunity for PIF offences. Italy has adopted a new law on the matter whose impact remains to be seen and whose effectiveness will be assessed not only in relation to the PIF Directive, but also in relation to Article 325 TFEU. Both the Italian Constitutional Court278 and the CJEU279 stressed the role of the legislature in addressing any shortcomings. From an EU law perspective, the European Commission has a crucial role to play in this regard in its role as guardian of the Treaties. However, ultimately, a new raft of questions and constitutional controversies may arise in the future concerning the question of who will ultimately have the final say on the compatibility of EU law requirements with national constitutional provisions: national courts or the CJEU. In the Taricco litigation, the CJEU has attempted to uphold its key findings regarding the applicability of EU law principles and obligations of national authorities to ensure the fight against impunity for violations of EU interests; at the same time, it addressed domestic concerns by creating a somewhat artificial temporal dividing line before and after harmonisation, with Member States retaining a certain amount of leeway to act in cases where the EU has not acted.280 The immediate response by the Italian Constitutional Court was not encouraging, but rather entrenched,281 with the question being dealt with from an internal balance of power rather than from an antiimpunity perspective. However, this is not a zero-sum game, as Italian domestic rules

277 Mitsilegas (n 256). 278 Point 7. 279 Taricco II (n 204) para. 41. 280 V Mitsilegas, ‘Conceptualising Impunity in the Law of the European Union’ in S Montaldo and L Marin (eds), The Fight against Impunity in EU Law (Hart Publishing, 2020) 13–45. 281 V Manes, ‘Taricco, Endgame’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Hart Publishing, 2019) 188–95.

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 43 on limitation periods have been amended to accommodate anti-impunity concerns,282 and the subsequent case law of the Italian Constitutional Court appears to be more open towards fully applying the cooperative mechanisms with the CJEU.283 The approach of the CJEU, especially in Taricco II, stresses the role of legislation more broadly in addressing both impunity and legal certainty concerns. In this manner, the fight against impunity acts once more as a driver for European integration by requiring further EU harmonising legislation. However, the fact remains that EU law obligations to ensure the effectiveness of the fight against fraud on the EU budget and to avoid impunity in this context remain even in cases where limited EU harmonisation has occurred – this is particularly the case in the field of criminal procedure, where the impact of EU law on national rules remains unclear and contested. A key question here is the extent to which national authorities must respect fundamental rights when applying their obligations to ensure the effectiveness of EU law in the context of the fight against impunity. A recent example of the CJEU’s approach has been its ruling in Kolev,284 where it focused on the conformity of national procedural measures with fundamental rights in proceedings aimed at safeguarding the EU’s financial interests. In Kolev, the CJEU extended the obligation stemming from Article 325 TFEU to ensure the effectiveness of EU law expressly in the field of criminal procedure.285 The CJEU proceeded with a delicate balancing act: on the one hand, it called upon the national legislator to amend rules when there is a systemic risk that acts that may be categorised as offences against the EU’s financial interests may go unpunished, while also ensuring that the fundamental rights of accused persons are protected;286 that the national court disapplies national law if necessary;287 and that the referring court ensures that, at the various stages of proceedings, any deliberate and abusive obstruction on the part of the defence to the proper conduct and progress of those proceedings can be overridden.288 On the other hand, the CJEU stated that fundamental rights cannot be defeated by the obligation to ensure the effective collection of the EU’s resources.289 The CJEU then focused on the requirement to protect the right of accused persons to have their case heard within a reasonable time,290 which was treated by the Court as a general principle of EU law, enshrined in Article 6(1) ECHR and in Article 47 of the Charter of Fundamental Rights.291 The Court referred to European Court of Human Rights (Strasbourg) case law to determine the temporal applicability of that right in the field of criminal law.292 However, and while the interpretation of the parameters of a specific rights have 282 Law 23 June 2017, No 103, known as ‘Orlando reform’. See Gazzetta Ufficiale della Repubblica Italiana, 4 July 2017. 283 See Constitutional Court, ruling of 23 January 2019, No 20; Constitutional Court, ruling of 20 February 2019, No 63; Constitutional Court, ruling of 10 May 2019, No 112. Furthermore, with the Order of 10 May 2019, No 117, the Constitutional Court has referred to the CJEU a request for a preliminary reference. I am grateful to Michele Caianiello, Giulia Lasagni and Luisa Marin for drawing my attention to these cases. 284 Kolev (n 205); see also ch 5. 285 Kolev (n 205) para 55. 286 ibid para 65. 287 ibid para 66. 288 ibid para 67. 289 ibid para 68. 290 ibid para 70. 291 ibid para 71. 292 ibid.

44 History, Principles and Institutions again been based on Strasbourg case law, it is noteworthy that the CJEU reverted to its internal ‘constitutional’ approach, focusing on the general principles of EU law in order to address the broader question of balancing the protection of fundamental rights with the requirement to achieve the effective enforcement of EU law in the protection of an EU interest. This attempt to temper the national courts’ duty to fight impunity and ensure the effectiveness of Article 325 TFEU by their duty to respect fundamental rights is also evident in the case of Dzivev.293 In Dzivev, the CJEU extended rights protection by stating expressly that the obligation to ensure the effective collection of the EU’s resources does not excuse national courts from the necessary observance of the fundamental rights guaranteed by the Charter of Fundamental Rights and of the general principles of EU law. More precisely, it argued that the criminal proceedings instigated for VAT offences amount to an implementation of EU law, and that those rights and principles must be respected not only during the criminal proceedings, but also during the stage of the preliminary investigation, from the moment when the person concerned becomes an accused.294 In a case involving unlawful interception of communications, the CJEU, emphasising the importance of protecting legality and the rule of law,295 found that EU law cannot require a national court to disapply such a procedural rule, even if the use of that evidence gathered unlawfully could increase the effectiveness of criminal prosecutions, enabling national authorities, in some cases, to penalise non-compliance with EU law.296 The trajectory of the Court’s approach from Taricco to Dzivev thus reveals an interesting trend regarding the fight against impunity in terms of the protection of the EU budget. The CJEU took full advantage of ‘Lisbonisation’ in Taricco I to set out a clear benchmark of effectiveness and anti-impunity by empowering Article 325 TFEU with direct effect and spelling out far-reaching obligations of disapplication for national authorities, including courts. The CJEU hinted at the importance of further European integration in the form of legislative harmonisation, but insisted on the application of these duties in national legal orders, even in the face of limited harmonisation – with duties stemming from Article 325 also applying in the fields of criminal procedure and criminal investigations. However, the quest for effectiveness in the fight against impunity is limited by the constitutional requirement for national authorities to respect legality and the rule of law. In a field of law where there is still limited, minimum and piecemeal harmonisation, this European approach of balancing the fight against impunity with the protection of fundamental rights and the rule of law leaves a number of questions of certainty and consistency unanswered, as responses may vary considerably in accordance with national legal systems and policy priorities.297 293 Case C-310/16, Petar Dzivev, ECLI:EU:C:2019:30. 294 ibid para 33. 295 ibid para 34. 296 ibid para 39. 297 See the criticism of AG Bobek in his Opinion in Dvizev, noting the challenges to foreseeability (any national court can and should draw appropriate procedural consequences from a finding of incompatibility, which it is entitled to make for itself, without a reference to the CJEU). When extended to the setting aside of national rules of criminal procedure by individual courts in the Member States based on their self-assessment, criminal justice appears to run the risk of becoming an EU-sponsored lottery (para 106) and that, even after the ruling in Kolev, the catalysing point set by the Court for any such selective disapplication of offending national rules remains unclear (para 107).

The Lisbon Treaty and the Constitutionalisation of EU Criminal Law 45

C. Rights Another key factor in the constitutionalisation of EU criminal law after Lisbon has been the central place of the protection of fundamental rights in the Treaty. A key development in this context has been the constitutionalisation of the Charter of Fundamental Rights, which has the same legal value as the Treaties298 and has been seen as contributing to reinforcing the centrality of fundamental rights in the EU legal order.299 The Charter contains a whole Title (Title VI) on Justice. Title VI enshrines key rights and principles for the development of EU criminal law, including the right to an effective remedy and to a fair trial,300 the presumption of innocence and right of defence,301 the principles of legality and proportionality of criminal offences and penalties,302 and the right not to be tried or punished twice in criminal proceedings for the same criminal offence.303 Further Charter rights which are relevant to EU criminal law include rights and principles enshrined in Title I of the Charter on dignity (including the provisions on human dignity,304 the right to life,305 the right to the integrity of the person306 and the prohibition of torture and inhuman or degrading treatment or punishment);307 in Title II on freedoms (including the provisions on the right to liberty and security,308 respect for private and family life,309 and the protection of personal data,310 as well as the provisions on freedom of expression and information,311 freedom of assembly and association,312 the right to property313 and protection in the event of removal, expulsion or extradition);314 in Title III on equality (most notably the provisions on equality before the law,315 non-discrimination316 and the rights of the child);317 and in Title V on citizens’ rights (including the right to good administration,318 the right of access to documents319 and freedom of movement and of residence).320 A whole raft of articles – and thus the majority of the Charter provisions – are relevant and applicable in the 298 Article 6(1) TEU. See P Craig, The Lisbon Treaty: Law, Politics, and Treaty Reform (Oxford University Press, 2010) 200. 299 See S Iglesias Sanchez, ‘The Court and the Charter: The Impact of the Entry into Force of the Lisbon Treaty on the ECJ’s Approach to Fundamental Rights’ (2012) 49 CML Rev 1565, 1582. 300 Article 47. 301 Article 48. 302 Article 49. 303 Article 50. 304 Article 1. 305 Article 2. 306 Article 3. 307 Article 4. 308 Article 6. 309 Article 7. 310 Article 8. 311 Article 11. 312 Article 12. 313 Article 17. 314 Article 18. 315 Article 20. 316 Article 23. 317 Article 24. 318 Article 41. 319 Article 42. 320 Article 45.

46 History, Principles and Institutions implementation of EU criminal law. The impact of the Charter in this context will be analysed in detail throughout this volume. Linked to the protection by the Charter is the emphasis of the Lisbon Treaty on other sources of rights. Fundamental rights, as guaranteed by the ECHR and as they result from the constitutional traditions common to the Member States, constitute general principles of EU law.321 In Kolev, the understanding of fundamental rights as general principles of EU law has been underlined in relation to the right of an individual to have his case heard within a reasonable time, which forms part of the right to a fair trial as enshrined in Article 6(1) ECHR and Article 47 of the Charter. In that respect, the CJEU stressed that this right must be respected not only during the trial procedure, but also during the stage of the preliminary investigation, from the moment when the person concerned becomes an accused.322 The Treaty also calls for the EU’s accession to the ECHR.323 Throughout this volume, it will be demonstrated that, notwithstanding the methodological difficulties regarding the accession of the EU to the ECHR that the Court of Justice is currently facing,324 the Court has also been using Strasbourg case law in detail in order to evaluate human rights compliance of EU law.325 The influence of the Charter in the development of EU criminal law after Lisbon is not limited to the interpretation of the content of EU criminal law in conformity with the Charter. It is also crucial when determining the scope of application and interpretation of rights and the level of protection provided by the Charter – aspects which are addressed in the final, horizontal provisions of the Charter.326 These provisions aim to regulate the relationship between the Charter and national law on the one hand, and the relationship between the Charter and other sources of human rights protection (including the ECHR) on the other. The Court of Justice has thus far intervened on both aspects. In the seminal ruling in Melloni, the Court found that EU law which is found to be in compliance with the Charter has primacy over national constitutional law which provides a higher level of protection. While this ruling may be seen as lowering the protection of fundamental rights in certain jurisdictions, the Court has compensated for this potential outcome (which was justified by the need to ensure the primacy, unity and effectiveness of EU law) by adopting a broad interpretation of what constitutes the implementation of EU law which triggers the application of the Charter under Article 51(1) of the Charter. In the case of Fransson,327 the Court of Justice adopted a broad interpretation of the application of the Charter, including in cases where national legislation does not 321 Article 6(3) TEU. 322 Kolev (n 205) para 71. See also ECtHR, Affaire stratégies et communications et Dumoulin v Belgium (Judgment of 15 July 2002) para 39; and McFarlane v Ireland (Judgment of 10 September 2010). 323 Article 6(2) TEU. 324 See the discussion on the impact of Opinion 2/13 in ch 4 on mutual recognition. 325 See in particular references to the ECHR in the Court’s case law on substantive criminal law on fraud (ch 2), ne bis in idem (ch 3) and mutual recognition and the European Arrest Warrant (ch 4). 326 See in particular arts 51–53 of the Charter. For commentaries, see, inter alia, K Lenaerts, ‘Exploring the Limits of the EU Charter of Fundamental Rights’ (2012) 8 European Constitutional Law Review 375; D Sarmiento, ‘Who’s Afraid of the Charter? The Court of Justice, National Courts and the New Framework of Fundamental Rights Protection in Europe’ (2013) 50 CML Rev 1267; and F Fontanelli, ‘Implementation of EU Law through Domestic Measures after Fransson: The Court of Justice Buys Time and “Non-preclusion” Troubles Loom Large’ (2014) 39 European Law Review 682. 327 Case C-617/10, Åklagaren v Hans Åkerberg Fransson, ECLI:EU:C:2013:105.

Legal Basis Disputes and Contested Competence 47 implement an EU criminal law instrument expressly or directly. The Court found that domestic law on VAT fraud does fall within EU law since there is a direct link between the collection of VAT revenue in compliance with the applicable EU law and the availability to the EU budget of the corresponding VAT resources.328 This reasoning has become influential in the development of the Court’s case law on the relationship between EU law and national law on criminal procedure.329 At the same time, it has caused concern in Member States, which fear that the Court’s expansive approach might lead to the extension of the competence of the EU.330 The Court of Justice developed its approach on the applicability of the Charter in Siragusa,331 where it ruled that the concept of ‘implementing Union law’, as referred to in Article 51 of the Charter, requires a certain degree of connection above and beyond the matters covered being closely related or one of those matters having an indirect impact on the other.332 The Court’s approach has the effect of including a wide range of national legislation and measures relating to national criminal justice systems within the scope of the Charter. This view is reinforced by the Court’s finding in Siragusa that it is important to consider the objective of protecting fundamental rights in EU law, which is to ensure that those rights are not infringed in areas of EU activity, whether through action at the EU level or through the implementation of EU law by the Member States.333

VII. Legal Basis Disputes and Contested Competence A key testing ground for the constitutionalisation of EU criminal law is the application of the principle of conferral and the existence, extent and exercise of EU competence in the field of criminal justice. The entry into force of the Lisbon Treaty has demonstrated two at first sight conflicting tendencies in the field: on the one hand, the drafters of the Treaty have been ambitious enough to include in Title V for the first time new, express legal bases which would extend the powers of the EU to new areas of criminal justice, including criminal procedure (Article 82(2) TFEU), ‘functional’ substantive criminal law (Article 83(2) TFEU) and the establishment of a EPPO (Article 86 TFEU). On the other hand, and in accordance with the general spirit of the Treaty,334 the drafters have been careful to articulate and determine as precisely as possible the extent of EU 328 ibid para 26. 329 See in particular the case of Taricco (n 203). 330 See in this context the judgment of the Bundesverfassungsgericht in the anti-terrorism databases case – 1 BvR 1215/07, judgment of 24 April 2013, where the Court adopted a restrictive interpretation of Fransson, finding that art 51(1) of the Charter cannot operate when the domestic measure relates to the purely abstract scope of EU law or when it has a merely de facto effect upon it (para 91). See F Fontanelli, ‘Hic Sunt Nationes: The Elusive Limits of the EU Charter and the German Constitutional Watchdog’ (2013) 9 European Constitutional Law Review 315. On the broader concerns of the Bundesverfassungsgericht with regard to the potential impact of the Lisbon Treaty on national sovereignty and competence in criminal law, see the commentary on the Lisbon judgment below. 331 Case C-206/13, Siragusa v Regione Sicilia, ECLI:EU:C:2014:126. 332 ibid para 24. 333 ibid para 31. 334 See in particular arts 4(1) and 5(2) TEU; and art 51(2) of the Charter; for an analysis, see L Azoulai, ‘Introduction: The Question of Competence’ in L Azoulai (ed), The Question of Competence in the European Union (Oxford University Press, 2014) 1–18, at 10–11.

48 History, Principles and Institutions competence in criminal law and to ensure that the EU acts within the limits of conferral. However, the care of the Treaty drafters has not avoided controversy over the existence, extent and exercise of EU competence in criminal matters. There has already been extensive litigation at three levels: at the level of the relationship between national and EU powers in criminal matters; at the level of the choice of legal basis in the adoption of internal EU law; and at the level of the choice of legal basis and inter-institutional balance concerning the choice of legal basis in external relations. These three aspects of competence and legal basis litigation will be examined in this section.

A. Criminal Law versus the Internal Market: The Weapons Case Legal basis and competence disputes regarding security-related instruments adopted under an internal market legal basis have arisen repeatedly in the field of data retention and the transfer of personal data.335 A similar dispute has arisen regarding the adoption of Directive (EU) 2017/853 of the European Parliament and of the Council of 17 May 2017 amending Council Directive 91/477/EEC on control of the acquisition and possession of weapons.336 The Czech Republic sought the annulment of the Directive inter alia on the grounds that Article 114 TFEU cannot constitute an appropriate legal basis for its adoption as the objectives it pursues consist exclusively in ensuring a higher level of public security in relation to the terrorist threat and other forms of crime, and prohibiting the possession of certain semi-automatic firearms and their magazines, which was the main novelty of the contested directive, has no link with the isolated shortcomings in the functioning of the internal market.337 As in recent litigation on the data retention Directive,338 it was argued that not only was the legal basis for the adoption of the instrument in question incorrect, but also that the EU did not have competence to adopt the measure in the first place as in the field of prevention of crime and terrorism, harmonisation is specifically excluded by Article 84 TFEU, echoing the national security exception set out in Article 4(2) TEU.339 The CJEU did not accept these arguments and held that the Directive in question was adopted under the correct legal basis. It found that in adopting the Directive, the EU legislature has continued to pursue, in the context of risk developments in the area of security, the stated objective of the fifth recital of Directive 91/477 of reinforcing mutual confidence between Member States in the field of the protection of the safety of persons.340 It noted that the circumstances have evolved significantly since the adoption of Directive 91/477341 and that the EU legislature cannot be denied the possibility of adapting, on the basis of Article 114 TFEU, an act such as Directive 91/477 to any change in circumstances or development of knowledge having regard to its task of 335 For further analysis, see ch 9. 336 [2017] OJ L137/22 337 Case C-482/17, Czech Republic v European Parliament and Council, ECLI:EU:C:2019:1035, paras 21 and 22. 338 See ch 9. 339 Czech Republic v European Parliament and Council (n 337) para 23. 340 ibid para 54. 341 ibid para 55.

Legal Basis Disputes and Contested Competence 49 safeguarding the general interests recognised by the Treaties, including the maintenance of public security.342 The CJEU further noted that harmonisation of aspects relating to the safety of goods is one of the essential elements for the proper functioning of the internal market343 and that the measure resulting from the amendments made to Directive 91/477 by the contested directive includes rules governing the internal market in firearms for civilian use that are adapted to the particular features of those goods and that continue to ensure, as regards the free movement of goods, legal approximation.344 Moreover, it does not appear that the EU legislature exceeded the margin of discretion conferred upon it by the legal basis of Article 114 TFEU as regards the method of approximation, when in order to ensure the maintenance of a limited degree of free movement of firearms for civilian use within the internal market, it adopted the measures adding certain semi-automatic firearms to the category of firearms that are prohibited by Directive 91/477.345 By upholding the internal market legal basis, the CJEU has also upheld the very existence of EU competence to legislate in a security-related matter where legislation was adopted in response to security emergencies in Europe.346

B. Criminal Law versus Transport Policy: The Road Traffic Offences Directive Case The entry into force of the Lisbon Treaty included an attempt to address the pre-Lisbon inter-institutional battles over the existence and extent of EU competence in criminal matters. As will be analysed in the following chapter, Article 83(2) TFEU establishes a paradigm of functional criminalisation by attempting to translate into Treaty terms the seminal rulings of the Court of Justice in litigation concerning the delimitation of criminal law competence on environmental crime and pollution at sea.347 The precise scope and contours of EU competence under Article 83(2) TFEU remain contested, and the wording of the provision may still raise questions that will need to be resolved by the Court of Justice. However, competence questions are not limited to substantive criminalisation. The entry into force of the Lisbon Treaty has already triggered litigation regarding the correct legal basis on a measure introducing a cooperation mechanism on the investigation of road traffic offences. Directive 2011/82/EU facilitating the crossborder exchange of information on road safety related traffic offences was adopted on 25 October 2011.348 Its legal basis was Article 87(2) TFEU, which is a police cooperation

342 ibid para 56. 343 ibid para 57. 344 ibid para 59. 345 ibid para 62. 346 The CJEU did not have an issue with the fact that the Directive in question was tabled by the Commission without the publication of an Impact Assessment; for a critical overview, see V Mitsilegas, ‘Counter-terrorism and the Rule of Law in an Evolving European Union: Plus ça Change?’ (2021) 12 New Journal of European Criminal Law 36. 347 Case C-176/03, Commission v Council [2005] ECR I-7879; Case C–440/05 Commission v Council [2007] ECR I-9097. For an analysis, see ch 2. 348 Directive 2011/82/EU of the European Parliament and of the Council of 25 October 2011 facilitating the cross-border exchange of information on road safety related traffic offences [2011] OJ L288/1, 5 November.

50 History, Principles and Institutions legal basis under Title V TFEU.349 Its stated objective was to ensure a high level of protection for all road users in the EU by facilitating the cross-border exchange of information on road safety-related traffic offences and thereby the enforcement of sanctions, where those offences are committed with a vehicle registered in a Member State other than the Member State where the offence took place.350 The key measures it introduced were a procedure for the exchange of information between Member States351 and the issuing of an information letter on the road safety-related traffic offences.352 The Commission challenged the validity of the Directive on the grounds of the incorrect use of legal basis.353 The Commission argued that Article 87(2) TFEU could only be the legal basis of measures specifically related to the prevention or detection of criminal offences. It further argued that ‘it cannot be inferred simply because an “offence” is punitive in nature or seeks to achieve deterrence, that it can automatically be regarded as a “criminal” offence within the meaning of Article 87 TFEU’.354 According to the Commission, both the goal and the content of the Directive fell within the field of transport policy and in particular Article 91 TFEU, which should have been used as the legal basis of the Directive.355 The aim of the Directive, argued the Commission, was to improve road safety and its content confined itself to ‘organising the exchange of information with regard to … conduct bearing upon road safety, without adopting harmonising measures in relation to that conduct and … without obliging the Member States to criminalise such conduct’.356 The Commission’s arguments were rebutted by the European Parliament and the Council, supported by seven Member States (Belgium, Ireland, Hungary, Poland, the Slovak Republic, Sweden and the UK). The European Parliament, supported by the majority of the intervening Member States, considered that the Directive principally pursued the objective of establishing a system of exchange of information and only indirectly objectives relating to road safety – for that reason, the Directive could not have been based on Article 91 TFEU.357 The Council further pointed out that the Directive provided for rules relating to the enforcement of sanctions concerning road safetyrelated traffic offences. While these offences may be of an administrative or criminal nature, the means for enforcing them must be regarded as falling, in all cases, within the category of rules of criminal procedure, with the question of what is a ‘criminal

349 According to art 87(1) TFEU, the EU will ‘establish police cooperation involving all the Member States’ competent authorities, including police, customs and other specialised law enforcement services in relation to the prevention, detection and investigation of criminal offences’. According to art 87(2)(a) TFEU, the European Parliament and the Council may establish for the purposes of art 87(1) measures concerning ‘the collection, storage, processing, analysis and exchange of relevant information’. 350 Directive 2011/82/EU, art 1. 351 ibid art 4. 352 ibid art 5. 353 Judgment of the CJEU (Grand Chamber) in Case C-43/12, European Commission v European Parliament and Council, ECLI:EU:C:2014:298. For an analysis, see N Vavoula, ‘Exchanging Information on Road Traffic Offences: A Measure of Police Cooperation or Transport Policy? Case Note on C-43/12 Commission v Parliament and Council’ (2016) 7 New Journal of European Criminal Law 113. 354 ibid para 17. 355 ibid para 19. 356 ibid para 20. 357 ibid para 24.

Legal Basis Disputes and Contested Competence 51 matter’ to be interpreted autonomously under EU law.358 The Council argued that provisions such as those in the Directive, the aim of which is to improve road safety by deterring certain types of behaviour regarded as dangerous, are necessarily ‘criminal’ matters and cannot be classified as road safety related norms within the meaning of Article 91 TFEU.359 It also argued that the Directive fell entirely within the objectives of Article 87(2) TFEU, as the measures sought to facilitate the detection of persons who have committed cross-border road safety-related offences, and the aim of the Directive was to collect information concerning offences in order to help deter them, which are measures for which the EU has competence under Article 87 TFEU. According to the Council, the reference to ‘all the … competent authorities’ in Article 87(1) TFEU confirms that it is immaterial, for the purposes of determining the applicability of that provision, whether the services at issue were, in each Member State concerned, administrative or criminal in nature.360 The Court found in favour of the Commission. It began its reasoning by reiterating that in assessing the appropriate use of the legal basis, both the aim and the content of the measure must be examined,361 and that if examination of the measure concerned reveals that it pursues a twofold purpose or that it has a twofold component, and if one of those is identifiable as the main or predominant purpose or component (whereas the other is merely incidental), that measure must be based on a single legal basis, namely that required by the main or predominant purpose or component.362 Examining the Directive in question, the Court found that its main aim was to improve road safety, which is a prime objective of the European transport policy.363 The aim of the establishment of the system of cross-border information exchange set out in the Directive was to enable the EU to pursue the goal of improving road safety.364 With regard to the content of the Directive, and following an examination of the key provisions of that measure,365 the Court found again that the system for the exchange of information set up by the Directive provides the means of pursuing the objective of improving road safety and enables the EU to attain that aim.366 The Directive was thus a measure to improve transport safety within the meaning of Article 91(1)(c) TFEU and it should have been adopted under that legal basis.367 The Directive was not directly linked to the AFSJ objectives enshrined in Article 67(2) TFEU.368 The Court thus annulled the Directive, but decided to maintain its effects until the entry into force within a reasonable period of time and not exceeding 12 months from the date of the delivery of the judgment of a new Directive based on the correct legal basis of Article 91(1)(c) TFEU.369 358 ibid para 25. 359 ibid para 26. On the deterrent effect of the Directive, see also the Opinion of AG Bot, delivered on 10 September 2013, para 33. 360 ibid para 27. 361 ibid para 29. 362 ibid para 30. 363 ibid para 36. 364 ibid para 37. 365 ibid paras 38–41. 366 ibid para 42. 367 ibid para 44. 368 ibid para 47–49. 369 ibid para 56.

52 History, Principles and Institutions A new Directive based on Article 91(1)(c) was indeed adopted and published in the Official Journal 10 months after the date of the delivery of the judgment in the road traffic offences case.370 The Court’s ruling has far-reaching implications for the delimitation of EU powers to act in criminal matters. First of all, the change in the legal basis of the road traffic offences Directive has had a profound impact on the position of Member States which did not participate (Denmark) or had a right not to opt into (Ireland and the UK) Title V legislation. All these states are now bound by the new ‘transport’ road traffic offences Directive (as there is no possibility of an opt-out from Article 91 TFEU), although they were not (Denmark) or chose not to be (Ireland and the UK) subject to the original Directive adopted under a Title V legal basis. The new Directive recognises this change by granting these Member States additional time to implement a Directive, the substance of which is identical to the measure to which they were not subject.371 The Court’s ruling is also significant in that it reiterates the functional criminalisation approach adopted in the earlier rulings on environmental crime and ship-source pollution rulings, and extends this approach beyond the field of substantive criminal law to the field of cooperation in criminal matters. As with its earlier rulings, the Court here views criminal law as merely a means to an end for the achievement of EU objectives, in this case transport. In order to reach this conclusion, the Court has privileged in its analysis the objective of the road traffic offences Directive, while it essentially subordinated the content of the measure (which was – and still is – essentially related to law enforcement cooperation) to the rather general and broad aim of transport policy. In this manner, law enforcement cooperation becomes the means to the end of the achievement of transport policy objectives. This reasoning is not convincing in disregarding the cooperation essence of the measure. It has a profound effect in that it seems to enable the adoption of functional criminal law measures outside the field of substantive criminal law under legal bases outside the scope of Title V TFEU. There is thus a functional criminal law spill-over from Title V to other parts of the Treaty, with the road traffic offences ruling leaving open the possibility of EU legislation in criminal matters being adopted outside Title V.372 This approach may challenge significantly the position of Member States which have, as seen in this chapter, inserted a number of sovereignty and legal diversity safeguards into Title V TFEU, which could thus be circumvented.

C. The Internal/External Dimension: The Case of Terrorist Sanctions Persistent questions with regard to the legality of EU action against terrorism have arisen in the context of the adoption by the EU of sanctions amounting to the freezing of assets of terrorist suspects, implementing in the EU legal order UNSC Resolutions 1267 and 1373. One of the key legality hurdles that the EU legislator had to overcome 370 Directive (EU) 2015/413 of the European Parliament and of the Council of 11 March 2015 facilitating cross-border exchange of information on road-safety-related traffic offences [2015] OJ L68/9, 13 March. 371 Recital 29. 372 For further details on this debate, see ch 2.

Legal Basis Disputes and Contested Competence 53 pre-Lisbon was the absence in the Treaties of an express legal basis conferring on the Community or the Union competence to legislate on sanctions against individuals.373 In order to overcome this hurdle, and in particular to implement Resolution 1267, the Council adopted a Common Position under Article 15 TEU374 and in parallel a first pillar Regulation on the basis of Articles 60, 301 and 308 EC.375 The addition of Article 308 to the legal basis of Regulation 881/2002 has been attributed to the need to take account of political developments taking place at the time. By January 2002, the Taliban regime in Afghanistan had fallen and so at the time that the Regulation was adopted, the persons and entities listed did not have a direct connection with the territory or governing regime of a third country. The initial choice of legal bases of Articles 60 and 301 EC, which was based on the principle that the individuals and entities listed were in effective control of the territory of a third country, or were associated with those in effective control and provided them with financial support, was thus no longer deemed adequate to address the situation in Afghanistan.376 Under this technique, sanctions against individuals not linked with the government or the control of a country were thus included within the scope of Community law, with Regulation 881/2002 consolidating and expanding the sanctions regime in the light of developments in the UNSC.377 Although the legality of the adoption of Regulation 881/2002 is questionable, it was affirmed by the Court of Justice in its ruling in Kadi I. The Court found that inasmuch as they provide for Community powers to impose restrictive measures of an economic nature in order to implement actions decided on under the CFSP, Articles 60 and 301 EC are the expression of an implicit underlying objective, namely, that of making it possible to adopt such measures through the efficient use of a Community instrument,378 adding that that objective may be regarded as constituting an objective of the Community for the purposes of Article 308.379 The Court then found a link between the Regulation and the operation of the common market, stating that if sanctions were imposed unilaterally by Member States, the multiplication of those national measures ‘might well affect the operation of the common market’, adding that such measures could have a particular effect on trade between Member States, especially with regard to the movement of capital and payments, and on the exercise by economic operators of their right of establishment, and that they could create distortions of competition, ‘because any differences between the measures unilaterally taken by the Member States could operate to the

373 V Mitsilegas, ‘The European Union and the Globalisation of Criminal Law’ (2010) 12 Cambridge Yearbook of European Legal Studies 337. See also ch 10. 374 Council Common Position of 27 May 2002 concerning restrictive measures against Usama bin Laden, members of the Al-Qaida organisation and the Taliban and other individuals, groups, undertakings and entities associated with them and repealing Common Positions 96/746/CFSP, 1999/727/CFSP, 2001/154/CFSP and 2001/771/CFSP (2002/402/CFSP) [2002] OJ L139/4. 375 Council Regulation (EC) No 881/2002 of 27 May 2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaida network and the Taliban, and repealing Council Regulation (EC) No 467/2001 [2002] OJ L139/9. 376 See M Cremona, ‘EC Competence, “Smart Sanctions” and the Kadi Case’ (2009) 28 Yearbook of European Law 559, 569. 377 See in particular arts 2, 4 and 6 of the Regulation. 378 Joined Cases C-402/05 P and C-415/05 Kadi and Al Barakaat International Foundation v Council and Commission [2008] ECR I-6351, para 226. 379 ibid para 227.

54 History, Principles and Institutions advantage or disadvantage of the competitive position of certain economic operators although there were no economic reasons for that advantage or disadvantage’.380 The Court thus attempted to accommodate the transposition of the UNSC sanctions system within the EU legal order, by accepting the legality of the use of Community legal bases targeting states and related to the operation of the common market for the adoption of EU internal security law introducing sanctions against individuals.381 The Lisbon Treaty has addressed the gaps with regard to the legal basis for terrorist sanctions which the Court attempted to fill in Kadi I by the introduction of specific provisions in the field. Not one but two Treaty provisions are potentially applicable in this context. Article 75 TFEU, located in the Treaty part on the EU as an AFSJ, states that where necessary to achieve the objectives set out in Article 67, as regards preventing and combating terrorism and related activities, the European Parliament and the Council, acting by means of regulations in accordance with the ordinary legislative procedure, must define a framework for administrative measures with regard to capital movements and payments, such as the freezing of funds, financial assets or economic gains belonging to, or owned or held by, natural or legal persons, groups or non-state entities. Article 215(2) TFEU states that where a decision adopted in accordance with Chapter 2 of Title V TEU so provides, the Council may adopt restrictive measures under the procedure referred to in paragraph 1 against natural or legal persons and groups or non-state entities. We have thus moved from the pre-Lisbon constitutional landscape, when arguably the EU Treaties did not include a legal basis for the adoption by the EU of sanctions against individuals, to a post-Lisbon proliferation of legal bases in the field. The post-Lisbon developments have thus not stopped legal basis litigation before the Court of Justice, as Articles 75 and 215(2) TFEU contain differences in the legislative procedure they set out for the adoption of sanctions, and the proliferation of legal bases leads to a lack of clarity as regards the role, scope and extent of each of these legal bases. After the entry into force of the Lisbon Treaty, the Council elected to continue the amendments to Regulation 881/2002 on the basis of Article 215(2) TFEU and not Article 75 TFEU. Article 215(2) TFEU was the legal basis for Regulation 1286/2009 of 22 December 2009 amending Regulation 881/2002.382 The validity of Article 215(2) as the legal basis for Regulation 1286/2009 was contested by the European Parliament, which sought the annulment of the measure by the Court of Justice.383 The Parliament based its plea on two main arguments relating to the aim and content of the contested Regulation and its position in the general scheme of the Treaties. With regard to the aim and content of the Regulation, the Parliament argued that the objective of the contested regulation is, as corroborated by the Court’s ruling in Kadi I, and like that of Regulation No 881/2002, ‘to combat terrorism and the financing of terrorism, which is consistent with the objectives of Article 75 TFEU’.384 ‘Given that it is not the purpose of Regulation No 881/2002 to achieve CFSP objectives, it is difficult to see how the contested 380 ibid para 230. 381 For a critical analysis, see Mitsilegas (n 373). 382 Council Regulation (EU) No 1286/2009 of 22 December 2009 amending Regulation (EC) No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaeda network and the Taliban [2009] OJ L346/42. 383 Case C-130/10, European Parliament v Council, ECLI:EU:C:2012:472. 384 ibid para 14.

Legal Basis Disputes and Contested Competence 55 regulation, adopted to ensure the application of the former regulation, could do so’; according to the Parliament, ‘the Council may have recourse to Article 215 TFEU only for measures that pursue CFSP objectives, more particularly when a decision intended to achieve the objectives of that policy makes provision for such recourse’.385 The Parliament further challenged the Council’s distinction between ‘internal’ and ‘external’ terrorism, noting that ‘the only distinction that can be made in this context is between national measures to combat terrorism, and international anti-terrorism measures’ and that ‘it is not always possible to say with any certainty whether terrorist and related activities carried out within the European Union will create a threat within or without the European Union’.386 The Council on the other hand argued that ‘in the light of its objectives and its content, the contested regulation falls within the scope of the provisions of the Treaties relating to the European Union’s external action, and more specifically within the sphere of the CFSP’ and that ‘Article 215 TFEU constitutes the appropriate legal basis for that measure’.387 According to the Council: ‘The purpose of that regulation, like that of Regulation No 881/2002, is to combat international terrorism and its financing in order to maintain international peace and security’ (emphasis added).388 Moreover, it argued that the content of the contested Regulation No 1286/2009 was consistent with that objective. Articles 7a and 7c, which that Regulation inserts into Regulation No 881/2002, confirm that those Regulations directly implement the listing decisions adopted by the Sanctions Committee and establish a system of interaction between the Sanctions Committee, the EU and the individuals and entities listed.389 In the Council’s view, Regulation No 881/2002 and the contested Regulation do not in any way fall within the scope of the provisions intended to create an AFSJ within the EU.390 ‘Article 75 TFEU now provides a legal basis for adopting measures to freeze the funds of “internal” terrorists’; ‘conversely, if the threat relates primarily to one or more third States or to the international community in general, Article 215 TFEU is the appropriate legal basis’.391 The Council was supported by the Commission, which, following a different line of argument, challenged the Parliament’s claim that an act based on Article 308 EC cannot pursue a CFSP objective. According to the Commission, the Court did not in that judgment deny that Articles 60 and 301 EC were legal bases permitting the adoption of Community measures pursuing a CFSP objective. As regards Regulation No 881/2002, the Court identified a second, underlying Community objective linked to the functioning of the common market to justify the inclusion of Article 308 EC as a third legal basis. Moreover, it confirmed that the EC Treaty required recourse to that provision for the imposition of restrictive measures in respect of natural or legal persons in cases where

385 ibid para 15. 386 ibid para 16. 387 ibid para 17. 388 ibid para 18. 389 ibid para 19. 390 ibid para 20. 391 ibid para 22. ‘Furthermore, the Council, supported in substance by the Kingdom of Sweden, submits that the Parliament’s proposition fails to take account of those cases where, in the context of the fight against terrorism, the European Union seeks to adopt or impose restrictive measures other than the freezing of assets, such as a travel ban, in respect of persons or entities associated with “external” terrorism’ (para 23)

56 History, Principles and Institutions there is no link with the governing regime of a non-Member State.392 Moreover, the Commission considered that Articles 215 and 75 TFEU cannot be used jointly as legal bases for the contested regulation. It is not possible to base an act on those two articles at the same time, for they lay down different procedural and decision-making conditions. The Commission further emphasised that one of the crucial differences between Articles 215 and 75 TFEU is to be found in the need for a link to decisions in the sphere of the CFSP, taken in the interests of international peace and security, whatever the precise geographical location or the scope of the terrorist threat at issue. When restrictive measures relating to terrorism must be adopted under the TFEU following a CFSP decision further to a UNSC Resolution, Article 215 TFEU is, according to the Commission, the only possible legal basis.393 With regard to the position of the contested Regulation in the general scheme of the Treaties, the Parliament argued that ‘the general scheme and spirit of the Treaties justify the use of Article 75 TFEU as the legal basis of the contested regulation’.394 ‘The contested regulation is linked to the protection of individuals and groups’ and ‘[s]ince the entry into force of the Treaty of Lisbon, however, the European Union may adopt measures concerning fundamental rights only under the ordinary legislative procedure or with the consent of the Parliament’. According to the Parliament, this link with fundamental rights means that ‘Article 215(2) TFEU is applicable only in respect of measures that do not raise issues of fundamental rights to the same extent’.395 The contested Regulation involves ‘measures with regard to capital movements and payments, thus recognising that such measures may affect the proper functioning of the internal capital market and the provision of financial services’ which fall within Article 75 TFEU and ‘is linked to the establishment of an area of freedom, security and justice’.396 Finally, according to the Parliament, there is no link between the contested Regulation and the CFSP. Under Article 24(1) TEU, the CFSP is subject to specific rules and procedures. To give effect to those rules and procedures outside their ambit would run counter to the objectives set out in the second paragraph of Article 1 TEU and would have the effect of depriving national parliaments of the application of the protocols on their role and on the application of the principles of subsidiarity and proportionality, and of denying the Parliament the application of the ordinary legislative procedure.397 [i]t would be contrary to European Union law for it to be possible to adopt measures having a direct impact on the fundamental rights of individuals and groups, on the internal market and on the fight against crime by means of a procedure which excludes the participation of the European Parliament, when the ordinary legislative procedure applies for the adoption of measures in those areas … Recognising Article 215(2) TFEU as the correct legal basis for measures such as the contested regulation would, in practice, deprive Article 75 TFEU of much of its effectiveness. The Parliament also points out that Article 75 TFEU constitutes a more specific legal basis than Article 215 TFEU.398

392 ibid

para 26. para 27. para 28. 395 ibid para 29. 396 ibid paras 30 and 31 respectively. 397 ibid para 32. 398 ibid para 34. 393 ibid 394 ibid

Legal Basis Disputes and Contested Competence 57 The Council on the other hand submitted ‘that the arguments put forward by the European Parliament with respect to the general scheme of the Treaties do not constitute relevant criteria for determining the correct legal basis of the contested regulation’ as ‘the Parliament’s proposition amounts to a claim that procedures determine the choice of legal basis rather than the other way round’.399 According to the Council, the Parliament’s argument to the effect that the EU can adopt measures concerning respect for human rights only with the Parliament’s involvement is contradicted by Article 215(3) TFEU, which provides that: ‘The acts referred to in this Article shall include necessary provisions on legal safeguards.’400 The Council also submitted that the purpose of Article 215 TFEU was ‘to enable the Council to adopt measures which are directly applicable to economic operators’, thus helping ‘to ensure the proper functioning of the common market’.401 As regards the relationship of the contested regulation to the CFSP, ‘[the] regulation constitutes the framework within which the European Union performs its obligations under the Charter of the United Nations’ and ‘it is not unreasonable to take account of the objective of the resolutions adopted by the Security Council in determining the appropriate legal basis’.402 Lastly, the Council pointed out that the Treaty of Lisbon has not affected the distinction between the CFSP and the AFSJ. On the contrary, the importance of a line clearly delimiting those two fields was emphasised in the second paragraph of Article 40 TEU. As a consequence, if the Court were to take the view that the contested regulation pursues an objective falling under the CFSP, Article 215(2) TFEU would be the only possible legal basis for its adoption.403 The Court dismissed the action brought by the European Parliament, ruling that Article 215(2) was the correct legal basis for the contested legislation. In order to reach this conclusion, the Court proceeded on the basis of three steps: the examination of the relationship between Articles 75 and 215(2) TFEU and the pre-Lisbon legal bases of Articles 60, 301 and 308 EC; the examination of the ambit of Article 251(2); and the purpose and tenor of the contested Regulation. However, this three-step analysis was preceded by the Court’s acceptance of the Commission’s argument that even if the contested regulation does pursue several objectives at the same time or have several components indissociably linked, without one being secondary to the other, the differences in the procedures applicable under Articles 75 and 215(2) TFEU mean that it is not possible for the two provisions to be cumulated, one with the other, in order to serve as a twofold legal basis for a measure such as the contested regulation.404 The Court based this finding in its earlier case law in Titanium Dioxide,405 where it found that recourse to a dual legal basis is not possible where the procedures laid down for each legal basis are incompatible with each other.406 The Court found that the T itanium Dioxide approach ‘is still valid, after the entry into force of the Treaty of Lisbon, in

399 ibid

paras 35 and 36. para 38. 401 ibid para 39. 402 ibid para 40. 403 ibid para 41. 404 ibid para 49. 405 Case C-300/89 Commission v Council (Titanium Dioxide) [1991] ECR I-2867, paras 17–21. 406 Case C-130/10, European Parliament v Council, ECLI:EU:C:2012:472, para 45. 400 ibid

58 History, Principles and Institutions the context of the ordinary legislative procedure’.407 In this instance, while Article 75 TFEU provides for the application of the ordinary legislative procedure, which entails qualified majority voting in the Council and the Parliament’s full participation in the procedure, Article 215(2) TFEU, for its part, entails merely informing the Parliament. In addition, recourse to Article 215(2) TFEU, unlike recourse to Article 75 TFEU, requires a previous decision in the sphere of the CFSP, namely, a decision adopted in accordance with Chapter 2 of Title V TEU, providing for the adoption of restrictive measures such as those referred to in that provision. As a general rule, the adoption of such a decision calls for unanimous voting in the Council acting alone.408 According to the Court, ‘differences of that kind are such as to render those procedures incompatible’.409 Having established that the procedures laid down under Articles 75 and 215(2) TFEU are incompatible, the Court went on to assess the relationship of these provisions in the light of their relationship with the pre-Lisbon legal bases for the Regulation which the contested Regulation sought to amend. It found that as a result of the amendments made to primary law after the Treaty of Lisbon entered into force, the content of Articles 60, relating to restrictive measures with regard to capital movements and payments, and 301 EC on the interruption or reduction, in part or completely, of economic relations with one or more third countries, is mirrored in Article 215 TFEU.410 Furthermore, Article 215(2) TFEU allows the Council to adopt restrictive measures against natural or legal persons and groups or non-state entities, namely, measures that, before the Lisbon Treaty entered into force, required Article 308 EC too to be included in their legal basis if their addressees were not linked to the governing regime of a third country.411 The ‘context and tenor’ of Article 75 TFEU differ according to the Court from those of Articles 60 and 301 EC as ‘Article 75 TFEU does not, in fact, refer to the interruption or reduction, in part or completely, of economic relations with one or more third countries’.412 However, it is difficult to see how this finding is relevant in the field of terrorist sanctions, which are targeting individuals and not third states. In its next step, the Court analysed in detail the ambit of Article 215 TFEU (and mentioned only in passing the ambit of Article 75 TFEU). It noted in particular the link between restrictive measures and the CFSP. It referred to the wording of Article 215(1) and (2), and the fact that the latter concerns the adoption by the Council of ‘restrictive measures … against natural or legal persons and groups or non-State entities’, without specifically referring to the combating of terrorism and without limiting those measures to those alone that concern capital movements and payments.413 Moreover, the Court noted that ‘Article 215(2) TFEU, unlike Article 75 TFEU, provides … that it may not be used until a decision under the CFSP has provided for the adoption of restrictive measures against natural or legal persons, groups or non-State entities’, while ‘Article 75 TFEU states that it may be used where necessary to achieve the objectives set out in Article 67 TFEU, that is to say, in connection with creating

407 ibid

para 46. para 47. para 48. 410 ibid paras 51 and 52. 411 ibid para 53. 412 ibid para 54. 413 ibid para 57. 408 ibid 409 ibid

Legal Basis Disputes and Contested Competence 59 an area of freedom, security and justice’.414 Referring to Kadi I, which established a bridge between the Community legal bases of Articles 60 and 301 and external relations including the CFSP, the Court noted that post-Lisbon, ‘Article 215 TFEU expressly provides such a bridge, but this is not the case with Article 75 TFEU, which creates no link with decisions taken under the CFSP’.415 It found that as regards combating terrorism and its funding, ‘there is nothing in Article 215 TFEU to indicate that measures designed to combat them, taken against natural or legal persons, groups or non-State entities, could not constitute restrictive measures provided for in subparagraph 2 of that article’.416 It noted that while admittedly the combating of terrorism and its financing may well be among the objectives of the area of freedom, security and justice, as they appear in Article 3(2) TEU, ‘the objective of combating international terrorism and its financing in order to preserve international peace and security corresponds, nevertheless, to the objectives of the Treaty provisions on external action by the Union’ (emphasis added).417 The Court mentioned in this context the references to the preservation of peace and international security in Article 21(2)(c) TEU, the broad reference to ‘the Union’s security’ in the CFSP provision of Article 24(1) TFEU,418 and the wording of Article 43(1) TFEU, according to which the CFSP may contribute to the fight against terrorism.419 On the basis of this very broad conceptualisation of security, the emphasis on international peace and security, and the establishment of a general link between security and EU foreign and defence policy, the Court asserted that given that terrorism constitutes a threat to peace and international security, the object of actions undertaken by the EU within the sphere of the CFSP, and the measures taken in order to give effect to that policy in the EU’s external actions – in particular, restrictive measures for the purpose of Article 215(2) TFEU – can be to combat terrorism.420 As regards the purpose and tenor of the contested Regulation, the Court stated, again quoting Kadi I, that ‘the essential purpose and object’ of the latter ‘is to combat international terrorism’ (emphasis added).421 ‘In the light of its objectives and of its content, the contested regulation relates to a decision taken by the Union under the CFSP.’422 The Parliament’s argument that it is impossible to distinguish the combating of ‘internal’ terrorism, on the one hand, from the combating of ‘external’ terrorism, on the other, does not appear capable of calling into question the choice of Article 215(2) TFEU as a legal basis of the contested Regulation.423 Article 215(2) TFEU provides a sufficient legal basis for adopting, in response to a decision taken under the CFSP, restrictive measures taken in order to apply that policy to natural or legal persons, groups or non-state entities involved in acts of terrorism.424 In the present case the contested regulation amends Regulation No 881/2002 which ‘constitutes one of the instruments by which the European Union

414 ibid

para 58. para 59. para 60. 417 ibid para 61. 418 ibid para 62. 419 ibid para 64. 420 ibid para 63. 421 ibid para 68. 422 ibid para 72. 423 ibid para 74. 424 ibid para 75. 415 ibid 416 ibid

60 History, Principles and Institutions put into effect an action decided upon within the UNSC and intended to preserve international peace and security’.425 The Parliament has not called into question whether it was possible for that Common Position, having enabled adoption of Regulation No 881/2002 in accordance with Articles 60 and 301 EC, to be validly based on Title V TEU as it stood before the Lisbon Treaty, that is to say, the title of that treaty concerning the CFSP.426 Having regard to those factors, it suffices to note that Article 215(2) TFEU constitutes the appropriate legal basis for measures, such as those at issue in the present case, directed to addressees implicated in acts of terrorism who, having regard to their activities globally and to the international dimension of the threat they pose, affect fundamentally the EU’s external activity.427 The Court further considered the consequences of this finding for the Parliament’s prerogatives. It accepted the Council’s assertion that ‘it is not procedures that define the legal basis of a measure but the legal basis of a measure that determines the procedures to be followed in adopting that measure’.428 It accepted that ‘participation by the Parliament in the legislative process is the reflection, at Union level, of the fundamental democratic principle that the people should participate in the exercise of power through the intermediary of a representative assembly’,429 but stated that the difference between Articles 75 and 215 TFEU, so far as the Parliament’s involvement is concerned, is the result of the choice made by the framers of the Lisbon Treaty conferring a more limited role on the Parliament with regard to the EU’s action under the CFSP.430 The Court added that in relation to the Parliament’s argument, it would be contrary to EU law for it to be possible for measures to be adopted that impinge directly on the fundamental rights of individuals and groups by means of a procedure excluding the Parliament’s participation. The duty to respect fundamental rights is imposed, in accordance with Article 51(1) of the Charter of Fundamental Rights, on all the institutions and bodies of the EU. In addition, under both Articles 75 and Article 215(3) TFEU, the acts referred to in those articles are to include necessary provisions on legal safeguards.431 The Court added that the Parliament’s argument ‘that such a measure may be adopted only on the basis of Article 75 TFEU, would … render Article 215(2) largely redundant, whereas the duty to respect fundamental rights bears also on Union measures giving effect to resolutions of the Security Council’.432 The attempt by the Court of Justice to justify the legality of Article 215(2) TFEU with regard to the adoption of terrorist sanctions by the EU implementing UNSC Resolution 1267 – at the expense of the AFSJ legal basis of Article 75 TFEU – is premised on a number of contradictions. The Court accepted the Council’s statement that it is not procedures that define the legal basis of a measure, but the legal basis of a measure that determines the procedures to be followed in adopting that measure, yet its reasoning on the preference of Article 215(2) TFEU over Article 75 TFEU is based essentially

425 ibid

para 76. para 77. 427 ibid para 78. 428 ibid para 80. 429 ibid para 81. 430 ibid para 82. 431 ibid para 83. 432 ibid para 84. 426 ibid

Legal Basis Disputes and Contested Competence 61 on procedural arguments. In the first place, the Court chose to exclude the possibility of Articles 75 and 215(2) acting as joint legal bases for the contested Regulation by ruling that these legal bases are incompatible with each other. This declaration of incompatibility was by no means a one-way street for the Court, which in earlier case law accepted the adoption of a dual legal basis consisting of Treaty provisions which prescribed different legislative procedures. In these cases, procedural differences were reconciled, with the Court opting for the adoption of the procedure which respects the Parliament’s prerogatives more fully.433 The Court could have certainly followed this reasoning in the present case, where the content and objective of the two legal bases were very similar. Second, the Court’s emphasis on procedure is evident in its attempt to justify the legality of Article 215(2) on the basis of the existence of a bridge between terrorist sanctions and the CFSP. In order to establish this bridge, the Court adopted a historical approach aiming to interpret the relationship between the post-Lisbon legal bases on terrorist sanctions in the light of the articulation of the relationship between the pre-Lisbon legal bases for the Regulation that the contested measure seeks to amend, as put forward by the Court of Justice in Kadi I. Yet this approach disregards the fundamental procedural and constitutional differences between the pre- and the post-Lisbon legal bases for terrorist sanctions. Pre-Lisbon, the Treaties did not include an express legal basis allowing the EC or the EU to adopt sanctions against individuals. In Kadi I, the Court of Justice went out of its way to find a way to uphold the legality of EU action in the field by establishing a bridge between the first pillar legal bases and the CFSP.434 Yet the situation is radically different after the entry into force of the Lisbon Treaty. The EU legislator in Lisbon attempted to address the legality gaps in the pre-Lisbon constitutional framework by including express legal bases for the adoption of terrorist sanctions against individuals, including Article 75 TFEU. To establish a continuum between the preLisbon and the post-Lisbon legal bases is to disregard the new legal situation brought about by the Lisbon Treaty. In establishing the constitutional link between Articles 75 and 215(2) TFEU, the pre-Lisbon constitutional arrangements should not be decisive. The Court’s approach has profound implications for the conceptualisation of security in EU law, the relationship between internal and external security in the context of counter-terrorism law, as well as the configuration of the relationship between CFSP and other areas of EU law and policy after Lisbon. The Court rightly did not attach weight to the artificial distinction made by the Council between ‘internal’ and ‘external’ terrorists. Yet at the same time, the Court seemed to treat the imposition of terrorist sanctions on individuals under EU law as a matter of ‘international terrorism’, which was justified in order to achieve the professed CFSP objectives of maintaining peace and security. The reference to international peace and security echoes UN law, and a system which was initially designed to govern inter-state relations. Moreover, references to international terrorism and international peace and security disregard the internal security dimension of counter-terrorism law as well as the impact of these measures on

433 G de Baere, ‘From “Don’t Mention the Titanium Dioxide Judgment” to “I Mentioned it Once, But I Think I Got Away with it All Right”: Reflections on the Choice of Legal Basis in EU External Relations after the Legal Basis for Restrictive Measures Judgment’ (2013) 15 Cambridge Yearbook of European Legal Studies 537, 541–42. 434 Mitsilegas (n 373).

62 History, Principles and Institutions the fundamental rights of affected individuals. By giving security such a broad meaning in order to be able to justify the legality of an external relations legal basis, and at the same time finding that the use of this legal basis is incompatible with the use of an AFSJ legal basis for measures imposing terrorist sanctions, the Court radically reconfigured the relationship between the CFSP and other areas of EU law and policy.435 Post-Lisbon, Article 40 TEU436 has been seen as abolishing the pre-Lisbon hierarchy whereby CFSP should not affect EC policies by establishing an equal relationship between the CFSP and other fields of EU law and policy.437 Yet the Court’s ruling in the terrorist sanctions legal basis case effectively grants primacy to the CFSP over other policies, including the AFSJ. Any aspect which may fall under the very broad scope of security for the purposes of the CFSP would potentially negate the application of other legal bases located elsewhere in the Treaties. In this manner, EU policies relating to security (including internal security and AFSJ policies) are effectively subordinated to CFSP objectives.438 There is very little room for ‘internal security’ in a landscape where a large part of counterterrorism law can be seen as related to external security. In the case in question, the Court’s ruling has led to the paradox whereby terrorist sanctions – which are clearly related to internal security – were adopted pre-Lisbon under first pillar legal bases, whereas post-Lisbon, in an era where the old third pillar has collapsed and the AFSJ part of the Treaty contains a specific legal basis on terrorist sanctions, measures on such sanctions are adopted exclusively under an external relations legal basis. The key issue which the Court’s ruling fails to take into account is the content of the contested Regulation and the impact of its provisions on the affected individuals. As confirmed by the Court of Justice in its case law, including the Kadi litigation, terrorist sanctions have profound consequences for the daily lives and fundamental rights of affected individuals. The implementation of the UN sanctions regime by the EU reflects a change of paradigm, in that international law (and EU sanctions law) targets not states, but individuals. The impact of terrorist sanctions on fundamental rights clearly places them within the ambit of the part of the TFEU on the AFSJ, which focuses on law enforcement, contains a specific provision on terrorist sanctions, and whose title and provisions confirm the focus on developing policies on security and justice while respecting free

435 On the broad concept of security, see P Eeckhout, EU External Relations Law, 2nd edn (Oxford University Press, 2011) 181–83. 436 Article 40 reads as follows: ‘The implementation of the common foreign and security policy shall not affect the application of the procedures and the extent of the powers of the institutions laid down by the Treaties for the exercise of the Union competences referred to in Articles 3 to 6 of the Treaty on the Functioning of the European Union. Similarly, the implementation of the policies listed in those Articles shall not affect the application of the procedures and the extent of the powers of the institutions laid down by the Treaties for the exercise of the Union competences under this Chapter.’ 437 On different views on the relationship between the CFSP and other areas of EU policy post-Lisbon, see Eeckhout (n 435); P van Elsuwege, ‘The Adoption of “Targeted Sanctions” and the Potential for Interinstitutional Litigation after Lisbon’ (2011) 7 Journal of Contemporary European Research 488, 494, arguing for a non-hierarchical relationship. 438 E Neframi, ‘L’aspect externe de l’espace de liberté, de sécurité et de justice: quel respect des principes et objectifs de l’action extérieure de l’Union?’ in C Flaesch-Mougin and LS Rossi, La Dimension Extérieure de l’Espace de Liberté, de Sécurité et de Justice de l’Union Européenne après le Traité de Lisbonne (Bruylant, 2013) 509–32. Neframi argues that counter-terrorism measures fall under the external aspect of the AFSJ only to the extent that they do not relate to the CFSP (at 524).

Legal Basis Disputes and Contested Competence 63 movement and fundamental rights. The impact of terrorist sanctions imposed by EU law on fundamental rights not only justifies their treatment as an internal security measure falling within the AFSJ, but also necessitates a high intensity of scrutiny by the European Parliament. In its ruling, the Court seems to accept that fundamental rights will be observed anyway, especially post-adoption (by referring to the Kadi litigation). Yet this is not a convincing argument to exclude the European Parliament (which is a co-legislator post-Lisbon in the vast majority of EU internal security law) from having a decisive say on the content of EU measures which have a far-reaching impact on the daily lives and human rights of individuals affected by EU law. The Court’s willingness to prioritise the CFSP at the expense of AFSJ objectives in the context of security is confirmed in two rulings concerning piracy.439 In the first case, the European Parliament sought the annulment of Council Decision 2011/640/ CFSP of 12 July 2011 on the signing and conclusion of the Agreement between the EU and the Republic of Mauritius on the conditions of transfer of suspected pirates and associated seized property from the EU-led naval force to the Republic of Mauritius and on the holding conditions of suspected pirates after transfer.440 The Parliament alleged infringement of Articles 218(6) and 218(10) TFEU. With regard to Article 218(6), the Parliament argued that the Council was wrong to consider that the contested decision concerned an agreement relating exclusively to the CFSP within the meaning of the first part of the second subparagraph of Article 218(6) TFEU.441 Article 218(6) TFEU envisages the involvement of the European Parliament in the adoption of such decisions via consent442 or consultation443 ‘except where agreements relate exclusively to the CFSP’. The Council treated the contested Decision as involving an agreement relating exclusively to the CFSP. This is notwithstanding the fact that the agreement contains a number of provisions on judicial and police cooperation,444 and its stated aims include the transfer of persons suspected of attempting to commit, committing or having committed acts of piracy and the treatment of transferred persons.445 The Joint Action to which the contested Decision and subsequent agreement constitute a follow-up,446 and which calls for the conduct of an EU military operation (‘Operation Atalanta’) in support of UNSC Resolutions 1814(2008), 1816(2008) and 1838 (2008), includes in its mandate the arrest, detention and transfer of persons suspected of intending to commit acts of piracy or armed robbery,447 and includes a specific provision on the transfer of persons arrested and detained with a view to their prosecution.448 In spite of the inclusion of specific 439 Case C-658/11, European Parliament v Council, ECLI:EU:C:2014:2025; Case C-263/14, European Parliament v Council, ECLI:EU:C:2016:435 440 [2011] OJ L254/1. 441 Czech Republic v European Parliament and Council (n 337) para 23. 442 Article 218(6)(a), including cases involving agreements covering fields to which the ordinary legislative procedure applies (art 218((6)(a)(v)). 443 Article 218(6)(b). 444 See in particular arts 3–6 of the Agreement. 445 Article 1(a) and (c). 446 Council Joint Action 2008/851/CFSP of 10 November 2008 on a European Union military operation to contribute to the deterrence, prevention and repression of acts of piracy and armed robbery off the Somali coast ([2008] OJ L3010/33) as amended by Council Decision 2010/766/CFSP of 7 December 2010 [2010] OJ L327/49. 447 Article 2(e). 448 Article 12.

64 History, Principles and Institutions provisions dealing with judicial cooperation in criminal matters in both the agreement and its underlying Joint Action, the Court of Justice did not accept the Parliament’s argument that the contested decision and agreement do not pursue exclusively CFSP objectives.449 In order to reach this conclusion, the Court once again employed criteria of form rather than substance, focusing on procedure rather than content. According to the Court, Article 218(6) TFEU reflects a symmetry between EU internal and external action, with the substantive legal basis of a measure determining the procedures to be followed in adopting that measure:450 ‘in the context of the procedure for concluding an international agreement in accordance with Article 218 TFEU, it must be held that it is the substantive legal basis of the decision concluding the agreement which determines the type of procedure applicable under paragraph 6 of that provision’.451 The Court’s reasoning means that in practice, the unilateral decision by the EU legislator (on this occasion the Council) to label a decision concluding an international agreement as a CFSP Decision suffices to exclude the European Parliament from any involvement in the adoption of the decision, even in cases where the agreement following the adoption of the decision in question clearly includes elements related to non-CFSP EU policies, including judicial cooperation in criminal matters. This reasoning is even more noteworthy bearing in mind that the Parliament here did not challenge the legality of the use of the CFSP as a legal basis, but merely argued – correctly – that the contested Decision did not relate exclusively to the CFSP. The Court attempted to compensate for the exclusion of the Parliament from the procedure regarding the adoption of the contested decision by affirming its right to be informed immediately and fully under Article 218(10) TFEU. According to the Court, the procedural rule laid down in Article 218(10) ‘constitutes an essential procedural requirement within the meaning of the second paragraph of Article 263 TFEU and its infringement leads to the nullity of the measure thereby vitiated’.452 ‘That rule is the expression of the democratic principles on which the European Union is founded’453 and the Lisbon Treaty has enhanced its importance in the treaty system ‘by inserting it as a separate provision that is applicable to all types of procedures envisaged in Article 218 TFEU’.454 According to the Court, it cannot be inferred that despite its exclusion from the procedure for negotiating and concluding an agreement relating exclusively to the CFSP, the Parliament has no right of scrutiny in respect of that EU policy.455 On the contrary, it is precisely for that purpose that the information requirement laid down in Article 218(10) TFEU applies to any procedure for concluding an international agreement including agreements relating exclusively to the CFSP.456 If the Parliament is not immediately and fully informed at all stages of the procedure in accordance with Article 218(10) TFEU, including that preceding the conclusion of the agreement, it is not in a position to exercise the right of scrutiny which the Treaties have conferred on

449 Case

C-658/11, European Parliament v Council (n 439) para 47. para 57. 451 ibid para 58. 452 ibid para 80. 453 ibid para 81. 454 ibid para 82. 455 ibid para 84. 456 ibid para 85. 450 ibid

Legal Basis Disputes and Contested Competence 65 it in relation to the CFSP or, where appropriate, to make known its views as regards, in particular, the correct legal basis for the act concerned. The infringement of that information requirement impinges, in those circumstances, on the Parliament’s performance of its duties in relation to the CFSP and therefore constitutes an infringement of an essential procedural requirement.457 The same approach was taken in the second case where the European Parliament sought to annul Council Decision 2014/198/CFSP of 10 March 2014 on the signature and conclusion of an almost identical Agreement between the EU and the United Republic of Tanzania on the conditions of transfer of suspected pirates and associated seized property from the EU-led naval force to Tanzania. The Parliament had lodged that action for annulment before the delivery of the judgment in the case of the EU–Mauritius Agreement, putting forward the same pleas of law: that the decision in question ought not to have been adopted in accordance with the specific procedure for agreements relating exclusively to the CFSP prescribed in Article 218(6) TFEU, which excludes any participation of the European Parliament; and that the Council had failed to keep it immediately and fully informed at all stages in the negotiation and conclusion of the Agreement, as mandated by Article 218(1) TFEU. As in the case of the EU–Mauritius Agreement, the Parliament submitted that the Agreement served two objectives, with the secondary aim being the transfer of persons suspected of criminal activities, who are under the jurisdiction of the Member States and are on EU territory, to the judicial and police authorities of a third state in order to enable them to exercise their powers to investigate and prosecute in relation to those suspects.458 In its defence, the Council stressed the strong similarity between the two Agreements459 and further noted that the detention and transfer of suspected pirates was ‘no more than a mere consequence of Operation Atalanta’s security mission’.460 The Parliament understood the Court’s decision in Case C-658/11 as not having given a ruling on whether the contested Decision in that case should have been founded solely on the legal basis of Article 37 TFEU or whether, in addition, it should have been based on other Treaty provisions. While conceding that the elimination of piracy with the objective of protecting vessels was ‘undeniably’ the main objective of Operation Atalanta, it took the view that all the activities which follow on from that operation do not automatically fall within the scope of the CFSP.461 In response to the Parliament’s arguments, the Council took the view that the measures concerning the AFSJ, whether of an internal nature or having an external dimension, must be adopted with the objective of promoting freedom, security and justice within the EU or at its borders, and when transferring suspects pirates to Tanzania, no Member State exercises its jurisdiction.462 The Court retained its approach and found in favour of the Council. However, this time it was more prepared to engage with the aim and content of the Agreement in question. While recognising that the some of the obligations laid down in the EU–Tanzania

457 ibid

para 86. para 28. 459 ibid para 34. 460 ibid para 36. 461 ibid para 38. 462 ibid para 40. 458 ibid

66 History, Principles and Institutions Agreement appear, at first sight, to relate to the field of cross-border judicial cooperation in criminal matters and police cooperation, in line with the Advocate General’s view, it opined that an affinity with rules that may be adopted within an EU police area is not in itself sufficient to determine the appropriate legal basis.463 As regards the aim of the Agreement, the Court made a direct link to Operation Atalanta to stress that it is designed to establish a mechanism that is an essential element in the effective realisation of its objectives, particularly international cooperation regarding the prevention of acts of piracy and in general to preserve international peace and security.464 Therefore, the Agreement is merely ancillary to the European Union Naval Force Somalia (EU NAVFOR) action and would be rendered devoid of purpose as soon as that force ceases its activities.465 The Court considered it to be of no relevance that Member States themselves would be in a position to ensure that criminal proceedings were brought against the persons taken into custody.466 It further dismissed the argument that the actions undertaken by the naval force can be treated as equivalent to actions of the judicial or police authorities, since those actions take place exclusively within the framework of a specific operation falling within the scope of the CFSP, to which the performance of these are inseparably linked.467 The Court has attempted to address this democratic deficit not via the route of legality, but via the route of transparency by providing precise and strict guidelines as to the Council’s obligations of information. In particular, the Court first explained that the obligation to inform the Parliament is incumbent on the Council, since Article 218(2) TFEU prescribes that it is for the Council to authorise the opening of negotiations, to adopt negotiating directives and to authorise the signing and conclusion of the agreements.468 Second, it was submitted that this obligation does not merely arise at the beginning of the negotiations, but ‘extends to the stages that precede the conclusion of such an agreement, and therefore covers, in particular, the negotiation phase’.469 Third, the scope of the information obligation involves a series of components in the negotiating process: the authorisation to open negotiations, the definition of the negotiating directives, the nomination of the EU negotiator and, in some cases, the designation of a special committee, the completion of negotiations, the authorisation to sign the agreement, where necessary, the decision on the provisional application of the agreement before its entry into force and the conclusion of the agreement.470 Importantly, the Court cautiously underlined that whilst the information requirement does not extend to stages that are part of the internal preparatory process within the Council, it nonetheless ‘extends also to the intermediate results reached by the negotiations’.471 As such, ‘the Council should communicate the text of the draft agreement and the text

463 ibid

para 47. paras 49–51; see also para 54. 465 ibid para 51. 466 ibid para 52. 467 ibid para 53. 468 ibid para 73. 469 ibid para 75. 470 ibid para 76. 471 ibid para 77. 464 ibid

Sovereignty Concerns and the Persistence of National Diversity 67 of the draft decision approved by the Council’s Foreign Relations Counsellors who are responsible for the negotiations, when the text of those drafts was communicated to the Tanzanian authorities with a view to the conclusion of the agreement’.472 Fourth, the fact that agreement displaying similar characteristics existed and thus the Parliament could exercise scrutiny was of relevance.473 Fifth, the Court reiterated that publication in the Official Journal of the EU is not capable of remedying an infringement of Article 280(1) TFEU.474 Last, as regards the extent to which provision of information was late, because the Parliament was informed of the adoption of the contested Decision nine days later and not ‘immediately’ as mandated by Article 218(10) TFEU, the Court was more sympathetic, stating that in some circumstances, information delivered to the Parliament after a period of a few days may be regarded as ‘immediate’. However, the Council had failed to transmit both that Decision and the Agreement altogether. The analysis of the aforementioned rulings demonstrates that while the Court is not ready to grant to the European Parliament a full legislative scrutiny role in cases of measures involving the CFSP and other EU policies, it accepts that the Parliament should be fully and immediately informed in negotiations of international agreements under Article 218, even if the latter relate exclusively to the CFSP. The information requirement entails a precise and detailed scope from which the Council can no longer deviate. In this manner, the Court has, as will be seen below, to some extent prioritised transparency as a rule of law safeguard for internal security.

VIII. Sovereignty Concerns and the Persistence of National Diversity A key concern of Member States following the entry into force of the Lisbon Treaty has been the perceived adverse impact that the ‘communautarisation’ of EU criminal law would have on state sovereignty and the diversity of their domestic criminal justice systems. In order to address these concerns, the Lisbon Treaty introduced a number of mechanisms aiming to safeguard sovereignty national legal diversity in the field of criminal justice. These mechanisms reflect what I have called resistance to the ‘communautarisation’ of EU criminal law475 and have resulted in the shadow of the third pillar ‘looming large’ post-Lisbon.476 This section will focus on four key mechanisms aimed at safeguarding the role of the state in shaping EU criminal law and addressing sovereignty and national diversity concerns: provisions on the form and legal effect of EU criminal law; provisions on strategy and initiative; provisions on subsidiarity; and provisions on variable geometry and enhanced cooperation.

472 ibid. 473 ibid para 78. 474 ibid paras 79–80. 475 V Mitsilegas, ‘European Criminal Law and Resistance to Communautarisation Post-Lisbon’ (2010) 1 New Journal of European Criminal Law 458. 476 J Monar, ‘The Institutional Framework of the AFSJ: Specific Challenges and Dynamics for Change’ in J Monar (ed), The Institutional Dimension of the European Union’s Area of Freedom, Security and Justice (Peter Lang, 2010) 21–52, at 47.

68 History, Principles and Institutions

A. National Diversity, Directives and the Emergency Brake In terms of the first mechanism outlined above, respect for national diversity occupies a central place from the very outset in Title V TFEU on the AFSJ. Its opening provision, Article 67(1), states that the EU will constitute an AFSJ ‘with respect for fundamental rights and the different legal systems and traditions of Member States’. The emphasis on maintaining the diversity of national legal systems is further reflected in a number of choices made in the Treaty with regard to the method of law-making in EU criminal law. The Lisbon Treaty places great emphasis on mutual recognition as a method of European integration in criminal matters, and, as will be seen further in this chapter, extends EU competence in criminal procedure only by subordinating harmonisation in the field to mutual recognition – this choice is significant, as mutual recognition does not in principle involve the adoption of harmonised EU standards and is perceived, at least prima facie, by governments as less threatening to state sovereignty, as they will not have to change their law.477 The need to respect national diversity is also reflected in the choice of the form of EU legislative action concerning the harmonisation of substantive criminal law and criminal procedure: in both cases, harmonisation will take place by means of Directives.478 This choice is significant as Directives leave Member States with a considerable margin of manoeuvre as to how to implement EU law, being binding as to the result to be achieved, but leaving the choice of form and methods to the national authorities.479 This discretion left to Member States may serve to take into account the particularities of their domestic criminal justice systems when called on to implement EU measures on matters such as rules on the admissibility of evidence or the rights of the defendant in criminal proceedings.480 It is clear that Member States opted for such discretion rather than for top-down uniform standards across the EU. Concerns with regard to the respect of national diversity and the challenges to state sovereignty posed by the introduction of supranational decision-making in EU criminal law have been articulated perhaps most clearly in the introduction of provisions establishing a so-called ‘emergency brake’ on the adoption of Directives in the fields of criminal procedure and substantive criminal law. Under the ‘emergency brake’ procedure, where a Member State considers that a draft Directive in the field ‘would affect fundamental aspects of its criminal justice system’, it may request that the draft directive be referred to the European Council – leading to the suspension of the ordinary legislative procedure. After discussions in the European Council, in the event of consensus, within four months of this suspension, the proposal is sent back to the Council of Ministers for the resumption of negotiations. In the event of disagreement, within the same timeframe, authorisation for Member States who wish to proceed with the proposal under enhanced cooperation referred to in Articles 20(2) TEU and 329(1) TFEU is deemed to be granted.481 In this manner, reluctant Member States which may be in the

477 I have developed this point further in V Mitsilegas, ‘The Constitutional Implications of Mutual Recognition in Criminal Matters in the EU’ (2006) 43 CML Rev 1277. 478 Articles 82(2), 83(1) and (2) TFEU respectively. 479 ibid art 288(3). 480 For the legal bases for such measures, see art 82(2)(a) and (b) TFEU respectively. 481 Article 82(3) TFEU on criminal procedure and art 83(3) TFEU on substantive criminal law.

Sovereignty Concerns and the Persistence of National Diversity 69 minority may ensure that they do not take part in the measure, while allowing those in favour of the measure to proceed with its adoption.482 As witnessed by the inclusion of the European Council in the legislative process, the emergency brake is a primarily political mechanism of dispute resolution which places national governments centre stage in terms of law-making at the EU level.483 It has not been used widely thus far, but its existence remains important for national authorities.484 The European Council here assumes the role of a mediator in cases where Member States express concerns over the development of EU criminal law and press the emergency brake. A similar procedure is envisaged in the event of disagreement on legislation establishing a European Public Prosecutor, and legislation establishing operational cooperation between national law enforcement authorities (although in both cases, unanimity is in principle required in the Council).485

B. The European Council: Initiative and Strategy In terms of maintaining national influence at an institutional level by controlling the initiative on future strategic priorities, an important institutional development in the Lisbon Treaty is the express recognition of the European Council as one of the EU institutions.486 According to the Treaty, the European Council – the most intergovernmental of the EU institutions – will provide the EU with the necessary impetus for its development and will define the general political directions and priorities thereof, but will not exercise legislative functions.487 This is an example of what has been characterised as the ‘high politics’ nature of the European Council decisions.488 This role of the European Council is further confirmed in the specific context of EU Justice and Home Affairs, with Title V TFEU stating that the European Council will define ‘the strategic guidelines for legislative and operational planning within the area of freedom, security and justice’.489 It is thus the leaders of Member States who will continue to set out, post-Lisbon (as in the cases of Tampere Conclusions, The Hague Programme and most recently the Stockholm Programme), the general guidelines for the development of EU Justice and Home Affairs law.

482 For an analysis of several aspects of the emergency brake mechanism, see J Öberg, ‘Exit, Voice and Consensus: A Legal and Political Analysis of the Emergency Brake in EU Criminal Policy’ (2021) 46 European Law Review 506. 483 For a discussion of the ‘emergency brake’ provisions, see House of Lords European Union Committee, The Treaty of Lisbon: An Impact Assessment, 10th Report, session 2007–08, HL Papers 62-I and 62-II, paras 6.44–6.66. 484 See the Lisbon judgment of the German Constitutional Court in ch 2. 485 Articles 86(1) and 87(3) TFEU respectively. 486 See art 13(1) TEU. Under Lisbon, the European Council will consist of the Heads of State or Government of the Member States, together with its President and the President of the Commission, with the High Representative of the Union for Foreign Affairs and Security Policy also taking part in its work (art 15(2) TEU). 487 ibid art 15(1). However, note that the Treaty does not preclude acts of the European Council from having effects on third parties and thus establishing ECJ jurisdiction; see art 263(1) TFEU. On the role and procedures of the European Council, see art 15 TEU and arts 235 and 236 TFEU. 488 See M Dougan, ‘The Treaty of Lisbon 2007: Winning Minds, Not Hearts’ (2008) 45 CML Rev 627. 489 Article 68 TFEU.

70 History, Principles and Institutions This emphasis on the role of the European Council in drawing up the strategy for the EU action in the AFSJ creates inevitable tensions in the general framework of supranationalisation of EU criminal law post-Lisbon. The prominent role of the European Council seems potentially at odds with the central role of the Commission as a generator of initiative and policy. These tensions between Member States and the Commission became public in the context of the implementation of the Stockholm Programme and the publication of the Commission’s Action Plan to that effect. Member States took the striking step of criticising the Commission’s priorities, with the June 2010 Justice and Home Affairs Council emphasising ‘strongly that the Stockholm Programme is the only guiding frame of reference for the political and operational agenda of the European Union in the Area of Freedom, Security and Justice’, noting that ‘some of the actions proposed by the Commission are not in line with the Stockholm Programme and that others, being included in the Stockholm Programme, are not reflected in the Communication of the Commission’, urging the Commission ‘to take only those initiatives that are in full conformity with the Stockholm Programme in order to ensure its complete and timely implementation’ and finally calling on ‘all parties concerned to ensure due implementation of all necessary measures and actions stemming from the Stockholm Programme, including those not present in the above Commission proposal’.490 These are far-reaching conclusions, aiming to assert the exclusivity of the Member States’ strategic initiative in the AFSJ, and to push through the totality of Member States’ priorities under Stockholm, disregarding the Commission’s views. Competition as to who has the final say, rather than cooperation, sits uneasily with the principle of mutual sincere cooperation between the EU institutions.491 In its post-Stockholm follow-up, the European Council has again departed from the positions of the other institutions492 and has demonstrated a marked lack of ambition with regard to the adoption of new EU legislation in the field of criminal law and a strong emphasis on consolidation and implementation.493 More than a decade since the entry into force of the Lisbon Treaty, we have seen the end of the format of the five-year strategy plans like The Hague and the Stockholm Programmes. On the other hand, we have seen the Commission focusing on specific priorities, not over-legislating (for some under-legislating) and also focusing on sectoral initiatives such as the development of a ‘Security Union’.494 The initiative remains with Member States not only at the stage of the initiation of policy and strategy, but also at the stage of the initiation of legislation: individual Member States (and not the European Council as such) retain the right of initiative

490 Council conclusions on the Commission Communication, ‘Delivering an area of freedom, security and justice for Europe’s citizens – Action Plan Implementing the Stockholm Programme’, 3018th Justice and Home Affairs Council meeting, Luxembourg, 3 June 2010, points 1, 3, 4 and 6 respectively. 491 Article 13(2) TEU. 492 On the Commission’s views, see Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, ‘An open and secure Europe: making it happen’ COM (2014) 154 final, Brussels, 11 March 2014; European Parliament, Motion for a Resolution on the mid-term review of the Stockholm Programme, 2013/2024 (INI), 4 March 2014. 493 European Council Conclusions, 26–27 June 2014, Brussels, EUCO 79/14, para 3. 494 For details, see V Mitsilegas and S Carrera (eds), Constitutionalising the Security Union: Effectiveness, Rule of Law and Rights in Countering Terrorism and Crime (Centre for European Policy Studies, 2017).

Sovereignty Concerns and the Persistence of National Diversity 71 after Lisbon, sharing the right with the Commission – proposals for EU legislation on police cooperation and judicial cooperation in criminal matters can be tabled either by the Commission or on the initiative of a quarter of Member States.495 In this manner, Member States retain some control of the legislative agenda. Pre-Lisbon, Member States – at times involved in consecutive EU presidencies/troikas – have used the right of initiative to table proposals on matters perceived as quite close to state sovereignty and thus rather ‘intergovernmental’ – examples in this context include a series of Member States’ sole or joint initiatives promoting mutual recognition in criminal matters,496 as well as initiatives that can be seen at times as a pre-emptive response to more integrationist proposals due by the Commission.497 These tendencies continued to some extent in the early days after the entry into force of the Lisbon Treaty. Key examples are the Directives on the European Protection Order498 and on the European Investigation Order,499 which were adopted as Member State initiatives. The rationale behind Member State intervention has been different in these two cases: in the European Investigation Order, Member States clearly wanted to control the agenda, while the European Protection Order was an instrument which was essentially promoted by a Member State (Spain) and not by the Commission. Another example of a showdown between the Commission and Member States is the adoption of the first EU instrument on defence rights, namely the Directive on the right to translation and interpretation in criminal proceedings, with Member States tabling a draft Directive in the field shortly after the entry into force of the Treaty (as early as 11 December 2009).500 The Commission’s response was to propose its own initiative for a Directive on the right to interpretation and translation in criminal proceedings, tabled in March 2010.501 The Commission’s proposal can be seen as an attempt to defend its own right of initiative in the field after Lisbon. The Directive on the right to interpretation and translation was eventually deemed to be agreed as a Member State initiative,502 but the subsequently adopted measures on procedural rights have been adopted as Commission initiatives, with the decision-making process in the field being now fully normalised.

495 Article 76 TFEU. 496 See n 77 above. 497 The example of the evolution of Eurojust is characteristic in this context; see V Mitsilegas, ‘The Third Wave of Third Pillar Law: Which Direction for EU Criminal Justice?’ (2009) 34 European Law Review 523. 498 Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters [2004] OJ L130/1, 1 May, was an initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Republic of Estonia, the Kingdom of Spain, the Republic of Austria, the Republic of Slovenia and the Kingdom of Sweden. 499 Directive 2011/99/EU of the European Parliament and of the Council of 13 December 2011 on the European protection order [2011] OJ L338/2, 21 December, was an initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Republic of Estonia, the Kingdom of Spain, the French Republic, the Italian Republic, the Republic of Hungary, the Republic of Poland, the Portuguese Republic, Romania, the Republic of Finland and the Kingdom of Sweden. 500 Initiative for a Directive on the rights to interpretation and translation in criminal proceedings, tabled by Belgium, Germany, Estonia, Spain, France, Italy, Luxembourg, Hungary, Austria, Portugal, Romania, Finland and Sweden, Council Doc 16801/09, Brussels, 11 December 2009. 501 COM (2010) 82 final, Brussels, 9 March. 502 Preamble, recital 2.

72 History, Principles and Institutions

C. Subsidiarity and its Limits A central theme in the discussions on the reform of the EU constitutional framework, including the negotiations on the Lisbon Treaty, has been the issue of ‘bringing Europe closer to its citizens’ – with the principle of subsidiarity, used to best allocate the level of desired action in Europe, playing a central part in this context.503 The principle of subsidiarity has been enshrined post-Lisbon in Article 5 TEU, which states that in areas which do not fall within its exclusive competence, the EU must act only if and insofar as the objectives of the proposed action cannot be sufficiently achieved by the Member States, either at a central level or at a regional and local level, but can rather, by reason of the scale or effects of the proposed action, be better achieved at the EU level. In the field of criminal law, respect for the principle of subsidiarity and its monitoring can be seen as a safeguard for respecting national legal diversity, which, as seen above, is one of the aims of the evolution of the EU as an AFSJ under Article 67 TFEU. The move towards a greater focus on subsidiarity as a constitutional principle of EU law – as a means of better justifying action at the EU level and of connecting citizens with the EU – has been inextricably linked with calls to provide national parliaments with a greater role in the scrutiny and development of EU legislation. The view that national parliaments can address the democratic deficit in the EU by providing a useful intermediate link between the EU and citizens in the various Member States, and can provide extra checks on proposed EU action in particular by monitoring subsidiarity, justifies and underpins the expansion of the relevant provisions in the Lisbon Treaty.504 The Lisbon Treaty brings national parliaments more prominently within the EU legal framework. According to Article 12 TEU, national parliaments contribute actively to the good functioning of the EU in a number of ways, including being informed by EU institutions of draft legislation505 and seeing that the principle of subsidiarity is respected506 – with more detailed provisions on both roles included in separate protocols annexed to the Treaty.507 A specific provision on national parliaments and subsidiarity is also included in Title V TFEU, which states that national parliaments ensure that proposals and legislative initiatives in the field of police cooperation and judicial cooperation in criminal matters comply with the principle of subsidiarity in accordance with the relevant protocol.508 The Subsidiarity Protocol establishes a so-called ‘early warning mechanism’ leading to a ‘yellow card’: any national parliament or any chamber of a national parliament can send to EU institutions, within eight weeks from the 503 See T Tridimas, The General Principles of EU Law, 2nd edn (Oxford University Press, 2006) ch 4; and, for a post-Lisbon analysis, P Craig, EU Administrative Law, 2nd edn (Oxford University Press, 2012) 390–98. 504 For an early analysis of the link between national parliaments, subsidiarity and monitoring EU powers in the context of the Convention on the Future of Europe, see A Vergés Bausili, Rethinking the Methods of Dividing and Exercising Powers in the EU: Reforming Subsidiarity and National Parliaments, Jean Monnet Working Paper 9/02, NYU School of Law, at https://www.jeanmonnetprogram.org/archive/papers/02/020901.pdf; see also House of Lords European Union Committee (then Select Committee on the European Union), The Future of Europe: National Parliaments and Subsidiarity: The Proposed Protocols, 11th Report, session 2002–03, HL Paper 70. 505 Article 12(a) TEU. 506 ibid art 12(b). See also art 5(1) and (3) on the principle of subsidiarity. 507 Protocol No 1 on the Role of National Parliaments in the European Union and Protocol No 2 on the Application of the Principles of Subsidiarity and Proportionality respectively. 508 Article 69 TFEU.

Sovereignty Concerns and the Persistence of National Diversity 73 transmission of draft legislative acts (and their amended drafts), ‘a reasoned opinion stating why it considers that the draft in question does not comply with the principle of subsidiarity’;509 where such reasoned opinions for EU criminal law proposals represent at least one-quarter of the votes allocated to national parliaments, the draft must be reviewed.510 Protocol No 2 contains a further, ‘orange card’ mechanism: under the ordinary legislative procedure, where reasoned opinions represent at least a simple majority of the votes allocated to national parliaments, the proposal must be reviewed, and if the Commission chooses to maintain the proposal, a special procedure is triggered in the Council and the European Parliament examining whether negotiations should go ahead.511 The Protocol also contains a provision on the ex post control of subsidiarity, granting jurisdiction to the Court of Justice in actions on the grounds of infringement of the principle of subsidiarity by a legislative act, brought in accordance with the rules laid down in Article 263 TFEU by Member States, or notified by them in accordance with their legal order on behalf of their national parliament or a chamber thereof.512 However, it is clear that national parliaments cannot block the adoption of EU law. As Schütze notes, the Lisbon mechanism will leave the political decision on subsidiarity ultimately to the European legislator, while allowing national parliaments to channel their scrutiny to where it can be most useful and effective, namely on their respective national governments.513 In the field of EU criminal law, it was the Commission’s proposal for a Regulation on the establishment of a EPPO which provided national parliaments with the opportunity to issue a ‘yellow card’, reflecting concerns in a number of Member States about the content of the proposal and the added value of the EPPO. The process and content of the opinions of national parliaments was summarised by the European Commission in its response containing a review of national parliaments’ subsidiarity concerns.514 No fewer than 14 chambers of national parliaments had sent reasoned opinions to the Commission, thus triggering the subsidiarity control mechanism provided for in Article 7(2) of the Protocol.515 The Commission summarised and responded to the main subsidiarity concerns as follows. The first concern involved the view that the Commission did not sufficiently explain the reasons justifying the proposal. Reference was made to the – quite laconic – subsidiarity assessment put forward by the Commission in the foreword to the text of the draft Regulation. The Commission on the other hand rebuked this claim by referring to

509 Articles 4 and 6 of Protocol No 2. 510 ibid art 7. For all other proposals, the threshold is one-third of the votes. 511 ibid art 7(3). 512 ibid art 8. For an analysis, see J-C Piris, The Lisbon Treaty: A Legal and Political Analysis (Cambridge University Press, 2010) 130; and X Groussot and S Bogojevic, ‘Subsidiarity as a Procedural Safeguard of Federalism’ in Azoulai (ed) (n 334) 234–52. 513 R Schütze, From Dual to Cooperative Federalism: The Changing Structure of European Law (Oxford University Press, 2009) 60–61. 514 European Commission, Communication from the Commission to the European Parliament, the Council and the National Parliaments on the review of the proposal for a Council Regulation on the establishment of the European Public Prosecutor’s Office with regard to the principle of subsidiarity, in accordance with Protocol No 2, COM (2013) 851 final, Brussels, 27 November. 515 ibid 3.

74 History, Principles and Institutions the detailed justifications provided in the impact assessment preceding the proposal.516 While it is true that the Commission did not refer expressly to the impact assessment in the text or the foreword to the draft Regulation,517 it must be recognised that the impact assessment itself has been extremely detailed and followed detailed external and internal consultation on the proposal. The second principal subsidiarity argument put forward by national parliaments was that investigation and prosecution action by Member State and EU coordination mechanisms are sufficient to tackle fraud against the EU budget. The Commission responded by referring to the statistics from the European Anti-Fraud Office (OLAF), showing that the Treaty objective of an effective, deterrent and equivalent level of protection is not achieved in general518 and by pointing out the limitations of OLAF, Europol and Eurojust in particular regarding issues of admissibility of crossborder evidence and establishing cross-border links.519 The latter point can arguably be addressed by reforming existing EU criminal justice bodies, while on the evidence of the scale of the phenomenon, detailed OLAF statistics should be accompanied by external independent studies.520 The third doubt by national parliaments concerned the added value of the EPPO, to which the Commission responded by stressing the need for a common EU-level prosecution policy and the contribution of the EPPO towards the simplification of action in cross-border cases521 (although the latter does not seem to be the focal point of the Commission’s draft). The fourth subsidiarity concern by national parliaments involved the centralised structure of the EPPO, to which the Commission responded that while a collegiate structure is not necessarily less centralised than that of the proposal, it can hamper efficiency, rendering its decision-making less efficient.522 The fifth concern involved the extension of the powers of the EPPO via the attribution of exclusive and ancillary competence by the Regulation, to which the Commission responded that exclusive competence arises out of the nature of the crimes in question which have an intrinsic EU dimension (thus putting forward a federal, ‘Eurocrimes’ argument), while pointing out that the attribution of ancillary competence may work in both directions.523 In the light of the above, the Commission concluded that its proposal complied with the principle of subsidiarity enshrined in Article 5(3) TEU and that a withdrawal or an amendment of the proposal was not required. It decided to maintain the proposal, but reassured the recipients of its report that it would take due account of the reasoned

516 European Commission, Commission Working Document: Impact Assessment accompanying the proposal for a Council Regulation on the establishment of the European Public Prosecutor’s Office, SWD (2013) 274 final, Brussels, 17 July 2013. 517 H Bang Fugslang Madsen and T Elholm, ‘EPPO and the Principle of Subsidiarity’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stifelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015) 31–50, at 40. 518 ibid 5. 519 ibid 7–8. 520 Note in this context the criticism by the House of Lords European Union Committee pointing out that the Commission treats VAT fraud as a fraud affecting the financial interests of the EU when the UK, along with other Member States, does not consider that it is. See House of Lords European Union Committee, Subsidiarity Assessment: The European Public Prosecutor’s Office, 3rd Report, session 2013–14, HL Paper 65, 6–7. 521 ibid 9. 522 ibid 10. 523 ibid 11–12.

Sovereignty Concerns and the Persistence of National Diversity 75 opinions of the national parliaments during the legislative process.524 The Commission’s approach met with adverse reactions at the national level, with the Dutch Parliament in particular criticising the lack of willingness by the Commission to engage in a dialogue with national parliaments.525 Regarding the procedure followed, one can indeed view the glass as half full or half empty depending on one’s perspective: from a supranational position, subsidiarity review has played a significant role in forcing the Commission to revisit its proposal and to provide a detailed explanation of its reasoning and justification of the proposal; however, from a national perspective, the lack of a detailed follow-up may come as a disappointment, demonstrating a lack of substantive engagement with national parliamentary concerns. Regarding the substance of the Commission’s subsidiarity assessment, one may agree or disagree with the content and rigour of its reasoning. However, what has been made clear is the temporal limitation of the ‘yellow card’ mechanism, in that it does not take into account subsequent developments in negotiations in the Council. Indeed, the move from a centralised to a collegiate model may temper the Commission’s efficiency argument. Moreover, the possible exclusion of VAT fraud from the scope of the mandate of the EPPO would raise further questions with regard to the evidential basis and added value of the establishment of a new EU prosecutorial body.526 These are questions which can be further addressed before the Court of Justice if an action for annulment of the eventually adopted EPPO Regulation is brought under Article 8 of Protocol No 2.

D. The Limits of Justice à la Carte: Variable Geometry Another legal avenue aiming to address Member States’ concerns on the impact of the ‘Lisbonisation’ of EU criminal law on state sovereignty and national diversity has been the option for states not to participate in EU criminal law adopted under Title V TFEU. Conditions for non-participation (or ‘opt-outs’) are spelt out in a series of Protocols accompanying the Lisbon Treaty which determine the specific position of a number of EU Member States, in particular Denmark, Ireland and (in the pre-Brexit era) the UK. Protocol No 22 on the position of Denmark states that Denmark will not take part in the adoption of all Title V measures527 and that no Title V measure will be binding upon or applicable to it.528 Denmark may decide to opt into Schengen building measures adopted post-Lisbon, and in such cases the measures will create an obligation under international law between Denmark and the other Member States bound by the measure.529 At any time Denmark may decide not to avail itself of all or part of the Protocol, in which case Denmark will apply in full all relevant measures then in force taken within the framework of the EU.530 Moreover, at any time Denmark may notify the other Member States of the replacement of Part I of the Protocol with provisions attached in its annex,

524 ibid

11. Fugslang Madsen and Elholm (n 517) 45–46. of VAT fraud were eventually included within the remit of the EPPO; see ch 8. 527 Protocol No 22, art 1(1). 528 ibid art 2. 529 ibid art 4(1). 530 ibid art 7. 525 Bang

526 Aspects

76 History, Principles and Institutions introducing, inter alia, an ‘opt-in’ mechanism similar to the arrangements for the UK and Ireland.531 Denmark has also declared that it will not block measures which contain both provisions applicable to it and provisions not applicable to it.532 In terms of the position of the UK and Ireland, Protocol No 19 on the Schengen acquis continued these Member States’ pre-Lisbon position after Lisbon, stating in particular that they may at any time request to take part in some or all of the provisions of the Schengen acquis, but that the Council must decide on this request by unanimity of the full Schengen members.533 Moreover, Protocol No 21 also extended the UK and Irish ‘opt-out’ (or rather the option for these Member States not to participate in EU law) to EU criminal law by covering all measures under Title V TFEU. Ireland (and before Brexit the UK) may decide to take part in post-Lisbon Title V measures on a case-by-case basis.534 Further, Protocol No 36 on Transitional Provisions retained the limited powers of EU institutions under the largely intergovernmental framework of the third pillar with regard to third pillar law for a period of five years after the entry into force of the Lisbon Treaty.535 In addition to these country-specific provisions, the Lisbon Treaty has also introduced a more generalised legal possibility for the development of EU criminal justice à la carte, in the Treaty legal basis enabling the establishment of an EPPO. Reflecting Member States’ concerns over the impact of such an agency on national sovereignty and legal diversity, Article 86 TFEU introduces an exception to the ordinary decision-making procedure by requiring unanimity in the Council for the establishment of the EPPO. However, if such unanimity is not forthcoming, the Treaty enables the establishment of enhanced cooperation with the participation of at least nine Member States.536 These ‘opt-outs’ and enhanced cooperation avenues reflect a mistrust of Member States towards European integration in criminal matters. This mistrust is extended in the relations between EU Member States in the context of full membership of the Schengen acquis. Acceptance to full membership remains intergovernmental, with accession to the EU not meaning automatic Schengen membership for the newcomers – although the latter had to implement the Schengen acquis pre-accession, the old, ‘intergovernmental’ mechanism of granting full Schengen membership remains, with the existing Schengen members being required to agree unanimously on the readiness of candidate countries to be members.537 A long time after their accession to the EU, Bulgaria, Romania and Croatia are still at the time of writing not full Schengen members.538 On the other hand, a higher degree of trust towards non-EU Member States has led to the full 531 Protocol No 22, art 8. 532 Declaration 48 annexed to the Final Act of the Lisbon Treaty. 533 Protocol No 19, art 4. 534 See arts 3 and 4 of Protocol No 21. 535 Article 10(1) and 10(3) of Protocol No 36. For further analysis, see ch 12. 536 Article 86(1) TFEU. For details on how enhanced cooperation has evolved in the adoption of the EPPO Regulation, see ch 8. 537 On the sensitivity of Schengen membership for newcomers, see Mitsilegas, Monar and Rees (n 1); and J Monar, Enlargement-Related Diversity in EU Justice and Home Affairs: Challenges, Dimensions and Management Instruments, Dutch Scientific Council for Government Policy, Working Document W112, The Hague, 2000. 538 See the calls by the European Parliament in favour of full membership: https://www.europarl.europa.eu/ doceo/document/A-9-2021-0183_EN.html, para 7.

The Interplay between EU Criminal Law and Upholding the Rule of Law 77 Schengen membership of Iceland, Norway,539 Switzerland540 and Liechtenstein.541 The high degree of mutual trust allowing membership of the Schengen area has significant implications for the position of states in EU criminal law. The high degree of mutual trust (and the operational capacities offered by the use by third states of key EU mechanisms underpinning intra-EU cooperation in criminal matters, such as the Schengen Information System (SIS) II)542 has facilitated the conclusion of an Agreement on surrender between the EU and Norway and Iceland.543 The CJEU has evoked this close relationship in extending the protection provided by EU law to a national of Iceland: according to the Court, the fact that the person concerned has the status as a national of an EFTA state, which is a party to the EEA Agreement, but also the fact that that state implements and applies the Schengen acquis, renders the situation of that person objectively comparable with that of an EU citizen to whom, in accordance with Article 3(2) TEU, the EU offers an AFSJ without internal frontiers, in which the free movement of persons is ensured.544 The Court noted that while Iceland did not take part in the European Arrest Warrant Framework Decision, it was party to a surrender Agreement with the EU, which reflected close cooperation and mutual trust and whose provisions on the surrender procedure are very similar to those of the European Arrest Warrant Framework Decision.545 A close, ‘special’ relationship based on a high level of mutual trust is thus recognised by the Court.

IX. The Interplay between EU Criminal Law and Upholding the Rule of Law In recent years, links between rule of law concerns and the operation of EU criminal law have come prominently to the fore. These concerns are inextricably linked with the question of mutual trust between authorities which are entrusted to implement and operate EU criminal law instruments and mechanisms. The existence and extent of mutual trust is dependent on broader issues of rule of law fundamentals, including judicial independence and robust anti-corruption standards. However, these questions are not new. Considerations relating to mutual trust and the rule of law have appeared

539 Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters’ association with the implementation, App and development of the Schengen acquis – Final Act [1999] OJ L176/36. 540 Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, App and development of the Schengen acquis [2008] OJL 53/52. 541 Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, App and development of the Schengen acquis [2011] OJ L160/3. 542 On the SIS II, see ch 9. 543 Agreement between the European Union and the Republic of Iceland and the Kingdom of Norway on the surrender procedure between the Member States of the European Union and Iceland and Norway – Declarations [2006] OJ L292/2. 544 Case C-897/19 PPU, Ruska Federacija, EU:C:2020:262, para 58. 545 ibid paras 72–74.

78 History, Principles and Institutions prominently in the process of accession of new Member States in the EU. The road of third countries towards their accession to the EU is marked by a very strong role for the EU as a ‘rule generator’, exporting EU law to third countries.546 The latter are obliged to adopt and implement the EU acquis as an indispensable condition for them joining the EU, with accession thus being dependent on conditionality in those terms.547 Conditionality is central to the enlargement process in ensuring that the new Member States are able to absorb the – at times heavy – demands of the EU acquis and ultimately fully assume their membership obligations. From the point of view of ‘old’ Member States, conditionality is crucial in creating trust towards the newcomers, thus contributing to mutual trust within the EU post-accession.548 The link between conditionality and trust appeared very prominently in the process leading to the eastward enlargements of the EU. In this context, the EU had to face a situation whereby countries in transition, with a very different economic, social and political background, were aiming at being further integrated with the EU. To address this complexity, the EU adopted a gradual approach, much broader than simply requiring candidates to adopt the EU acquis. The European Council adopted in 1993 the so-called Copenhagen criteria –these included, inter alia, institutional stability guaranteeing democracy, the rule of law, human rights and minority protection, and the existence of a functioning market economy.549 These criteria in effect co-existed with the specific requirements to implement the specific EU acquis in criminal matters in the accession process, and continue to be of relevance in the assessment of candidates’ (but also new Member States’) progress in meeting EU standards. Moreover, compliance with aspects of EU criminal law such as anti-money-laundering measures was also prompted – much earlier than the adoption of specific negotiating Justice and Home Affairs chapters – by the need to achieve internal market integration.550 The issue of trust in the candidate countries of Central and Eastern Europe has been central in the field of integration in criminal matters. The transitional state of these countries in the early 1990s raised fears that political, societal and economic instability would lead to the development of criminogenic factors which would ‘export’ criminality to the EU. The East was thus increasingly viewed as a source of insecurity, threatening the ‘safe’ inside of the EU – with mistrust regarding the potential capacity of the relevant candidate countries to provide security in home affairs being prevalent.551 Linked to

546 On the concept of the EU as a ‘rule generator’, see M Cremona, ‘The Union as a Global Actor: Roles, Models and Identity’ (2004) 41 CML Rev 555, 557–58. 547 On conditionality and enlargement, see KE Smith, ‘The Evolution and Application of EU Membership Conditionality’ in M Cremona (ed), The Enlargement of the European Union (Oxford University Press, 2003) 105–40; see also F Schimmelfennig and U Sedelmeier, ‘Governance by Conditionality: EU Rule Transfer to the Candidate Countries of Central and Eastern Europe’ (2004) 11 Journal of European Public Policy 661. 548 On the link between conditionality and trust, see M Cremona, ‘Introduction’ in Cremona (n 547) 1–8, at 5–6. 549 For an overview, see C Hillion, ‘The Copenhagen Criteria and Their Progeny’ in C Hillion (ed), EU Enlargement: A Legal Approach (Hart Publishing, 2004) 1–22. 550 See European Commission, White Paper – Preparation of the Associated Countries of Central and Eastern Europe for integration into the internal market of the Union, COM (95) 163 final. For further details, see V Mitsilegas, Money Laundering Counter-measures in the European Union (Kluwer Law International, 2003) 79–80. 551 See Mitsilegas, Monar and Rees (n 1) 126–27.

The Interplay between EU Criminal Law and Upholding the Rule of Law 79 the background of the candidate countries, exiting from a communist past,552 a related source of mistrust involved the ability of these countries to actually implement the EU criminal law standards in the light of the weakening of their internal control structures (an ability which would mean – along with the implementation of specific EU measures – a remodelling of institutions and mentality/culture in the criminal law sphere).553 It is this lack of trust in implementation capacity that was to some extent behind the recommendation by the European Council554 and the subsequent adoption by the Justice and Home Affairs Council of a ‘Pre-Accession Pact’ on Organised Crime between the EU Member States and the applicant countries of Central and Eastern Europe (and Cyprus).555 The Pact, which called inter alia for intensified police and judicial cooperation in criminal matters and action to combat corruption and money laundering, was soon followed by the establishment, via a Joint Action, of a mechanism for collective evaluation of the Justice and Home Affairs acquis by candidate countries.556 This evaluation mechanism (conducted by experts from Member States and the Commission) was ‘without prejudice’ to the accession negotiations,557 but the Commission was invited to take account of the collective evaluations produced in the context of the pre-accession strategy and evaluations would be taken into account ‘in the context of future discussions on enlargement’.558 This move is another example of the emphasis placed by the existing EU Member States on addressing the lack of trust and the perceived limited capacity of candidate countries to effectively implement EU measures in criminal matters. In this climate of mistrust and with negotiations on the Justice and Home Affairs chapter beginning at the end of the 1990s, the candidate countries had to face considerable challenges prior to their eventual accession in the EU.559 A central challenge has been the ‘moving target’ character of the EU acquis in criminal matters, with EU criminal legislation proliferating following the entry into force of the Amsterdam Treaty and events such as 9/11, which rendered EU action in criminal matters a top priority for Member States. Candidate countries were thus asked to implement a constantly growing acquis, the novelty of which posed significant challenges to the ‘old’ Member States.560 Along with this quantitative change, the EU acquis in criminal matters presented a qualitative change as well: the integration of the Schengen acquis in the EC/EU legal framework in Amsterdam (and the related proclaimed EU objective of developing 552 For an overview of crime control features under Communism, see A Fijakowski, ‘The Paradoxical Nature of Crime Control in Post-communist Europe’ (2007) 15 European Journal of Crime, Criminal Law and Criminal Justice 155. 553 On the implementation challenges, see K Henderson, ‘Perceptions of Internal Security Issues in the New Member States’ in K Henderson (ed), The Area of Freedom, Security and Justice in the Enlarged European Union (Palgrave Macmillan, 2004) 15. 554 In its 1997 Action Plan on Organised Crime [1997] OJ C251, 15 August, 1 (Recommendation 3). 555 [1998] OJ C220/1. 556 [1998] OJ L191/8. 557 See art 1 of the Joint Action. 558 ibid art 4(2). 559 For a detailed overview of the various stages in the accession negotiations, see W de Lobkowitz, ‘La sécurité intérieure de l’Union Européenne élargie’ in G de Kerchove and A Weyembergh (eds), Sécurité et justice: Enjeu de la politique extérieure de l’Union Européenne (Éditions de l’Université de Bruxelles, 2003) 31–65. 560 For a detailed overview of the acquis, see Mitsilegas, Monar and Rees (n 1).

80 History, Principles and Institutions into an ‘area’ of freedom, security and justice) on the one hand, and the furthering of integration in criminal matters primarily on the basis of mutual recognition (with the European Arrest Warrant Framework Decision being a prime example)561 on the other. In this process, a key requirement for integration in criminal matters within the EU has been the existence of mutual trust between the authorities (and arguably the citizens) of Member States.562 With the internal EU acquis in criminal matters requiring an enhanced degree of trust for the ‘Area of Freedom, Security and Justice’ to function, the benchmark has been set even higher for the candidate countries. The lack of trust and the considerable challenges that the candidate countries faced in trying to align themselves with the EU criminal law acquis and related EU standards were not eventually an obstacle to the accession of 10 new Member States (eight of which from Central and Eastern Europe) to the EU in 2004. However, elements of mistrust remained during and post-accession. The Act of Accession included a so-called ‘safeguard clause’ to cover potential shortcomings in the implementation by newcomers of EU instruments relating to mutual recognition in criminal (and civil) matters. In the event of serious shortcomings or imminent risks thereof in the field, the Commission may adopt, after consulting the Member States, safeguard measures including the temporary suspension of the provisions on judicial cooperation in criminal matters.563 The safeguard clause could be invoked for three years after accession.564 This period passed without the clause having being invoked. If the attitude of the judiciary is a reliable indication, it is striking that the highest courts of new Member States, faced with potential conflict between the domestic Constitution and the European Arrest Warrant implementation requirements, attempted to some extent to accommodate EU law requirements in their domestic legal order, taking into account both the security rationale of the European Arrest Warrant and Luxembourg case law on the third pillar.565 This stance may be viewed as an attempt to address the general climate of mistrust towards the newcomers and the existence of safeguard clauses specifically, attempting to demonstrate that every effort should be made to fully implement EU criminal law domestically.566

561 [2002] OJ L190/1. 562 On the issue of trust in the context of mutual recognition in criminal matters, see ch 4. 563 Article 39 of the Accession Act. For an overview, see C Hillion, ‘The European Union is Dead, Long Live the European Union: A Commentary on the Treaty of Accession 2003’ (2004) 29 European Law Review 583, 605–607. Hillion notes the role of the Commission in this context, notwithstanding the fact that mutual recognition in criminal matters is a third and not a first pillar issue. 564 A similar safeguard clause has been included in the Treaty accompanying the accession of Croatia to the EU, according to which ‘the Commission may, until the end of a period of up to three years after accession, upon the reasoned request of a Member State or on its own initiative and after consulting the Member States, adopt appropriate measures’, which may take the form of a temporary suspension of the application of relevant provisions and decisions in the relations between Croatia and any other Member State or Member States (art 39). See A Lazowski, ‘EU Criminal Law and Enlargement’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on European Criminal Law (Edward Elgar, 2016) 507–531 and also on the EU’s position on the current accession negotiations. 565 See Mitsilegas (n 477). 566 It has been argued that the safeguard clause has had an impact on the outcome of the Polish Constitutional Tribunal judgment; see A Lazowski, ‘Constitutional Tribunal on the Surrender of Polish Citizens under the European Arrest Warrant. Decision of 27 April 2005’ (2005) 1 European Constitutional Law Review 569, 580.

The Interplay between EU Criminal Law and Upholding the Rule of Law 81 Concerns regarding the implementation of the EU criminal law acquis by new Member States persisted in the context of the sixth EU enlargement, which saw Bulgaria and Romania joining the EU in 2007. Compliance of these two countries with the EU acquis on Justice and Home Affairs has been perceived over a period of time to be problematic.567 In its pre-accession monitoring reports, the Commission has been consistently critical of progress in the field, with gaps in institutional capacity raising broader questions regarding the feasibility of the 2007 accession date for both countries.568 Getting closer to the accession date, the Commission published a critical monitoring report, where it pointed out remaining gaps regarding progress in the justice systems of the two countries and the fight against corruption, with Bulgaria also being singled out for gaps in the field of measures against organised crime and money laundering.569 The Commission also recommended – along with the introduction of a safeguard clause allowing the unilateral suspension of Member States obligations with regard to judicial cooperation in civil and criminal matters vis-a-vis Bulgaria and Romania – the introduction of a mechanism verifying progress by the newcomers after accession. The Commission’s recommendations were taken up by Member States, with the Act of Accession including a safeguard clause in criminal matters similar to the one used in 2004,570 and the Commission adopting – using as legal basis the Accession Treaty and the safeguard clauses in the Accession Act – two Decisions establishing ‘a mechanism for cooperation and verification of progress’ to address specific benchmarks in the areas of judicial reform and the fight against corruption (Romania) and these areas plus organised crime (Bulgaria).571 In an unprecedented manner, pre-accession monitoring continues post-accession with regard to key aspects of the rule of law linked also to the capacity of new Member States to meet EU law obligations in the field of criminal law. The benchmarks themselves are attached as annexes to the Commission Decisions and are indicative of the concerns regarding the preparedness of Bulgaria and Romania to fully take up their EU obligations in the criminal law field. Romania is asked to ensure a ‘more transparent and efficient judicial process’ and to combat corruption by establishing an integrity agency, conducting ‘professional, non-partisan investigations’ into allegations of high-level corruption, and taking ‘further measures’ to prevent and fight corruption in particular within the local government. The latter benchmark (also including corruption at the borders) applies to Bulgaria as well, as does the benchmark on corruption investigations and the one regarding ensuring a more transparent and efficient judicial process. However, the benchmark list for Bulgaria is somewhat more extensive: it also includes two further benchmarks dealing with the independence of the judiciary (adopting constitutional amendments ‘removing any ambiguity’ regarding 567 For an analysis of Bulgaria’s early efforts to implement the EU acquis, see D Bozhilova, ‘Measuring Success and Failure of EU: Europeanization in the Eastern Enlargement: Judicial Reform in Bulgaria’ (2007) 9 European Journal of Law Reform 285. 568 For a background, see A Lazowski, ‘And Then They Were Twenty-Seven: A Legal Appraisal of the Sixth Accession Treaty’ (2007) 44 CML Rev 401–430. 569 European Commission, Monitoring Report on the state of preparedness for EU membership of Bulgaria and Romania, COM (2006) 549 final, 26 September, 4–5. 570 Articles 37 and 38. For an overview, see Lazowski (n 568). 571 [2008] OJ L354/ 56 and 58.

82 History, Principles and Institutions the independence and accountability of the judicial system, and continuing the reform of the judiciary) and an additional, separate benchmark urging Bulgaria to implement a strategy to fight organised crime, focusing on serious crime, money laundering and confiscation. It is thus evident that the benchmarks are essentially aimed at broader institutional changes and not so much at the implementation of specific legislation forming part of the EU criminal law acquis. Even the benchmarks involving specific areas of EU action in criminal matters (such as corruption) refer to broader measures aiming to change the culture and practices of the administration and the judiciary. Bulgaria and Romania are required to report once a year to the Commission on their progress made in addressing each of these benchmarks.572 The Commission may gather and exchange information on the benchmarks and organise expert missions for that purpose.573 The benchmarks may be adjusted in the future by amending the two Decisions.574 If Bulgaria and Romania fail to address the benchmarks adequately, the Commission may apply safeguard measures based on Articles 37 and 38 of the Accession Act, including the suspension of Member States’ obligation to recognise and execute, under the conditions laid down in Community law, judicial decisions from the two countries ‘such as European arrest warrants’.575 However, the progress verification Decisions do not preclude the adoption of safeguarding measures at any time if the conditions for such measures are fulfilled.576 The Cooperation and Verification Mechanism (CVM) is ongoing, with the Commission publishing reports on an annual basis.577 The design of the progress verification process is noteworthy. This is an ex post monitoring mechanism, operating after the entry of the new Member States into the EU. This means that, for the time being, Bulgaria and Romania are subject to further, more detailed evaluation and monitoring in the criminal law sphere than the other EU Member States. The role of the Commission in this context is significant. Notwithstanding the fact that the object of the monitoring exercise (and the ambit of the safeguard clause) falls primarily within the third pillar, the Commission has an extensive monitoring role by setting benchmarks, gathering information, organising expert missions and ultimately evaluating progress. This role for the Commission – which can be viewed as a continuum of its role before accession, where it was involved actively in negotiations on the Justice and Home Affairs chapter, in spite of its third pillar reach – is again at odds with its current limited role in the third pillar with regard to the other 25 Member States. One could thus speak of ‘double standards’ with regard to the two newcomers. However, on the other hand, one cannot help but notice the content of the benchmarks – which, beyond looking at the implementation of specific EU criminal law standards, take us back to the fulfilment of the very fundamental Copenhagen criteria (namely institutional stability which guarantees the rule of law) and examine the institutional and justice system of the assessed states as a whole. It appears that the perceived lack

572 Article 1 first indent of both Decisions. 573 Article 1 second indent of both Decisions. 574 Preamble, recital 9 in both Decisions. 575 ibid, Preamble, recital 7. 576 ibid, Preamble, recital 8. 577 For details, see https://ec.europa.eu/info/policies/justice-and-fundamental-rights/upholding-rule-law/ rule-law/assistance-bulgaria-and-romania-under-cvm/reports-progress-bulgaria-and-romania_en.

The Interplay between EU Criminal Law and Upholding the Rule of Law 83 of preparedness to fulfil the fundamental Copenhagen criteria – at least in the context of the functioning of criminal law in the ‘are of freedom, security and justice’ – was not deemed sufficient to change the political decision to admit Bulgaria and Romania to the EU in 2007. The CVM is a key mechanism to address rule of law shortcomings. Its legal impact has been strengthened by the CJEU, which held that Commission Decision 2006/928/ EC of 13 December 2006 establishing a mechanism for cooperation and verification of progress in Romania to address specific benchmarks in the areas of judicial reform and the fight against corruption, and the reports drawn up by the Commission on the basis of that decision constitute acts of an EU institution, which are amenable to interpretation by the Court under Article 267 TFEU; that Decision 2008/928 is binding in its entirety on Romania and that the benchmarks in its Annex are intended to ensure that Romania complies with the value of the rule of law, set out in Article 2 TEU, and are binding on it, in the sense that Romania is required to take appropriate measures for the purposes of meeting those benchmarks, giving due account, under the principle of sincere cooperation laid down in Article 4(3) TEU, to the reports drawn up by the Commission on the basis of that decision, and in particular the recommendations made in those reports; that the legislation governing the organisation of justice in Romania falls within the scope of Decision 2006/928, with the result that it must comply with the requirements arising from EU law and, in particular, from the value of the rule of law set out in Article 2 TEU; and that the principle of the primacy of EU law must be interpreted as precluding legislation of a Member State having constitutional status, as interpreted by the constitutional court of that Member State, according to which a lower court is not permitted to disapply of its own motion a national provision falling within the scope of Decision 2006/928, which it considers, in the light of a judgment of the Court, to be contrary to that decision or to the second subparagraph of Article 19(1) TEU.578 The CJEU has thus confirmed that the CVM mechanism is legally binding and it has used the process to rule on the incompatibility of a Member State’s internal law and practice on the rule of law and the organisation of justice with EU law. The evocation of the principle of primacy of EU law over national constitutional law579 here serves to empower lower national courts to disapply provisions of a constitutional status validated by the constitutional court in order to ensure the effectiveness of EU law and the proper implementation of the CVM benchmarks, which are themselves designed to improve the rule of law situation in the Member State in question. However, rule of law concerns have persisted with regard to EU Member States beyond the CVM and beyond Bulgaria and Romania. Calls for increased scrutiny of Member States’ compliance with the rule of law, emphasising ex post monitoring on institutional capacity, was reflected in the Commission’s 2014 Communication on ‘A New Framework to Strengthen the Rule of Law’.580 The Commission emphasises that mutual trust among EU Member States and their respective legal systems is the

578 Joined Cases C-83/19, C-127/19, C-195/19, C-291/19, C-355/19 and C-397/19, Asociaţia ‘Forumul Judecătorilor din România’ et al, ECLI:EU:C:2021:393. 579 See also the reference to Melloni in ibid para 245. On the primacy principle, see section VI.B.iii above. 580 Commission, ‘A New Framework to Strengthen the Rule of Law’ COM (2014) 158 final, 11 March 2014.

84 History, Principles and Institutions ‘foundation of the Union’ and that the way in which the rule of law is implemented at the national level plays a key role in this respect.581 The Commission considered the confidence of EU citizens and national authorities in the functioning of the rule of law ‘vital’ for the further development of the EU into an AFSJ without internal frontiers.582 After stressing the links between the rule of law and the respect for democracy and fundamental rights, it also acknowledged that there may be situations of concern falling outside the scope of EU law and, therefore, outside the scope of the infringement procedure. These cases still pose ‘a systemic threat to the rule of law’ and may lead to the application of the preventing and sanctioning mechanisms provided for by Article 7 TEU.583 However, Article 7 TEU sets high thresholds for activating both mechanisms, which are defined as ‘a last resort’.584 In addition to Article 7 TEU and to infringement procedures, the Commission introduced a new instrument to protect the rule of law across the EU, namely the EU Framework to Strengthen the Rule of Law. This is a three-stage process that aims to find a solution through dialogue with the Member State concerned and to guarantee an objective and thorough assessment of the situation at stake.585 It should also ensure equal treatment among Member States and indicate ‘swift and concrete actions’ that could be taken to address the systemic threat and to avoid the use of Article 7 mechanisms.586 The first stage is the Commission’s assessment, which may include a ‘rule of law opinion’ where the Commission explains its concerns and initiates a dialogue with the Member State concerned, which has the opportunity to respond.587 Should the matter not be resolved by this exchange between the Member State and the Commission, the latter may then adopt a ‘rule of law recommendation’, where it indicates the reasons for its concerns and recommends that the Member State solves the problems identified within a fixed time limit.588 The third stage is the follow-up to the Commission’s recommendation. The Member State should keep the Commission informed of the measures taken to solve the problems identified in the recommendation. If there is no satisfactory follow-up to the recommendation within the time limit set, the Commission assesses the possibility of activating one of the mechanisms set out in Article 7 TEU.589 The Commission activated the procedure vis-a-vis Poland in 2016. Concerned by several pieces of legislation undermining the independence and the functioning of the Polish Constitutional Tribunal, as well as of the Polish judicial system more broadly, the Commission issued four Rule of Law Recommendations between 2016 and 2017, and it also launched infringement proceedings against Poland.590 The procedure 581 ibid 2. 582 ibid 4. 583 ibid 5. 584 ibid 6. 585 ibid 7. 586 ibid. 587 ibid 7–8. 588 ibid 8. 589 ibid. For a critique of the process, see L Pech and K Lane Scheppele, ‘Illiberalism Within: Rule of Law Backsliding in the EU’ (2017) 19 Cambridge Yearbook of European Legal Studies 3. 590 European Commission, ‘Rule of Law: Commission Launches Infringement Procedure to Protect the Independence of the Polish Supreme Court’, press release, Brussels, 2 July 2018. See the Commission Recommendations issued on 27 July 2016 (C(2016) 5703 final), 21 December 2016 (C(2016) 8950 final), 26 July 2017 (C(2017) 5320 final), and 20 December 2017 (C(2017) 9050 final).

The Interplay between EU Criminal Law and Upholding the Rule of Law 85 culminated in the adoption by the Commission of a Reasoned Proposal in accordance with Article 7(1) TEU asking the Council to determine that there is a clear risk of a serious breach of the rule of law in Poland.591 The Commission highlighted the links between the rule of law, mutual trust and judicial cooperation by stating that respect for the rule of law ‘is also essential for mutual trust in the area of Justice and Home Affairs, in particular for effective judicial cooperation in civil and criminal matters which is based on mutual recognition’.592 Effective cooperation needs to be founded upon an independent judiciary in each Member State.593 In 2015, the European Parliament has called twice on the Commission to activate the first stage of the EU Framework to Strengthen the Rule of Law with regard to Hungary, voicing serious concerns over recent initiatives and measures resulting in a ‘serious systemic deterioration in the situation as regards the rule of law and fundamental rights’.594 The procedure was eventually triggered not by the Commission but by the European Parliament in September 2018.595 The effectiveness of triggering Article 7 procedures in both cases has been severely criticised. It has been noted that: [B]oth Article 7 procedures were initiated with great delays – after two years of meaningless ‘dialogue’ in case of Poland and only in year eight of ongoing constitutional destruction in Hungary. In the only two cases in which Article 7 has ever been invoked, then, it is hard to find a reason for optimism that Article 7 can ever become an instrument bringing lasting constitutional change.596

In addition to the triggering of the Article 7 procedure, recent years have seen the proliferation of the institution of rule of law-related infringement proceedings before the CJEU. While the routine institution of these proceedings is a welcome step to increase rule of law scrutiny and to provide a strong EU response to Member States’ deviation from EU values, proceedings inevitably target specific cases of rule of law deficiencies (which include crucially issues of judicial independence) on a case-by-case and not a holistic basis – a situation which has led scholars to propose the launch of systemic infringement actions.597 In 2019, the Commission published a ‘Blueprint for Action’ on the rule of law which launched an annual assessment of rule of law compliance by each EU Member State.598 This monitoring process results in the publication of annual reports and involves a focus, inter alia, on monitoring the quality of the justice systems of

591 European Commission, Proposal for a Council Decision on the determination of a clear risk of a serious breach by the Republic of Poland of the rule of law, COM (2017) 835 final, 20 December. 592 ibid para 180(3). 593 ibid. 594 European Parliament Resolution of 16 December 2015 on the situation in Hungary (2015/2935(RSP)), para F. See also European Parliament Resolution of 10 June 2015 on the situation in Hungary (2015/2700(RSP)). 595 European Parliament Resolution of 12 September 2018 on a proposal calling on the Council to determine, pursuant to Article 7(1) of the Treaty on European Union, the existence of a clear risk of a serious breach by Hungary of the values on which the Union is founded (2017/2131(INL)). 596 K Lane Scheppele, D Kochenov and B Grabowska-Moroz, ‘EU Values are Law, after All: Enforcing EU Values through Systemic Infringement Actions by the European Commission and the Member States of the European Union’ (2020) 39 Yearbook of European Law 3, 40. 597 See Lane Scheppele, Kochenov and Grabowska-Moroz (n 596), which includes a detailed analysis of existing infringement proceedings before the CJEU. 598 European Commission, ‘Strengthening the Rule of Law within the European Union: A Blueprint for Action’ COM (2019) 343 final.

86 History, Principles and Institutions EU Member States (including perceived judicial independence, procedures for appointing judges, autonomy and independence of the prosecution services, and ensuring accountability in the judiciary and safeguarding judicial independence in disciplinary procedures) and the national anti-corruption framework of Member States.599 Upholding the rule of law in the EU and its action in the field of criminal law are linked at two levels: at the operational level and at the monitoring level. At the operational level, upholding the rule of law – including crucially judicial independence – is a pre-requisite for the legitimacy of the functioning of EU criminal law cooperation mechanisms, in particular the operation of the principle of mutual recognition in criminal matters. A number of instances in the operation of the European Arrest Warrant Framework Decision have raised key challenges on safeguarding EU values in cases where serious rule of law concerns exist with regard to the legal orders and systems of individual Member States which take part in the EU cooperation system.600 At the level of monitoring compliance with the rule of law, a key development has been linking rule of law monitoring with the monitoring of Member States’ compliance with the EU framework on fraud against the EU’s financial interests – and with full cooperation of Member States with the EU competent bodies, including OLAF and the EPPO.601 The link between rule of law monitoring and the protection of the EU budget is also evident in the Regulation introducing a conditionality regime for the protection of the EU budget.602 The Preamble acknowledges that there is a clear relationship between respect for the rule of law and the efficient implementation of the EU budget in accordance with the principles of sound financial management.603 The Regulation establishes a system where measures will be taken against Member States in cases where breaches of the rule of law affect or seriously risk affecting the sound financial management of the EU budget or the protection of the financial interests of the EU in a sufficiently direct way,604 with such breaches being defined as concerning, inter alia, effective and timely cooperation with OLAF and, subject to the participation of the Member State concerned, with EPPO in their investigations or prosecutions pursuant to the applicable EU acts in accordance with the principle of sincere cooperation.605 Cooperation of Member States with OLAF and the EPPO thus becomes a key tool for rule of law compliance. An obstacle in this direction is the fact that a number of EU Member States – most notably Poland and Hungary – currently do not take part in the EPPO Regulation. While the idea of linking conditionality with participation in the EPPO would appear to be a logical step in order to ensure effective rule of law monitoring, the enhanced cooperation framework established in Article 86 TFEU complicates direct legal avenues to that effect. 599 European Commission, 2021 ‘Rule of Law Report, The rule of law situation in the European Union’, COM (2021) 700 final, 20 July 2021, accompanied by country reports. 600 For further details, see ch 4. 601 This link is highlighted in the 2021 Commission Rule of Law Report (n 599), which states that the effectiveness of the national justice systems analysed in the report will be a key factor for ensuring that cases initiated by OLAF and the EPPO are brought to conclusions and effective sanctions apply (at 29). For more on OLAF and the EPPO, see ch 8. 602 Regulation (EU, Euratom) 2020/2092 on a general regime of conditionality for the protection of the Union budget [2020] OJ LI 433/1. 603 ibid, Preamble, recital 13. 604 ibid art 4(1). 605 ibid art 4(2))(g).

Conclusion 87

X. Conclusion The entry into force of the Lisbon Treaty has created significant momentum towards the constitutionalisation of EU criminal law. The immediate impact can be seen at the institutional level, where EU action in criminal matters – especially after the end of the transitional period imposed by Protocol No 36 – is, with few exceptions, subject to the full powers of EU institutions. The move towards supranationalism in the field has not stopped legal basis litigation and has, if anything, alerted Member States further to the potential impact that European integration in the field can have on their national criminal justice systems. Legal basis litigation has emerged involving the reconfiguration of inter-institutional balance after Lisbon touching upon both internal and external dimensions of EU criminal law, as well as involving attempts by Member States to assert their legal position regarding the possibilities of an ‘opt-out’ from EU criminal law. However, thus far, it can be seen that the Lisbon provisions aimed at safeguarding national diversity have been relatively underused – with Brexit of course presenting a ‘total opt-out’ and its own post-withdrawal challenges.606 Instead of strong governmental Member State action to safeguard national diversity on the basis of the provisions of the Lisbon Treaty, we have instead seen national constitutional courts emerging as the defenders of national constitutional identity in cases where they felt that fundamental constitutional principles (and their own powers to define them) are under threat from EU law. In this process, criminal law questions become constitutional law questions, and trigger a dialogue with the CJEU which brings questions on the extent of mutual trust, upholding the rule of law and protecting fundamental rights firmly into the fore. If the entry into force of the Lisbon Treaty has already had a significant effect on the intra-EU interinstitutional balance and the balance of power between the EU and Member States, its constitutionalising impact will be felt most strongly in relation to the relationship between the individual and the state in an increasingly integrated system of EU criminal justice. Constitutionalisation means in this context that the constitutional principles of EU law, including the protection of fundamental rights, apply fully on EU criminal law. These principles (and, as will be seen later in this volume, secondary EU law on the rights of the individual) have the effect of placing the individual at the heart of Europe’s area of criminal justice. Constitutionalisation means that not only is the protection of fundamental rights a sine qua non condition for the development of EU criminal law, but also that Member States, when implementing EU criminal law, are obliged to comply fully with the EU’s constitutional principles. The application of these principles ensures both the decentralised and the centralised enforcement of EU law. In terms of decentralised enforcement, individuals can claim rights before national courts by evoking the principle of direct effect – this is very likely to be the case concerning key provisions of criminal procedural law. In terms of centralised enforcement, EU institutions have increased powers to scrutinise Member States’ implementation of EU criminal law. Their scrutiny remit is extensive, entailing a holistic examination of domestic criminal justice systems to the extent that aspects of these systems are

606 See

ch 12.

88 History, Principles and Institutions connected with the implementation of key EU criminal law instruments, including the Framework Decision on the European Arrest Warrant and the Directives on procedural rights in criminal proceedings. Monitoring implementation means monitoring conditions from the police station to the court to prison in order to ensure that the requirement of effective protection of fundamental rights on the ground is complied with fully. This continuum of scrutiny will inevitably extend to core rule of law issues, with upholding the rule of law being a key factor in safeguarding the legitimacy and credibility of EU criminal law.

2 Substantive Criminal Law From Securitised to Functional Criminalisation I. Introduction The extent of the competence of the EU to criminalise – namely to define criminal offences and adopt criminal sanctions – has traditionally been contested and remains contested, notwithstanding the abolition of the third pillar and the normalisation of EU criminal law after the entry into force of the Lisbon Treaty. Concerns with regard to the impact of EU action to criminalise on national sovereignty and the diversity and integrity of national legal systems have led to the evolution of EU criminalisation competence in a series of fraught, incremental steps, reflecting a number of EU interinstitutional battles and necessitating the intervention of the Court of Justice. Informed by an overview of the evolution of EU competence in the field, this chapter will analyse the extent of the EU’s power to define criminal offences and introduce criminal sanctions after Lisbon, and the impact of such competence on the harmonisation of substantive criminal law.1 The chapter will demonstrate that EU competence to criminalise can

1 The term ‘harmonisation’ is a commonly used term regarding Community action in the first pillar, in particular with regard to the development of the internal market, but also expanding into other areas of Community competence. For an overview, see S Weatherill, ‘Harmonisation: How Much, How Little?’ (2005) 16(3) European Business Law Review 533; and S Weatherill, ‘Why Harmonise?’ in T Tridimas and P Nebbia (eds), European Law for the Twenty-First Century. Rethinking the New Legal Order, vol 2 (Hart Publishing, 2004) 11–32. For a discussion on the applicability of the concept in EU criminal law, see the contributions in A Klip and H van der Wilt (eds), Harmonisation and Harmonising Measures in Criminal Law (Amsterdam, Royal Netherlands Academy of Arts and Sciences, 2002). Harmonisation in the context of EU criminal law has also been examined in comparison to the term of ‘approximation’, which is also used in the TEU. It has been argued that, with the difference between the two concepts being unclear, they can be deemed to be in effect synonymous; see A Weyembergh, L’harmonisation des législations: condition de l’espace pénal européen et révélateur de ses tensions (Editions de l’Université de Bruxelles, 2004) 33. ‘Approximation may be seen as a process of ‘bringing things closer to each other’ (see FM Tadic, ‘How Harmonious Can Harmonisation Be? A Theoretical Approach towards Harmonisation of (Criminal) Law’ in A Klip and H van der Wilt (eds), Harmonisation and Harmonising Measures in Criminal Law (Amsterdam, Royal Netherlands Academy of Arts and Sciences, 2002) 9), and as such can certainly apply to EC/EU criminal law. However, the difference of this process to harmonisation may indeed be a matter of degree and is not always clear. While both approximation and harmonisation are different from uniformity and from the development of a ‘one-size-fits-all’ criminal law, harmonisation can be seen to imply – along with the approximation of national criminal laws – the creation of common standards aiming at ensuring ‘harmony’ in the Community/Union system of criminal law. It is in this context that the term ‘harmonisation’ will be used in this chapter.

90 Substantive Criminal Law be justified in a twofold manner: by the need for the EU to address security threats (securitised criminalisation); and by the need for the EU to use criminal law in order to ensure the effectiveness of EU law (functional criminalisation). While the focus will be on an analysis of the EU’s power to criminalise under Article 83 TFEU, the chapter will also test the wording of this article in relation to other Treaty legal bases and the practice of the institutions with regard to proposals on EU substantive criminal law after the entry into force of the Lisbon Treaty. These legal developments will also be evaluated in the light of the inter-institutional debate on EU criminalisation, as reflected in a series of policy documents published by the Commission, the Parliament, the Council and the European Council. The chapter will then evaluate critically a number of areas where there are gaps or shortcomings regarding EU criminalisation, addressing both the securitised and functional criminalisation options set out in the Lisbon Treaty. The underused potential of decriminalisation will be highlighted in this context.

II. Before Lisbon: The Interplay between Community Law and National Criminal Law The debate on the existence and extent of a role for the European Community in the field of criminal law has been a longstanding one.2 A key factor leading to ambiguity and conflicting views on the existence of competence of the Community in criminal matters has been the silence of the EC Treaty on the matter. At first sight, the primary focus of Community law on the market and free movement could be seen –at least on the surface – to preclude any interaction between the European (economic) Community and criminal law. However, there have been a number of occasions where Community law and criminal law have had to interact in the enactment or implementation of Community law. Such interaction has led to a substantial body of case law by the Court of Justice, which demonstrates that shielding criminal law from the objectives and legislation of the Community has not always been possible. There are three main lines of cases in which the Court has affirmed the interrelationship between criminal law and Community law – the first two confirm the impact of Community law on national criminal law, while the third demonstrates the impact that domestic criminal law principles may have on Community law.

2 Of the plethora of academic writing in the field, see in particular M Delmas-Marty, ‘The European Union and Penal Law’ (1998) 4(1) European Law Journal 87; H Labayle, ‘L’ouverture de la jarre de Pandore: réflexions sur la compétence de la Communauté en matière pénale’ (2006) 42 Cahiers de droit européen 379; C Harding, ‘Exploring the Intersection of European Law and National Criminal Law’ (2000) 25 European Law Review 374; U Sieber, ‘Union européenne et droit pénal européen’ (1993) Revue de science criminelle et du droit pénal comparé 249; J Dine, ‘European Community Criminal Law?’ [1993] Criminal Law Review 246; HG Sevenster, ‘Criminal Law and EC Law’ (1992) 29 CML Rev 29; M Wasmeier and N Thwaites, ‘The “Battle of the Pillars”: Does the European Community Have the Power to Approximate National Criminal Laws?’ (2004) 29 European Law Review 613; A Klip, ‘European Integration and Harmonisation and Criminal Law’ in D. Curtin et al, European Integration and Law (Intersentia, 2006) 109–50; and G Giudicelli-Delage and S Manacorda (eds), L’intégration pénale indirecte (Paris, Société de législation comparée, 2005). For an early analysis, see JW Bridge, ‘The European Communities and the Criminal Law’ [1976] Criminal Law Review 88.

Before Lisbon: The Interplay between Community Law and National Criminal Law 91

A. The Impact of Community Law on National Criminal Law: Proportionality and the Limits to National Criminal Law In a number of cases, the Court of Justice has confirmed that Community law places limits on the application of national criminal law, if the latter would have as its effect to disproportionately limit rights established by Community law, in particular rights relating to free movement. As early as 1981, the Court stated in Casati that: In principle, criminal legislation and the rules of criminal procedure are matters for which the Member States are still responsible. However, it is clear from a consistent line of cases decided by the Court, that Community law also sets certain limits in that area as regards the control measures which it permits the Member States to maintain in connection with the free movement of goods and persons. The administrative measures or penalties must not go beyond what is strictly necessary, the control procedures must not be concerned in such a way as to restrict the freedom required by the Treaty and they must not be accompanied by a penalty which is so disproportionate to the gravity of the infringement that it becomes an obstacle to the exercise of that freedom. (Emphasis added)3

The Court justified this approach, notwithstanding the objections of a number of Member States,4 on the grounds of the necessity to prevent the erosion of Community law freedoms by national measures.5 The Court’s approach is based on the principle of proportionality. As Tridimas has noted, the Court followed in Casati a strict proportionality test, and confirmed this approach in a series of cases concerning obstacles posed by national criminal law to the exercise of Community free movement rights.6 In order to ensure the exercise of Community rights, the Court has not hesitated to check the compatibility with Community law of domestic criminal laws penalising conduct as diverse as driving without a licence in the host Member State (resulting from a failure to exchange the home state driving licence with the host state licence within the time limits prescribed by the law of the host state),7 and pursuing the organised activity of collecting bets without a licence or a police authorisation.8 In addition to limits to the imposition of criminal sanctions by Member States, the Court has held that state sovereignty in choosing the language of criminal proceedings may be limited in order

3 Case 203/80, Casati [1981] ECR 2595, para 27. 4 See in particular the views of Ireland and Denmark, which both argued that in principle penalties are a matter for Member States to determine; ibid para 2606. 5 ibid para 28. 6 T Tridimas, The General Principles of EU Law, 2nd edn (Oxford University Press, 2006) 234; see also at 234–38 for an overview of the Court’s application of proportionality to a series of cases concerning the free movement of persons and goods, particularly cases concerning residence conditions of EU nationals in other Member States. 7 Case C-193/94, Skanavi and Chryssanthakopoulos [1996] ECR I-929. For an overview, see Tridimas (n 6) 235–36. 8 Joint Cases C-338/04, C-359/04 and C-360/04, Placanica, Palazzese and Sorricchio [2007] ECR I-1891. The Court referred therein to Case 48/96 Calfa [1999] ECR I-11, where it was held that the penalty of expulsion of a Community national found guilty of drug possession for personal use was precluded by arts 48, 52 and 59 of the EC Treaty and art 3 of Directive 64/221/EC. Being a tourist, Calfa was deemed by the Court to be a recipient of services following the earlier Cowan ruling (Case 186/87, Cowan v Trésor Public [1989] ECR 195).

92 Substantive Criminal Law to ensure non-discrimination against persons to whom Community law grants equal treatment rights, as well as free movement.9 The Court’s approach on the limits that EU law places upon national power to criminalise has continued after the entry into force of the Lisbon Treaty. In a significant post-Lisbon development, the Court has extended its case law to include limiting national criminalisation on the grounds of ensuring the effectiveness of an instrument of immigration enforcement within the AFSJ. In the case of El-Dridi,10 which concerned the compatibility of national criminalisation of immigration offences with the EU Return Directive, the Court reiterated that although in principle criminal legislation and the rules of criminal procedure are matters for which the Member States are responsible, this branch of the law may nevertheless be affected by EU law.11 The Court added that Member States may not apply rules, even criminal law rules, which are liable to jeopardise the achievement of the objectives pursued by a Directive and therefore deprive it of its effectiveness.12 It also confirmed the applicability of the principle of loyal cooperation as expressed in Article 4(3) TEU.13 The Court’s effectiveness reasoning in El-Dridi has been since reiterated by the Court in a number of cases concerning the compatibility of national criminalisation initiatives with the Return Directive.14 These cases are significant as they mark a departure from earlier case law: while traditionally, in rulings like Casati, the Court of Justice has placed limits on national criminal law in order to achieve free movement objectives, in El-Dridi and its follow-up cases, limits to national criminalisation are justified in order to achieve the effectiveness of an enforcement measure, namely the EU Return Directive.15 In this context, the decriminalisation potential of the application of the principle of effectiveness has increased considerably.16

B. The Impact of Community Law on National Criminal Law: Effectiveness and Assimilation The Court’s intervention in criminal matters has not been confined to cases limiting the application of national criminal law. In a number of cases, the Court has developed mechanisms whereby the use of criminal law at the national level might be encouraged and thus increased. This increase in the application of national criminal law primarily concerns cases where the latter is deemed necessary to ensure the effectiveness of

9 Case C-274/96, Bickel and Franz [1998] ECR I-7637. 10 Case C-61/11 PPU, El-Dridi [2011] ECR I-03015. 11 ibid para 53. 12 ibid para 55. 13 ibid para 56. 14 Case C-329/11, Achughbabian v Préfet du Val-de-Marne [2011] ECR I-12695; Case C-430/11, Sagor, ECLI:EU:C:2012:777; Case C-297/12, Filev and Osmani, ECLI:EU:C:2013:569. 15 See V Mitsilegas, ‘The Changing Landscape of the Criminalisation of Migration in Europe: The Protective Function of European Union Law’ in M Guia, M van der Woude and J van der Leun (eds), Social Control and Justice: Crimmigration in an Age of Fear (Eleven International Publishing, 2012) 87–114; and V Mitsilegas, The Criminalisation of Migration in Europe: Challenges for Human Rights and the Rule of Law (Springer, 2015) ch 3. 16 See V Mitsilegas, ‘From Overcriminalisation to Decriminalisation: The Many Faces of Effectiveness in European Criminal Law’ (2014) 5 New Journal of European Criminal Law 415.

Before Lisbon: The Interplay between Community Law and National Criminal Law 93 Community law. Already in the 1970s, the Court more than hinted at the use of national criminal law for that purpose, stating that: Although Article 5 of the EEC Treaty places Member States under a duty to take all appropriate measures, whether general or particular, to ensure fulfilment of the obligations resulting from action taken by the institutions of the Community, it allows the various Member States to choose the measures which they consider appropriate, including sanctions which may even be criminal in nature. (Emphasis added)17

Amsterdam Bulb is a clear reflection of the view that criminal law may be used as a means to an end, with the end being the achievement of the effectiveness of Community law.18 This view applies here in the context of criminal law at the national level, while, as will be seen below, it has also played a central role in the development of Community competence to legislate in criminal matters. The Court maintained effectiveness at the heart of its case law on the impact of Community law on national criminal law, and in the late 1980s took its reasoning a step further in a landmark judgment concerning the possibility of imposition of national criminal sanctions for the protection of the financial interests of the Community. In Commission v Greece,19 the Court stated that: [W]here Community legislation does not specifically provide any penalty for an infringement or refers for that purpose to national laws, regulations and administrative provisions, Article 5 of the Treaty requires the Member States to take all measures necessary to guarantee the application and effectiveness of Community law. For that purpose, whilst the choice of penalties remains within their discretion, they must ensure in particular that infringements of Community law are penalised under conditions, both procedural and substantive, which are analogous to those applicable to infringements of national law of a similar nature and importance and which, in any event, make the penalty effective, proportionate and dissuasive. Moreover, the national authorities must proceed, with respect to infringements of Community law, with the same diligence as that which they bring to bear in implementing corresponding national laws.20

Based on effectiveness, the Court thus introduced the principle of assimilation: Community law must be ‘assimilated’ into national legal systems, and infringements of Community law must be treated in a manner analogous to the manner that breaches of similar domestic law are treated. In the present case (also referred to as the Greek Maize

17 Case 50/76, Amsterdam Bulb [1977] ECR 137, para 32. The Court continued by stating that in the absence of any provision in the Community rules providing for specific sanctions to be imposed on individuals for a failure to observe those rules, the Member States are competent to adopt such sanctions as appear to them to be appropriate (para 33). 18 See also the Commission’s submission in the case, stating that: ‘It is clear that, as regards Community law, the validity of a national provision imposing penal sanctions depends on that of the provisions whose observance it is intended to ensure. A provision which imposes penal sanctions is compatible with Community law to the extent to which the rule of substance in relation to which it was adopted is itself compatible with that law. As regards rules of substance which are compatible with Community law, it is certain that Member States are not only empowered but also, with Art 5 of the EEC Treaty, obliged to take all appropriate measures, whether general or particular, to ensure the proper implementation of Community rules’ (ibid para 144, emphasis added). 19 Case C-68/88, Commission v Greece [1989] ECR 2965. 20 ibid paras 23–25.

94 Substantive Criminal Law case), this would effectively mean that the Greek authorities would have to treat fraud against the Community budget in an analogous way to the treatment of fraud against the national budget – if the latter is punishable by criminal sanctions at the national level, the former must be punishable by criminal sanctions too. The assimilation principle has been developed further by the Court, which stated that effective national measures ‘may include criminal penalties even where the community legislation only provides for civil sanctions’.21 The principle of assimilation is reflected post-Lisbon in Article 325 TFEU, a provision which has given rise to extensive litigation in national courts and before the CJEU.22

C. The Impact of National Criminal Law on Community Law: Criminal Law Principles as General Principles of Community Law The potential impact of Community law on national criminal law (especially when this results in an increase of criminalisation) has brought to the fore a number of issues relating to the need to accommodate, by both the Community and the national legal systems, safeguards for the individual in the application of criminal law – in particular safeguards relating to the principles of legal certainty and non-retroactivity in criminal proceedings. To address this issue, the Court has developed extensive case law, confirmed by the Pupino judgment,23 on the limits imposed to the obligation of national courts to interpret national law to the extent possible in conformity with EU law in order to take into account the particular position of the individual in the criminal process.24 However, along with the limits to indirect effect, considerations relating to the potential severe consequences of criminal law to the individual and the need to protect fundamental rights in the context of the criminal justice process have also led to the export of national law safeguards relating to legal certainty and non-retroactivity to the Community legal order. A prime example of such exported norm is the principle of the retroactive application of the more lenient penalty, which, according to the Court in Berlusconi,25 forms part of the constitutional traditions common to the Member States and thus must be regarded as forming part of the general principles of Community law that the courts must respect when applying national legislation implementing Community law.26 The Court appears to use this principle as a counterweight to the assimilation principle which it reiterates earlier in the judgment.27 It also places the application of the principle in the present case in the particular context of the fact that the Community legislation 21 Case C-186/98, Nunes de Matos [1999] ECR I-4883, para 14. 22 See in particular the Taricco litigation (see ch 1). For a recent post-Lisbon iteration of the assimilation principle on the basis of art 325 TFEU, see Case C-574/15, Scialdone ECLI:EU:C:2018:295. 23 Case C-105/03, Maria Pupino [2005] ECR I-5285. 24 For further analysis, see ch 1. 25 Joint Cases C-387/02, C-391/02 and C-403/02, Berlusconi, Adelchi, Dell’Utri and Others [2005] ECR I-3565, ECLI:EU:C:2005:270. See also the comments by H van der Wilt, ‘Case Note’ (2006) 2 European Constitutional Law Review 303; and A Biondi and R Mastroianni, ‘Case Note’ (2006) 43 CML Rev 553. 26 Berlusconi (n 25) 68 and 69. 27 ibid para 65.

The Constitutional Politics of Criminalisation before Lisbon 95 in question was a Directive – the Court reiterated its earlier case law that a Directive cannot, of itself and independently of a national law for its implementation, have the effect of determining or aggravating the liability in criminal law of persons who act in contravention of the provisions of that Directive.28 Given the focus of the judgment on the form of the legal instrument concerned, the question arises as to whether this general principle of Community law would also apply if the requirement to impose penalties was included in a Regulation (and not in a Directive). It has been suggested that the national court might be under an obligation to set aside national law in such cases.29 As was seen in Chapter 1, post-Lisbon EU criminal law primarily takes the form of Directives.30 However, this may not necessarily be the case with measures on criminal law measures adopted on a legal basis outside the AFSJ title.31

III. The Constitutional Politics of Criminalisation before Lisbon: The Competence Question Notwithstanding its extensive case law affirming the interaction between Community law and national criminal law, the Court of Justice was initially reluctant to explicitly confer upon the Community the competence to define criminal offences and impose criminal sanctions.32 This stance, coupled with the silence of the EC Treaty on the matter (and thus the lack of express provisions therein attributing to the Community competence to define criminal offences and impose criminal sanctions), fuelled the debate on the existence and extent of Community competence in the field. As I have noted elsewhere, in extremis this silence could lead to two diametrically opposed views regarding Community competence in the field, views which were affected by the attitude that one has towards criminal law – in particular, whether one considers that criminal law is a special case and should be treated differently from economic law. Those in favour of Community competence to define criminal offences and impose criminal sanctions argued that criminal law should not be distinguished from other fields of law and that the Community should have powers to interfere in one way or another in Member States’ decisions in criminal matters in order to safeguard the integrity of the Community legal order. Those who were more sceptical argued that the criminal law is a special case. It is inextricably linked with state sovereignty and deals with sensitive areas such as the relationship between the individual and the state. They argued that any

28 ibid para 74, referring to Case 80/86, Kolpinghuis Nijmegen [1987] ECR 3969 and Case C-60/02, X [2004] [2004] ECR I-651. 29 Tridimas (n 6) 264–65. 30 See in particular art 82(2) TFEU on measures on criminal procedure and art 83(1) and (2) TFEU with regard to substantive criminal law. 31 See section VI below. 32 This is to distinguish criminal offences and sanctions (the object of this analysis) from Community administrative offences or sanctions (which may, as it has been argued, in fact be criminal sanctions on occasions). The latter will not be examined here. For commentary on administrative offences and sanctions and their potential relationship with EC/EU criminal law, see, inter alia, Harding (n 2); P-A Albrecht and S Braum, ‘Deficiencies in the Development of European Criminal Law (1999) 5 European Law Journal 293.

96 Substantive Criminal Law conferral of competence in criminal matters by Member States to the Community must be express in the Treaties and that intervention in criminal matters does not sit well with the character of the Community as a primarily economic space.33

A. Competence Disputes The debate regarding the existence and extent of Community competence in the field of criminal offences and sanctions took the form of inter-institutional battles in the proposal and negotiation of Community legislation touching upon criminal law, with the European Commission arguing on a number of occasions that the Community does have competence in the field in order to ensure the effective application of Community law. A prime example of such stance before the entry into force of the Maastricht Treaty (which via the third pillar introduced an express Union – but not a Community – competence to adopt legislation in criminal matters) has been the negotiation of the first Money Laundering Directive, which was eventually adopted in 1991.34 The Community institutions, bound by commitments undertaken under the 1988 UN Convention on drug trafficking and the 1990 Financial Action Task Force (FATF) Recommendations, initiated a process of negotiation of a Community instrument aimed at fighting money laundering – an instrument which should involve, in accordance with the preceding international standards, some degree of criminalisation of money laundering. Given both its aim to fight crime and the need to criminalise money laundering, the proposal for an EC Directive in the field raised the twofold issue of whether the EC Treaty contained an appropriate legal basis for such an instrument, and whether, even if such legal basis was found (in the event, internal market and free movement legal bases were used),35 the Community had competence to criminalise money laundering and impose criminal sanctions for such offence(s).36 In its original proposal, the Commission proposed the criminalisation of money laundering, arguing that the use of criminal law would ensure the effectiveness of Community law.37 The Council, however, was not ready for

33 See V Mitsilegas, ‘Constitutional Principles of the European Community and European Criminal Law’ (2006) 8 European Journal of Law Reform 301, 302; see also Wasmeier and Thwaites (n 2), who argue that in this context, criminal law should not be viewed as a separate Community policy (like the internal market, the environment etc), but as a field of law which can horizontally advance the Community objectives. 34 Council Directive 91/308/EEC of 10 June 1991 on prevention of the use of the financial system for the purpose of money laundering [1991] OJ L166/77. 35 Money laundering has been an example where the need for custodial penalties was accepted by the Commission in order to ensure the smooth functioning of the internal market. On this aspect and the broader debate on the use of penalties in the internal market context, see European Commission, ‘Communication on the Role of Penalties in Implementing Community Internal Market Legislation’ COM (1995) 162 final, Brussels, 3 May 1995. 36 For a detailed discussion of both aspects, see V Mitsilegas, Money Laundering Counter-measures in the European Union (Kluwer Law International, 2003) ch 3. 37 [1990] OJ C106, 28 April, 6. According to the Preamble of the proposal, ‘making money laundering a criminal offence in the Member States, although it goes beyond the scope of the financial system, constitutes a necessary condition for any action to combat this phenomenon and in particular to permit cooperation between financial institutions or banking supervisors and judicial authorities’ (recital 10). In evidence to the House of Lords (then) Select Committee on the European Communities, the Commission justified the choice for criminalisation, stating that ‘the Community was competent to impose obligations on Member States to carry out

The Constitutional Politics of Criminalisation before Lisbon 97 the conferral of such competence to the Community and the compromise reached in the final text was that money laundering would be ‘prohibited’ in Member States. This wording – which was repeated in the second and third Money Laundering Directives adopted in 2001 and 2005 respectively, long after the third pillar was introduced (which would have allowed the adoption of EU legislation criminalising money laundering) – has led to a de facto criminalisation of money laundering in all EU Member States.38 The introduction of an EU competence in criminal matters in Maastricht in the third pillar did not change the legal framework regarding criminal law and Community law, with the EC Treaty remaining silent regarding action in criminal matters. If anything, the introduction of the third pillar could strengthen the argument that the Community has no competence to define criminal offences and impose criminal sanctions, as such competence is expressly attributed (and thus limited to) the EU in the third pillar. However, the European Commission continued to press for the adoption of first pillar criminal law measures, which it deemed necessary to achieve the effectiveness of Community law. A key focus of the Commission’s effort has been the fight against fraud relating to the Community budget, which was perceived as a quintessential ‘Community’ interest necessitating criminal law harmonisation in the first pillar. In the second half of the 1990s, the Commission funded an academic study which proposed a so-called corpus juris to fight fraud against the Community financial interests. The corpus juris was essentially a mini criminal code, including definitions of a series of criminal offences (for instance, fraud, corruption and money laundering), as well as provisions on criminal procedure (including the controversial proposal for the establishment of a European Public Prosecutor).39 It could thus be seen as an attempt to ‘unify’ rather than harmonise Community criminal law on the subject.40 The idea was floated to adopt part or all of the corpus juris under a first pillar legal basis – in particular, Article 280(4) EC, which envisages the adoption of Community measures to prevent and fight fraud, and notwithstanding the fact that according to the same

penal action, if it deemed that this was necessary to obtain the full effect of the measures which it adopted’. House of Lords Select Committee on the European Communities, Money Laundering, session 1990–91, HL Paper 6, 29. For further analysis, see Mitsilegas (n 36) 58–63. 38 The Directive definitions were eventually linked with provisions contained in parallel EU third pillar measures on confiscation – see the 2001 Framework Decision on money laundering and confiscation (2001/500/JHA OJ L182, 5 July 2001, 1). On the situation after the adoption of the third Money Laundering Directive, see V Mitsilegas and B Gilmore, ‘The EU Legislative Framework against Money Laundering and Terrorist Finance: A Critical Analysis in the Light of Evolving Global Standards’ (2007) 56 International and Comparative Law Quarterly 119. 39 On the corpus juris, see inter alia: M Delmas-Marty and J Vervaele, The Implementation of the Corpus Juris in the Member States, vol 1 (Intersentia, 2000); M Delmas-Marty, ‘Guest Editorial: Combating Fraud – Necessity, Legitimacy and Feasibility of the Corpus Juris’ (2000) 37 Common Market Law Review 247; M Delmas-Marty, ‘Towards an Integrated European Criminal Law’ (2004–05) 7 Cambridge Yearbook of European Legal Studies 17; J R Spencer, ‘The Corpus Juris Project and the Fight against Budgetary Fraud’ (1998) 1 Cambridge Yearbook of European Legal Studies 77; JR Spencer, ‘The Corpus Juris Project: Has it a Future?’ (1999) 2 Cambridge Yearbook of European Legal Studies 87. For a critical commentary, see M Kaiafa-Gbandi, ‘Das Corpus Juris und die Typiesierung des Strafphänomens im Bereich der Europäischen Union’(1999) 82 KritV 162; and I Manoledakis, ‘Das Corpus Juris als falsche Grundlage eines gesamteuropäischen Strafjustizsystems’ (1999) 82 KritV 181. 40 On the unification of criminal law in Europe in the context of fraud, see Delmas-Marty, ‘Guest Editorial’ (n 40).

98 Substantive Criminal Law provision, these measures ‘shall not concern the application of national criminal law or the national administration of justice’.41 The corpus juris was not integrated as such in the Community legal order, although some harmonisation of substantive criminal law has taken place in the third (and in the case of money laundering, as stated above, in the first) pillar and the idea for the establishment of a European Public Prosecutor is still alive and was included in the Lisbon Treaty.42 Criminal law measures on fraud were adopted in the form of a third pillar Convention and subsequent Protocols.43 This did not stop the Commission from putting forward a proposal for first pillar legislation aimed at harmonising Member States’ criminal law in order to tackle fraud against the Community’s financial interests in 2001.44 According to the Commission, the third pillar anti-fraud legislation in place had not achieved satisfactory criminal law harmonisation, not least because it was in the form of a Convention, which results in delays in ratification. According to the Commission, Community law would help achieve appropriate harmonisation, and the EC Treaty contained a suitable legal basis for aligning substantive criminal law in the Member States as regards the definition of fraud, corruption and money laundering affecting Community financial interests as well as the applicable criminal penalties (Article 280 EC). The Commission brushed aside the exceptions in Article 280(4) EC by stating that: [T]he exception does not refer to the whole of criminal law in general but specifically to two aspects of it, namely ‘the application of national criminal law’ and ‘the national administration of justice’. Since, in principle, Article 280(4) covers all measures in the area of preventing and curbing fraud, it is in this context that the second sentence specifies exceptions to this, so given the general purpose of the article, the second sentence can but be interpreted narrowly. The wording and the legal context of the article do not preclude the adoption of measures setting certain harmonisation objectives of a criminal type, provided that they do not ‘concern the application of national criminal law or the national administration of justice’.45

This reasoning, which attempted somewhat artificially to distinguish between ‘national’ and ‘Community’ criminal law,46 did not convince Member States and the Directive 41 A similar exception can be found in art 135 EC concerning customs cooperation. Members of the Group drafting the Corpus Juris held a variety of different views on whether the Community had competence to adopt the instrument via an art 280(4) legal basis; for an overview, see Delmas-Marty and Vervaele (n 39) 369–94. 42 See ch 8. 43 See the 1995 Fraud Convention [1995] OJ C316/49) and its Protocols of 1996 (First Protocol [1997] OJ C151/1) and 1997 (Second Protocol [1997] OJ C221, 19 July 1997/12). For an analysis, see S White, Protection of the Financial Interests of the European Communities: The Fight against Fraud and Corruption (Kluwer Law International, 1998). 44 ‘Proposal for a Directive of the European Parliament and of the Council on the criminal-law protection of the Community’s financial interests’ COM (2001) 272 final, Brussels 23 May 2001. 45 ibid 5–6. See the analysis in GJM Corstens, ‘Criminal Law in the First Pillar?’ (2005) 11 European Journal of Crime, Criminal Law and Criminal Justice 131. 46 In this sense, the Commission seems to reflect the view of K Tiedemann that art 280(4) guarantees the application of national criminal law ‘without excluding a complementary Community criminal competence going further than the legislation of a Member State’ (in Delmas-Marty and Vervaele (n 39) 386; see also on this point the comments of a number of other contributors, in particular Delmas-Marty, Grasso and Spencer – the latter two are particularly sceptical of the appropriateness of art 280 to act as a legal basis for the Corpus Juris).

The Constitutional Politics of Criminalisation before Lisbon 99 proposal was not taken forward by the Council.47 A similar (but not identical) feat awaited another proposal put forward by the Commission in 2001 aiming at harmonising criminal law by a first pillar measure – a Directive on the protection of the environment through criminal law.48 The Commission justified the adoption of criminal law via the first pillar as necessary to provide for sufficiently dissuasive and effective penalties ensuring the full compliance of Member States with Community law protecting the environment.49 Criminal law was thus used in order to ensure the effectiveness of Community law, with the Community having competence to legislate since the objective was environmental protection – with the proposed legal basis being Article 175 EC on environmental protection. As in the draft Fraud Directive, Member States did not take up the proposal for a first pillar criminal law measure in the Council. However, unlike the fraud case (where some form of criminalisation existed in the third pillar), Member States in this case opted to legislate on environmental crime, but in the third (and not the first) pillar – two years later, the Council adopted a Framework Decision on environmental crime.50 Thus far, we have examined three different outcomes to Commission proposals for Community law harmonising criminal law: cases where criminal law harmonisation was dictated by Community law de facto but not de jure (with Community law referring to prohibition and not expressly to criminalisation (the Money Laundering Directives); cases where the Commission proposal failed to be adopted by the Council (the draft Fraud Directive); and cases where the Council opted to legislate in the third – and not the first – pillar (the Environmental Crime Framework Decision). In a fourth scenario, first pillar legislation has been combined with parallel third pillar legislation, with the criminal law aspects moved to the third pillar, but defined by reference to the first pillar. The situation has arisen in particular post-Amsterdam, when asylum and immigration matters were transferred from the third to the first pillar, and the issue of the correct legal basis and the existence of competence in criminal matters has arisen in the context of negotiations of measures in the field of irregular migration. A legal basis for the adoption of such measures could be found in the first pillar (in Title IV), but it was unclear whether such first pillar law could include criminal offences and sanctions.51 The compromise reached in this instance (concerning legislative action on human smuggling), in the light of Member States’ reluctance to confer to the Community competence in criminal matters, was to adopt two parallel and interlinked measures: a first pillar Directive describing the regulated conduct, and a third pillar Framework Decision stipulating that the conduct described in the first pillar would be

47 Although the European Parliament commented on the proposal at first reading, leading to an amended Commission proposal – COM (2002) 577 final, Brussels, 16 October 2002. 48 COM (2001) 139 final, Brussels 13 November 2001. 49 ibid 1. For a detailed analysis of the proposal, see Corstens (n 45) 137–39. 50 [2003] OJ L29/55. 51 The umbrella provision of Title IV, art 61, states that the Council shall adopt, inter alia, ‘measures in the field of police and judicial co-operation in criminal matters aimed at a high level of security by preventing and combating crime within the Union in accordance with the provisions of the Treaty on European Union’. Moreover, as Peers points out, art 63(3)(b) does not contain an exception along the lines of the wording in arts 280(4) and 135 EC.

100 Substantive Criminal Law treated as a criminal offence and determining criminal sanctions.52 This strategy53 was repeated subsequently in legislation relating to other first pillar policies: a Directive and accompanying Framework Decision were adopted regarding the criminalisation of ship-source pollution.54 However, the legality of the adoption of third pillar legislation in both the ship-source pollution and the environmental crime cases was challenged by the Commission, leading to the Court of Justice to intervene in two cases with substantial constitutional implications.

B. The Environmental Crime Case The European Commission decided to react to the Council’s choice to adopt criminal legislation in matters deemed to be relating to the achievement of Community objectives by challenging the legality of the adoption of the relevant third pillar law. This led initially to the intervention by the Court of Justice, which was called upon to rule on the legality of the adoption of the Framework Decision on environmental crime and gave a ruling with major implications for EU criminal and constitutional law.55 The Commission, supported by the European Parliament, instituted an action for annulment of the Framework Decision, arguing that the third pillar measure was adopted on the wrong legal basis. It should have been adopted according to the Commission under the first pillar, as the protection of the environment is a first pillar objective. The Commission argued that while the Community did not have a general competence in criminal matters, it had competence to prescribe criminal penalties for infringements of Community environmental protection legislation if it took the view that that is a necessary means of ensuring that the legislation is effective – adding that the harmonisation of national criminal law was designed to be an aid to the Community policy in question.56 Along with this argument – based on the view that criminal law is merely an auxiliary, ‘horizontal’ means of achieving Community objectives – the Commission evoked Member States’ duty of loyal cooperation and the general principles of effectiveness and equivalence constantly present in the Court’s case law.57 52 Council Directive 2002/90/EC of 8 November 2002 defining the facilitation of unauthorised entry, transit and residence [2002] OJ L328, 5 December, 4, and the corresponding Framework Decision, at 1. For an analysis, see V Mitsilegas, J Monar and W Rees, The European Union and Internal Security,(Palgrave Macmillan, 2003) ch 4. 53 Vervaele calls this a ‘cohabitation forcée’ – see ‘The European Community and Harmonization of the Criminal Law Enforcement of Community Policy’ (2006) 3–4 European Criminal Law Associations’ Forum 88. Vervaele also refers to the ‘warding off ’ of Commission first pillar legislative proposals by Member States, and ‘hijacking’ of proposals such as the environmental crime Directive by Member States and their adoption in the third pillar. 54 [2005] OJ L255/11 and 164. 55 Case C-176/03, Commission v Council [2005] ECR I-7879. For case commentaries, see C Tobler, ‘Case Note’ (2006) 43 CML Rev 835; S White, ‘Harmonisation of Criminal Law under the First Pillar’ (2006) 31 European Law Review 92; M Böse, ‘Die Zustaendigkeit der Europäischen Gemeinschaft fuer das Strafrecht Zugleich Besprechung von EuGH, Urteil vom 13.9.2005’ (2006) Goldtammer’s Archiv 211; and E HerlinKarnell, ‘Commission v Council: Some Reflections on Criminal Law in the First Pillar’ (2007) 13 European Public Law 69. See also Labayle (n 2) 379–428. 56 Commission v Council (n 55) para 19. 57 ibid para 20. A similar argument was advanced in 2003 by the European Parliament Legal Affairs Committee in its Report on legal bases and compliance with Community law (A5–0180/2003, 22 May 2003,

The Constitutional Politics of Criminalisation before Lisbon 101 The Council, supported by no fewer than 11 Member States,58 opposed this view. The Council and the vast majority of the Member States59 argued that as the law currently stood, the Community does not have power to require Member States to impose criminal penalties in respect of the conduct covered by the Framework Decision.60 Not only was there no express conferral of power in that regard, but, given the considerable significance of criminal law for the sovereignty of Member States, there were also no grounds for accepting that this power can have been implicitly transferred to the Community at the time where substantive competences, such as those exercised under Article 175 EC, were conferred on it.61 Moreover, Articles 135 and 280 EC, which expressly reserved States the application of national criminal law and the administration of justice to the Member, confirmed that interpretation. It was also borne out by the fact that the TEU devotes a specific title to judicial cooperation in criminal matters, which expressly confers competence in criminal matters on the EU.62 Finally, the Council argued, the Court never obliged Member States to adopt criminal penalties and legislative practice was in keeping with that interpretation.63 The Court found for the Commission and annulled the Framework Decision. It used Articles 47 and 29 TEU, according to which nothing in the TEU is to affect the EC Treaty.64 The Court then focused on the environment as a Community objective. It confirmed that the environment constitutes one of the essential objectives of the Community; it highlighted that, according to settled case law, the choice of legal basis must rest on objective factors that are amenable to judicial review, including in particular the aim and the content of the measure, and stated that the aim of the instrument was the protection of the environment and that the Framework Decision established a list of particularly serious environmental offences.65 The essential character of environmental protection as a Community objective is crucial for determining whether criminal law can be used to achieve this objective in the Community pillar. According to the Court, while as a general rule, neither criminal law nor the rules of criminal procedure fall within EC competence, this does not prevent the EC legislature, when the application of effective, proportionate and dissuasive criminal penalties by the competent national authorities is an essential measure for combating serious environmental offences, from taking measures which relate to the criminal law of the Member States which it considers necessary in order to ensure that the rules that it lays down on environmental protection are fully effective.66 The Court found that Articles 1–7 of the Framework Decision (which relate Rapporteur: I Koukiadis). The Committee used art 10 EC on loyal cooperation to argue in favour of the existence of EC competence in criminal matters in certain circumstances. However, it took a seemingly more limited view compared to that of the Commission, arguing that EC competence to require the Member States to make provision for criminal penalties must be limited to cases in which the Community legislator considers that compliance with Community law can only be safeguarded by such means (point 5). 58 Denmark, Germany, Greece, Spain, France, Ireland, the Netherlands, Portugal, Finland, Sweden and the UK. 59 With the exception of the Netherlands, which supported the Council but via a different reasoning. 60 Commission v Council (n 55) para 26. 61 ibid para 27. 62 ibid paras 28 and 29. 63 ibid paras 31 and 32. 64 ibid para 38. 65 ibid paras 41 and 45–47. 66 ibid paras 47–48.

102 Substantive Criminal Law to the environmental crime offences) have as their main purpose the protection of the environment and they could have been properly adopted on the basis of Article 175 EC.67 This finding was not called into question by the existence of Articles 135 and 280(4) EC.68 However, the Court added that although Articles 1–7 of the Framework Decision determine that certain conduct which is particularly detrimental to the environment is to be criminal, they leave to the Member States the choice of the criminal penalties to apply (although these must be effective, proportionate and dissuasive).69 This was a seminal ruling, reminiscent of the Court’s landmark judgments in the 1960s on primacy and direct effect. In the face of a significant number of Member States, and the wording of the Treaties which confer express powers to the EU to act on criminal matters, while being silent on the role of the Community, the Court decided to interpret the Treaties creatively in order to expressly establish a Community competence to act in criminal matters. The timing of the judgment is noteworthy, as it came at a time when the Constitutional Treaty – which would put an end to the pillar structure and in effect would (with some exceptions) fully ‘communitarise’ the third pillar – was ‘frozen’, having been rejected by France and the Netherlands. This would effectively mean that criminal law harmonisation – if confined to the third pillar only – would necessitate unanimity of the then 25 (and, from 1 January 2007, 27) Member States and would require mere consultation of the European Parliament, thus potentially leading to legislative paralysis and the exacerbation of the democratic deficit in criminal matters. In the light of this timing, a further parallel could be drawn here with the 1960s, where the Court pushed European integration in the face of legislative stagnation. The starting point in the Court’s reasoning in ascertaining the conferral of criminal law competence to the Community was the focus on the effect of Articles 29 and 47 TEU, which state respectively that third pillar action must be without prejudice to the powers of the European Community and that nothing in the TEU will affect the Treaties establishing the European Communities. The Court used these provisions to strengthen the Community pillar and to address its centrality and primacy over the intergovernmental pillars. It thus sent a strong signal that third pillar action must not jeopardise Community action.70 Having asserted the primacy of and the need to ensure the integrity of the Community pillar, the Court did not take up the Commission’s reference to the principle of loyal cooperation and did not take up the Advocate General’s extensive analysis of the specific need for high-level protection of the environment.71 Instead, it chose to focus specifically and extensively on an analysis justifying the conferral to the 67 ibid para 51. 68 ibid para 52. The Court added that it is not possible to infer from those provisions that, for the purposes of the implementation of environmental policy, any harmonisation of criminal law, even as limited as that resulting from the Framework Decision, must be ruled out even where it is necessary in order to ensure the effectiveness of Community law. 69 ibid para 49. In this context, the Court seems to follow the distinction made between criminalisation and the choice of the appropriate penalty in the Opinion of AG Ruiz-Jarabo Colomer, who stated that ‘it seems clear that the response to conduct which seriously harms the environment must be a criminal one but, in terms of punishment, the choice of the penalty to admonish that conduct and to ensure the effectiveness of Community law is the province of the Member States’ ((2005) ECR I-7879, para 84). 70 Manacorda has called this a censure by the Court of ‘prohibited intergovernmentalisation’ (intergouverementalisation prohibée): S Manacorda, ‘Judicial Activism dans le cadre de l’espace de liberté, de justice et de sécurité de l’Union européenne’ [2005] Revue de science criminelle et du droit pénal comparé 956. 71 On this point, see H Labayle, ‘Architecte ou spectatrice? La Cour de justice de l’Union dans l’espace de liberté, sécurité et justice’ (2006) 42 Revue trimestrielle du droit européen 1, 10–11.

The Constitutional Politics of Criminalisation before Lisbon 103 Community of a criminal law competence on the basis of the need to ensure the effective achievement of Community objectives. In this respect, the fact that the case involved the protection of the environment – an ‘essential’ Community objective according to the Court – may have been of particular relevance, notwithstanding the fact that the Court did not focus on environmental protection to such a great extent as had the Advocate General.72 What is significant in this context is that the Court did not hesitate to apply its reasoning on the effective achievement of Community objectives in the field of criminal law, viewing criminal law as a means to an end rather as a special field of law where special rules must apply. Criminal law will fall within Community competence, like any other field of law, if Community objectives are at stake. This conclusion may appear striking bearing in mind the express exclusion of the application of national criminal law in matters relating to customs cooperation and fraud by the EC Treaty (Articles 135 and 280(4)) and the express conferral of competence in criminal matters on the EU (and not the Community).73 However, it was not clear whether the judgment has established in principle that the Community may, under certain circumstances, have competence in the field of criminal law in general or that it is limited to environmental crime only.74 Questions regarding the extent and scope of Community competence in criminal matters still remained.75 The Court did not specify whether Community competence in criminal law is limited to the definition of criminal offences or also extends to the imposition and precise definition of criminal sanctions.76 The Court mentions that while the annulled Framework Decision criminalised conduct that is particularly detrimental to the environment, it left the choice of the criminal penalties to apply to the Member States.77 However, it was not clear if this meant that the Community was granted powers to criminalise only or also to impose criminal sanctions, at least in the environmental crime field.78 It seems paradoxical – and potentially incoherent – to confer competence to define criminal offences 72 On the significance of environmental protection in the development of the Court’s case law, see F Jacobs, ‘The Role of the European Court of Justice in the Protection of the Environment’ (2006) 18 Journal of Environmental Law 185. 73 For a critical view, see the evidence of Richard Plender to the House of Lords European Union Committee. Plender, who was counsel for the UK in the case, wondered whether the conferral of an implied Community power in criminal law was legitimate in the face of the absence of a subjective intention by Member States to confer such power and the existence of an express EU power in the third pillar. See House of Lords European Union Committee, The Criminal Law Competence of the European Community, 42nd Report, session 2005–06, HL Paper 227, Q1. For the opposite view, see Tobler ((n 55) 851), who argues that the Council seems to forget that the EC Treaty does not confer a catalogue of negative competences. For a view advocating Community action in criminal matters – very much along the lines put forward by the Court – see also Wasmeier and Thwaites (n 2). 74 A very narrow view in this context has been put forward by ECJ Judge Puissochet, who stated before the French Senate that the Court has only said in this case that the Community has competence to oblige Member States to impose criminal sanctions to protect the environment. It has not recognised a Community competence to harmonise criminal law. Sénat, Réunion de la délégation pour l’Union européenne du mercredi 22 février 2006. 75 See also Labayle (n 71) 14 and evidence by Steve Peers to the House of Lords European Union Committee (n 73) Q52. 76 Some authors seem to suggest that Community competence is limited to criminalisation only. See C Haguenau-Moizard, ‘Vers une harmonisation communautaire du droit pénal?’ (2006) 42 Revue trimestrielle du droit européen 377, 384. 77 Commission v Council (n 55) para 49. 78 Wasmeier and Thwaites ((n 2) 634) argue that if a measure specifically aims at a concrete Community objective, particularly at the enforcement of related Community provisions through dissuasive (criminal) sanctions, it may fall within Community competence; however, detailed rules on the type and scale of sanctions would go beyond such an ‘implied power’. In the event of such a situation, one could still have a cross-pillar split.

104 Substantive Criminal Law and impose the criminalisation of certain types of conduct, but to leave the choice of the sanctions to Member States. Moreover, the imposition of a criminalisation requirement to Member States in the first place (which, under the qualified majority voting arrangements of the first pillar, may be outvoted in relation to such a measure) arguably constitutes at least as great a challenge to state sovereignty and the exercise of power in the criminal law sphere as the dictation of the imposition of specific criminal sanctions. A relating issue involved the objectives for the achievement of which the Community has criminal law competence.79 The case involved environmental crime, which, according to the Court, is one of the ‘essential’ objectives of the Community.80 However, it is not clear whether Community competence in criminal matters concerning environmental protection played a part in the Court’s ruling and therefore the Court’s approach regarding the delimitation of EC competence in criminal matters in the future.81 Is the environment a special case? Is Community competence in criminal matters limited when necessary to achieve an ‘essential’ Community objective and, if so, what constitutes such an objective?82 Or, at the other extreme, does EC competence in criminal matters extend to the achievement of any Community objective? Does Community competence extend beyond the effective achievement of Community objectives to the effective achievement of Community policies? Varied interpretations have been put forward by EU institutions in their reactions to the judgment.

C. Reactions to the Court’s Environmental Crime Judgment Shortly after the Environmental Crime judgment, the Commission published a Communication arguing for a recasting of a number of existing EU measures and proposals, while also stating that it would apply the Court’s test in any future legislative proposals it would table.83 The Commission interpreted the Court’s ruling broadly, arguing that: [F]rom the point of view of subject matter, in addition to environmental protection the Court’s reasoning can therefore be applied to all Community policies and freedoms which involve binding legislation with which criminal penalties should be associated in order to ensure their effectiveness.84 79 And of course whether EC competence in criminal matters could be viewed outside the framework of the achievement of Community objectives. 80 Commission v Council (n 55) para 41. 81 The Court did not hesitate to annul the ‘PNR’ international agreement between the EC and the US on the grounds that the main objective of the agreement (to fight terrorism) was really a third pillar issue: Cases C-317/04 and C-318/04, European Parliament v Council and Commission, ECLI:EU:C:2006:346. For an analysis, see ch 9. 82 The latter question has been posed by Plender (n 73) Q10; and Labayle (n 71) 14. In its Report on the judgment, the French Assembly seems to understand the judgment as limited to the achievement of ‘essential’ objectives. In their view, it is not enough that an objective is listed as such in the EC Treaty, but it must be essential and transversal. See Assemblée Nationale, Rapport d’information sur les consequences de l’arret de la Cour de Justice du 13 Septembre 2005, 25 January 2006, Rapport No 2829, 10. 83 ‘Communication on the implications of the Court’s judgment of 13 September 2005’ COM (2005) 583 final/2, Brussels, 24 November 2005. The European Parliament supported the Commission’s view that a number of EU instruments needed to be recast in the light of the Court’s judgment, but called for a review on a case-by-case basis and urged the Commission not to automatically extend the conclusions of the Court to every other field falling within the scope of the first pillar – Resolution on the consequences of the judgment of the Court of 13 September 2005 (C-176/03 Commission v Council) (2006/2007(INI)), 14 June 2006. 84 ‘Communication on the implications of the Court’s judgment of 13 September 2005’ (n 83) para 8.

The Constitutional Politics of Criminalisation before Lisbon 105 According to the Commission, the Court’s ruling clarified that criminal law provisions required for the effective implementation of Community law are a matter for the first pillar, bringing measures adopted under a dual legal basis in both first/third pillars to an end, with the Commission proposing a quick procedure of recasting existing texts it deems affected by the environmental crime judgment;85 third pillar legislation would only cover measures relating to police and judicial cooperation in criminal matters more broadly.86 However, the reaction by Member States to the Commission Communication was rather lukewarm, with a number of governments taking the view that future Commission proposals should be considered on a case-by-case basis.87 This cautious approach was confirmed at the February 2006 Justice and Home Affairs Council, which agreed merely on a procedure for the examination of future Commission legislative proposals containing provisions on criminal law.88 The Commission sought to further enhance the Community’s competence in criminal matters by putting forward in 2006 – and against the backdrop of the ‘freezing’ of the ratification process of the Constitutional Treaty (which would abolish the pillars) – a proposal for moving third pillar matters to the first pillar by using the so-called ‘passerelle’ provision of Article 42 TEU.89 The Commission called for the use of Article 42 TEU (and the move towards the ‘Community method’ of decision-making in Title IV) on both democracy and efficiency grounds. It stated that: Action and accountability in some areas of policy making are hindered by the current decision making arrangements which lead to deadlock and lack of proper democratic scrutiny. Existing Treaty provisions (Articles 42 of the Treaty on the European Union and 67(2) of the Treaty establishing the European Community) allow for changes to these arrangements, which would improve decision taking in the Council and allow proper democratic scrutiny by the European Parliament; and the enhancement of the role of the Court of Justice.90

85 For a list of measures needing to be recast, see the annex to the Communication. These include dual instruments such as those on the facilitation of unauthorised entry, transit and residence mentioned above, but also the adoption in the first pillar of measures thus far adopted under the third pillar (such as the Framework Decision on corruption in the private sector – OJ L192, 31 July 2003 54), and the adoption in the first pillar of proposals which had failed in the Council (such as the Proposal for a Directive on the criminal law protection of the Community’s financial interests, also mentioned at n 36 above). 86 ‘Communication on the implications of the Court’s judgment of 13 September 2005’ (n 83) para 11. 87 See, eg, the reaction of the UK government: in the Explanatory Memorandum to the Westminster European Union Committees regarding the Commission Communication, it was noted that the Commission’s proposal to simply repeal the offending third pillar provision and re-enact it in new first pillar instruments was not favoured by the government ‘because we consider that any new provisions relating to the criminal law introduced under the First Pillar should be considered on a case by case basis’. Explanatory Memorandum by Ms Fiona MacTaggart (then Parliamentary Under Secretary of State, Home Office) of 16 January 2006, para 17. 88 According to the Council conclusions, in these cases, the presidency will draw the attention of COREPER II and, following the latter’s guidance, will refer the proposal to an ‘appropriate’ working party for examination, taking into account all the relevant factors, such as its content, aim and required expertise. The opportunity for Justice and Home Affairs experts to given input into the negotiations of criminal law proposals should be ensured. Doc 6077/06 (Presse 38), 10. 89 This states that ‘the Council, acting unanimously on the initiative of the Commission or a Member State, and after consulting the European Parliament, may decide that action in areas referred to in Art 29 [the umbrella provision for the third pillar] shall fall under Title IV of the Treaty establishing the European Community, and at the same time determine the relevant voting conditions relating to it. It shall recommend the Member States to adopt that decision in accordance with their respective constitutional requirements’. 90 Communication from the Commission to the European Council, ‘A Citizens’ Agenda: Delivering Results for Europe’ COM (2006) 211 final, Brussels, 10 May 2006, 6.

106 Substantive Criminal Law The use of the passerelle provision of the TEU was also strongly backed by Commission President Barroso, who placed greater emphasis on security, which he stated ‘is increasingly becoming a concern of people in Europe’ and that ‘the most effective response in the field of security is a European response’, ‘with or without a Constitution’.91 However, Member States again appeared rather sceptical of the Commission’s initiative. In the Tampere Council of September 2006, no fewer than 14 Member States rejected the proposals to use the ‘passerelle’ provision92 and by the end of 2006, the debate was deemed to be concluded against the use of Article 42 TEU.93 Following its Communication reacting to the Court’s environmental crime ruling, and notwithstanding the cautious reaction by the Council and the passerelle setback, the Commission tabled three major first pillar proposals involving Community action on the definition of criminal offences and the imposition of criminal sanctions – all of which are currently under negotiation. The first Commission initiative of this kind was a proposal for a Directive on criminal measures aimed at the enforcement of intellectual property rights.94 The proposal replaced earlier Commission proposals following the ‘dual’ model of a first pillar Directive and a parallel third pillar Framework Decision on the enforcement of intellectual property rights, both of which were tabled prior to the Court’s ruling.95 The legal basis of the proposal was Article 95 EC (on the internal market) – the draft contained not only detailed provisions on criminal sanctions, but also provisions on confiscation, joint investigation teams and the initiation of criminal proceedings96 – something that constituted a very broad interpretation of the scope of Community competence and that arguably fell outside Community criminal law competence as defined by the Court. Subsequently, the Directive was not adopted. The second proposal, as expected, was a proposal for a Directive on the protection of the environment through criminal law.97 The proposal addressed specifically the Court’s ruling on environmental crime, with the Commission aiming at recasting the proposal in the light of its interpretation of the judgment. The legal basis of the proposal is Article 175(1) on environmental protection. The proposal included detailed definitions of offences and detailed provisions on criminal sanctions, both for natural and legal persons (but, unlike the intellectual property rights proposal, no provisions on criminal procedure). In negotiations, the Justice and Home Affairs Council accepted that the Directive ‘will probably be one of the first sets of legal instruments by means of which criminal law arrangements can be made in the context of the first pillar, and as such will to some extent serve as an example’.98 The Council noted that fundamental issues need 91 JM Barroso, ‘Strengthening a Citizens’ Europe’, speech, Bélem Cultural Centre, 8 May 2006 (speech/06/283), www.europa.eu. 92 ‘EU Plan to Fight Terror in Tatters’ Financial Times (23–24 September 2006). 93 See House of Lords European Union Committee, The Criminal Law Competence of the EC: Follow-up Report, 11th Report, session 2006–07, HL Paper 63. See also ch 1. According to Geoff Hoon, the then UK Minister for Europe, the situation with regard to the use of art 42 was ‘a matter of intellectual inquiry only’ (para 4). 94 COM (2006) 168 final, Brussels, 26 April 2006. 95 COM (2005) 276 final. The recasting of the proposals was mentioned in the Commission’s post-Environmental Crime case Communication. 96 Articles 6–8 of the Commission Proposal. 97 COM (2007) 51 final, Brussels 9 February 2007. 98 Conclusions of the Justice and Home Affairs Council of 12–13 June 2007, Council Doc 10267/07 (Presse 125) 41.

The Constitutional Politics of Criminalisation before Lisbon 107 to be clarified regarding both the scope of the criminal offences and the rule on criminal sanctions, with discussions on the latter postponed until the Court had ruled on the second major case concerning the extent of Community criminal law competence on ship-source pollution.99 In the meantime, concerns have been expressed that the broad list of proposed criminal offences exceeded the scope of Community competence after the environmental crime case.100 Similar concerns have been expressed regarding the provisions criminalising participation in the offences set out in the draft Directive and setting penalty levels.101 In the end, negotiations resulted in the adoption of a first pillar Directive on environmental crime in 2008.102 Another first pillar proposal containing criminal law provisions was the Directive on sanctions against employers of illegally staying third-country nationals.103 The proposed legal basis was Article 63(3)(b) EC (measures on illegal immigration and illegal residence). The main avenue of enforcement of employers’ duties under the Directive was administrative sanctions. However, the Directive also provided for the criminalisation of serious cases of non-compliance with its provisions and introduces criminal sanctions for such cases.104 The introduction of criminal offences and sanctions (which, unlike the earlier examples, is not the sole focus of the Commission proposal) was justified by the Commission on the grounds that administrative fines may not have a sufficiently dissuasive effect in certain cases.105 The Directive was eventually adopted before the entry into force of the Lisbon Treaty in the first half of 2009.106 Given the uncertainty as to the precise extent of Community criminal law competence following the Court’s judgment on the environmental crime case, all three proposals mentioned above have been subject to rigorous scrutiny. The debate focused on the content of some of these proposals, in particular the extent of criminalisation and the levels of proposed criminal sanctions. It is also interesting to look at the legal bases of the proposals – the protection of the internal market and the environment, and action against illegal immigration – and link them with the relevant objectives of the Community in order to address the question of whether these objectives constitute ‘essential’ objectives justifying the employment of Community criminal law for their achievement. However, these questions of competence cannot be disassociated from questions of the necessity of criminalisation and severity of the criminal sanction envisaged. On both the intellectual property rights107 and the employers’

99 ibid 42. 100 See House of Commons European Scrutiny Committee, 14th Report, session 2006–07, 20–21. 101 European Parliament Committee on Legal Affairs, ‘Working Document on Protection of the Environment through Criminal Law’, Rapporteur: H Nassauer, 12 June 2007, PE 390.607v02–00. 102 Directive 2008/99/EC of the European Parliament and of the Council of 19 November 2008 on the protection of the environment through criminal law [2008] OJ L328/28. 103 COM (2007) 249 final, Brussels, 16 May 2007. 104 ibid arts 10–11. See also the specific provisions on the liability of legal persons in arts 12–13. 105 ibid 10. 106 Directive 2009/52/EC of the European Parliament and of the Council of 18 June 2009 providing for minimum standards on sanctions and measures against employers of illegally staying third-country nationals [2009] OJ L168/24. 107 See the comments by the Law Society of England and Wales in August 2006, where concern was expressed that the introduction of broad criminal sanctions may upset the balance that exists between the use of civil and criminal proceedings (para 19). The Justice and Home Affairs Council of 5–6 October 2006 noted in this

108 Substantive Criminal Law sanctions proposals,108 concerns were raised regarding the suitability of the criminal law to regulate the matter. Concerns relating to both legality and overcriminalisation have led to difficulties in the negotiations of both the irregular employment and intellectual property proposals.109

D. The Ship-Source Pollution Case110 Further clarification on the scope of Community criminal law competence has been expected from the Court of Justice on the ship-source pollution case. The subject matter of this case is very similar to the environmental crime case. The Commission challenged the legality of the adoption of a Framework Decision on ship-source pollution, arguing that parts of the measure should have been adopted under the first pillar.111 In this case, the Framework Decision was accompanied by a parallel first pillar Directive defining the conduct that was criminalised by the Framework Decision. Given the timing and constitutional significance of the case, no fewer than 20 Member States intervened in support of the Council and against the Commission’s challenge. The main arguments of the parties were described in detail in the Opinion of Advocate General Mazák.112 The Commission argued that Articles 1–10 of the Framework Decision could have been adopted on the basis of Article 80(2) EC relating to the Community common transport policy and that, consequently, the entire Framework Decision (due to its indivisibility) infringes Article 47 TEU.113 In a broad interpretation of the environmental crime judgment and again stressing the need to ensure the effectiveness of Community law, the Commission was of the view that principles that the Court laid down in its environmental crime judgment apply ‘in their entirety to other Community policies’ such as the transport policy, arguing that the importance of environmental protection in the Community and its particular characteristics (such as its ‘transversal’ nature) had in fact no decisive bearing on the environmental crime

context that criminal law is considered as a means of last resort and that further scrutiny is needed regarding the need for criminal measures on the EU level in order to protect intellectual property rights. Council Doc 13068/06 (Presse 258) 22. 108 See S Carrera and E Guild, An EU Framework on Sanctions against Employers of Irregular Immigrants, CEPS Policy Brief No 140, Brussels, CEPS, August 2007, https://www.ceps.eu/ceps-publications/ eu-framework-sanctions-against-employers-irregular-immigrants-some-reflections-scope. 109 See, inter alia, J Brunsden, ‘Member States Split over Commission Powers’, European Voice (28 February 2008); J Brunsden, ‘France Seeks Quick Deal to Penalise Employment of Illegal Immigrants’, European Voice (17 July 2008); and R Goldirova, ‘EU States Clash over Penalties for Hiring Illegal Immigrants’, EU Observer, 24 July 2008. See also the rather generally worded conclusions of the July 2008 Justice and Home Affairs Council: Council Doc 11653/08 (Presse 205) 13. 110 For an earlier version, focusing on the Opinion of the Advocate General, see V Mitsilegas, ‘The Competence Question: The European Community and Criminal Law’ in E Guild and F Geyer (eds), Security versus Justice. Police and Judicial Co-operation in the European Union (Ashgate, 2008) 153–70. 111 Case C-440/05, Commission v Council [2007] ECR I-9097. For a commentary, see S Peers, ‘The European Community’s Criminal Law Competence: The Plot Thickens’ (2008) 33(3) European Law Review 399. 112 AG Opinion delivered on 28 June 2007. 113 Commission v Council (n 111) para 27. A similar view was put forward by the European Parliament, which stressed the similarities with the environmental crime case and argued that the Framework Decision in question is also concerned with environmental protection (paras 32–35).

The Constitutional Politics of Criminalisation before Lisbon 109 decision in principle.114 According to the Commission, the Community legislature may provide for criminal measures so far as is necessary to ensure the full effectiveness of Community rules and regulations. Such action may be based only on implied Community powers which are determined by the need to guarantee compliance with Community measures, but are not confined to criminal law measures in a certain area of law or of a certain nature.115 Therefore, according to the Commission, the Community was competent to define the type and level of penalties if and insofar as it is established that this is necessary to ensure the full effectiveness of a Community policy.116 The Council on the other hand defended the choice of the third pillar instrument (supported by all intervening Member States) and denied that criminal law measures should have been adopted in the first pillar under Article 80(2) EC. The Council’s strategy was primarily to attempt to differentiate between the ship-source pollution and the environmental crime cases. According to the Council, it is undisputed Article 80(2) EC (on transport) is the correct legal basis for the adoption of the first pillar Directive, even if it also pursues objectives relating to the environmental protection.117 The common transport policy lacks the specific characteristics and importance of environmental protection; moreover, the Community powers to act on transport matters depend on the decision of the Council.118 In the alternative, the Council argued that the provisions of the Ship-Source Pollution Framework Decision differed from those of the third pillar measure on environmental crime in that they were more detailed, particularly with regard to the level and type of penalties to be imposed. Given the leeway provided by the environmental crime judgment to Member States regarding the imposition of criminal sanctions when the first pillar is involved, the Council argued that a number of provisions in the present Framework Decision could not have been adopted under the first pillar, adding that if the environmental crime case were to be interpreted along the lines advocated by the Commission, Title VI of the TEU would largely be deprived of practical effect.119 According to the Council, it could not be concluded from the adoption of the Ship-Source Pollution Framework Decision that the criminal law measures provided for must be regarded as ‘necessary’ within the meaning of the environmental crime case.120 A similarly narrow interpretation of the environmental crime case was provided by the Member States which intervened in favour of the Council. In their view, the implied Community competence to legislate on criminal law matters is confined to measures which are ‘necessary’ or (absolutely) ‘essential’ for combating serious environmental offences; they added that such competence does not extend beyond the field of environmental protection to another common policy such as the transport policy at issue, and in any event excludes harmonisation of the type and level of penalties as laid down in the Framework Decision.121 In support of this minimalist interpretation, Member

114 ibid 115 ibid

116 ibid. 117 ibid

para 28. para 29.

para 36. para 38. 119 ibid para 39. 120 ibid para 40. 121 ibid para 41. 118 ibid

110 Substantive Criminal Law States put forward a number of arguments linked with their broader concern of loss of sovereignty in criminal matters, relating to: [T]he principles of subsidiarity, attributed powers and proportionality; the particular nature and necessary coherence of criminal law; the margin of appreciation to be left for the Member States; and the system set up by the Treaty on the European Union which would be undermined if the arguments of the Commission were upheld.122

Member States also argued that Article 47 TEU is intended to lay down a clear delimitation of competences between the first and the third pillars, but not to establish that the former has primacy over the latter.123 It is with the interpretation of Article 47 TEU that the Advocate General (AG) began his Opinion.124 The AG interpreted the provision broadly, stating that Article 47 TEU is not designed merely to ensure that nothing under the TEU affected or ran counter to existing substantive provisions of Community law – instead, it was intended to preserve the powers conferred on the Community as such.125 In order to determine whether Article 47 TEU has been infringed, the question to be asked is whether the provisions in question could have potentially been adopted on the basis of the EC Treaty.126 The Opinion of the AG differs substantially from the submissions of Member States in this context. He categorically stated that: Contrary to the view expressed by certain Governments, Article 47 EU thus establishes the ‘primacy’ of Community law or, more particularly, the primacy of Community action under the EC Treaty over activities undertaken on the basis of Title V or Title VI of the EU Treaty, in that the Council and, as the case may be, the other institutions of the Union must act on the basis of the EC Treaty if and in so far as it provides an appropriate legal basis for the purposes of the action envisaged.127

The AG thus established in a clear-cut manner a hierarchy between the pillars, granting ‘primacy’ to the first pillar and a presumption for Community action. This approach was also based on a Community-friendly reading of Article 1 TEU, whereby the supplementary character of the EU provisions to the foundational Community pillar is stressed.128 On the basis of this reasoning, the AG went on to look at whether the Community pillar contains a legal basis which would mean that the adoption of criminal law legislation on ship-source pollution in the third pillar would infringe the horizontal distribution of competence described above. According to the AG, a first pillar legal basis could include – but is not limited to – Article 80(2) EC on transport; in principle, if it were found that the provisions of the Framework Decision could have been adopted using a legal basis provided for elsewhere in the EC Treaty (such as in the part on the environment), this

122 ibid para 42. 123 ibid para 43. 124 Article 47 TEU states that ‘nothing in this Treaty [the TEU] shall affect the Treaties establishing the European Communities or the subsequent Treaties and Acts modifying or supplementing them’. 125 Commission v Council (n 111) para 50. According to the AG, that is confirmed by art 29(1) TEU which expressly provides that third pillar provisions are ‘without prejudice to the powers of the European Community’ (para 51). 126 ibid para 52. 127 ibid para 53. 128 ibid para 54.

The Constitutional Politics of Criminalisation before Lisbon 111 would mean that the Framework Decision infringed Article 47 TEU.129 He took the view that Article 80(2) EC could provide the correct legal basis for ship-source pollution measures, even if these measures also pursued the aim of environmental protection.130 What did fall within the first pillar – and could have been adopted under Article 80(2) EC – are the Framework Decision provisions on the constituent elements of criminal offences, as well as the requirement that these are punishable by effective, proportionate and dissuasive penalties.131 Since this was the case and the Framework Decision is to be regarded as indivisible, the AG recommended that the entire Framework Decision be annulled as it was adopted in breach of Article 47 TEU.132 Like the AG, and similarly to the environmental crime judgment, the Court used Article 47 TEU as a starting point in affirming that it was its task to ensure that acts which, according to the Council, fall within the scope of Title VI do not encroach upon the powers conferred by the EC Treaty on the Community.133 The Court would thus have to look at whether the Framework Decision affected the Community’s competence on transport under Article 80(2) EC.134 In doing so, it adopted a twofold approach: it examined the nature of Community competence on transport in the general Treaty framework; and it linked Community transport policy to the objective of environmental protection. It noted first that the common transport policy is one of the foundations of the Community, with the latter having broad legislative powers under Article 80(2) EC, including powers in the field of maritime transport.135 The existence of the legislative competence conferred to the Community by Article 80(2) EC was not dependent on a decision by the legislature to actually exercise this competence.136 Second, the Court linked Community transport policy to the objective of environmental protection. The latter was, according to the Court, one of the essential objectives of the Community which must, according to Article 6 EC, ‘be integrated into the definition and implementation of … Community policies and activities’, including transport policy.137 Having highlighted the environmental dimension of the legislation in question, the Court reiterated its findings in the environmental crime case, namely that although as a general rule neither criminal law nor the rules of criminal procedure fall within the Community’s competence, the fact remained that when the application of effective, proportionate and dissuasive criminal penalties by the competent national authorities is an essential measure for combating serious environmental offences, the Community

129 ibid para 65. The AG noted that the need for a prior Council decision for the Community to act on transport was not a decisive factor with regard to the application of art 47 TEU (para 62). 130 Commission v Council (n 111) paras 128 and 130. 131 ibid paras 132 and 138. 132 ibid para 139. 133 The Court used the same approach and referred expressly to both the Environmental Crime and the Ship-Source Pollution judgments in the ‘small arms’ case, where it determined, on the basis of art 47 TEU, the relationship between the first and the second pillars – see Case C-91/05, Commission v Council [2008] ECR I-03651 (delivered on 20 May 2008). For a critical comment, see P Koutrakos, ‘Development and Foreign Policy: Where to Draw the Line between the Pillars’ (2008) 33(3) European Law Review 289 (editorial). 134 Judgment of 23 October 2007, paras 53 and 54 respectively. 135 ibid paras 55 and 58 respectively. 136 ibid para 59. 137 ibid para 60.

112 Substantive Criminal Law legislature may require the Member States to introduce such penalties in order to ensure that the rules which it lays down in that field are fully effective.138 The Court then examined the Framework Decision in this light, asserting that the latter’s provisions relate to conduct which ‘is likely to cause particularly serious environmental damage as a result, in this case, of the infringement of the Community rules on maritime safety’.139 According to the Court, it was also clear that the Council took the view that criminal penalties were necessary to ensure compliance with Community rules on maritime safety.140 In the light of these two considerations and the Court’s earlier ruling on the environmental crime case,141 the Court took the view that Articles 2, 3 and 5 of the Framework Decision on ship-source pollution, which ‘are designed to ensure the efficacy of the rules adopted in the field of maritime safety, noncompliance with which may have serious environmental consequences, by requiring Member States to apply criminal penalties to certain forms of conduct’, were essentially aimed at improving maritime safety as well as environmental protection and could have been validly adopted on the basis of Article 80(2) EC.142 However, the Court noted that Community competence in the field does not extend to the determination of the type and level of criminal penalties; therefore, it did not extend to provisions such as Articles 4 and 6 of the Framework Decision determining specific levels of criminal sanctions.143 However, as these sets of provisions were inextricably linked to each other, the Court annulled the Framework Decision as a whole. The Court’s ruling offered a degree of clarification regarding the delimitation of Community criminal law competence. For supporters of first pillar criminal law, the judgment was seen as a further affirmation of the existence of Community competence in criminal matters and as an expansion of such competence in the field of ship-source pollution. Moreover, the Court reiterated its emphasis on effectiveness, reaffirming the view of criminal law as a means to an end.144 However, it had by no means given carte blanche to the adoption of a wide range of first pillar criminal law measures. First of all, the relative vagueness of the environmental crime ruling on the extent of first 138 ibid para 66. 139 ibid para 67. The Court also noted that the purpose of the Framework Decision, according to its Preamble, was to enhance maritime safety and improve protection of the marine environment against ship-source pollution (para 62). 140 ibid para 68. 141 See also ibid para 66. 142 ibid para 69. 143 ibid paras 70–71. Similarly, the Court noted that provisions on jurisdiction and information exchange are third pillar matters (para 73). 144 Note that the AG devoted a substantial part of his Opinion to discussing the special nature of criminal law and the relationship between criminal law and Community law, and the potential subordination of criminal law to the effectiveness of Community law. The AG accepted that effectiveness is an imprecise criterion on the basis of which to establish criminal law competence and does not encapsulate entirely the essence of criminal law. Having broadened Community competence in criminal matters by extending it potentially to any Community policy, he now tried to place some limits on this by stating that the necessity of Community criminal law does not stem only from the objective criterion of the existence of a legal basis in the EC Treaty, but also from a degree of judgment by the institutions involved. Moreover, the AG accepted that it is not ideal for Community criminal law to be considered a mere accessory to the specific Community competences and only a single aspect of the policies involved. Finally, the AG hinted at the necessity of a uniform Community legislative procedure to accommodate Community criminal law (Opinion of Advocate General Mazák delivered on 28 June 2007, ECLI:EU:C:2007:393, paras 114–21).

The Constitutional Politics of Criminalisation before Lisbon 113 pillar criminal law competence has been remedied to some extent in this case, with the Court stating that while criminalisation in this case would fall within the first pillar, the imposition of precise sanctions (such as levels of custodial sentences) would still fall within the third pillar.145 This approach was followed in the eventually adopted (prior to the entry into force of the Lisbon Treaty) of Directive 2009/123/EC on ship-source pollution and on the introduction of penalties for infringements (hereinafter the ‘ShipSource Pollution Directive’).146 Moreover, the Court embarked on a delicate balancing act regarding the question of whether Community criminal law competence is limited to the achievement of ‘essential’ Community objectives or whether it extends to all Community objectives and/or policies. The Court certainly refrained from doing the latter.147 While it accepted that a first pillar measure with a transport legal basis may include criminal law provisions, this appeared to be justified on the grounds of the strong link between the measure in question with the protection of the environment – an essential Community objective whose protection may necessitate criminal law. The extent of Community criminal law competence in this context thus remained contested; however, it appears that the Court has left the door open to Member States sceptical to further ‘communitarisation’ of criminal law at this stage (before the Treaty of Lisbon entered into force) to argue that such ‘communitarisation’ does not extend beyond measures having an environmental protection objective.

E. Substantive Criminal Law Competence in the Convention on the Future of Europe The debate over the extent of EU competence to criminalise was further reflected in the work of the Convention on the Future of Europe, which was entrusted with providing recommendations for the drafting of the Constitutional Treaty. The Final Report of Working Group X on ‘Freedom, Security and Justice’ produced a number of recommendations on the basis of the constitutional state of play of criminalisation under the third pillar and its members’ perceived needs for EU legislative intervention in the field.148 The Report called for clearer identification of the scope of EU legislation in the field, recognising that Articles 30 and 31 TEU, which constituted the applicable legal bases for criminal law, were ‘too vague in many respects, and too narrow in some other aspects’.149 The Working Group made specific recommendations, a great number of which found 145 These issues may well arise in the negotiations of the recent ‘Commission Proposal for an amendment to the Ship-Source Pollution Directive including penalties for infringements’ COM (2008) 134 final, Brussels, 11 March 2008. Negotiations on the proposal are under way (see Conclusions of the Justice and Home Affairs Council of 5–6 June 2008, Council Doc 9956/08 (Presse 146) 18). The Council and the European Parliament have already reached a first reading agreement on the environmental crime Directive; ibid 16. 146 Directive 2009/123/EC of the European Parliament and of the Council of 21 October 2009 amending Directive 2005/35/EC on ship-source pollution and on the introduction of penalties for infringements [2009] OJ L280/52. See Recital No 2 on the need for this Directive to ‘fill the legal vacuum following the judgment’ of the Court of Justice in the Ship-Source Pollution case (n 111). 147 See the significantly broader approach of the AG – see in particular ibid paras 94–97 of the Opinion. 148 CONV 426/02, Brussels, 2 December 2002, WG X 14. 149 ibid 8.

114 Substantive Criminal Law their way into the text of the Lisbon Treaty. It recommended the inclusion of a legal basis in the new Treaty permitting the adoption of minimum rules on constituent elements of criminal acts and of penalties in certain fields of crime where the crime in question is both of a particularly serious nature and has a cross-border dimension, and where the crime is directed against a shared European interest which is already itself the subject of a common policy of the EU (for example, counterfeiting of the euro and the protection of EU financial interests).150 The Working Group thus advocated the constitutional recognition of both securitised and functional criminalisation.151 The majority of the Working Group supported enumeration of those types of crime considered to have a transnational dimension and advocated – if this enumeration were to be exhaustive – that the Council, acting by unanimity, and after the assent of the European Parliament (or, for a few members, consultation) may amend this list if the need arises in order for the EU to respond adequately to changing patterns of crime. According to a widespread view in the Working Party, the Treaty could provide that approximation of substantive criminal laws, although this should be carried out in the form of Directives only. As will be seen below, both these recommendations have been incorporated into the Lisbon Treaty.

IV. EU Competence to Criminalise after Lisbon: Securitised and Functional Criminalisation The drafters of the Lisbon Treaty attempted to define detailed parameters delimiting the EU’s competence in substantive criminal law. The main provision, Article 83 TFEU, puts forward a dual model of securitised and functional criminalisation. The first paragraph of Article 83 confers upon the EU competence to establish, by means of Directives: [M]inimum rules concerning the definition of criminal offences and sanctions in the areas of particularly serious crime with a cross-border dimension resulting from the nature or impact of such offences or from a special need to combat them on a common basis. (Emphasis added)

These areas of crime are enumerated exhaustively in Article 83(1). The list includes ‘terrorism, trafficking in human beings and sexual exploitation of women and children, illicit drug trafficking, illicit arms trafficking, money laundering, corruption, counterfeiting of means of payment, computer crime and organised crime’. As per the recommendation of the Convention on Justice and Home Affairs Working Party, the list may be expanded ‘on the basis of developments in crime’ by the Council acting unanimously after obtaining the consent of the European Parliament. Article 83(1) thus affirms the acceptance of the added value of criminalisation at the EU level in

150 ibid 10. According to the Working Group, approximation of substantive criminal law should be part of the toolbox of measures for the pursuit of that policy whenever non-criminal rules do not suffice. 151 The Working Group also called for further consideration to be given to the possible inclusion of a third criterion, which was proposed, namely ‘when approximation is required to generate sufficient mutual confidence to enable the full application of mutual recognition of judicial decisions or to guarantee the effectiveness of common tools for police and judicial cooperation created by the Union’. However, this criterion has not been explicitly included in the criminalisation legal basis of the Lisbon Treaty (ibid).

EU Competence to Criminalise after Lisbon 115 order to address perceived serious security threats. The second paragraph of Article 83 constitutes an attempt to translate the Court’s functionalist interpretation of the extent of Community (and now Union) criminal law competence in Environmental Crime and Ship-Source Pollution. Article 83(2) TFEU thus grants the EU with the competence to approximate national criminal laws and regulations if such approximation ‘proves essential to ensure the effective implementation of a Union policy in an area which has been subject to harmonisation measures’. For that purpose, ‘directives may establish minimum rules with regard to the definition of criminal offences and sanctions in the area concerned’.

A. Securitised Criminalisation: Article 83(1) TFEU Article 83(1) TFEU reflects the securitised criminalisation approach in determining EU competence in substantive criminal law. EU competence to criminalise is justified as necessary to combat specified areas of criminality, the majority of which have been elevated after the Cold War by the international community and the EU as global security threats.152 The objective of Article 83(1) TFEU to address security threats is also confirmed by the requirement for harmonisation to apply only to particularly serious crimes.153 The securitised view of Article 83(1) TFEU has recently been confirmed by the Court of Justice, according to which the very enumeration of an area of criminality under Article 83(1) suffices for criminality to be considered serious enough to justify the limitation of citizenship rights and the expulsion of EU citizens on public security grounds, although arguably the offences themselves did not necessarily represent a threat to the wider public as such.154 In this manner, Article 83(1) TFEU – whose purpose is to define the extent of EU competence in substantive criminal law – has been used for a very different purpose, namely to interpret exceptions to freedom 152 V Mitsilegas, ‘Countering the Chameleon Threat of Dirty Money: “Hard” and “Soft” Law in the Emergence of a Global Regime against Money Laundering and Terrorist Finance’ in A Edwards and P Gill (eds), Transnational Organised Crime: Perspectives on Global Security (Routledge, 2003) 195–211. 153 The legal basis of art 83(1) has been primarily used to modernise pre-Lisbon substantive criminal law. The entry into force of the Lisbon Treaty has resulted in the separation of the criminal law provisions from the preventive EU anti-money laundering Directives and in the adoption in 2018 of a separate criminal law Directive under an art 83(1) TFEU legal basis: Directive 2018/1673 on combating money laundering by criminal law [2018] OJ L284/12. Other key instruments of securitised criminalisation adopted post-Lisbon include Directive 2011/36/EU on preventing and combating trafficking in human beings and protecting its victims, and replacing Council Framework Decision 2002/629/JHA [2011] OJ L101/1; Directive 2011/93/EU on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA [2011] OJ L335/1; Directive 2013/40/EU on attacks against information systems and replacing Council Framework Decision 2005/222/JHA [2014] OJ L218/8; and Directive (EU) 2017/541 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA [2017] OJ L 88/6. 154 Case C-348/09 PI v Oberbürgermeisterin der Stadt Remscheid [2012] 3 CMLR 662. According to the Court, art 28(3)(a) of the Citizens’ Rights Directive must be interpreted as meaning that it is open to the Member States to regard criminal offences such as those referred to in the second subparagraph of art 83(1) TFEU as constituting a particularly serious threat to one of the fundamental interests of society, which might pose a direct threat to the calm and physical security of the population and thus be covered by the concept of ‘imperative grounds of public security’, capable of justifying an expulsion measure under art 28(3) as long as the manner in which such offences were committed discloses particularly serious characteristics, which is a matter for the referring court to determine on the basis of an individual examination of the specific case before it.

116 Substantive Criminal Law of movement. By confirming the seriousness of the areas of crime enumerated in Article 83(1) in abstracto, the Court has transformed securitised criminal law into symbolic criminal law. In an attempt to circumscribe EU competence in the field further, Article 83(1) TFEU contains an express enumeration of these areas of serious crime and specifies that these areas must have a cross-border dimension resulting from the nature or impact of such offences or from a special need to combat them on a common basis. This requirement has led commentators to argue that the justification for EU criminal law under Article 83(1) resides in its value-added function, drawing on a common capability to address the scale and nature of threats posed by transnational criminality.155 While the wording of Article 83(1) can indeed be seen as an attempt to establish the added value of criminalisation at the EU level, this added value is not limited to transnational criminality. The applicability of Article 83(1) to areas of serious crime with a cross-border dimension resulting from the nature or impact of such offences or from a special need to combat them on a common basis must be read as conferring on the EU competence to define criminal offences and adopt criminal sanctions in areas of crime which have a cross-border dimension, but which do not involve cross-border or transnational criminality as such.156 Examples of areas of crime with a cross-border dimension resulting from their nature or impact or need to combat on a common basis – but which may involve criminality conducted purely at the national level – include terrorism and corruption. In this way, the scope of Article 83(1) TFEU is broader than it appears at first sight. This broad scope is confirmed by the fact that EU competence is defined on the basis of areas of crime rather than on the basis of specific criminal offences. These areas of crime may actually correspond to a wide range of criminal offences or sanctions. A clear example of the potential to overstretch EU criminal law competence under Article 83(1) involves the use of the concept of organised crime. Not only is the definition of the concept vague and amorphous at the EU level,157 but it can also be used as a legal basis for harmonisation of a wide range of specific criminal offences and sanctions linked to the activities of a criminal organisation. Such a broad approach may serve to address some gaps in the Lisbon legal bases for criminal law, whose wording may be narrower than the third pillar legal bases and can thus be seen to exclude prima facie EU action in areas where the EU has legislated extensively under the third pillar. A prime example in this context is constituted by the recent Commission proposal for a directive on confiscation,158 where the Commission has used Article 83(1) TFEU as a broad legal basis to 155 C Harding and JB Banach-Gutierrez, ‘The Emergent EU Criminal Policy: Identifying the Species’ (2012) 37 EL Rev 758. 156 See also AG Pikamäe, according to whom the ‘cross-border dimension’ condition is dependent merely on the fact that the criminal offence under consideration falls within one of the areas of crime amenable to harmonisation under the second subparagraph of art 83(1) TFEU and that it comes within the scope of the secondary legislation adopted on the basis of art 83(1) TFEU and governing such an area: Opinion in Joined Cases C-845/19 and C-863/19, Okrazhna prokuratura – Varna (Criminal Proceedings v DR (C-845/19) and TS (C-863/19)), Opinion delivered on 24 March 2021, ECLI:EU:C:2021:229, para 40. 157 V Mitsilegas, ‘Defining Organised Crime in the European Union: The Limits of European Criminal Law in an Area of Freedom, Security and Justice’ (2001) 26 EL Rev 565; V Mitsilegas, EU Criminal Law (Hart Publishing, 2009) ch 2. 158 COM (2012) 85 final, 12 March 2012.

EU Competence to Criminalise after Lisbon 117 justify EU action on confiscation and enable confiscation of the proceeds of crime to include all offences committed within the framework of organised crime. Limits to EU confiscation law appear to have been the side effects of EU efforts to clarify EU competence in criminal matters after Lisbon. If confiscation measures are to be considered measures of criminal procedure to facilitate mutual recognition, then their adoption is not possible under Article 82(2) TFEU as confiscation is not an area of criminal procedure expressly enumerated therein. If confiscation is to be considered a sanction, it can no longer apply on a catch-all basis to all offences in the light of the limits placed on EU competence by Article 83(1) TFEU. The broad interpretation of Article 83(1) TFEU by the Commission seeks to address this lacuna, and constitutes the first example of a measure adopted under Article 83(1) TFEU focusing specifically and horizontally on sanctions and not on the definition of criminal offences. The use of Article 83(1) TFEU in this manner may constitute a precedent for the adoption of EU instruments introducing a general framework of sanctions for the areas of crime enumerated therein. The solution eventually reached by the institutions in the adoption of the confiscation Directive has been to use the dual legal basis of Articles 82(2) and 83(1) TFEU.159 This choice of legal basis may have served to evade the answer to the question of whether confiscation is a sanction or a judicial cooperation mechanism, but it has also led to the narrowing of the scope of confiscation measures at the EU level. The use of Article 83(1) TFEU has meant that the harmonised confiscation regime applies only to criminal offences falling within the specifically enumerated fields in Article 83(1) TFEU and not across the board.160

B. Functional Criminalisation: Article 83(2) TFEU The introduction of Article 83(2) TFEU in the Treaty of Lisbon confirms a functionalist view of criminal law. Rather than assuming the status of a self-standing EU policy, criminal law is thus perceived as a means to an end, the end being the effective implementation of other EU policies.161 Criminal law is thus used as a tool to achieve the effectiveness of EU law.162 Article 83(2) TFEU flows naturally from the Court’s interpretation of the EU’s (then the Community’s) criminalisation competence under the first pillar in the Environmental Crime and Ship Source Pollution rulings. As the Court of Justice confirmed in its environmental crime ruling, while: As a general rule, neither criminal law nor the rules of criminal procedure fall within [EC] competence … [this] does not prevent the [EC] legislature, when the application of effective, proportionate and dissuasive criminal penalties by the competent national authorities is an 159 Directive 2014/42/EU of the European Parliament and of the Council of 3 April 2014 on the freezing and confiscation of instrumentalities and proceeds of crime in the European Union [2014] OJ L127, 29 April, 39. 160 See ibid art 3. 161 V Mitsilegas, ‘The Transformation of Criminal Law in the Area of Freedom, Security and Justice’ (2007) 26 Yearbook of European Law 1. 162 For a critical view, see M Kaiafa, ‘The Importance of Core Principles of Substantive Criminal Law for a European Criminal Policy Respecting Fundamental Rights and the Rule of Law’ (2011) 1 European Criminal Law Review 7, 19, arguing that the unique identity of criminal law cannot allow it to be reduced to a mere tool for the implementation of any policy.

118 Substantive Criminal Law essential measure for combating serious environmental offences, from taking measures which relate to the criminal law of the Member States which it considers necessary in order to ensure that the rules which it lays down on environmental protection are fully effective. (Emphasis added)163

The Lisbon Treaty constitutionalises the Court’s case law on competence in the field of substantive criminal law, providing an express legal basis for functional criminalisation. This legal basis is not confined to the adoption of substantive criminal law in the field of environmental crime (which was viewed by the Court as an essential objective of the European Community),164 but extends to any EU policy in an area which has been subject to harmonisation measures. This expansive constitutionalisation of the Court’s functional criminalisation approach in Article 83(2) TFEU has raised concerns with regard to the extent of criminalisation powers conferred upon the EU by the Lisbon Treaty. The Treaty attempts to address concerns with regard to the extensive use of Article 83(2) by introducing two central requirements for the use of EU competence in the field: the requirement that measures are essential to achieve effectiveness; and the requirement that measures are ‘essential to ensure the effective implementation of a Union policy in an area which has been subject to harmonisation measures’ (emphasis added). By using the term ‘essential’, the Treaty has adopted a high threshold for EU intervention in the area of functional criminalisation, but it is unclear what kind of action meets this threshold.165 Demonstrating the ‘essential’ character of EU intervention under Article 83(2) is prone to litigation in Luxembourg.166 The interpretation of the second requirement of Article 83(2) TFEU – that measures are essential to ensure the effective implementation of an EU policy in an area that has been subject to harmonisation measures – may also prove to be contested. On the one hand, it is noteworthy that effectiveness is relating broadly to the implementation of EU policies and not of EU objectives.167 On the other hand, the requirement that effectiveness must be in an area that has been subject to harmonisation measures may serve to limit the scope of EU competence under Article 83(2) TFEU. A lively academic discussion on the detail of this requirement (in particular on the temporal aspect of Article 83(2) and whether criminalisation can occur in cases where no previous harmonisation has taken place, as well as on the level of detail of harmonisation to be required) has ensued.168 163 Commission v Council (n 55) paras 47–48. 164 ibid paras 41 and 45–47. 165 For example, it has been suggested that the requirement of action under art 83(2) is essential includes a strict proportionality requirement – J Öberg, ‘Union Regulatory Criminal Law Competence after the Lisbon Treaty’ (2011) 19 European Journal of Crime, Criminal Law and Criminal Justice 289, 290. 166 The German Constitutional Court has already adopted a narrow view of the EU’s criminalisation competence under art 83(2) TFEU. In its Lisbon ruling, the Court found that such competence exists ‘only if it is demonstrably established that a serious deficit concerning enforcement actually exists and that it can only be remedied by the threat of a sanction, this exceptional constituent element exists and the annex competence for legislation in criminal law may be deemed conferred’ (para 362). See BVerfG, 2 BvE 2/08, Gauweiler, Die Linke v Act of Approval of the Lisbon Treaty (‘Lisbon’), 30 June 2009. 167 P Craig, The Lisbon Treaty: Law, Politics, and Treaty Reform (Oxford University Press, 2010) 365. 168 For a narrow interpretation, see Öberg (n 165) 314–16. For broader interpretations, see P Asp, The Substantive Criminal Law Competence of the EU (Skrifter Utgivna av Juridiska Fakulteten vid Stockholms Universitet Nr 79, 2013) 134; and S Peers, EU Justice and Home Affairs Law, 3rd edn (Oxford University Press, 2011) 775–76.

EU Competence to Criminalise after Lisbon 119 In this context, Peers argues that while it could not be said that there is an EU policy that needs implementing effectively in the absence of harmonisation in specific areas of law, there is nothing in the current legal framework of the Lisbon Treaty that requires full harmonisation as a precondition.169 Indeed, in interpreting the scope of Article 83(2), the key focus must be whether EU action is essential to ensure the effectiveness of EU law in a policy area that has been subject to a degree of harmonisation.

C. The Extent of EU Competence to Criminalise: Minimum Rules The articulation of EU competence to define criminal offences and impose criminal sanctions in the Lisbon Treaty may result in actually limiting the criminalisation powers of Member States. The limited conferral on the EU of competence in substantive criminal law only via the adoption of minimum rules can be potentially decisive in limiting Member States’ criminalisation competence. Hans Nilsson has set out the limits that the minimum rules requirement may pose for national sovereignty in substantive criminal law: One may argue that the term ‘minimum rules’ should be seen from the point of view of the Member State, so that the Member States may adopt the constituent elements of the offence as set out in the Framework Decision or Directive, but they are free to have less constituent elements, and thus criminalise more acts than the minimum ones. This is however hardly defendable, both for reasons of logic, legal certainty and respect for the principle of the unity of the common market (in this case the criminal law part of it), as well as for the uniform application of Community/Union law, as laid down in the AETR case law. It would therefore appear to me that the ‘minimum rules’ in all substantive criminal law Framework Decisions would not only be minimum, but also maximum rules and that they would in principle be not only ‘harmonising’ but also ‘unifying’ instruments in the real sense of the word.170

Notwithstanding the uncertainty as to what constitutes a ‘minimum rule’ under Article 83,171 Nilsson is right in arguing that the requirement of the EU to legislate via minimum rules under Article 83 TFEU places barriers to Member States overcriminalising and adopting more extensive substantive criminal law provisions than those which have been selected by the European legislator. This view is reinforced by the protective character of minimum harmonisation, which has traditionally been used in the context of the internal market as a means of addressing social concerns.172 Similar concerns are 169 Peers (n 168) 775. 170 H Nilsson, ‘How to Combine Minimum Rules with Maximum Legal Certainty?’ (2011) Europaraettslig Tidskrift 665. Nilsson refers to the analysis in the first edition of A Klip’s European Criminal Law (Intersentia, 2009), where the author argued that it is necessary to look at the spirit of the instrument when one examines the impact of minimum rules (at 154). In the book’s second edition, Klip mentions Nilsson’s argument, but continues to argue that the starting point is the objective of the legal instrument in question: A Klip, European Criminal Law, 2nd edn (Intersentia, 2012) 167. 171 There is also a debate on whether the minimum rules requirement allows the EU to adopt minimum maximum penalties as per the pre-Lisbon practice, or also minimum penalties as such: see Asp (n 168) 126. Asp argues that rules requiring a specific minimum penalty are not minimum rules, as to require a certain minimum level would amount to full harmonisation in relation to the minimum penalties. The post-Lisbon trend is for substantive criminal law measures to retain the ‘minimum maximum’ formula. 172 M Dougan, ‘Minimum Harmonization and the Internal Market’ (2000) 37 CML Rev 53.

120 Substantive Criminal Law addressed by the treatment of minimum harmonisation in the context of EU measures in the field of criminal procedure under Article 82(2) TFEU. The last indent of this Article states expressly that ‘adoption of the minimum rules referred to in this paragraph’ (which involve the adoption of largely protective standards, including measures on the rights of the defendant in criminal proceedings) ‘will not prevent Member States from maintaining or introducing a higher level of protection for individuals’. As Nilsson notes, Member States can go beyond minimum rules as expressly stated in Article 82(2) TFEU to protect individuals, but not so in Article 83 TFEU, as this is not expressly granted in the Treaty and would have the opposite effect.

V. The Relationship between Criminal and Administrative Law A key question following the entry into force of the Lisbon Treaty concerns the interplay between criminal and administrative law after Lisbon in cases where EU measures are being put forward which envisage the adoption of both criminal and non-criminal (administrative) sanctions. This dual approach to sanctions has been adopted by the European Commission in its recent proposals for revised post-Lisbon legislation, introducing sanctions for insider dealing and market manipulation.173 Unlike the case of its recent proposal on criminal law on fraud, the European Commission here has used Article 83(2) TFEU for the adoption of criminal law provisions, with an internal market legal basis being used for the regulation. This dual approach was ultimately confirmed by the Council and the Parliament in the adoption of two parallel instruments.174 Two issues arise in this context in terms of criminalisation powers: the first, as mentioned above, is whether Member States are constrained by the adoption of criminal offences and sanctions under Article 83(2) TFEU in terms of their criminalisation choices at the national level; the second, and related point, is whether Member States are similarly constrained by their choices of what to treat as an administrative infraction under the Regulation adopted under a separate legal basis. The requirement to ensure the effectiveness of EU law militates in favour of limiting national powers to criminalise in both cases. In the case of the interplay between EU administrative law and national criminal law, the choice by the EU legislator to address harmful behaviour (in this case market abuse) via merely administrative – and not criminal – sanctions would mean that the effectiveness of the EU policy and measure in question would be jeopardised if Member States adopted a harsher, criminal law approach. National criminalisation would also be contrary to the principle of proportionality, as enshrined in Article 49(3) of the Charter. In this manner, the adoption of EU law may actually limit criminalisation and lead to 173 Commission, ‘Draft directive on criminal sanctions for insider dealing and market manipulation’ COM (2011), 654 final, 20 October 2011 accompanying a ‘Proposal for a regulation under Art 114 TFEU’ COM (2011) 651 final, 20 October 2011. 174 Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (Market Abuse Regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/EC [2014] OJ L173, 12 June, 1; and Directive 2014/57/EU of the European Parliament and of the Council of 16 April 2014 on criminal sanctions for market abuse (Market Abuse Directive) [2014] OJ L173, 12 June, 179.

Extending EU Competence to Criminalise Elsewhere in the Treaty 121 decriminalisation at the national level. The adoption of the Market Abuse Regulation and the Market Abuse Directive throw up a number of challenges in this regard. On the one hand, the Directive adopts a restrictive criminalisation approach, limiting criminalisation as a minimum measure to serious cases – although the Directive’s reference to including ‘at least’ serious cases raises issues of legal certainty.175 On the other hand, administrative sanctions imposed by the Regulation are ‘without prejudice to any criminal sanctions’.176 It is submitted that this approach undermines the effectiveness of the market abuse legal framework put forward by the combination of the Regulation and the Directive, as the relationship between the two instruments and their objectives becomes blurred and the added value of distinguishing between criminal and administrative law becomes unclear. The wording of the Regulation may result in cases where market abuse is punishable with administrative sanctions in one Member State and by criminal sanctions in another. This approach raises serious issues of legal certainty vis-a-vis affected individuals and legal persons in Europe’s area of criminal justice, highlighting the quest for certainty in terms of the protection of fundamental rights177 and rendering the prospect of double punishment (administrative and criminal) in cross-border cases a reality. It also raises a number of questions on the scope and applicability of the ne bis in idem principle in parallel criminal/‘administrative’ proceedings.178

VI. Extending EU Competence to Criminalise Elsewhere in the Treaty The attempt by the drafters of the Lisbon Treaty to determine more clearly the extent of EU competence in substantive criminal law under Article 83 TFEU may be undermined not only by the inherent flexibility in the competence requirements of Article 83(1) and 83(2) TFEU, but also by the question of whether these provisions are the sole legal bases for EU action in the field. It is contested in particular whether Article 83(2) is the only legal basis for the adoption of functionalist EU criminal law or whether criminal law can be adopted by the EU by using a different, policy-specific legal basis elsewhere in the Treaty. Using a legal basis other than Article 83(1) and 83(2) TFEU has significant constitutional consequences: it may enable the adoption of EU substantive criminal law measures in the form of regulations; it deprives Member States of the option of using the emergency brake introduced under Article 83(3) TFEU; and it forces the participation of Denmark and Ireland (and the UK when it was a Member State) in EU criminal law if the legal basis for EU criminalisation is located in a part of the Treaty from which

175 See arts 3(1), 4(1) and 5(1) of the Market Abuse Directive (n 174). 176 Article 30(1) of the Market Abuse Regulation (n 174). 177 The CJEU has held that Member States must ensure, in the context of the implementation of obligations stemming from Directive 2003/6 or Regulation No 596/2014, that, in accordance with the right to silence guaranteed by arts 47 and 48 of the Charter, the competent authority cannot impose penalties on natural persons for refusing to provide that authority with answers which might establish their liability for an offence that is punishable by administrative sanctions of a criminal nature, or their criminal liability: Case C-481/19, DB (Consob), ECLI:EU:C:2021:84. 178 For a detailed analysis, see ch 3.

122 Substantive Criminal Law these states have not negotiated an opt-out. EU substantive criminal law rules adopted under a legal basis other than Article 83 TFEU may not necessarily be minimum rules. The adoption of regulations in the field of substantive criminal law challenges Treaty requirements to respect national diversity as outlined in Title V of the TFEU on the AFSJ.179 It also – at least in theory – raises the prospect for EU measures defining criminal offences and imposing criminal sanctions to have direct effect, thus reversing the protective function of the principle in domestic legal orders. While the Court of Justice has excluded the direct effect of Directives in this context,180 direct effect is not excluded in the case of regulations that do not require further implementing measures by Member States.181 However, it is difficult to see how in practice a Regulation defining criminal offences and imposing criminal sanctions would be clear and unconditional enough not to require a degree of implementation in order to secure an adjustment to the specificities of national criminal justice systems. The first potential legal basis for substantive criminal law outside Article 83 TFEU is Article 325 TFEU on the fight against fraud affecting the EU’s financial interests. Article 325(4) confers upon the EU competence to adopt: [T]he necessary measures in the fields of the prevention of and fight against fraud affecting the financial interests of the Union with a view to affording effective and equivalent protection in the Member States and in all the Union’s institutions, bodies, offices and agencies.

A comparative analysis of Article 325(4) TFEU with its pre-Lisbon version182 reveals that the last sentence of Article 280(4) has been deleted in the Lisbon text. This sentence stated that measures to combat fraud (an area which is not expressly listed in Article 83(1) TFEU but may be included in Article 83(2)) will not concern the application of national criminal law and the national administration of justice.183 The fact that the adoption of criminal law measures is not excluded by Article 325(4) TFEU, in addition to the general wording of the provision, can be seen to militate in favour of the conferral on the EU of competence to define criminal offences and impose criminal sanctions in the field not under Article 83(2) TFEU, but solely under Article 325 TFEU. It has been noted that such competence is justified by the fact that Article 325(4) TFEU contains a stronger obligation to legislate in comparison with Article 83 (by the use of the verb ‘shall’ instead of ‘may’) as well as by the fact that Article 325(4) calls for the adoption of ‘necessary measures’, instead of the more minimalistic requirement of Article 83 TFEU for the EU to adopt ‘minimum rules’.184 It should also be noted in this context that Article 325 TFEU is a legal basis for the adoption of measures in a specific criminal justice field (fraud). In terms of policy areas, Article 325(4) can thus be considered as lex specialis in relation to Article 83(2). It is noteworthy in this context that the Commission has opted in favour of using exclusively Article 325 TFEU as a legal 179 See art 67 TFEU. 180 Berlusconi (n 25). 181 For details, see V Mitsilegas, ‘Article 49 (the Principles of Legality and Proportionality of Criminal Offences and Penalties)’ in S Peers et al (eds), The EU Charter of Fundamental Rights: A Commentary (Hart Publishing/CH Beck, 2014) 1351–73. 182 Article 280(4) EC. 183 A similar clause was deleted from art 135 EC concerning customs cooperation (now art 33 TFEU). 184 R Sicurella, ‘Some Reflections on the Need for a General Theory of the Competence of the European Union in Criminal Law’ in A Klip (ed), Substantive Criminal Law of the European Union (Maklu, 2011) 233–50, at 236–37.

Extending EU Competence to Criminalise Elsewhere in the Treaty 123 basis for its recent proposal for a Directive on fraud.185 However, in negotiations in the Council, Member States have opted for the use of Article 83(2) TFEU as the sole legal basis for the Directive,186 with the Directive eventually being adopted under an Article 83(2) TFEU legal basis.187 The discussion on the use of Article 325 TFEU as a legal basis for the adoption of EU substantive criminal law is of relevance to the parallel debate on whether the harmonisation of substantive criminal law on fraud offences (seen as attacking a ‘European’ interest par excellence) should take place in the form of a Regulation (seen to provide a higher level of uniformity) or a Directive (allowing Member States leeway in implementation).188 The discussion is inextricably linked to the question of legal certainty in the operation of the EPPO, whose mandate is based primarily on the offences established in the anti-fraud (PIF) Directive.189 The impact of the determination of the material competence of the EPPO via a reference to the PIF Directive on legality, legal certainty and foreseeability must be seen from the broader perspective of legal certainty in the context of the harmonisation of substantive criminal law at the EU level. EU legislative intervention before (via Framework Decisions) and after (via Directives) Lisbon in the field is designed to allow Member States a degree of leeway in implementation in order to adjust EU law objectives to the specificity of their domestic criminal justice systems. In addition to sovereignty concerns, this choice reflects the considerable diversity in national criminal justice systems and their internal coherence. Legality, legal certainty and foreseeability must thus be assessed primarily from the perspective of the implementation of EU law in domestic legal orders – a point which is made clearly throughout Article 22 of the EPPO Regulation, which enumerates the offences forming its material competence ‘as implemented by national law’. Sceptics of this approach point out that it may lead to divergences in the mandate of the EPPO depending on the different implementation routes of the PIF Directive in different Member States, hence hindering legal certainty and foreseeability in terms of EPPO action across the board,190 especially in cases of defective transposition of the Directive by Member States.191 Two arguments can be put forward to address this concern.192 First, even if EU criminal law on PIF offences had taken the form of a Regulation, it is highly likely that 185 COM (2012) 363 final, Brussels, 11 July 2012; art 325(4) TFEU. 186 See Council Document 8604/15, Brussels, 7 May 2015, www.statewatch.org/news/2015/may/eu-councilfraud-dir-trilogue-8604-15.pdf. 187 Directive (EU) 2017/1371 on the fight against fraud to the Union’s financial interests by means of criminal law [2017] OJ L198/29. 188 It has been noted that despite the fact that the financial interests of the EU are the same irrespective of the country where the offences are committed, investigated, prosecuted and tried, the substantive legal framework regarding prosecution will differ from one Member State to another; see P Caeiro and J Amaral Rodrigues, ‘A European Contraption: The Relationship between the Competence of the EPPO and the Scope of Member States’ Jurisdiction over Criminal Matters’ in K Ligeti, MJ Antunes and F Giuffrida (eds), The European Public Prosecutor’s Office at Launch (Wolters Kluwer-Cedam, 2020) 57–84, at 61. 189 See ch 8. 190 For a critique on the potential lack of harmonisation leading to diversity in terms of applicable law, see R Sicurella, ‘A Blunt Weapon for the EPPO? Taking the Edge off the Proposed PIF Directive’ in W Geelhoed, LH Erkelens and AWH Meij (eds), Shifting Perspectives on the European Public Prosecutor’s Office (Asser Press and Springer, 2018) 99–128 at 102. 191 See Caeiro and Rodrigues (n 188) 64. 192 V Mitsilegas, ‘European Prosecution between Cooperation and Integration: The European Public Prosecutor’s Office and the Rule of Law’ (2021) 28 Maastricht Journal of European and Comparative Law 245.

124 Substantive Criminal Law Member States, as in the case of the EPPO Regulation itself, would still have to adopt implementing legislation to adjust the requirements of EU law within their domestic legal orders. It is hard to see how an EU text in criminal law would in all cases provide a one-size-fits all solution applicable in all Member States bound by the instrument without the need for further national adjustment. Second, one should not underestimate the potentially high harmonising effect of Directives. While there may be differences in implementation in Member States, the post-Lisbon constitutional armoury in EU criminal law grants extensive powers of scrutiny of national implementation to the Commission and jurisdiction to the CJEU to clarify any grey areas which may arise. The argument that ‘European’ offences such as fraud which affects a ‘European’ interest distinct from national interests require a uniform European substantive criminal law does not add much to the above discussion, and in fact would pose additional challenges to legal certainty. In view of the extension of the EPPO mandate to relating offences and of proposals to extend the EPPO’s material competence to cover offences such as terrorism in the future,193 it is not clear how one can meaningfully distinguish between offences affecting the EU financial interests on the one hand (as ‘true’ European offences requiring uniform criminal law) and other areas of crime triggering EU competence under the TFEU legal bases on securitised and functional criminalisation set out in Article 83(1) and (2) TFEU on the other hand.194 In addition to the potential use of Article 325 TFEU as a legal basis, attention should also be given to two further alternative legal bases for the adoption of EU substantive criminal law, one located within and the other outside the Treaty title on the AFSJ (Title V). Within Title V, the relevant provision is Article 86 TFEU, which enables the establishment of the EPPO. According to Article 86(2) TFEU, the EPPO will be ‘responsible for investigating, prosecuting and bringing to judgment the perpetrators of, and accomplices in, offences against the Union’s financial interests’, as determined by the Regulation establishing the Office provided for in Article 86(1). According to Article 86(4) TFEU, the powers of the EPPO may be subsequently extended by a decision of the European Council ‘to include serious crime having a cross-border dimension and amending accordingly [Article 86(2)] as regards the perpetrators of, and accomplices in, serious crimes affecting more than one Member State’. The question thus arises as to whether legislation defining criminal offences and imposing criminal sanctions for the purposes of the operation of the EPPO can be adopted not under Article 83, but under Article 86(2) and 86(4) TFEU, which would lead to the adoption of substantive criminal law under different legislative procedures, by different institutions (note the reference to the European Council in Article 86(4)) and by different instruments. The wording of Article 86(2), which calls for fraud offences to be ‘determined’ by a Regulation under Article 86(1), is open enough not to exclude the adoption of substantive EU criminal law on fraud. However, the function of any criminalisation based on Article 86(2) TFEU would be limited to the operation of the EPPO and would not exclude the adoption of 193 For a discussion of the potential extension of the material competence of the EPPO, see A Juszszak and E Sason, ‘Fighting Terrorism through the European Public Prosecutor’s Office (EPPO)?’ (2019) 1 Eucrim 66. 194 On a taxonomy of EU competence in the field of substantive criminal law in art 83 TFEU under these terms, see V Mitsilegas, ‘EU Criminal Law Competence after Lisbon: From Securitised to Functional Criminalisation’ in D Acosta and C Murphy (eds), EU Security and Justice Law (Hart Publishing, 2014) 110–29.

Contesting EU Competence in Substantive Criminal Law 125 parallel EU measures under Article 83(2) or Article 325(4) TFEU – with the risk of proliferation and fragmentation of the criminal law on fraud being visible. On the other hand, Article 86(4) TFEU, which refers to the inclusion of further areas of crime, should be read as mandating not a criminalisation process, but merely the listing of offences already defined elsewhere.195 Another alternative criminalisation legal basis discussed by commentators is the catch-all provision of Article 352(1) TFEU, which confers competence on the EU if action by the EU should prove necessary, within the framework of the policies defined in the treaties, to attain one of the objectives set out in the Treaties, and the Treaties have not provided the necessary powers.196 It has been pointed out that Article 352(1) TFEU could lead to the adoption of EU substantive criminal law in cases where the requirement of Article 83(2) TFEU for harmonisation in the underlying policy area has not been met, and it has been argued that Article 352 should not apply in the light of this requirement197 and in the light of the existence of the specific provisions in Title V TFEU.198 However, this analysis cannot mask the paradox inherent in the constitutionalisation of functional criminalisation in the Lisbon Treaty. If substantive criminal law is, under Article 83(2) TFEU, merely a means to the end of achieving effectiveness of EU law based on the specific EU policies outlined in the Treaties, it is difficult to see in principle why the Treaty legal bases relating to these policies and located elsewhere in the treaties – in particular outside the Treaty Title on the AFSJ – cannot be used as additional, or alternative, legal bases for the adoption of EU substantive criminal law. This is especially the case where the conditions of Article 83(2) TFEU are not met, in particular where an area has not been subject to harmonisation measures and there is an urgent need to address a social problem relating to the implementation of an EU policy or objective.

VII. Contesting EU Competence in Substantive Criminal Law: The Lissabon-Urteil The care taken by the drafters of the Lisbon Treaty to circumscribe the extent of EU competence in the field of criminal law has not addressed fully national concerns regarding the potential overreach of the EU in the field. These concerns have been most vividly reflected in the judgment of the German Constitutional Court on the Lisbon Treaty.199 Throughout the judgment, the German Court advocated a restrictive interpretation of the EU’s competence in criminal matters.200 Underlying this approach is the attempted link that the Bundesverfassungsgericht has made between criminal law, democracy,

195 But see here the analysis of Sicurella (n 184), who argues that art 86(2) TFEU also implies a listing function. 196 See E Herlin-Karnell, The Constitutional Dimension of European Criminal Law (Hart Publishing, 2012) ch 4. 197 Asp (n 168) 138. 198 Herlin-Karnell (n 196) 87. 199 Decision of 30 June 2009 (2 BvE 2/08, 5/08, 2 BvR 1010/08, 1022/08, 1259/08, 182/09). 200 See in particular ibid paras 358 and 363.

126 Substantive Criminal Law community and identity at the national level, and safeguarding of what the Court has deemed ‘democratic self-determination’. The Court has emphasised the fact that criminalisation stems essentially from national values and moral choices, and only partially from European values.201 Criminal law harmonisation must extend only to specific cross-border situations on restrictive conditions; in principle, substantial freedom of action must remain reserved for the Member States.202 The Court applied this reasoning in particular with regard to the EU’s criminalisation competence under Article 83(1) TFEU. According to the Court, democratic self-determination is affected in a particularly sensitive manner where a legal community is prevented from deciding on the punishability of conduct, or even the imposition of prison sentences, according to their own values. This applies all the more the closer these values are connected to historical experience, traditions of faith and other factors essential to the self-esteem of the people and their society.203 The main reference point for the democratic legitimacy of criminal law for the German Constitutional Court thus seems to remain the nation state. Common values, public perception of these values and public opinion are shaped at the national level and not at the EU level.204 This emphasis on democratic legitimacy based on national communities can be seen as addressing the perceived problem of ‘moral distance’, which is defined as the frequent remoteness or separation of law’s normative expectations from many of those current and familiar in the fields of social interaction that it purports to regulate.205 Yet the exclusive focus by the Bundesverfassungsgericht on the state as the sole source of democratic legitimacy – which permeates the judgment – has rightly been criticised as unduly German-centric.206 In the field of criminal law, the ruling appears to disregard the constitutionalisation of EU criminal law outlined above, the prominent role played by democratic institutions such as the European Parliament in this context and the thorough attempts by the drafters of the Lisbon Treaty to clarify as far as possible the extent of EU competence in the field and the balance of powers between the EU and its Member States.207 Further, the ruling does not take into account the safeguards built into the Lisbon Treaty with regard to the exercise of EU competence in criminal matters, and in particular the use of Directives (which leave leeway as regards the means of implementation to Member States) as the exclusive instrument of EU lawmaking under Articles 82 and 83 TFEU. While the German Constitutional Court has not declared the Treaty unconstitutional (but rather placed emphasis on national control of the operation of a series of Lisbon safeguards, such as the emergency brake), its approach leaves the possibility open for further constitutional tension between the national and EU levels on the EU’s powers in the field of criminal law. 201 ibid para 253. 202 ibid. 203 ibid para 363. 204 See also A Steinbach, ‘The Lisbon Judgment of the German Federal Constitutional Court: New Guidance on the Limits of European Integration?’ (2010) 11 German Law Journal 367, in particular 377–79. 205 R Cotterrell, Law’s Community: Legal Theory in Sociological Perspective (Clarendon Press, 1995) 304–05. 206 For a persuasive critique see D Halberstam and C Möllers, ‘The German Constitutional Court says “Ja zu Deutschland!”’ (2009) 10 German Law Journal 1241–57. 207 For a critique of the Court’s arguments on the lack of the EU’s democratic legitimacy, see D Grimm, ‘Comments on the German Constitutional Court’s Decision on the Lisbon Treaty: Defending Sovereign Statehood against Transforming the European Union into a State’ (2009) 5 European Constitutional Law Review 353, 367–68.

Policy Responses to the EU Competence to Criminalise after Lisbon 127

VIII. Policy Responses to the EU Competence to Criminalise after Lisbon The redefinition of the EU’s competence to criminalise by the Lisbon Treaty has led to an extensive inter-institutional policy debate over the extent and use of such competence. The European Council’s intentions were revealed in the Stockholm Programme,208 which includes a special section on criminal law.209 The Stockholm Programme confirms in this context that criminal behaviour in the areas of particularly serious crime with a cross-border dimension resulting from the nature or impact of such offences or from a special need to combat them on a common basis should become the object of common definitions of criminal offences and common minimum levels of maximum sanctions, and that these are the serious criminal offences referred to in Article 83(1) TFEU. Priority should be given to terrorism, trafficking in human beings, illicit drug trafficking, sexual exploitation of women and children, and child pornography and computer crime. The European Council invited the Commission in particular to examine whether the level of approximation is sufficient in relation to the adopted Framework Decisions and to report on the need to establish common definitions and sanctions, and to consider submitting new legislative proposals where further approximation is needed, adding that the relationship between the approximation of criminal offences or their definition and the double criminality rule within the framework of mutual recognition should be further explored. Particular emphasis has been placed upon the justification and limits or conditions for the adoption of EU substantive criminal law. According to the Stockholm Programme, criminal law provisions should be introduced when they are considered essential in order for the interests to be protected and, as a rule, should only be used as a last resort. Minimum rules with regard to the definition of criminal offences and sanctions may also be established when the approximation of criminal laws and regulations of the Member States proves essential to ensuring the effective implementation of an EU policy which has been subject to harmonisation measures. The Stockholm Programme was preceded by the adoption of Conclusions by the Council shortly before the entry into force of the Lisbon Treaty.210 The Council’s intervention can be seen as an attempt to set out a marker on what Member States consider to be the extent and limits of EU competence to criminalise after Lisbon. The Council predicted that the Lisbon Treaty was likely to have the effect that criminal law provisions would be discussed within the Council to an even greater extent than previously, and that this might result in incoherent and inconsistent criminal provisions in EU legislation. In order to address this, the Council put forward a series of detailed Guidelines for EU substantive criminal law. It emphasised in particular the requirement to assess the need for criminal provisions and stressed the application of principles including

208 The Stockholm Programme – An Open and Secure Europe Serving and Protecting Citizens [2010] OJ C115/01. 209 ibid s 3.3.1. 210 Draft Council conclusions on model provisions, guiding the Council’s criminal law deliberations Council Doc 16542/1/09 25 November 2009. See also Council Doc 16798/09, 27 November 2009 – endorsed by the JHA Council of 30 November – 1 December 2009, Doc 16883/1/09 REV 1 (Presse 355) 31.

128 Substantive Criminal Law necessity and ultima ratio (namely that criminal law provisions should be introduced when they are considered essential in order for the interests to be protected and, as a rule, should be used only as a last resort), proportionality and subsidiarity. The Guidelines also emphasised the need to address clearly defined and delimited conduct, which cannot be addressed effectively by less severe measures, and added that when there seems to be a need to adopt new criminal provisions, the following factors should be further considered: added value or effectiveness of criminal provisions compared to other measures; how serious and/or widespread and frequent the harmful conduct is both regionally and locally within the EU; and the possible impact of existing criminal provisions on EU law and on different legal systems. The Council Guidelines demonstrate a degree of ambiguity with regard to the impact of EU substantive criminal law on the domestic systems of penalties. It is stated that when it has been established that criminal penalties for natural persons should be included, it may in some cases be sufficient to provide for ‘effective, proportionate and dissuasive’ criminal penalties and to leave it to each Member State to determine the actual level of the penalties, but that in other cases, there may be a need to go further in the approximation of the levels of the penalties. The European Commission reacted to the entry into force of the Lisbon Treaty by publishing a Communication on European Criminal Policy.211 The Commission focused on what it considered to be the ‘added value’ of the harmonisation of substantive criminal law. This ‘added value’ was perceived to be fourfold: harmonisation of criminal law fosters the confidence of citizens in using their right to free movement and to buy goods or services from providers from other Member States through a more effective fight against crime; it prevents ‘forum shopping’ by criminals; it strengthens mutual trust among the judiciaries and law enforcement authorities of the Member States, facilitating mutual recognition and judicial cooperation in criminal matters; and it helps to prevent and sanction serious offences against EU law in important policy areas, such as the protection of the environment or illegal employment. This is a rather mixed bag of assertions whose credibility is difficult to ascertain – this was the case in particular when the Commission emphasised the subjective elements of EU criminal law as enhancing the confidence of citizens in exercising their EU law rights and as leading to greater mutual trust among national authorities.212 Aware that such a vague approach might lead to fears that the Commission would be unduly activist in the field of substantive criminal law after Lisbon, the Commission proceeded to outline the principles that should guide EU criminal law.213 These principles included subsidiarity and respect for fundamental rights. The Commission then called for a two-step approach in criminal law legislation: step one concerned the decision on whether to adopt criminal law measures at all, where it was stated that necessity and proportionality must be respected and that criminal law

211 Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, ‘Towards an EU Criminal Policy: ensuring the effective implementation of EU policies through criminal law’ (Communication) COM (2011) final, 20 September 2011. 212 V Mitsilegas, ‘The Limits of Mutual Trust in Europe’s Area of Freedom, Security and Justice: From Automatic Inter-state Cooperation to the Slow Emergence of the Individual’ (2012) 31 Yearbook of European Law 319. 213 Commission to the European Parliament (n 211) 6–9.

Policy Responses to the EU Competence to Criminalise after Lisbon 129 is a means of last resort (ultima ratio); and step two concerned the principles guiding the decision on what kind of criminal law measures to adopt – these included the adoption of minimum rules, necessity and proportionality, the existence of clear factual evidence about the nature and effects of the crime in question as well as about a diverging legal situation in all Member States which could jeopardise the effective enforcement of an EU policy subject to harmonisation, and tailoring the sanctions to the crime. However, these principles should not be read as a sign of the Commission’s limited ambition as regards the adoption of further substantive criminal law at the EU level. The last part of the Communication revealed the primary purpose of the document, which was to set out the Commission’s vision as to the areas where further EU standards on criminal offences and sanctions would be developed on the basis of Article 83(2) TFEU.214 The list of such policies provided in the Communication is far-reaching. The Commission claimed that it had been established that criminal law measures were necessary in order to protect the financial sector, to fight against fraud and to protect the euro against counterfeiting, and that it would further reflect on the use of criminal law to tackle the illegal economy and financial crime, and on the use of criminal law in areas as diverse as road transport, data protection, customs rules, environmental protection, fisheries policy and internal market policies. Rather than following the principles set out earlier in the Communication, this list confirmed an expansive approach treating criminal law merely as a ‘means to an end’.215 The European Parliament responded by the adoption of a resolution on an EU approach to criminal law.216 The resolution focused on the principles that should govern EU action in the field of substantive criminal law. The European Parliament stressed the need for EU substantive criminal law to respect the principles of subsidiarity and proportionality and fundamental rights. It was also noted that, in the adoption of EU substantive criminal law, it is not sufficient to refer to abstract notions or to symbolic effect, but that the necessity of new substantive criminal law provisions must be demonstrated by the necessary factual evidence making it clear that damage has occurred; there are no less intrusive measures which can be adopted; that the crime in question is of a particularly serious nature or is having a direct negative impact on the effective implementation of an EU policy which has been subject to harmonisation measures; that there is a need to combat on a common basis; and that EU action is in conformity with Article 49(3) of the Charter and in particular that the severity of the proposed sanctions is not disproportionate to the criminal offence. The European Parliament also

214 ibid 9–11. 215 This expansionist tendency is also reflected in the willingness of the Commission to maintain legal basis litigation concerning criminal law. The latest example is a case before the ECJ in which the Commission obtained the annulment of a road traffic directive adopted under art 87(2) TFEU (Directive 2011/82/ EU facilitating the cross-border exchange of information on road safety related traffic offences [2011] OJ L288/1, 5 November 2011), with the Commission successfully arguing in favour of the more supranational legal basis of art 91(1) TFEU (Case C-43/12, European Commission v European Parliament and Council, judgment of 6 May 2014, EU:C:2014:298). Although the case did not involve the adoption of substantive criminal law, it is a clear indication that the Commission will not hesitate to defend its choices or prerogatives in cases involving the use of art 83(2) TFEU. 216 Based on ‘Report on an EU approach on criminal law’ A7-0144/2012, 24 April 2012, Rapporteur: Cornelis de Jong.

130 Substantive Criminal Law recognised the importance of the other general principles governing criminal law (such as the principle of non-retroactivity of criminal sanctions) and welcomed the recognition by the Commission that the first step in criminal law legislation should always be to decide whether to adopt substantive criminal law measures at all. The differences in the policy approaches of EU institutions towards substantive criminal law are noteworthy. In the Stockholm Programme, the European Council placed emphasis on the continuation of the adoption by the EU of securitised criminal law. Member States in the Council aimed at pre-empting the supranationalisation brought forward by the entry into force of the Lisbon Treaty, and emphasised conditions and limits to the exercise of EU competence under Article 83 post-Lisbon. The Commission attempted to demonstrate the added value of criminalisation at the EU level and focused primarily on functional criminalisation. The European Parliament emphasised the need for EU substantive criminal law to comply with fundamental rights. A common theme in these institutional approaches has been the call to respect either fundamental principles of domestic criminal law (such as ultima ratio) or constitutional principles of EU law, including effectiveness, subsidiarity and proportionality. Institutional practice after the entry into force of the Lisbon Treaty in terms of the production of secondary substantive criminal law has not revealed a major change to the pre-Lisbon practice as regards post-Lisbon initiatives proposed by the Commission. Those who expected a renewed momentum towards EU harmonisation in the field of substantive criminal law by the post-Stockholm five-year plan will have been disappointed by the European Council conclusions of June 2014 which contained minimal – if any – references to criminal law harmonisation.217 EU law constitutional principles – and in particular the principles of legality and proportionality as enshrined in Article 49 of the Charter – that must be taken into account in the further development of EU substantive criminal law. In addition to addressing the issue of EU competence, a key and distinct question which must be addressed is ‘why criminalise?’,218 with the adoption of EU measures with the effect of decriminalising certain conduct also being considered.

IX. EU Criminalisation Challenges and Prospects for Law Reform As has been seen earlier in this chapter, the EU legislators have used the powers conferred upon them by Article 83 TFEU to adopt legislation on substantive criminal law in a number of areas of securitised and functional criminalisation. However, there remain areas where EU criminalisation efforts face considerable challenges in terms of the degree of harmonisation achieved, clarity in terms of the existence of EU competence to criminalise, and the degree of criminalisation at the EU level, including concerns

217 European Council Conclusions of 26–27 June 2014, EUCO Doc 79/14, Brussels, 27 June 2014. 218 For a call to take normative and criminological justifications seriously in the development of EU legislation, see N Persak, ‘EU Criminalisation, its Normative Justifications, and Criminological Considerations for EU Criminal Policy and Justice’ in J Ouwerkerk, J Altena, J Öberg and S Miettinen (eds), The Future of EU Criminal Justice Policy and Practice: Legal and Criminological Perspectives (Brill, 2019) 15–36.

EU Criminalisation Challenges and Prospects for Law Reform 131 regarding overcriminalisation. Challenges arise in particular in areas of crime where the EU had legislated before the entry into force of the Lisbon Treaty, but where legislation has not been revised since. This section will focus on four key areas of crime in order to address the multi-dimensional challenges of substantive criminal law reform at the EU level. The analysis will focus on: the criminalisation of organised crime as a prime example of securitised criminalisation; the criminalisation of racism and xenophobia as a competence used under the third pillar but not expressly envisaged under the Lisbon Treaty; in terms of functional criminalisation, the adoption of substantive criminal law on the protection of the environment, following the translation into the EU legal framework of the CJEU Environmental Crime ruling; and the case for decriminalisation in the case of facilitation of unauthorised entry, transit and residence.

A. Securitised Criminalisation: Reconceptualising Organised Crime The adoption of substantive criminal law to tackle organised crime constitutes a prime example of securitised criminalisation. The need to fight organised crime has been one of the main motors for the advancement of European integration in the field of criminal law. It justified to a great extent the expansion of EU competence in criminal matters in Maastricht and beyond, and was elevated to becoming a top EU priority by a number of political declarations in the 1990s, including (with eastward enlargement looming) two Action Plans to combat organised crime in 1997 and 2000.219 Yet, as in the case of anti-corruption law,220 EU substantive criminal law on organised crime remains out of date, with the acquis dating back to before the entry into force of the Lisbon Treaty.221 With organised crime forming a central part of EU action in the third pillar and being included in the mandate of Europol, calls surfaced in the 1990s regarding the need for a harmonised definition of the term across the EU.222 These calls resulted in the adoption in 1998, under a Maastricht legal basis, of a Joint Action making it a criminal offence to participate in a criminal organisation in the EU Member States.223 A central term to be agreed in this context has been the concept of a ‘criminal organisation’. This has by no means been an easy task, given the lack of clarity as to the required degree of organisation and the differences in views within the criminological and law enforcement community (is organised crime understood as involving hierarchically structured criminal groups or are we talking about more loosely constructed networks?) and the different national priorities and paradigms in fighting organised 219 For the background, see Mitsilegas, Monar and Rees (n 52) ch 1. 220 On the gaps in EU substantive criminal law on corruption, see V Mitsilegas ‘The Aims and Limits of EU Anti-corruption Law’ in J Horder and P Alldridge (eds), Modern Bribery Law: Comparative Perspectives (Cambridge University Press, 2013) 160–95. For a call for the reform of EU substantive law on organised crime and corruption, see P Caeiro, L Foffani and V Mitsilegas, ‘Strengthening the Fight against Economic and Financial Crime within the EU’ (2020) 3 Eucrim 248. 221 As in the case of anti-corruption, the EU has emerged as a key actor in the development of global measures in the field; see ch 10. 222 See Mitsilegas (n 157) 565–68. 223 98/733/JHA, L351, 29 December 1998, 1.

132 Substantive Criminal Law crime (for instance, is the Mafia model applicable across Europe?).224 The solution reached in the Joint Action has been to define a criminal organisation as: [A] structured association, established over a period of time, of more than two persons, acting in concert with a view to committing offences which are punishable by deprivation of liberty or a detention order of a maximum of at least four years or a more serious penalty, whether such offences are an end in themselves or a means of obtaining material benefits and, where appropriate, of improperly influencing the operation of public authorities.225

This definition is far from clear, as terms such as ‘structured association’ and a ‘period of time’ remain unspecified.226 However, it proved to be influential in terms of the development of a definition of organised crime in the subsequent UN Convention on Transnational Organised Crime signed in Palermo in 2000.227 The definition of an organised criminal group therein is very similar to the one in the Joint Action,228 with the Convention in addition containing a definition of what constitutes a ‘structured group’.229 The latter definition is also far from clear and seems at odds with the very requirement of ‘structure’ in an organised crime group. A further issue of complexity in the negotiations of the Joint Action was the criminalisation and legal definition of participation in an organised crime group. The latter conduct had been a criminal offence only in a number of EU Member States, and even in those cases there had been significant differences with regard to the concepts used in domestic law.230 Moreover, in countries such as the UK, participation in organised crime was a concept used by law enforcement agencies, but was not a legal term, with the law criminalising conspiracy more broadly.231 In the light of these different legal approaches, the compromise reached in the Joint Action has been to offer Member States a choice between two options of criminalisation: Member States are called upon to punish by ‘effective, proportionate and dissuasive penalties’ one or both of the following types of conduct: (a) conduct by any person who, with intent and with knowledge of either the aim and general criminal activity of the organisation or the intention of the organisation to commit the offences in question, actively takes part in: ––

the organisation’s criminal activities falling within Article 1, even where that person does not take part in the actual execution of the offences concerned and, subject

224 For an analysis, see V Mitsilegas, ‘From National to Global, from Empirical to Legal: The Ambivalent Concept of Transnational Organised Crime’ in M Beare (ed), Critical Reflections on Transnational Organized Crime, Money Laundering and Corruption (University of Toronto Press, 2003) 55–87. 225 Art 1, sub-para 1. These offences include those mentioned in Art 2 of the Europol Convention and its Annex and carrying an equivalent sentence to that mentioned above (Art 1 sub-para 2). 226 See Mitsilegas (n 157). 227 For a commentary see D McClean, Transnational Organized Crime: A Commentary on the UN Convention and its Protocols (Oxford University Press, 2007). On the EU role in negotiating the Palermo Convention, see ch 10. 228 Article 2(a) of the UN Convention on Transnational Crime defines an organised crime group as ‘a structured group of three or more persons, existing for a period of time and acting in concert with the aim of committing one or more serious crimes or offences established in accordance with this Convention, in order to obtain, directly or indirectly, a financial or other material benefit’. 229 Article 2(c) defines a structured group as ‘a group that is not randomly formed for the immediate commission of an offence and that does not need to have formally defined roles for its members, continuity of its membership or a developed structure’. 230 For a comparison between Italy and Germany, see Mitsilegas (n 224). For an overview of national approaches to organised crime in Europe, see C Fijnaut and L Paoli (eds), Organised Crime in Europe: Concepts, Patterns and Control Policies in the European Union and Beyond (Springer, 2004) 231 Mitsilegas (n 224).

EU Criminalisation Challenges and Prospects for Law Reform 133

––

to the general principles of the criminal law of the Member State concerned, even where the offences concerned are not committed, the organisation’s other activities in the further knowledge that his participation will contribute to the achievement of the organisation’s criminal activities falling within Article 1;

(b) conduct by any person consisting in an agreement with one or more persons that an activity should be pursued which, if carried out, would amount to the commission of offences falling within Article 1, even if that person does not take part in the actual execution of the activity.232

This result effectively meant that common law jurisdictions would not have to change their law to create a specific offence on participation in a criminal organisation, but would continue to prosecute on the basis of conspiracy, elements of which are clearly reflected in the second option cited above. For those seeking a harmonised legal definition of participation in a criminal organisation, the result may be far from satisfactory as the two options used do not converge on the central element of participation.233 However, this ‘dual’ model has also been adopted by the Palermo Convention, presumably to take into account specificities in common law jurisdictions.234 The wording of the options used in the Palermo Convention is similar to the wording of the Joint Action,235 with the Convention adding the criminalisation of ‘organising, directing, aiding, abetting, facilitating or counselling the commission of serious crime involving an organised crime group’.236 In 2005, the Commission tabled a proposal for a Framework Decision ‘on the fight against organised crime’ aiming at replacing the 1998 Joint Action.237 According to the Commission, the new proposal took into account developments since 1998, including the introduction of Framework Decisions as a form of third pillar law in Amsterdam and the need to take into account legislative developments such as the Palermo Convention and the EU Framework Decision on terrorism.238 The Commission proposal further harmonised the crime of participation in a criminal organisation (by deleting the conspiracy variant),239 aligned EU law with the Palermo Convention by the criminalisation of directing a criminal organisation240 and the definition of an organised crime group (including what constitutes a ‘structured’ group),241 added provisions on mitigating circumstances242 as well as specific provisions on penalty levels,243 and

232 98/733/JHA, L351, article 2(1). 233 For a discussion, see Mitsilegas (n 157) 571–72. 234 See also McClean (n 227) 67. Commenting on the implementation of art 5, he notes that ‘the statute books of the common law countries which have ratified the Convention will be searched in vain for crimes defined as set out in this Article. As has been clear from the beginning, the offences of conspiracy, soliciting, and other forms of participation in criminal conduct more than adequately cover the field described in the text of the Article’. 235 Art 5(1)(a). 236 ibid art 5(1)(b). 237 COM (2005) final, Brussels, 19 January 2005. 238 ibid 3, 4. 239 Art 2 of the proposal. 240 ibid art 2(b). 241 ibid art 1. 242 ibid art 4. 243 ibid art 3.

134 Substantive Criminal Law introduced specific provisions on the position of victims, along the lines of the Framework Decision on terrorism.244 Following complex negotiations, in April 2006 the Justice and Home Affairs Council reached a ‘consensus’ on the Framework Decision,245 which was eventually adopted in 2008.246 The agreed text retains the Commission’s draft as regards the definition of a criminal organisation.247 It introduces a series of penalty levels on the basis of the ‘minimum maximum’ model described above,248 as well as granting Member States the discretion to introduce certain aggravating circumstances into their domestic law.249 Provisions on mitigating circumstances and (albeit slightly watered down) the position of victims have also been introduced.250 However, there have also been major changes to the Commission’s proposal: the criminalisation of directing an organised crime group has been deleted from the text; and, strikingly, the Framework Decision re-introduces the approach adopted by the Joint Action of offering Member States the option of criminalising either participation in a criminal organisation or conspiracy.251 The re-introduction of options to allow Member States to choose between the criminalisation of participation in a criminal organisation and conspiracy caused the reaction of the Commission, which issued (joined by France and Italy) a strongly worded statement that is annexed to the Framework Decision. It states that: The Commission considers that the Framework Decision on the fight against organised crime fails to achieve the objective sought by the Commission in relation to Joint Action 98/733/ JHA on making it a criminal offence to participate in a criminal organisation in the Member States of the European Union, and in relation to the United Nations Convention Against Transnational Organised Crime … to which the Community has been a party since 29 April 2004. The Framework Decision does not achieve the minimum degree of approximation of acts of directing and participating in a criminal organisation on the basis of a single concept of such an organisation, as proposed by the Commission and as already adopted in Framework Decision 2002/475/JHA on the fight against terrorism. Furthermore, the Framework Decision enables Member States not to introduce the concept of criminal organisation but to continue to apply existing national criminal law by having recourse to general rules on participation in and preparation of specific offences. The Commission is therefore obliged to note that the Framework Decision does not achieve the objective of approximation of legislation on the fight against organised crime as provided for in the Hague Programme. (Emphasis added)

244 ibid art 8. 245 Justice and Home Affairs Council of 27–28 April 2006, Doc 8402/06 (Presse 106). 246 Council Framework Decision 2008/41/JHA on the fight against organized crime [2008] OJ L300/11. 247 ibid art 1. 248 ibid art 3(1) – minimum maximum penalty of two to five years. For the common law variant, the punishment may be the same maximum term of imprisonment as the offence at which the agreement is aimed. On the background regarding the penalty for the ‘common law’ variant, see Council Doc 5468/2/06, Brussels, 20 March 2006. 249 ibid art 3(2). The insertion of aggravating circumstances in the text has not been uncontroversial, in the light of the very different approaches on aggravating circumstances between Member States. A number of Member States objected to mandatory aggravating circumstances, arguing that this should be left to the judiciary – see Council Doc 5468/2/06. 250 ibid arts 4 and 8 respectively – the provision for assistance to victims’ families has been deleted. 251 ibid art 2.

EU Criminalisation Challenges and Prospects for Law Reform 135 EU substantive criminal law on organised crime has been criticised as being unduly vague and as not resulting in a high degree of harmonisation.252 The Commission reiterated its concerns in its 2016 evaluation, noting that it is of the opinion that the Framework Decision does not achieve the necessary minimum degree of approximation as regards directing or participating in a criminal organisation on the basis of a single concept of such an organisation and that it considers that the Framework Decision enables the Member States not to introduce the concept of criminal organisation, but to continue to apply existing national criminal law by having recourse to general rules on participation in and preparation of specific offences, creating additional divergences in the Framework Decision’s practical implementation.253 A renewed post-Lisbon, post-Brexit254 effort to revise the text of the 2008 Framework Decision may serve to focus on enhancing legal certainty in the criminalization of participation in a criminal organisation, contributing at the same time to a better understanding of what constitutes ‘organised crime’ for the purposes of European criminal law. Such a common understanding is essential in view of the fact that organised crime has a substantial transnational dimension and forms the basis not only of national investigations and prosecutions but also of cooperation between national judicial and police authorities across the EU. As with the other areas of crime analysed in this section, participation in a criminal organisation falls within the list of conduct for which the existence of dual criminality is no longer verified for judicial cooperation under the principle of mutual recognition.255 The fight against organised crime further justifies to a great extent the existence – and is central to the mandate – of EU criminal justice bodies such as Europol and Eurojust. Both forms of EU stimulated action may be seen as requiring harmonisation.256 Similar considerations apply with regard to the operation of the EPPO, whose mandate is defined inter alia by reference to the 2008 Framework Decision.257

B. From Racism and Xenophobia to Criminalising Hate Speech EU criminal law harmonisation in the field of racism and xenophobia has been a matter of great controversy, notwithstanding the fact that combating racism and xenophobia is 252 See also V Militello, ‘The Notion of Organised Crime in EU Law’ in S Carnevale, S Forlati and O Giolo (eds), Redefining Organised Crime: A Challenge for the European Union? (Hart Publishing, 2017) 191–224. 253 European Commission, ‘Report based on Article 10 of Council Framework Decision 2008/841/JHA of 24 October 2008 on the fight against organised crime’ COM (2016) 448 final, 7 July 2016. The European Parliament has also called for further harmonisation: https://www.europarl.europa.eu/doceo/document/ TA-9-2020-0378_EN.html. 254 It is noteworthy that the UK legislator introduced a specific offence of participation in the activities of an organised crime group in s 45 of the Serious Crime Act 2015: see P Jarvis and R Earis, ‘Participating in the Activities of an Organised Crime Group: The New Offence’ [2015] Criminal Law Review 766. The participation offence co-exists with conspiracy in the domestic legal order. 255 See ch 4. 256 On the necessity of harmonisation (or ‘approximation’) in order to ensure the proper functioning of the relevant EU organs, see Weyembergh (n 1) 166–71. Weyembergh has developed a typology of approximation functions of criminal law in the EU; see more specifically A Weyembergh, ‘The Functions of Approximation of Penal Legislation within the European Union’ (2005) 12 Maastricht Journal of European and Comparative Law 149; see also A Weyembergh, ‘Approximation of Criminal Laws, the Constitutional Treaty and the Hague Programme’ (2005) 42 CML Rev 1567. 257 See ch 8. See also Mitsilegas (n 192).

136 Substantive Criminal Law expressly mentioned within the mandate of the EU action in the third pillar. Attempts to reach a harmonised approach in criminalising racist and xenophobic conduct have stumbled upon the great divergence in national attitudes to the extent to which such conduct should be criminalised. The first step towards using EU criminal law in the field occurred in the Maastricht era, with Member States adopting in 1996 a Joint Action ‘concerning action to combat racism and xenophobia’.258 The Joint Action defined racism and xenophobia as: (a) public incitement to discrimination, violence or racial hatred in respect of a group of persons or a member of such a group defined by reference to colour, race, religion or national or ethnic origin; (b) public condoning, for racist or xenophobic purposes, of crimes against humanity and human rights violations; (c) public denial of the crimes defined in Article 6 of the Charter of the International Military Tribunal appended to the London Agreement of 8 April 1945 insofar as it includes behaviour which is contemptuous of, or degrading to, a group of persons defined by reference to colour, race, religion or national or ethnic origin; (d) public dissemination or distribution of tracts, pictures or other material containing expressions of racism and xenophobia; (e) participation in the activities of groups, organisations or associations, which involve discrimination, violence, or racial, ethnic or religious hatred.259

The Joint Action required Member States to ensure ‘effective judicial cooperation’ with regard to offences based on the above types of behaviour. Effective judicial cooperation would be achieved either by criminalising such behaviour or, failing that and pending the adoption of any necessary provisions, by derogating from the principle of dual criminality for such behaviour.260 Thus, the Joint Action did not introduce a strong obligation for Member States to criminalise racism and xenophobia as defined therein. However, this relative ‘weakness’ of the text (along with the weakness of its form, it being merely a Joint Action) did not stop Member States concerned with the potential impact of the measure on their domestic criminal justice systems from inserting declarations aiming at preserving the domestic status quo. Hence, the UK stated that it would only apply the above obligations ‘where the relevant behaviour is threatening, abusive or insulting and is carried out with the intention of stirring up racial hatred or is likely to do so’,261 a wording which reflected UK domestic law in the field. Post-Amsterdam, in 2001, the Commission tabled a proposal for a Framework Decision aimed at replacing the 1996 Joint Action.262 The purpose of the Commission proposal was to ensure that the same racist and xenophobic conduct would be punishable in all Member States under a common criminal law approach and would thus achieve effective judicial cooperation. The list of offences in the 1996 Joint Action was thus expanded, and common definitions and penalties were introduced. The proposal

258 96/443/JHA, OJ L185, 24 July 1996, 5. 259 Title I(A). 260 ibid. 261 See Annex, Declaration 3. See also the Danish Declaration (Declaration 4), indicating that Denmark would apply the above obligations only where the relevant behaviour is threatening, abusive or insulting. 262 COM (2001) 664 final, Brussels, 28 November 2001.

EU Criminalisation Challenges and Prospects for Law Reform 137 caused concern in a number of Member States and was subject to lengthy negotiations, reflecting the differences in approaches in the various Member States.263 In the UK, one of the main concerns was that domestic law would have to be amended to include the criminalisation of incitement to religious hatred – an issue which has been controversial in recent years.264 However, inciting religious hatred eventually entered the criminal law statute book in the UK, before the adoption of the Framework Decision.265 Criminalisation in similar terms in the EU instrument would thus seem to be acceptable to the UK, but again only if the EU instrument would reflect domestic law – or at least if it did not require a change in the domestic law. In April 2007, the Council reached a ‘general approach’ on the text of the Framework Decision,266 which was eventually adopted in 2008.267 The Framework Decision does criminalise, inter alia, incitement to religious hatred, as well as, under certain conditions, ‘publicly condoning, denying or grossly trivialising’ crimes of, among others, genocide, war crimes and the Holocaust.268 However, there are exceptions aiming at addressing national sensitivities. With regard to criminalisation at the national level, a UK-inspired exception states that Member States may choose to punish only conduct which is either carried out in a manner likely to disturb public order or which is threatening, abusive or insulting.269 Moreover, the reference to religion is intended to cover at least ‘conduct which is a pretext for directing acts against a group of persons or a member of such a group defined by reference to race, colour, descent, or national or ethnic origin’.270 These provisions are aimed at ensuring that Member States would not have to change their – controversial and subject to lengthy negotiations – domestic criminal law.271 This is not the only limitation to the EU-wide criminalisation of racism and xenophobia. Member States’ concerns regarding the impact of such criminalisation on their domestic constitutions and fundamental rights, in particular freedom of expression, have led to the introduction in the body of the Framework Decision of a provision stating that the latter will not have the effect of modifying the obligation to respect fundamental rights, constitutional rules and fundamental principles, including freedom of expression and association.272 The provision becomes more specific by stating that the Framework Decision: [S]hall not have the effect of requiring Member States to take measures in contradiction to fundamental principles relating to freedom of association and freedom of expression, in

263 See M Bell, Race, Equality and the European Union (Oxford University Press, 2009) 264 See the UK government’s Explanatory Memorandum accompanying the Commission’s original proposal (para 13), reproduced in House of Lords European Union Committee, Combating Racism and Xenophobia – Defining Criminal Offences in the EU, 29th Report, session 2001–02, HL Paper 162. 265 Via the Racial and Religious Hatred Act 2006; for an analysis, see K Goodall, ‘Incitement to Religious Hatred: All Talk and No Substance?’ (2007) 70 Modern Law Review 89. 266 Doc 8665/07 (Presse 84). 267 Council Framework Decision 2008/913/JHA of 28 November 2008 on combating certain forms and expressions of racism and xenophobia by means of criminal law [2008] OJ L328/55. 268 ibid art 1(1). 269 ibid art 1(2). 270 ibid art 1 (3). 271 See the Explanatory Memorandum of the UK government accompanying an earlier draft of the Framework Decision, Doc 5118/07 (14 February 2007, para 20). 272 Council Framework Decision 2008/913/JHA (n 267) art 7(1).

138 Substantive Criminal Law particular freedom of the press and the freedom of expression in other media as they result from constitutional traditions or rules governing the rights and responsibilities of, and the procedural guarantees for, the press or other media where these rules relate to the determination or limitation of liability.273

The wording of the Framework Decision leaves much to be desired in terms of harmonisation. It may lead to quite divergent implementing laws as it may be seen as an invitation for Member States not to obstruct the balance between free speech and the criminalisation of racism which already exists in their domestic legal and constitutional systems. However, from a harmonisation point of view, this may not lead to optimal solutions, in particular for those hoping that the Framework Decision would create a level of legal certainty and common understanding regarding racism and xenophobia.274 According to the Commission, the clause may even be interpreted as giving precedence to national law in relation to EU law.275 However, this compromise clause has perhaps proven to be crucial in reaching (unanimous) agreement in such a controversial proposal where the need to send a strong EU message against racism and xenophobia eventually clashed with concerns regarding overcriminalisation and breach of fundamental rights. A view of the glass as ‘half-full’ may also indicate that this is a Framework Decision (repealing the weaker earlier Joint Action and expanding its content) containing some degree of criminal law harmonisation in the field of both offences and sanctions.276 From a substantive criminal law point of view, it is noteworthy that the export of domestic criminalisation approaches (for instance, on Holocaust denial) have led to calls for an even greater criminalisation of denial of other historical events or periods such as totalitarianism in Europe or of offences committed by totalitarian regimes. While this has not happened so far,277 this is an example of the potential of national diversity when exported across the EU. The deficit in the implementation of the Framework Decision has been confirmed by the Implementation Report published by the Commission in 2014, where the Commission noted, inter alia, that a number of Member States have fully and/or correctly not transposed all the provisions of the Framework Decision, namely in relation to the offences of denying, condoning and grossly trivialising certain crimes, and that while the majority of Member States have provisions on incitement to racist and xenophobic violence and hatred, these do not always seem to fully transpose the offences covered by the Framework Decision.278 In view of the complexity of implementation – and

273 ibid art 7(2). 274 This is especially in the light of the fact that racism and xenophobia is one of the offences for which the dual criminality requirement had been abolished in the European Arrest Warrant. However, art 3 of the Framework Decision introduces minimum maximum sanctions of at least one to three years of imprisonment – this may mean in practice that in the implementation of the Framework Decision, the three-year threshold required for the abolition of dual criminality in the Warrant may not be met. See also Bell (n 263). 275 See the attached declaration by the Commission to the Framework Decision. The Commission also refers to primacy of ‘Union’ law. 276 In this context, it is noteworthy that the Framework Decision contains a general provision on racist and xenophobic motivation as an aggravating factor for any offence other than those criminalised therein (art 4). 277 See the Council Declaration attached to the Framework Decision. 278 Commission Report on the implementation of Council Framework Decision 2008/913/JHA on combating certain forms and expressions of racism and xenophobia by means of criminal law COM (2014) 27 final, 27 January 2014.

EU Criminalisation Challenges and Prospects for Law Reform 139 the need to view criminalisation within the broader context of the fundamental rights which may be affected – a Guidance Note on the application of the Framework Decision has been issued by the EU High Level Group on combating racism, xenophobia and other forms of intolerance in 2018.279 While the complexity in criminalisation remains, a further complexity has arisen from the fact that racism and xenophobia is not enumerated in the areas of crime for which EU securitised criminalisation if granted under Article 83(1) TFEU, which renders the revision of the Framework Decision constitutionally challenging. The Commission has published a Roadmap indicating its intention to adopt a Communication by the end of 2021 on expanding the list of areas of crime in Article 83(1) TFEU to include hate speech and hate crime in order to enable future adoption of substantive criminal law in the field.280 The Commission thus envisages making use of the constitutional potential of the last indent of Article 83(1) TFEU, according to which the competence of the EU in substantive criminal law may be expanded if, on the basis of developments in crime, the Council adopts unanimously and after consulting the European Parliament a decision identifying other areas of crime to those listed under the securitised criminalisation introduced in the second indent of Article 83(1). These areas of crime must meet the criteria stated in Article 83(1). It is submitted that hate crime and hate speech meet the criteria for securitised criminalisation stated therein: these are areas of particularly serious crime with a cross-border dimension resulting both from their nature and impact and from a special need to combat them on a common basis. The condition of the existence of developments in crime – in particular, online hate speech – is also met. It is for the Commission to substantiate on the basis of evidence that these criteria are met. It is hoped that the unanimity hurdle for the expansion of EU competence will be overcome. Negotiations for new legislation on hate crime and hate speech will provide the opportunity to develop a European response, and at the same time to discuss in detail and justify the parameters and limits of criminalisation in this field.

C. Functional Criminalisation: Rethinking Environmental Crime A prime example of functional criminalisation preceding the entry into force of the Lisbon Treaty has been the adoption of EU substantive law in the field of environmental crime. The evolution of EU criminal law in the field has been analysed earlier in this chapter, with the CJEU ruling on environmental crime – since translated in the Lisbon Treaty largely into the functional criminalisation legal basis of Article 83(2) TFEU – also leading to the adoption of a new Environmental Crime Directive.281 The Directive 279 EU High Level Group on combating racism, xenophobia and other forms of intolerance, Guidance Note on the Practical Application of Council Framework Decision 2008/913/JHA, November 2018. The Guidance aims, inter alia, at a better understanding of the scope of the Framework Decision offences to enable more coherent and effective criminal justice responses. 280 https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12872-Hate-speech-&hate-crime-inclusion-on-list-of-EU-crimes_en. 281 Directive 2008/99/EC of the European Parliament and of the Council of 19 November 2008 on the protection of the environment through criminal law [2008] OJ L328/28.

140 Substantive Criminal Law introduced a complex legal framework against environmental crime.282 Article 3 of the Environmental Crime Directive obliges Member States to ensure that nine categories of forms of conduct constitute criminal offences, provided that two conditions are met: they have to be unlawful and committed intentionally, or at least with serious negligence.283 While ‘unlawfulness’ does not imply that conduct shall necessarily be active, since the ‘failure to comply with a legal duty to act can have the same effect as active behaviour’,284 it means that conduct is criminalised when it infringes either the legislation adopted pursuant to the European Treaties to be found in Annexes A or B to the Directive, or a national piece of legislation, a national regulation or a decision taken by a national authority giving effect to the legislation adopted pursuant to the Treaties.285 The obligation for Member States to criminalise forms of conduct that are ‘unlawful’ confirms the accessory nature of environmental criminal law. Criminalisation by reference to other environmental regulation measures does not contribute to a high degree of harmonisation or to legal certainty in criminal law.286 The Annexes to the Directive list more than 70 legal instruments adopted by the EU, so that in many instances, it is not immediately clear if and when a given conduct is criminal, nor it is easy to prove the intentional subjective element of the illegal conduct. This challenge is exacerbated considering that a large part of the list is currently out of date. The nine categories of individual conduct287 that Member States shall criminalise can be classified according to the legislative technique used to define them. Four of these forms of conduct have to be punished when they cause, or are likely to cause: i) death or serious injury to any person; or ii) ‘substantial damage’ to the quality of air, soil, water, or to animals or plants. In more detail, these four categories are: –– the discharge, emission or introduction of materials or ionising radiation into air, soil or water (Article 3(a)); –– the collection, transport, recovery or disposal of waste, including the supervision of such operations and the aftercare of disposal sites, and including action taken as a dealer or a broker (waste management) (Article 3(b)); –– the operation of a plant in which a dangerous activity is carried out or in which dangerous substances or preparations are stored or used (Article 3(d));288 and –– the production, processing, handling, use, holding, storage, transport, import, export or disposal of nuclear materials or other hazardous radioactive substances (Article 3(e)). 282 For a detailed analysis, see V Mitsilegas, E Fasoli, F Giuffrida and M Fitzmaurice, The Legal Regulation of Environmental Crime (Brill, forthcoming, 2022). 283 Article 3 of the Environmental Crime Directive. 284 Recital No 6 of the Environmental Crime Directive. As a consequence, failures to comply with a legal duty to act should also be subject to criminal penalties, if they meet the other requirements laid down in the Directive (ibid). 285 Article 2(a) of the Environmental Crime Directive. 286 V Mitsilegas, ‘The Third Wave of Third Pillar Law: Which Direction for EU Criminal Justice?’ (2009) 34 European Law Review 523. 287 The following section deals with the liability of legal persons. 288 In this case, the Directive requires that the operation of the plant causes or is likely to cause death or serious injury to any person or substantial damage to the quality of air, the quality of soil or the quality of water, or to animals or plants ‘outside the plant’ (art 3(d) of the Environmental Crime Directive).

EU Criminalisation Challenges and Prospects for Law Reform 141 Further complications arise since the Directive relies on unclear benchmarks against which criminalisation should follow at the national level, such as ‘serious’ injury to any person and ‘substantial’ damage to the quality of air, soil, water, or to animals or plants. It has indeed been noted that the notion of ‘substantial damage’ is ‘too vague and not clear enough’ and that ‘criteria, guidelines or instructions to define [this and other notions] are absent or insufficient’289 at the national level. Some authors have however pointed out that more detailed rules would have been difficult to agree on the political level and would have limited the leeway of Member States to accommodate the Directive in their legal systems.290 The overview of the criminal offences established in the Environmental Crime Directive lends support to the well-known argument according to which the boundaries of the notion of ‘environmental crime’ are unclear. Alike to that of environment itself, ‘environmental crime’ is a broad and ambiguous concept encompassing very different areas of conduct,291 and not all of them are included in Article 3 of the Directive. For instance, the Directive does not regulate crimes concerning food safety or animal welfare,292 as well as illegal, unreported and unregulated fishing and trade in hazardous chemicals.293 Moreover, a number of terms underpinning criminal conduct – such as substantial damage’, ‘negligible quantity’ or ‘significant deterioration’ have bene left undefined in the Directive.294 In its evaluation Report on the implementation of the Directive, the Commission has noted that there are diverging approaches among Member States in terms of the definition of criminal offences, the liability of legal persons (liability can be either criminal, administrative or both) and sanction levels applicable to both natural and legal persons – with the Commission recognising the existence of differences in the definition of criminal offences in practice between Member States and differences in the understanding of which conduct falls or does not fall under a particular environmental crime category which can impact legal certainty and cross-border cooperation.295 The lack of legal certainty and the varied implementation are both key issues to be addressed in the current revision of EU criminal law in the field of the protection of the environment. There is currently considerable political momentum towards the reform 289 ‘Final report on the 8th round of mutual evaluations on “The practical implementation and operation of the European polices on preventing and combating Environmental Crime”’ Council Doc 14852/19, 5 December 2019, 56. 290 GM Vagliasindi, ‘The eu Environmental Crime Directive’ in A Farmer, M Faure and G M Vagliasindi (eds) Environmental Crime in Europe (Oxford and Portland Oregon, Hart, 2017) 291 For different views on this topic, see, for instance, P Cleary Yeager and SS Simpson, ‘Environmental Crime’ in M Tonry (ed), The Oxford Handbook of Crime and Public Policy (Oxford University Press, 2009) 325; S Chin, W Veening and C Gerstetter, ‘EFFACE Policy Brief 1: Limitations and Challenges of the Criminal Justice System in Addressing Environmental Crime’ (2014) 4–5; A Farmer, AR Germani and R Sollund, ‘Conclusions of the EFFACE Case Studies’ (2015) 7–10; EnviCrimeNet, ‘Report on Environmental Crime’ (2016) 4, www.envicrimenet.eu/images/docs/envicrimenet%20report%20on%20environmental%20crime. pdf. 292 EnviCrimeNet and Europol, ‘Intelligence Project on Environmental Crime. Report on Environmental Crime in Europe’ (2015) 11, http://www.envicrimenet.eu/reports. 293 R Pereira, Environmental Criminal Liability and Enforcement in European and International Law (Brill, 2015) 255–61. 294 Commission Staff Working Document Evaluation of the Directive 2008/99/EC of the European Parliament and of the Council of 19 November 2008 on the protection of the environment through criminal law (Environmental Crime Directive), SWD(2020) 259 final, Part 1/2, SWD(2020) 259 final, 28 October 2020. 295 ibid 35–36.

142 Substantive Criminal Law of the EU acquis in the field. Only a few days after her appointment, the Commission presided by Ursula von der Leyen tabled a Communication on the ‘European Green Deal’296 which included a reference to environmental crime relating initiatives, stating that the Commission ‘will promote action by the EU, its Member States and the international community to step up efforts against environmental crime’.297 In 2019, the Commission conducted an assessment of the Environmental Crime Directive, focusing on waste and wildlife crime.298 The Finnish Presidency of the Council (second half of 2019) issued a report in October 2019 on the state of environmental criminal law in the European Union.299 At the time of writing, the Commission is developing a proposal for a new Directive on environmental crime. A new initiative will provide the opportunity to re-think the parameters of functional criminalisation in the field of the protection of the environment. Ten years after the entry into force of the Lisbon Treaty, the time has come to disassociate criminal law on the protection of the environment from the debate on competence which has led to the CJE environmental crime ruling and the ensuing Directive which is currently in force. A new text will provide the opportunity to link expressly aspects of environmental crime with their organised and financial crime dimensions.300 It will also provide an opportunity to achieve a greater degree of legal certainty in terms of criminalisation, by focusing the debate on what kind of conduct the EU should be criminalising in the first place. In doing so, the time may have come to stop treating criminal law on the environment as ancillary to administrative law, and to define the elements of self-standing, autonomous offences against the environment at the EU level.

D. The Case for Decriminalisation: Facilitation of Unauthorised Entry, Transit and Stay While the discussion on the drafting and implementation of existing EU substantive criminal law instruments focuses largely on issues of scope, legal certainty and the 296 Commission, ‘The European Green Deal’ COM (2019) 640 final, 11 December 2019. 297 ibid 23. 298 Commission, ‘Evaluation Roadmap. Evaluation of the Environmental Crime Directive’ (2019), https:// ec.europa.eu/environment/legal/crime/legis_en.htm. Already in 2015, highlighting the significant risks connected with environmental crime, the Commission claimed it would ‘consider the need to strengthening compliance monitoring and enforcement, for instance by increasing training for enforcement staff, support for relevant networks of professionals, and by further approximating criminal sanctions throughout the EU’ (Commission, ‘The European Agenda on Security’ COM (2015) 185 final, 28 April 2015, 18). 299 Council Presidency, ‘EU environmental criminal law – Presidency report’, Council Doc 12801/19, 4 October 2019. In further previous documents, the Council had called attention to environmental crime and the need to tackle it effectively at the EU level. See, for instance, ‘Council Conclusions on countering environmental crime – Council conclusions (8 December 2016)’, Council Doc 15412/16, 12 December 2016; ‘Council conclusions on setting the EU’s priorities for the fight against organised and serious international crime between 2018 and 2021’, https://data.consilium.europa.eu/doc/document/ST-8654-2017-INIT/en/pdf. 300 On the need to take the links between environmental crime and organised crime and money laundering seriously, see C Gerstetter, M Faure, V Mitsilegas et al, Environmental Crime and the EU: Synthesis of the Research Project ‘European Union Action to Fight Environmental Crime’ (EFFACE) (Ecologic Institute, 2016); and V Mitsilegas, ‘Contribution to Conclusions and Recommendations on Environmental Crime: Harmonisation of Substantive Environmental Criminal Law at EU Level’, EFFACE project, January 2016, https://www. ecologic.eu/sites/default/files/publication/2016/efface_conclusions_recommendations_harmonisation.pdf.

EU Criminalisation Challenges and Prospects for Law Reform 143 impact on harmonisation, the express question of whether EU intervention in the field of substantive criminal law has the potential to lead to decriminalisation is raised less frequently.301 Nowhere does the case for decriminalisation arise more prominently than in the case of the criminalisation of human smuggling. The relevant EU legal framework is set out by a Directive defining what is called in EU law the ‘facilitation of unauthorised entry, transit and residence’302 accompanied – in the light of the first pillar competence limits regarding criminalisation at the time303 – by a third pillar Framework Decision confirming that the conduct defined as facilitation in the Directive will be treated as a criminal offence.304 Both instruments of what is rather ‘old’ law by EU standards predate by far the entry into force of the Lisbon Treaty and, having being proposed not by the Commission but by a Member State (the French government), they have been negotiated and adopted with minimal scrutiny and debate.305 The EU Facilitation Directive goes further than international law – the UN Palermo Convention Smuggling Protocol306 – in that it dispenses with the condition of obtaining a financial or other material benefit for the smuggling offence to be established.307 The Directive calls upon Member States to adopt criminal sanctions for ‘any person who intentionally assists a person who is not a national of a Member State to enter, or transit across, the territory of a Member State in breach of the laws of the State concerned on the entry or transit of aliens’.308 Instigation, complicity and attempt are also criminalised.309 The Facilitation Framework Decision contains a general obligation for Member States to criminalise such conduct310 includes a general provision on sanctions,311 which may be accompanied by parallel sanctions including confiscation,312 and imposes specific high levels of sanctions only when certain aggravating circumstances occur.313

301 For an exception, see V Mitsilegas, ‘Decriminalisation in the Law of the European Union’ in Ouwerkerk et al (n 218) 106–21. 302 Council Directive 2002/90/EC of 28 November 2002 defining the facilitation of unauthorised entry, transit and residence [2002] OJ L328/4 (hereinafter ‘Facilitation Directive’). 303 For an overview, see Mitsilegas, EU Criminal Law (n 157) ch 2. 304 Council Framework Decision 2002/946/JHA of 28 November 2002 on the strengthening of the penal framework to prevent the facilitation of unauthorised entry, transit and residence [2002] OJ L328/1 (hereinafter ‘Facilitation Framework Decision’). 305 For the background on this, see V Mitsilegas, J Monar and W Rees, The European Union and Internal Security (Palgrave/Macmillan, 2003) 106–08. 306 On the role of the EU in negotiating the Protocol, see ch 10. 307 Article 1(1)(a) of the Facilitation Directive. 308 ibid. 309 ibid art 2. 310 According to art 1(1) of the Framework Decision, each Member State shall take the measures necessary to ensure that the infringements defined in Articles 1 and 2 of the Directive are punishable by effective, proportionate and dissuasive criminal penalties which may entail extradition (Article 1(3)). Article 1(6) of the Facilitation Framework Decision further states that, if imperative to preserve the coherence of the national penalty system, the actions defined in paragraph 3 shall be punishable by custodial sentences with a maximum sentence of not less than six years, provided that it is among the most severe maximum sentences available for crimes of comparable gravity. 311 Article 1(1) of the Framework Decision: infringements shall be punishable by effective, proportionate and dissuasive penalties which entail extradition. 312 Article 1(2) of the Framework Decision. 313 According to art 1(3) of the Facilitation Framework Decision, Member States must ensure that, when committed for financial gain, the infringements defined in art 1(1)(a) and, to the relevant extent, art 2(a) of Directive 2002/90/EC are punishable by custodial sentences with a maximum sentence of not less than

144 Substantive Criminal Law Notwithstanding the lack of specificity as regards the level of criminal sanctions to be imposed by Member States, it is clear that the scope of criminalisation at the EU level is very broad, as it can cover any form of assistance to enter or transit the territory of an EU Member State in breach of what is essentially administrative law (such as cases where the migrant is traveling without travel documents).314 It is clear that the EU approach aims at preventing entry into EU territory and targets not only the smugglers but also the smuggled. Alessandro Spena makes an insightful point in legal semiotics by drawing our attention to the terminological differences between international law, which defines smuggling as procuring irregular entry, and EU law, which focuses on assistance. Spena notes that ‘while assisting denotes an ancillary action, which entails that the principal action is performed by the person who is assisted, “procuring” denotes instead a stand-alone action, with a meaning of its own’.315 The negative impact of the EU approach towards criminalisation on third-country nationals wishing to apply for asylum is evident. The Directive does attempt to address this issue by granting Member States the discretion not to impose sanctions for human smuggling and instead to apply their national law and practice for cases where the aim of the behaviour is to provide humanitarian assistance to the person concerned.316 However, this provision is discretionary and its value in redressing the balance set out by the broad definition and criminalisation of human smuggling under EU law is questionable. According to a recent Commission Report, only seven Member States specifically include an exemption from punishment for facilitation for humanitarian assistance in their domestic law.317 By using the threat of criminal sanctions, the EU measures on human smuggling essentially aim at deterring individuals and organisations from coming into contact and assisting any third-country national wishing to enter the territory of EU Member States. In spite of these shortcomings, the Commission has pointedly declined to initiate the process of tabling a new text post-Lisbon to revise the existing ‘Facilitators Package’. A missed opportunity to decriminalise in this context has been the recent Commission evaluation of the EU criminal law framework on migrant smuggling.318 The Commission evaluation of the EU criminal law framework on human smuggling provided an opportunity for law reform in order to align the EU framework more closely with the approach adopted by the UN Convention on Transnational Organised Crime and to eight years where they are committed in any of the following circumstances: the offence was committed as an activity of a criminal organisation; and the offence was committed while endangering the lives of the persons who are the subject of the offence. 314 For a critical analysis, see V Mitsilegas, ‘The Normative Foundations of the Criminalisation of Human Smuggling. Exploring the Fault Lines between European and International Law’ (2019) 10 New Journal of European Criminal Law 68; see also V Mitsilegas, ‘The Criminalisation of Migration in the Law of the European Union. Challenging the Preventive Paradigm’ in G-L Gatta, V Mitsilegas and S Zirulia (eds), Controlling Immigration through Criminal Law. European and Comparative Perspectives on ‘Crimmigration’ (Hart Publishing, 2021) 25–45. 315 A Spena, ‘Human Smuggling and Irregular Immigration in the EU: From Complicity to Exploitation?’ in S Carrera and E Guild (eds), Irregular Migration, Trafficking and Smuggling of Human Beings (CEPS, 2016) 37. 316 Article 1(2) of the Facilitation Directive. 317 Commission, ‘Staff Working Document – REFIT Evaluation of the EU legal framework against facilitation of unauthorised entry, transit and residence’ SWD (2017) 117 final, Brussels, 22 March 2017, 14. 318 Facilitation Framework Decision, read in conjunction with the Facilitation Directive. For the background to this, see V Mitsilegas, ‘The Criminalisation of Migration in the Law of the European Union: Challenging the Preventive Paradigm’ in G-L Gatta, V Mitsilegas and S Zirulia (eds), Controlling Immigration through Criminal Law. European and Comparative Perspectives on ‘Crimmigration (Hart Publishing, 2021) 25–45.

EU Criminalisation Challenges and Prospects for Law Reform 145 address the human rights concerns arising from the overcriminalisation of the facilitation of unauthorised entry, transit and residence. Yet, the opportunity for law reform along these lines has been markedly and spectacularly missed: in its evaluation, the Commission has come up defending resolutely the status quo.319 The Commission declined to put forward proposals for law reform to expressly include a requirement for financial gain in the scope of the EU criminal offences on human smuggling. It claimed that at that point there was still limited intelligence available on the nature and extent of illicit financial flows associated to migrant smuggling and noted that: [T]he cash intensive nature of the payment methods linked to smuggling makes it difficult to trace illicit financial flows and in turn to conduct investigations on the financial nature of the crime … since the time of the adoption of the Facilitators Package and still today, the risks that such difficulties in tracing financial flows connected to migrant smuggling would disproportionately hamper the investigation and prosecution of this crime, affecting states’ legitimate interest to control borders and regulate migration flows, have been raised as a reason to avoid including a constituent financial gain element in the offence of facilitating irregular border crossing.320

The Commission added that it is difficult to disentangle the effects of the legal framework from the wider array of policy tools and enhanced operational cooperation to counter migrant smuggling, which have been triggered by the crisis321 and therefore that ‘there is no sufficient evidence to draw firm conclusions about the need for a revision of the Facilitators package at this point in time’.322 The Commission’s evaluation of the EU anti-smuggling framework further states generally and unconvincingly that there is limited evidence that social workers, family members or citizens acting out of compassion have been prosecuted for human smuggling.323 However, this assertion is blatantly contradicted by multiple attempts across the EU to criminalise – if not demonise – the humanitarian work of civil society and to create a ‘hostile environment’ against humanitarian action.324 The Commission’s reasoning for inaction is weak and lopsided. Rather than critically examining the legality and effectiveness of the current EU substantive criminal law framework on human smuggling, it justifies choices in criminalisation on the grounds of boosting investigatory and prosecutorial interests. In this manner, substantive criminal law becomes a mere tool for prosecutorial efficiency rather than reflecting normative or societal choices for criminalisation. By declining to adjust EU law, the Commission has missed three opportunities: to align EU law with international law on the criminalisation of human smuggling; to modernise (or ‘Lisbonise’) – as in the case of the ‘parallel’ offences of human trafficking325 – the EU legal framework on human smuggling by taking more fully into account the 319 Commission (n 317). 320 ibid 9. 321 ibid 34. 322 ibid 35. 323 Commission (n 317) 21. 324 For a detailed analysis of targeting NGOs on the ground, see, S Carrera, V Mitsilegas, J Allsopp and L Viosiliute, Policing Humanitarianism (Hart Publishing, 2019). 325 V Mitsilegas and N Vavoula, ‘Criminal Law: Institutional Rebalancing and Judicialization as Drivers of Policy Change’ in F Trauner and A Ripoll Servent (eds), Policy Change in the Area of Freedom, Security and Justice: How Institutions Matter (Routledge, 2015) 133.

146 Substantive Criminal Law human rights obligations of the EU enhanced after the entry into force of the Lisbon Treaty and the constitutionalisation of the EU Charter;326 and, fundamentally, an opportunity for decriminalisation in the field of EU criminal law.327 Notwithstanding the serious human rights consequences that overcriminalisation in this field entails, the Commission declined in its latest intervention on the EU Pact on Migration and Asylum to introduce new legislation in this field – it merely produced non-legally binding guidance on the implementation of the EU framework.328 This intervention does not go far enough and continues to leave a large margin of discretion to Member States to overcriminalise, including to use criminal law to target humanitarian action by civil society, citizens and migrants themselves. In the absence of legislative intervention, it will increasingly be for the courts to address the serious fundamental rights and rule of law shortcomings of the current EU substantive criminal law framework and its implementation.329

X. Conclusion The debate over the extent of EU competence to criminalise and introduce criminal sanctions before and after the entry into force of the Lisbon Treaty is inextricably linked to the broader discussion of the substance of the EU criminalisation policy. In the preLisbon third pillar world, the focus by EU institutions has been largely to determine the constitutional parameters of EU competence in the field, without considering the potential overcriminalisation impact that this framing of the issue may have.330 The entry into force of the Lisbon Treaty has not brought an end to the competence debate, but can still serve to refocus the mind on the impact of the exercise of EU competence in substantive criminal law upon the EU’s criminalisation policy. A key question in this context is whether, irrespective of the existence of EU competence to legislate, criminal law is the most effective way to address security threats or achieve the effective implementation of EU policies. This question is central in the light of the constitutional

326 See ch 1. 327 For a broader analysis on decriminalisation in EU criminal law, see V Mitsilegas, ‘From Overcriminalisation to Decriminalisation: The Many Faces of Effectiveness in European Criminal Law’ (2014) 5 New Journal of European Criminal Law 415. 328 Communication from the Commission Guidance on the implementation of EU rules on definition and prevention of the facilitation of unauthorised entry, transit and residence [2020] OJ C 323/1. The Guidance states that Article 1 of the Facilitation Directive must be interpreted as follows: ‘i) humanitarian assistance that is mandated by law cannot and must not be criminalised; ii) in particular, the criminalisation of NGOs or any other non-state actors that carry out search and rescue operations at sea, while complying with the relevant legal framework, amounts to a breach of international law, and therefore is not permitted by EU law; iii) where applicable, assessment of whether an act falls within the concept of ‘humanitarian assistance’ in Article 1(2) of the Directive – a concept that cannot be construed in a manner that would allow an act mandated by law to be criminalised – should be carried out on a case-by-case basis, taking into account all the relevant circumstances’. 329 For an overview of the emerging case law in Italy, see S Zirulia, ‘Is That a Smuggler? The Blurring Line between Facilitating Illegal Immigration and Providing Humanitarian Assistance at the European Borders’ in Gatta, Mitsilegas and Zirulia (n 314) 235–66. 330 V Mitsilegas, ‘The Third Wave of Third Pillar Law: Which Direction for EU Criminal Justice?’ (2009) 34 EL Rev 523.

Conclusion 147 affirmation by the Lisbon Treaty of the EU’s functional criminalisation competence. The use of the Lisbon legal bases on substantive criminal law will test this assumption. PostLisbon practice thus far has shown a rather measured use of the possibilities offered by the Lisbon Treaty and has highlighted a number of areas of remaining uncertainty and controversy with regard to the extent of the EU’s powers to criminalise. What this chapter has attempted to demonstrate is that the development of EU substantive criminal law in conformity with constitutional principles of EU law, and in full respect of the Charter, should lead to a more measured and focused use of criminal law and a reflection not only on the question of whether the EU has competence to criminalise, but also on the fundamental question of whether the EU should criminalise. In this context, it should not be forgotten that supranational criminal law after Lisbon has the potential to lead not to overcriminalisation, but to a process of decriminalisation.

3 Ne Bis in Idem and Conflicts of Jurisdiction VALMASIS MITSILEGAS AND FABIO GIUFFRIDA*

I. Introduction The right not to be tried or punished twice (bis) for an offence that has already been finally judged (idem) – expressed as the prohibition of double jeopardy in common law jurisdictions – is a fundamental principle in many, if not all, EU Member States.1 This principle is also recognised in several criminal justice systems all over the world and enshrined in various international and supranational legal instruments, such as the International Covenant on Civil and Political Rights, Protocol No 7 to the ECHR and the EU Charter of Fundamental Rights.2 At the national level, the determination of the parameters of the ne bis in idem principle reflects the balance between state demands for delivering effective criminal justice on the one hand and the need to ensure legal certainty and the finality of judicial decisions on the other.3 In this manner, ne bis in idem has both a rule of law and a human rights function.4 The rule of law function arises from the need to achieve legal certainty and finality with regard to state action in the field of criminal law. The human rights function – which is linked inextricably to the rule of law function – arises from the need to protect the rights of affected individuals and address * The opinions expressed in this chapter by Fabio Giuffrida are the personal opinions of the author and do not reflect those of the European Commission. 1 V Mitsilegas and F Giuffrida, ‘Ne Bis in Idem’ in R Sicurella et al (eds), General Principles for a Common Criminal Law Framework in the EU: A Guide for Legal Practitioners (Giuffrè, 2017) 209–42, at 209, from which this chapter partly draws. 2 For an overview, see JL de Lacuesta, ‘Concurrent National and International Criminal Jurisdiction and the Principle “Ne Bis in Idem”. General Report’ (2002) 73 Revue Internationale de Droit Pénal 707; B van Bockel, The Ne Bis in Idem Principle in EU Law (Kluwer Law International, 2010) 13ff; J Tomkin, ‘Article 50’ in S Peers et al (eds), The EU Charter of Fundamental Rights: A Commentary (CH Beck/Hart Publishing/Nomos, 2014) 1373–412, at 1379–84. 3 On various aspects of legal certainty in this context, see C van den Wyngaert and G Stessens, ‘The International Non Bis in Idem Principle: Resolving Some of the Unanswered Questions’ (1999) 48(4) International and Comparative Law Quarterly 779. See also van Bockel (n 2) ch 2. 4 See, eg, van Bockel (n 2) 25–30. For an historical overview of the evolution of this principle, see J Lelieur, ‘“Transnationalising” Ne Bis in Idem: How the Rule of Ne Bis in Idem Reveals the Principle of Personal Legal Certainty’ (2013) 9(4) Utrecht Law Journal 198, 199–202.

Introduction 149 the imbalance between individual rights and state power: the state should not be able to threaten individuals perennially with prosecution when criminal proceedings for the same conduct have been finalised once. The contrary would lead to a constant state of uncertainty and transform citizens into perennial suspects, eroding the relationship of trust between the individual and the state. On the other hand, limitations to the ne bis in idem principle have been advocated as necessary in order to enhance trust in the state as a security provider effectively delivering broader criminal justice objectives. Thus, questions of the delimitation of the ne bis in idem principle have to address fundamental choices of justice and of the relationship between the individual and the state in a system based upon the rule of law. These questions are central in the determination of the parameters of the ne bis in idem principle in a domestic context, but are equally valid in the context of interstate cooperation in criminal matters necessitating the development of a cross-border, or transnational, ne bis in idem principle.5 In the context of EU criminal law, ne bis in idem has traditionally been related to the challenge of providing clear and legitimate answers to the question of how to achieve justice in cases of cross-border prosecutions. In Europe’s AFSJ, transnational ne bis in idem was first introduced in Article 54 of the Convention Implementing the Schengen Agreement (CISA),6 which forbids prosecution – in any Member State – of a person who has already been judged in any other Member State. It is also enshrined, with a slightly different wording,7 in Article 50 of the EU Charter of Fundamental Rights. The inclusion of the ne bis in idem principle in the Schengen Convention, and subsequently in EU law as a consequence both of its inclusion in the Charter and of the incorporation of the Schengen acquis into the EU legal order by the Amsterdam Treaty,8 is inextricably linked to rethinking territoriality in the EU, in particular as regards the Schengen area. A person who is exercising free movement rights in a borderless area may not be penalised doubly by being subject to multiple prosecutions for the same acts as a result of them crossing borders. EU Member States must respect the outcome of proceedings in other Member States in this context under the conditions set out by the Schengen Convention. This represents another side of mutual recognition in criminal matters: the recognition of decisions finally disposing trials. This form of mutual recognition differs from the European Arrest Warrant and the other measures described in the previous chapter, as it does not require the active enforcement of an order in the executing Member State by coercive means, but rather action stopping prosecution. In addition to being a selfstanding fundamental right under the Charter, ne bis in idem is indeed also a ground 5 R Roth, ‘Non Bis in Idem Transnational: Vers de Nouveaux Paradigmes?’ in S Braum and A Weyembergh (eds), Le Contrôle Juridictionnel dans l’Espace Pénal Européen (Editions de l’Université de Bruxelles, 2009) 121–41; J AE Vervaele, ‘Ne Bis in Idem: Towards a Transnational Constitutional Principle in the EU?’ (2013) 9(4) Utrecht Law Review 211. 6 Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders [2000] OJ L239, 22 September, 19. 7 See section II below. 8 Protocol annexed to the Treaty on European Union and to the Treaty establishing the European Community – Protocol integrating the Schengen acquis into the framework of the European Union [1997] OJ C340, 10 November, 93. A similar Protocol is annexed to the Treaty of Lisbon (Protocol (No 19) on the Schengen acquis integrated into the framework of the European Union [2012] OJ C326, 26 October, 290).

150 Ne Bis in Idem and Conflicts of Jurisdiction for refusal to execute mutual recognition instruments.9 In this manner, it constitutes a safeguard for the individual concerned and may have protective rather than enforcement consequences. As will be discussed below, the protective dimension of ne bis in idem has been further enhanced by the Court of Justice’s decisions ruling that the same person cannot be punished twice for the same acts, which is a broader notion than the ‘same offence’ and thus extends the applicability of the ne bis in idem principle. Notwithstanding the inclusion of the ne bis in idem principle in primary and secondary EU legislation, there has been no further elaboration or clarification of the principle by EU legislation.10 A number of questions have thus arisen regarding the precise definition of the elements of ne bis in idem, such as the definition of idem11 and the definition of bis – what is essentially meant by a trial being ‘finally disposed of ’.12 In the light of this uncertainty regarding the reach of ne bis in idem in EU law, it has not always been easy for national courts to grapple with the principle and define its parameters. This has led to a series of references by national courts to Luxembourg for preliminary rulings, which have resulted in the development of a quite substantial case law on ne bis in idem by the Court of Justice. After an overview of the main European legal texts in which the prohibition of double jeopardy is included, this chapter will first look at the development of ne bis in idem – in its cross-border dimension – as a fundamental principle of EU law and then at the mechanisms to manage state sovereignty on the issue of which Member State should prosecute in the case of concurrent jurisdictions. Section V will examine a recent trend in the case law of European and national courts concerning ne bis in idem, namely the application of this principle – at the national level – to cases of administrative and criminal proceedings concerning the same fact.

II. Legislation on Ne Bis in Idem at the European Level In addition to mutual recognition instruments, where ne bis in idem features as a ground for non-execution,13 ne bis in idem is most notably provided for, in its

9 See, eg, art 3(2) of the Framework Decision on the European Arrest Warrant; art 11(1)(d) of the Directive on the European Investigation Order; and art 8(1)(a) of the Regulation on the mutual recognition of freezing orders and confiscation orders. On mutual recognition, see ch 2. 10 During its 2003 EU presidency, the Greek government tabled a proposal for third pillar legislation harmonising the definition of ne bis in idem: see ‘Initiative of the Hellenic Republic for the adoption of a Framework Decision of the Council on the application of the “ne bis in idem” principle’, Council Doc 6356/03, Brussels, 13 February 2003. Negotiations on the proposal were however suspended in 2004 (see Conclusions of Justice and Home Affairs Council of 19 December 2004, Council Doc 11161/04, 15). The Commission has since tabled a Green Paper on conflicts of jurisdiction and ne bis in idem attempting to take the issue further (COM (2005) 696 final, Brussels, 23 December 2005 and SEC (2005) 1767). See more in section IV below. 11 Whether the principle applies to the ‘same acts’ or to the ‘same offences’, and what constitutes a ‘same’ act or offence. 12 Whether the application of the principle is limited to judicial decisions determining a person’s guilt or innocence, or whether it has a broader application to include cases where a prosecution is terminated on procedural grounds (eg, if dropped by a public prosecutor in cases closed by plea bargaining or due to the application of the statute of limitation). 13 See n 9 above.

Legislation on Ne Bis in Idem at the European Level 151 transnational dimension, by the Schengen Convention and the Charter, and by Protocol No 7 to the ECHR in its national version.14 Article 54 of the Schengen Convention sets out the principle as follows: A person whose trial has been finally disposed of in one Contracting Party may not be prosecuted in another Contracting Party for the same acts provided that, if a penalty has been imposed, it has been enforced, is actually in the process of being enforced or can no longer be enforced under the laws of the sentencing Contracting Party. (Emphasis added)

Article 54 of the Convention applies in all EU Member States and in four non-EU countries that are parties to the Schengen acquis (Iceland, Norway, Switzerland and Liechtenstein).15 As far as the applicability ratione temporis is concerned, the Court of Justice examined whether Article 54 CISA applies in cases where the Convention, at the time of the first proceedings, was not yet in force in the state which ruled on the case. Since ne bis in idem comes into play when investigations or prosecutions on the same facts are initiated a second time, the Court submitted that it is only necessary to assess whether the Convention was in force – at the time of the second proceedings – in the second state.16 As for the Charter of Fundamental Rights, Article 50 reads as follows: ‘No one shall be liable to be tried or punished again in criminal proceedings for an offence for which he or she has already been finally acquitted or convicted within the Union in accordance with the law.’ The Charter resembles the text of the Schengen Convention, for it provides for the transnational version of ne bis in idem (‘within the Union’), although it refers to the same ‘offence’ rather than ‘same acts’ and does not replicate the ‘enforcement condition’ of Article 54 CISA (‘where he is sentenced, the sentence has been served or is currently being served or can no longer be carried out’). The issue of the enduring validity of this clause is discussed below.17 Finally, as far as the Council of Europe is concerned, the prohibition of double jeopardy is enshrined in Article 4 of Protocol No 7 to the ECHR. Germany and the Netherlands have not yet ratified the Protocol, while the UK has not even signed it.18 The Protocol is instead in force in all the other EU Member States, as well as in the 19 States Parties to the Council of Europe which are not EU countries. Article 4 of Protocol No 7 deals only with the national dimension of ne bis in idem: a final judgment issued by an authority of the same state where the second criminal proceedings are launched bars further prosecution or punishment of the same person in that state, while nothing is said

14 The ne bis in idem principle has also been developed in the context of EU competition law; see, inter alia, W Wils, ‘The Principle of “Ne Bis in Idem” in EC Antitrust Enforcement: A Legal and Economic Analysis’ (2003) 26(2) World Competition 131; Tomkin (n 2) 1399–403; R Nazzini, ‘Parallel Proceedings in EU Competition Law: Ne Bis in Idem as a Limiting Principle’ in B van Bockel (ed), Ne Bis in Idem in EU Law (Cambridge University Press, 2016) 131–66. 15 Articles 55–58 CISA lay down some limitations of, and further rules on, transnational ne bis in idem. For some remarks on these provisions, see PP Paulesu, ‘Ne Bis in Idem and Conflicts of Jurisdiction’ in R Kostoris (ed), Handbook of European Criminal Procedure (Springer, 2018) 393–421, at 402–04. 16 Case C-436/04, Van Esbroeck, judgment of 9 March 2006, EU:C:2006:165, paras 18–24. 17 See section III.C below. 18 Information on the ratification status of the Protocol is available on the Council of Europe website at https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/117/signatures?p_auth=hd0cAZD6.

152 Ne Bis in Idem and Conflicts of Jurisdiction with respect to investigations and prosecutions on the same facts in other countries.19 In spite of its limited applicability, the right to ne bis in idem is of utter importance in the Council of Europe context, since it falls among those fundamental rights that cannot be derogated even in times of emergency.20 As will be discussed below, the Council of Europe provision on ne bis in idem and its interpretation by the European Court of Human Rights (ECtHR) have played a central role in the development of the CJEU case law on concurring criminal and administrative penalties.21

III. Transnational Ne Bis in Idem: Scope and Content The AFSJ is founded primarily upon the interaction of national criminal justice systems which have largely not been harmonised. Here, rather than addressing the question of whether the state can enforce criminal law over an individual more than once for the same conduct, the question is rather whether another state can enforce its criminal law over the same individual for the same conduct or whether it is precluded from doing so in order to safeguard legal certainty and fundamental rights in an area without internal frontiers. Underpinning this question is the need to address the relationship between, on the one hand, fundamental rights and fundamental EU law principles such as free movement, and, on the other, fundamental criminal policy choices of justice at the national level, arising from the expectation of national constituencies for justice to be delivered by their state authorities. The extent to which national authorities will forfeit their right to prosecute or enforce sentences on the basis of mutual trust and the respect of the prior undertaking of similar proceedings against the same individual in another state – thus precluding them from delivering criminal justice in their own jurisdiction – remains unsurprisingly contested.22 The sensitivity of the matter shines through the Court of Justice’s case law on Article 54 CISA and Article 50 of the Charter, and the reactions to this. In accordance with both provisions, the ne bis in idem principle applies when some conditions are met: (i) a first set of criminal proceedings is finally closed and a second one is initiated (‘bis’); and (ii) both sets of proceedings concern the same facts and the same person (‘idem’). Unlike Article 50 of the Charter, Article 54 CISA also requires that the sentence that has been issued at the end of the first proceedings has already been served, is in the process of being served or can no longer be carried out (the ‘enforcement condition’).23 The Court of Justice has so far delivered several judgments concerning these components of ne bis in idem. 19 ‘No one shall be liable to be tried or punished again in criminal proceedings under the jurisdiction of the same State for an offence for which he has already been finally acquitted or convicted in accordance with the law and penal procedure of that State’ (art 4(1) of Protocol No 7 to the ECHR, emphasis added). 20 ibid art 4(3). 21 See section V below. 22 See in this context the critical view of Caeiro, who notes that in the absence of a mechanism to allocate jurisdiction, the rule of ne bis in idem in art 54 CISA creates an awkward situation, where the first final decision pre-empts possible decisions from other jurisdictions: P Caeiro, ‘Jurisdiction in Criminal Matters in the EU: Negative and Positive Conflicts, and Beyond’ (2010) 93(4) Kritische Vierteljahresschrift für Gesetzgebung und Rechtswissenschaft 366, 376. See more in section IV below. 23 It follows that this condition does not come into consideration when the first set of proceedings ends with an acquittal of the defendant.

Transnational Ne Bis in Idem: Scope and Content 153

A. The ‘Bis’ Element The first decision of the Court of Justice on Article 54 CISA, Gözütok and Brügge,24 dates back to 2003 and deals with the concept of ‘finally judged’.25 The cases involved the termination of prosecutions by the public prosecutor (in the Netherlands and Germany respectively) following out-of-court settlements with the defendants, with the Luxembourg Court being asked to determine whether such termination was capable to trigger the application of the Schengen ne bis in idem principle. The Court answered in the affirmative to apply the principle in such cases, which involve the discontinuation of prosecution by a public prosecutor – without the involvement of a court – once the accused has fulfilled certain obligations. The Court noted that the non-participation of national courts in procedures such as the out-of-court settlements at stake did not preclude the application of Article 54 CISA. It is true that, in some countries, the settlements between public prosecutors and defendants have to be validated by a court, yet Article 54 CISA does not assume the harmonisation or approximation of national criminal justice systems;26 on the contrary, this provision builds on the presumption of mutual trust among Member States.27 Furthermore, the need to achieve Community/Union objectives and facilitate the exercise of rights under Community/Union law was central to the Court’s approach, which examined the purpose of the integration of the Schengen acquis into the EU legal order. The Court noted that such integration ‘is aimed at enhancing European integration and, in particular, at enabling the Union to become more rapidly the area of freedom, security and justice which is its objective to maintain and develop’.28 Specifically examining Article 54 of the Schengen Convention, the Court emphasised its objective to ensure that no one is prosecuted on the same facts in several Member States on account of his or her having exercised the right to freedom of movement – Article 54

24 Joined Cases C-187/01 and C-385/01, Gözütok and Brügge, judgment of 11 February 2003, EU:C:2003:87. For comments on the case, see, inter alia, JAE Vervaele, ‘Case Note’ (2004) 41(3) CML Rev 795; M Fletcher, ‘Some Developments to the Ne Bis in Idem Principle in the European Union: Criminal Proceedings against Hüseyn Gözütok and Klaus Brügge’ (2003) 66 Modern Law Review 769; A Weyembergh, ‘Comment on CJEU, 11 February 2003, Joined Cases C-187/01 and C-385/01 Criminal Proceedings v Hüseyn Gözütok and Klaus Brügge’ and E Symeonidou-Kastanidou and Y Naziris, ‘The Impact of Case C-187/01 [Gözütok/Brügge] at the National Level: Inadvertent Legacy’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Hart Publishing, 2019) 199–211 and 212–25 respectively. 25 For an overview of the Court of Justice’s case law on the ‘bis’ element, as well as on the ‘idem’ element and the enforcement condition, see A Weyembergh and I Armada, ‘The Principle of Ne Bis in Idem in Europe’s Area of Freedom, Security and Justice’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on EU Criminal Law (Edward Elgar, 2016) 189–209. 26 Gözütok and Brügge (n 24) paras 31–32. 27 ibid para 33. The ECtHR has taken a similar approach in the recent Mihalache case, where it expressly ruled as follows: ‘What matters in any given case is that the decision in question has been given by an authority participating in the administration of justice in the national legal system concerned, and that that authority is competent under domestic law to establish and, as appropriate, punish the unlawful behaviour of which the person has been accused. The fact that the decision does not take the form of a judgment cannot call into question the person’s acquittal or conviction, since such a procedural and formal aspect cannot have a bearing on the effects of the decision’ (ECtHR, Mihalache v Romania, App No 54012/10, judgment of 8 July 2019, para 95). Gözütok and Brügge (n 24) para 31. 28 ibid para 37.

154 Ne Bis in Idem and Conflicts of Jurisdiction cannot play a useful role in bringing about the full attainment of that objective unless it applies to the decisions under examination in this case.29 The purposive interpretation of the Court and its emphasis on the attainment of EU objectives is backed by an ‘ahistorical’ approach to European integration, with the Court rejecting Member States’ arguments that the intentions of the Schengen Contracting Parties were not to adopt such a broad definition of Article 54, as, in particular, documents demonstrating such intentions ‘pre-date’ the integration of the Schengen acquis into the EU framework.30 In Gözütok and Brügge, the Court interpreted criminal law principles in the light of the need to achieve EU objectives and uphold fundamental principles of EC/EU law such as freedom of movement. This approach has led in this case to a broad interpretation of ne bis in idem as a protective criminal law principle. The Court followed this reasoning in a number of subsequent cases, which led to the adoption of a similarly protective approach to ne bis in idem by defining the scope of both bis and idem in a broad manner. The second decision of the Court on Article 54 CISA, Miraglia, also concerns the bis element, yet in this case the Court ruled that a decision of the public prosecutor to discontinue the prosecution ‘on the sole ground that criminal proceedings have been started in another Member State against the same defendant and for the same acts, without any determination whatsoever as to the merits of the case’ (emphasis added)31 does not trigger the application of Article 54 CISA. In similar circumstances of ‘preventive’ application of ne bis in idem,32 the decision to discontinue the prosecution could not fall within the concept of ‘final judgement’ of Article 54 CISA, since this decision contained ‘no assessment whatsoever of the unlawful conduct with which the defendant was charged’.33 Miraglia therefore clarified that ne bis in idem applies only when the first authorities have assessed the merits of the case. If they have done so, the outcome of the first set of criminal proceedings is irrelevant, since an acquittal for lack of evidence also prohibits further prosecution against the same person for the same facts. The Court spelled out this principle in Van Straaten,34 where it argued that not applying Article 54 to such cases would have the effect of jeopardising the exercise of the right of freedom of movement.35 Following AG Jarabo Colomer’s strong emphasis on the rationale behind ne bis in idem,36 the Court noted that in such a case – where the decision is based on the determination of the merits of the case37 – the bringing of criminal proceedings in

29 See ibid paras 35–38. 30 ibid para 46. In Case C-505/19, Bundesrepublik Deutschland (Notice Rouge d’Interpol), judgment of 12 May 2021, EU:C:2021:376, the Court confirmed that ne bis in idem also applies to procedures whereby public prosecutors decide to discontinue the prosecution without the involvement of courts, provided that that decision is based on a determination as to the merits of the case (paras 73–74). As for the relevance of such an assessment of the merits of the case for the application of the ne bis in idem principle, see immediately below in the text. 31 Case C-469/03, Miraglia, judgment of 10 March 2005, EU:C:2005:156, para 35. 32 ibid para 23. 33 ibid para 34. cf Bundesrepublik Deutschland (Notice rouge d’Interpol) (n 30) para 73. 34 Case C-150/05, Van Straaten, judgment of 28 September 2006, EU:C:2006:614. 35 ibid para 58. 36 ibid, Opinion of AG Jarabo Colomer, delivered on 8 June 2006, EU:C:2006:381, para 56. However, the Court did not go as far as the AG in using a fundamental rights vocabulary in the context of ne bis in idem. 37 ibid para 60.

Transnational Ne Bis in Idem: Scope and Content 155 another Contracting State for the same acts would undermine the principles of legal certainty and legitimate expectations.38 On the same day as the Van Straaten judgment, the Court handed down its judgment in Gasparini.39 This was a more challenging case for the Court, as it involved the question of whether time-barred prosecutions are final judgments for the purposes of Article 54 CISA. The Court had to deal with the Opinion of AG Sharpston, which in many aspects departed from the approach of AG Colomer and the Court’s earlier case law. AG Sharpston took the view that time-barred prosecutions should not merit the protection of Article 54 CISA, as they do not involve an examination of the merits of a case. The AG based her conclusion mainly on the arguments that a time-barred prosecution does not settle society’s account with the individual,40 that there must be a ‘balance’ between free movement and fighting crime41 (as free movement ‘is not an absolute principle and must not be distorted out of proportion’)42 and that a broad interpretation of bis would lead to ‘criminal jurisdiction shopping’.43 This ‘securitised’ approach to the limits of protection in criminal law reflects to a great extent the ‘war on terror’ discourse justifying exceptional measures in the UK,44 and the approach to free movement is a striking departure from the Court’s case law. The Court, however, did not change its approach on ne bis in idem. It included time-barred prosecutions within the scope of Article 54 CISA and reiterated the earlier case law and the importance of ensuring the exercise of the right of free movement. Not to apply Article 54 CISA when a court has finally acquitted the accused because prosecution of the offence is time-barred ‘would undermine the implementation of that objective’.45 While in Van Straaten and Miraglia the Court argued that the final decision that bars further prosecution has to deal with the merits of the case, in Gasparini it also held that a final decision by which the accused is acquitted because prosecution of the offence is time-barred – and thus without any possibility for the competent court to delve into the merits of the case – has the same effect for the purposes of Article 54 CISA. In Gasparini, therefore, the focus seems to shift from the ‘merits’ of the case to the ‘final status’ of national proceedings, with the Court suggesting that in order to assess whether a decision is apt to trigger Article 54 CISA, it is essential to look at the ‘final’ nature of such decision from a national perspective. If a Member State has had its opportunity to adjudicate a case, the definitive closure of the trial in that state according to its law does not allow the initiation of new investigations and prosecutions on the same facts in other EU countries. The Court explicitly adopted this interpretation of Article 54 CISA in Turanský.46 The case concerned the applicability of Article 54 CISA to a decision by which ‘a police authority, after examining the merits of the case brought before it, makes an order, at

38 ibid

para 59. On legal certainty, see also Gözütok and Brügge (n 24) para 119. C-467/04, Gasparini and Others, judgment of 28 September 2006, EU:C:2006:610. 40 ibid, Opinion of AG Sharpston delivered on 15 June 2006, ECLI:EU:C:2006:406, paras 74–76. 41 ibid para 81. 42 ibid para 84. 43 ibid para 104. 44 In particular, the standard discourse on ‘balancing’ different interests. 45 Gasparini and Others (n 39) para 28. 46 Case C-491/07, Turanský, judgment of 22 December 2008, EU:C:2008:768. 39 Case

156 Ne Bis in Idem and Conflicts of Jurisdiction a stage before the charging of a person suspected of a crime, suspending the criminal proceedings which had been instituted’;47 in that case, which concerned the Slovak legal system, such a decision did not bar further prosecution within the same state. Recalling Gözütok and Brügge, the Court noted that the concept of ‘finally disposed of ’ – to be found in Article 54 CISA – refers to those circumstances where ‘further prosecution is definitely barred’.48 In this decision, the Court underscored in particular the point that: [I]n order to assess whether a decision is ‘final’ for the purposes of Article 54 of the CISA, it is necessary first of all to ascertain … that the decision in question is considered under the law of the Contracting State which adopted it to be final and binding, and to verify that it leads, in that State, to the protection granted by the ne bis in idem principle. (Emphasis added)49

Other judgments have confirmed the principles laid down in Turanský. In Mantello,50 the Court did not deal with Article 54 CISA, but rather with Article 3(2) of the Framework Decision on the European Arrest Warrant, which lists ne bis in idem as a ground for mandatory non-execution of European Arrest Warrants. The Court argued that the two provisions share the same objective to prevent a person from being prosecuted or punished twice for the same acts.51 It thus confirmed the Turanský principles, namely that the assessment of the ‘final’ nature of the first judgment must be done in accordance with the law of the state where the judgment was delivered.52 The approach adopted in Turanský was subsequently confirmed in M and Kossowski.53 In the criminal proceedings against M, the Belgian authorities had issued an order of ‘non-lieu’ since they found that there was no ground to bring the suspect to judgment. In Belgium, this decision precludes new proceedings against the same person for the same facts, unless new facts and/or evidence come to light. In that case, the order of ‘non-lieu’ had been confirmed by the Court of Cassation. The question arose as to whether this final decision of the Belgian authorities should prevent the Italian authorities from investigating and prosecuting M for the same facts. The Court’s positive answer – that is, ne bis in idem also applies in these circumstances – relied on the previous judgments in Miraglia and Turanský, since the Court noted that Article 54 CISA applies when a decision concerns the merits of the case (Miraglia)54 and when that decision is regarded as ‘final’ in the state where it was issued (Turanský).55 However, the decisive factor for the applicability of ne bis in idem seems to be the latter, ie, the final nature of the decision according to the law of the first Member State. In M, the order making a finding of ‘non-lieu’ had become final and also concerned the merits of the case: it was a ‘definitive decision on the inadequacy of … evidence and exclude[d] any possibility that the case might be reopened on the basis

47 ibid para 30. 48 ibid para 32. 49 ibid para 35. 50 Case C-261/09, Mantello, judgment of 16 November 2010, EU:C:2010:683. 51 ibid para 40. 52 ibid para 46. 53 Case C-398/12, M, judgment of 5 June 2014, EU:C:2014:1057; and Case C-486/14, Kossowski, judgment of 29 June 2016, EU:C:2016:483. 54 Miraglia (n 31) 28 and 30. 55 Turanský (n 46) 31–32.

Transnational Ne Bis in Idem: Scope and Content 157 of the same body of evidence’.56 The defendant could not be judged again in Belgium for the same facts and on the basis of the same evidence. By interpreting Article 54 CISA in light of Article 50 of the Charter and Article 4 of Protocol No 7 to the ECHR, the Court concluded that Article 54 CISA applies with regard to the Belgian order of non-lieu, which ‘must be considered to be a final judgment, for the purposes of that article’ (emphasis added).57 This ruling therefore reaffirmed the priority of the requirement of legal certainty for the affected individual in Europe’s area of criminal justice.58 Nevertheless, the Court seemed to be aware that a ‘non-lieu’ decision might not sit easily with the concept of ‘final’ judgment. Recalling Bourquain, a previous decision, it clarified that ‘the sole fact that that criminal procedure would, under national law, have necessitated the reopening of the proceedings does not, in itself, mean that the judgment cannot be regarded as “final” for the purposes of Article 54 of the CISA’ (emphasis added).59 In Bourquain, the Court had to rule on a decision issued in absentia by a French military tribunal in Algeria in 1961, which was subsequently made void by an amnesty granted in 1968. The problems arose since French law imposed an obligation to hold a new trial if the person convicted in absentia reappeared before the date on which the enforcement of the sentence had become time-barred (20 years from the date on which the decision became definitive); in this case, the enforcement of the sentence would have become time-barred in 1981, but already in 1968 the defendant benefited from the amnesty. Hence, had Mr Bourquain reappeared in France between 1961 (the year of the judgment) and 1968 (the year of the amnesty), the penalty could have not been enforced because a new trial would have been necessary, this time in his presence. Before affirming the compatibility of this scenario with the enforcement clause of Article 54 CISA,60 the Court clarified that ne bis in idem also applies to decisions in absentia. Similar decisions can constitute a ‘procedural bar to the opening of new proceedings’61 not only because there is no evidence to the contrary in the text of Article 54 CISA,62 but also because the necessity to protect the freedom of movement of individuals requires not to prosecute again a defendant who is in a situation such as that of Mr Bourquain.63 Against this backdrop, the Court stated – as in M – that: [T]he sole fact that the proceedings in absentia would, under French law, have necessitated the reopening of the proceedings if Mr Bourquain had been arrested while time was running in the limitation period applicable to the penalty, and before he benefited from the amnesty … does not, in itself, mean that the conviction in absentia cannot be regarded as a final decision within the meaning of Article 54 of the CISA.64

56 ibid para 30. On the – somehow elusive – concept of ‘merits of the case’ and how it could be defined, see S Peers, EU Justice and Home Affairs Law. Vol 2: EU Criminal Law, Policing, and Civil Law, 4th edn (Oxford University Press, 2016) 244–45. 57 M (n 53) para 41. 58 V Mitsilegas, EU Criminal Law after Lisbon: Rights, Trust and the Transformation of Justice in Europe (Hart Publishing, 2016) 87. 59 M (n 53) para 34. As mentioned above in the text, according to Belgian law, cases closed with a non-lieu order can be reopened if new facts and/or evidence against the defendant are subsequently discovered. 60 See more in section III.C below. 61 Case C-297/07, Bourquain, judgment of 11 December 2008, EU:C:2008:708, para 34. 62 ibid para 35. 63 ibid para 41. 64 ibid para 40. cf M (n 53) para 34.

158 Ne Bis in Idem and Conflicts of Jurisdiction In other words, even if national law allows the reopening of closed cases under certain circumstances – such as the discovery of new facts or evidence (M) or the physical presence in the state of a person who had been convicted in absentia (Bourquain) – this is not sufficient as such to deny the ‘final’ nature of the decision adopted at the end of the first proceedings. Finally, in Kossowski, the applicability of Article 54 CISA to cases where public prosecutors terminate the criminal proceedings without any detailed investigation on the facts was discussed. The issue resembled that faced in Miraglia and the ruling of the Court is unsurprisingly similar: this decision of the prosecuting authorities does not fall within the scope of Article 54 CISA. In Kossowski, the Court pointed out a two-step procedure that national authorities should apply to assess whether the European right to ne bis in idem comes into play. First, national authorities must evaluate whether a decision is final in the state where it has been issued. In the event of a positive answer, the other question to address is whether that decision concerns the merits of the case; if not – as in Kossowski – Article 54 CISA cannot apply.65 The Court’s reasoning connects the dots of the previous decisions on the ‘bis’ element. As in M, which was quoted, the Court stated that Article 54 CISA must be read in light of Article 50 of the Charter.66 However, this clarification is more an assumption than the introduction of an analysis of the relationship between the two provisions, since the Court did not linger further on the matter. The Court did not mention the ECHR or the case law of the ECtHR either, but instead introduced the above-mentioned two-step procedure. Dealing with the first assessment – the final nature of the first judgment – the Court recalled the Turanský principle67 and confirmed that Article 54 CISA also applies to those decisions that have been adopted without the involvement of a court (as in Gözütok and Brügge).68 As far as the second step is concerned – whether the final judgment has dealt with the merits of the case – the Court suggested interpreting Article 54 CISA by taking into account the objective and the context of this rule.69 The Court stuck to the traditional finding that Article 54 CISA aims to protect the freedom of movement and ensure

65 Kossowski (n 53) paras 34 and 42. For a commentary, see K Ambos, ‘Judgment (Grand Chamber) C-486/14 Piotr Kossowski, 29 June 2016’ and C Nowak, ‘Impact of the Case C-486/14 – Kossowski at National Level’ in Mitsilegas, di Martino and Mancano (n 24) 227–33 and 234–43 respectively. In Mihalache v Romania (n 26), the ECtHR endorsed the criterion concerning the merits of the case to determine whether a judicial decision amounts to a ‘conviction’ or an ‘acquittal’ for the purposes of art 4 of Protocol No 7 to the ECHR (paras 97–98). On this noteworthy example of judicial dialogue between the two European Courts, see C Serneels, ‘“Unionisation” of the European Court of Human Rights’ Ne Bis in Idem Jurisprudence: The Case of Mihalache v Romania’ (2020) 11(2) New Journal of European Criminal Law 227. 66 ibid para 31. 67 ibid para 35: ‘A decision which does not, under the law of the Contracting State which instituted criminal proceedings against a person, definitively bar further prosecution at national level cannot, in principle, constitute a procedural obstacle to the opening or continuation of criminal proceedings in respect of the same acts against that person in another Contracting State’ (emphasis added). 68 ibid para 39. 69 ibid para 43. The Court of Justice confirmed the same two-step approach in Bundesrepublik Deutschland (Notice rouge d’Interpol) (n 30) paras 79–81. In the same judgment, the Court clarified that the provisional arrest, by the authorities of a State Party to the Schengen Agreement or a Member State, of a person in respect of whom Interpol has published a red notice, at the request of a third State, does not infringe art 54 CISA or art 21(1) TFEU, read in the light of art 50 of the Charter, until it has been established that the ne bis in idem principle applies.

Transnational Ne Bis in Idem: Scope and Content 159 legal certainty.70 Yet, as it did in Miraglia and Turanský, the CJEU underlined that the protective goal of Article 54 CISA must be coupled with the need to prevent and combat crime.71 In light of this further objective of Article 54 CISA, a decision such as the one at stake in the criminal proceedings against Kossowski – by which the public prosecutor dropped the case without any investigation on the merits – cannot be regarded as ‘final’. More precisely, in those circumstances, there was: [A] decision terminating criminal proceedings … adopted in a situation in which the prosecuting authority, without a more detailed investigation having been undertaken for the purpose of gathering and examining evidence, did not proceed with the prosecution solely because the accused had refused to give a statement and the victim and a hearsay witness were living in Germany, so that it had not been possible to interview them in the course of the investigation and had therefore not been possible to verify statements made by the victim. (Emphasis added)72

Should this decision bar further prosecution in other Member States, the aim to prevent and combat crime within the AFSJ would be seriously undermined. In sum, the Court’s case law on the bis element swings between decisions where the Court emphasises the final nature of the first judgment according to national law, even when this judgment does not deal with the merits of the case, and decisions where the key element is precisely such an assessment of the merits of the case. The first approach is more protective towards the defendants’ fundamental rights and the principle of legal certainty, while the second pays more heed to the need of ensuring security and avoiding impunity in the EU. The Grand Chamber’s ruling in Kossowski shows a preference for this second approach: the final nature of the first decision according to national law is a necessary condition for the application of ne bis in idem, yet it is not sufficient, since an assessment of the merits of the case should also have been carried out at the time of the first criminal proceedings. Kossowski departs from the strong free movement rationale of the initial case law of the CJEU on transnational ne bis in idem – as it has been noted, the Court: [S]eems to accept the mistrust from the second to the first state and accept one of the two state’s (and arguably the more draconian) approach on the conduct of criminal investigations … a European approach limiting the fight against impunity on the grounds of truly European considerations of legal certainty and free movement within Europe’s borderless AFSJ, give way to the precedence of unilateral perceptions of effective enforcement by individual Member States which have the potential to render important protective principles toothless and devoid of a common meaning reflecting a common sense of justice within the EU.73

B. The ‘Idem’ Element The Court of Justice has dealt with the idem aspect of the ne bis in idem principle in different judgments, where it has consistently endorsed the same interpretation: the second criminal proceedings shall concern the same ‘set of facts which are inextricably 70 Kossowski (n 53) para 44. 71 ibid paras 46–47. See Miraglia (n 31) para 34; Turanský (n 46) para 43. 72 Kossowski (n 53) 48. 73 V Mitsilegas, ‘Conceptualising Impunity in the Law of the European Union’ in S Montaldo and L Marin (eds), The Fight against Impunity in EU Law (Hart Publishing, 2020) 13–45.

160 Ne Bis in Idem and Conflicts of Jurisdiction linked together, irrespective of the legal classification given to them or the legal interest protected’.74 Only the national authorities are competent to evaluate whether given forms of conduct fall within the notion of inextricably linked set of facts.75 It goes without saying that, for the purposes of ne bis in idem, the person against whom new criminal proceedings are initiated must be the same person who was subject to the first set of proceedings. In Orsi and Baldetti, which concerned a case of domestic legislation that combined administrative and criminal penalties for non-payment of VAT, the Court noted that ne bis in idem could not be invoked since the administrative penalty was issued against a company, whereas the criminal proceedings had been launched against natural persons (the legal representatives of the company).76 Article 50 of the Charter, as well as Article 54 CISA, can only apply when the person involved in the two proceedings is the same. In AY, which concerned ne bis in idem as a ground for refusal to execute a European Arrest Warrant, the Court of Justice ruled that the principle does not apply when, with regard to the same facts, the same person is prosecuted in a set of proceedings and, in another set of proceedings in a different Member State, he or she is only interviewed as a witness.77 The leading case on the ‘idem’ element is Van Esbroeck, where the issue was examined for the first time. This judgment concerned a case of illegal drug trafficking, which represents the typical example of the problems that arise in the interpretation of ‘idem’. When the crime of drug trafficking is transnational, the defendants could be charged for the ‘export’ of drugs in the countries from which the drug is moved, whereas in those where the substances are received, they could be prosecuted for the ‘import’ of drugs. The answer to the question of whether similar forms of conduct constitute ‘same acts’ for the purposes of Article 54 CISA depends on the criterion that national courts apply in their assessment.78 If one looks at the legal classification of the forms of conduct, the ne bis in idem principle could never apply in similar circumstances, since the ‘export’ and ‘import’ of drugs are two different offences. The same is true if the evaluation focuses on the legal interests protected by the law. Assuming that drug trafficking affects, inter alia, the right to health and the public security of a given population, the legal interests at stake would be more than one: in the case of transnational trafficking, the right to health and the public security of (at least) two different populations – those of the importing country and of the exporting country – are affected. The only criterion that allows Article 54 CISA and Article 50 of the Charter to come into play in similar circumstances is that of the same historical fact: through the lens of the ‘idem factum’, importing and exporting drugs do not represent two different facts, but are two sides of the same coin. The Court of Justice endorsed this view in Van Esbroeck, in which it rejected an approach defining idem on the basis of its legal 74 Van Esbroeck (n 16) para 42. 75 ibid para 38. 76 Joined Cases C-217/15 and C-350/15, Orsi and Baldetti, judgment of 5 April 2017, EU:C:2017:264. 77 Case C-268/17, AY, judgment of 25 July 2018, EU:C:2018:602. In that case, AY, a Hungarian national, was investigated and prosecuted by the Croatian authorities. The Hungarian authorities refused to execute the Croatian European Arrest Warrant as AY had already been interviewed as a witness in the framework of an investigation opened in Hungary against an unknown person. 78 As noted in section II above, the wording of art 54 CISA and art 50 of the Charter is different in that respect, with the former referring to ‘same acts’ and the latter to the same ‘offence’, which is also the phrasing of art 4 of Protocol No 7 to the ECHR.

Transnational Ne Bis in Idem: Scope and Content 161 classification by viewing the issue from the perspective of achieving free movement – given that there is no harmonisation of national laws, a criterion based on the legal classification or the legal interest protected at the national level ‘might create as many barriers to freedom of movement within Schengen as there are legal systems’.79 The Court reiterated its case law in Gözütok and Brügge and Miraglia, stating that the objective of Article 54 CISA is that no one is prosecuted for the same acts on account of his or her having exercised the right to freedom of movement.80 Making express reference to the Opinion of AG Jarabo Colomer, the Court further noted that the right of free movement is guaranteed: [O]nly if the perpetrator of an act knows that, once he has been found guilty and served his sentence, or, where applicable, been acquitted by a final judgment, he may travel within the Schengen territory without fear of prosecution in another Member State.81

Six months after Van Esbroeck, the Court delivered two judgments, Van Straaten and Gasparini,82 in which it confirmed this interpretation of ‘same acts’ for the purposes of Article 54 CISA. In Van Straaten, the Court – looking again at the issue of the movement of drugs between two Schengen countries – reiterated the Van Esbroeck reasoning, adding that exporting and importing are in principle the same acts.83 It also upheld the line of reasoning of Van Esbroeck and Van Straaten in Kraaijenbrink.84 This case concerned the transnational crime par excellence, ie, money laundering. It involved money laundering-related convictions in Belgium and the Netherlands – while different acts giving rise to these convictions constituted ‘the successive and continuous implementation of the same criminal intention’,85 it was not clear whether they involved the same sums of money. In this context, the Court reiterated the earlier case law and stressed that the acts in question must make up ‘an inseparable whole’, but it noted that if the acts do not make up an inseparable whole, the fact that they were committed with the same criminal intention does not suffice to meet the test of what constitutes ‘same acts’ under Article 54 of the Schengen Convention.86 In other words, it is not sufficient that the facts are linked by the same criminal intention, since an objective link is also necessary. The Court also found that in cases where it has not been clearly established that the financial gain in question in the two Member States is identical, in principle the conduct involved can be covered by the notion of the ‘same acts’ if an objective link is established.87

79 Van Esbroeck (n 16) para 35. See also the Opinion of AG Ruiz-Jarabo Colomer, delivered on 20 October 2005, EU:C:2005:630, who rejected the legal classification criterion as inconsistent with the right to freedom of movement. He noted that in a drug-trafficking case, it is ironic to speak of ‘import’ and ‘export’ (between different Schengen countries) in a territory which is subject to one legal order that has exactly as its aim by its nature the abolition of borders for goods and persons (at para 52). 80 Van Esbroeck (n 16) para 33. 81 ibid para 34. 82 Gasparini (n 39) para 54. 83 As mentioned above, the assessment is for the national courts to make. The quantities of the drugs involved are not required to be identical; ibid para 53. 84 Case C-367/05, Kraaijenbrink, judgment of 18 July 2007, EU:C:2007:444, para 31. 85 ibid para 18. 86 ibid para 29. 87 ibid para 31.

162 Ne Bis in Idem and Conflicts of Jurisdiction On the same day as the Kraaijenbrink judgment, the Court also delivered the Kretzinger judgment.88 The case involved the transportation (without declaring this to any customs authority) by Mr Kretzinger of cigarettes from countries that were not members of the EU, which had previously been smuggled into Greece by third parties, by lorry through Italy and Germany, bound for the UK. The Venice Court of Appeal imposed upon Mr Kretzinger in absentia a suspended custodial sentence of one year and eight months, finding him guilty of offences of tobacco smuggling and failing to pay customs duty. The Tribunal of Ancona subsequently imposed again in absentia and under the same provisions a two-year custodial sentence (not suspended) for a second consignment of tobacco. Both sentences had become final. However, awareness of the Italian final judgments had not stopped a court in another Member State, Germany (the Landesgericht Augsburg), from sentencing Mr Kretzinger to one year and 10 months’ imprisonment in relation to the first consignment and one year imprisonment in relation to the second, finding the defendant guilty of evasion of the customs duties which had arisen on the importation of the smuggled goods into Greece in accordance with the German Tax Code. According to the Landesgericht Augsburg, Article 54 of the Schengen Implementing Convention did not apply in this case. On appeal, the Bundesgerichtshof decided to send a reference for a preliminary ruling to Luxembourg, asking in particular whether the case in question would involve the ‘same acts’ under Article 54 and whether in essence the Italian handling of the case would constitute ‘enforcement’ of a sentence under the same provision.89 The case is significant as it was generated by an attempt by a lower national court to apply and enforce its domestic law notwithstanding the EU rules on ne bis in idem. The key question underlying this case concerns the concept of the territory and its link with jurisdiction. Here, it seems that the national court attempted to circumvent EU law requirements by applying the domestic law whose reach extended beyond its national border and covered the EU external border (in Greece) – following this logic, tobacco smuggling on the EU external border is not the ‘same act’ as tobacco smuggling from Italy to Germany. On the question of what constitutes the ‘same act’, the Court followed and expanded upon its earlier case law. It reiterated the Van Esbroeck test that the only relevant criterion is identity of the material acts, understood as the existence of a set of facts which are inextricably linked together, adding that this criterion applies irrespective of the legal classification given to those acts or the legal interest protected.90 The Court rejected the position put forward by the German and Spanish governments that the national court must also take into account the legal interest protected when assessing a set of concrete circumstances. It reiterated that legal interest considerations are not to be deemed relevant and repeated Van Esbroeck in stating that ‘because there is no harmonisation of national criminal law, considerations based on the legal interest protected might create as many barriers to freedom of movement within the Schengen area as there are penal systems in the Contracting States’.91 According to the Court, while the final assessment is for the national courts to make, the transportation of

88 Case

C-288/05, Kretzinger, judgment of 18 July 2007, EU:C:2007:441. the background on this and the questions of the national court, see ibid paras 14–26. 90 ibid para 29. 91 ibid para 33. 89 For

Transnational Ne Bis in Idem: Scope and Content 163 contraband cigarettes involving successive crossings of internal Schengen area borders is capable of constituting a set of facts covered by the notion of the ‘same acts’.92 It thus remained focused on ensuring freedom of movement, and reinforced the centrality and broad definition of the concept of ‘same acts’ in the interpretation of ne bis in idem by clarifying in this context that successive border crossings within the Schengen area may not change the fact that the ‘same acts’ apply.93 In Mantello, finally, the Court extended its interpretation of the ‘idem’ element to the European Arrest Warrant Framework Decision, underlining that such a notion ‘must be given an autonomous and uniform interpretation throughout the European Union’.94 This autonomous concept of EU law has also crossed the EU borders, since it has been endorsed by the ECtHR. Even though in Article 4 of Protocol No 7 to the ECHR, the term ‘offence’ rather than ‘facts’ is used, in Zolotukhin v Russia the ECtHR’s Grand Chamber ruled that the right to ne bis in idem applies when the second proceedings concern the ‘same set of concrete factual circumstances involving the same defendant and inextricably linked together in time and space’.95 Zolotukhin has reframed the Strasbourg Court’s interpretation of ne bis in idem and has strikingly offered a coherent interpretation of ECHR domestic and EU transnational ne bis in idem. It has been influential and a key reference point for subsequent Strasbourg96 and Luxembourg97 case law. The alignment of two European Courts with respect to the interpretation of the idem element98 strengthens legal certainty vis-a-vis the application of the right to ne bis in idem; in addition, the interpretation of ‘idem’ as ‘idem factum’ enhances freedom of movement in the EU.99 However, within the EU legal framework itself, there are some inconsistencies among different policy areas: in the context of competition 92 ibid para 36. 93 This is a logical conclusion of the establishment of a single area with no internal frontiers and a common external border under Schengen. However, this approach would seem to imply that the position of the Court might be different in cases involving Member States not fully participating in Schengen, such as the UK – although the latter did apply the criminal law part of Schengen before leaving the EU. Should Mr Kretzinger have managed to smuggle tobacco into the UK, the final destination of the journey, would the UK courts have been shielded from applying the EU ne bis in idem principle by virtue of the external crossing of the goods? This seemed to follow from the emphasis of the Court on Schengen free movement. 94 Mantello (n 50) para 38. In Mantello, the Court examined ne bis in idem as a ground for mandatory non-execution of a European Arrest Warrant as provided for by art 3(2) of the European Arrest Warrant Framework Decision. In C-665/20 PPU, X (Mandat d’arrêt européen – Ne bis in idem), judgment of 29 April 2021, EU:C:2021:339, paras 68–83, the Court further clarified that art 3(2) (grounds for mandatory non-execution) and art 4(5) (grounds for optional non-execution) of the European Arrest Warrant Framework Decision must be interpreted as meaning that the concept of ‘same acts’, contained in both provisions, must be interpreted uniformly. 95 ECtHR, Zolotukhin v Russia, App No 14939/03, judgment of 10 February 2009, para 84. 96 See, eg, ECtHR, Glantz v Finland, App No 37394/11, judgment of 20 May 2014; ECtHR, Nykänen v Finland, App No 11828/11, judgment of 20 May 2014; ECtHR, Rinas v Finland, App No 17039/13, judgment of 27 January 2015; ECtHR, Österlund v Finland, App No 53197/13, judgment of 10 February 2015; ECtHR, Kapetanios et al v Greece, App Nos 3453/12, 42941/12 and 9028/13, judgment of 30 April 2015; ECtHR, Chernov v Ukraine, App No 16432/10, judgment of 10 December 2020. 97 See M (n 53) para 39. 98 For some differences in the approach of the two Courts with regard to other aspects of ne bis in idem, see section V below. 99 See, inter alia, Lelieur (n 4), 205; Weyembergh and Armada (n 25) 196–97; K Ligeti, ‘Fundamental Rights Protection between Strasbourg and Luxembourg: Extending Transnational Ne Bis in Idem across Administrative and Criminal Procedures’ in European Law Institute, K Ligeti and G Robinson (eds), Preventing and Resolving Conflicts of Jurisdiction in EU Criminal Law (Oxford University Press, 2018) 160–81 at 167–70.

164 Ne Bis in Idem and Conflicts of Jurisdiction law, for instance, the Court of Justice still refers to the criterion of the legal interests when dealing with ne bis in idem issues. The Court has ruled in several occasions that the application of this principle in competition law is subject to the threefold condition that ‘in the two cases the facts must be the same, the offender the same and the legal interest protected the same’.100 Some AGs and several authors therefore call for a unitary definition of ne bis in idem in EU law,101 especially bearing in mind that competition ‘falls somewhere in the grey area between criminal and administrative law’102 and that a fundamental right cannot have a different scope according to the policy area concerned.

C. The Enforcement Condition in Article 54 CISA and its Relations with Article 50 of the Charter Article 54 CISA provides that if a person has been convicted, ne bis in idem applies only if the penalty has been enforced, is in the process of being enforced or can no longer be enforced under the laws of the sentencing Contracting Party. The Court of Justice has so far interpreted this enforcement clause in four main cases. In Gözütok and Brügge, it only stated that when a defendant has complied with the obligations descending from an out-of-court settlement, namely paying a certain amount of money, the penalty can be regarded as ‘having been enforced’ for the purposes of Article 54 CISA.103 In Kretzinger, the facts of which have been summarised in the previous section, the Court was called upon to decide whether the enforcement condition could be considered to have been fulfilled in cases of suspended custodial sentence. Beyond that, the Court was in essence required to address a more fundamental question of trust: throughout the description of the facts and in the German Court’s questions themselves, implicit but clear is the lack of trust towards the Italian authorities and the manner in which they have handled the Kretzinger cases post-conviction. What the German Court is asking effectively is the extent to which ne bis in idem rules are bent or limited when another Member State is deemed as not taking its enforcement obligations seriously: do final decisions in another Member State, if they are not properly enforced, bind the hands of activist courts in other Member States under the ne bis in idem principle?

100 See, for instance, Case C-17/10, Toshiba Corporation and Others, judgment of 14 February 2012, EU:C:2012:72, para 97. 101 See Case C-17/10, Toshiba Corporation and Others, Opinion of AG Kokott delivered on 8 September 2011, EU:C:2011:552, paras 120–22; Case C-617/17, Powszechny Zakład Ubezpieczeń na Życie SA, Opinion of AG Wahl delivered on 29 November 2018, EU:C:2018:976, paras 46–49. The judgment issued in the latter case (Case C-617/17, judgment of 3 April 2019, EU:C:2019:283) has been interpreted as a first step towards the abandonment of two different notions of ‘idem’ in EU law (see G Lasagni, ‘La Corte di Giustizia e la Definizione di Idem nel Diritto della Concorrenza: Verso la Creazione di una Nozione Uniforme?’ (2020) 47(1) Giurisprudenza Commerciale 5). On the contentious differences between EU competition and criminal law in the interpretation of ne bis in idem, see, eg, B van Bockel, ‘The “European” Ne Bis in Idem Principle: Substance, Source, and Scope’ in van Bockel (n 14) 13–57 at 34–39; A Rosanò, ‘Ne Bis Interpretatio in Idem: The Two Faces of the Ne Bis in Idem Principle in the Case Law of the European Court of Justice’ (2017) 18(1) German Law Journal 39, 44ff; M Luchtman, ‘The ECJ’s Recent Case Law on Ne Bis in Idem: Implications for Law Enforcement in a Shared Legal Order’ (2018) 55(6) CML Rev 1717, 1724–25. 102 Powszechny Zakład Ubezpieczeń na Życie SA (n 101) Opinion of AG Wahl, para 19. 103 Gözütok and Brügge (n 24) para 30.

Transnational Ne Bis in Idem: Scope and Content 165 From the outset, the Court clarified that suspended custodial sentences constitute penalties within the meaning of Article 54 of the Schengen Convention insofar as they penalise the unlawful conduct of a convicted person – with the penalty regarded as ‘actually in the process of being enforced’ as soon as the sentence has become enforceable and during the probation period.104 However, the Court found that periods spent in police custody and/or remand pending trial must not be regarded automatically as the enforcement of a penalty for the purposes of Article 54 CISA.105 Moreover, the Court rejected Mr Kretzinger’s argument that the fact that it was legally possible under the Framework Decision on the European Arrest Warrant for the sentencing state to issue a warrant in order to enforce a judgment which had become final and binding meant that the enforcement condition must be regarded as satisfied (and the German courts could no longer prosecute him).106 The Court found that this factor could not affect the interpretation of the notion of ‘enforcement’ under Article 54 of the Schengen Convention as the latter required not only a conviction, but also the satisfaction of the enforcement condition.107 The Court is thus prepared to extend ne bis in idem in cases of suspended sentences, implicitly accepting that this is a legitimate choice of penal enforcement by Member States which, if adopted at the domestic level, must be recognised as enforcement across the Schengen area for the purposes of Article 54 CISA. However, it is noteworthy that the Court is not prepared to link ne bis in idem enforcement with the European Arrest Warrant, or rather with the possibility for a Member State to issue a European Arrest Warrant on a specific case. The Court seems to recognise that this would place an undue burden upon domestic criminal justice systems, as well as an inroad to prosecutorial or judicial discretion: if Mr Kretzinger’s argument were accepted, the decision not to issue an EAW would effectively shield defendants from prosecutions as it would in essence constitute an act equivalent to a decision triggering the ne bis in idem principle. The third relevant case on the enforcement condition is Bourquain. As mentioned above, Mr Bourquain had been convicted in absentia by the French military tribunal in 1961 and then benefited from the amnesty in 1968. However, the penalty issued in 1961 could have never been enforced: according to French law, had the defendant reappeared in France, a new trial would have been necessary in his presence.108 In such circumstances, the question was whether the enforcement condition was fulfilled and, consequently, whether Mr Bourquain would have enjoyed the right to ne bis in idem if his case had been reopened in another Member State. The Court replied in the affirmative, arguing that the clause of Article 54 CISA also encompasses cases where the penalty ‘can no longer be enforced’. Therefore, when the second proceedings begin, it is not relevant whether the penalty imposed with the first decision could have not been executed on the date when it was imposed – it is only necessary to assess whether,

104 Kretzinger (n 88) para 42. 105 ibid paras 48ff. 106 ibid para 57. 107 ibid paras 59 and 63. The Court also based this conclusion on the fact that Member States bound by the Framework Decision on the European Arrest Warrant are not all bound by the Schengen Convention and linking the two in this manner would create ‘legal uncertainty’ (at para 62). 108 See section III.A above.

166 Ne Bis in Idem and Conflicts of Jurisdiction at the time of the second proceedings, that penalty has been, or is in the process of being, enforced, or can no longer be enforced. The latter was precisely the case for Mr Bourquain, who was again prosecuted in 2002 for the same facts for which he had been convicted in 1961; that penalty became void with the amnesty of 1968 and, even without such an amnesty, according to French law, it could have not been served after 20 years from the decision – that is, as of 1981. As a consequence, there is no doubt that the enforcement condition in similar cases is satisfied as the sentence against Mr Bourquain could no longer be enforced when the second proceedings began. Any other conclusion would have impaired Mr Bourquain’s freedom of movement, since he could have been tried or punished again because his penalty – due to some specific features of the French system – was not enforceable at the time of the first proceedings.109 Finally, the Court’s fourth case on the enforcement condition, Spasic,110 is rather problematic. This decision dealt with two questions. The less sensitive concerned the application of the enforcement clause when a person, who is sentenced to both a custodial sentence and a financial penalty, has only paid the latter. The Court submitted that should ne bis in idem apply in similar circumstances, the aims of Article 54 CISA would be seriously jeopardised. In this judgment, however, the Court mentioned among the objectives of Article 54 CISA only the need not to grant impunity to the individuals and the need to ensure legal certainty, whereas freedom of movement was neglected.111 It follows that from this perspective, allowing a person to rely on ne bis in idem when the sentence has been only partially executed would be unacceptable. Article 54 CISA, which provides for the singular form ‘penalty’, also covers the cases where a financial penalty and a custodial sentence have been imposed.112 The other issue dealt with by Spasic is much more contentious. The Court was asked whether the enforcement condition of Article 54 CISA is compatible with the right to ne bis in idem as enshrined in Article 50 of the Charter, which does not make any reference to such a clause. The striking positive answer was based on the premise that Article 54 CISA is recalled in the explanations to Article 50; the explanations also provide that the limited exceptions to the right at stake, to be found in Articles 54–58 CISA, are covered by the horizontal clause of Article 52(1) of the Charter.113 The latter provision regulates how the Charter rights can be limited. Similar limitations must: (i) be provided for by law; (ii) respect the essence of those rights; and (iii) be subject to the principle of proportionality, and be necessary and genuinely meet the objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others. Assuming that the enforcement clause is a limitation of the right to ne bis in idem, the Court assessed whether the three conditions provided for by Article 52(1) of the Charter were met. First, the enforcement condition is provided by the law, namely Article 54 CISA.114 Second, the Court accepted the argument put forward by the German and French governments that the condition laid down in Article 54 CISA does not call into

109 Bourquain

(n 61) paras 45–52. C-129/14 PPU, Spasic, judgment of 27 May 2014, EU:C:2014:586. 111 ibid para 77. 112 ibid paras 80–81. 113 Explanations relating to the Charter of Fundamental Rights [2007] OJ C303, 14 December, 17–35, at 31. 114 Spasic (n 110) para 57. 110 Case

Transnational Ne Bis in Idem: Scope and Content 167 question the ne bis in idem principle as such, but is intended, inter alia, to avoid a situation in which a person definitively convicted and sentenced in one Contracting State can no longer be prosecuted for the same acts in another Contracting State and therefore ultimately remains unpunished if the first state did not execute the sentence imposed.115 The analysis then shifts to the proportionality of the enforcement clause. The Court’s positive assessment is based on the claimed objective of Article 54 CISA, ie, the general interest to prevent the impunity of persons convicted and sentenced in an EU Member State.116 According to the Court, by allowing, in cases of non-execution of the sentence imposed, the authorities of one Contracting State to prosecute a person definitively convicted and sentenced by another Contracting State on the basis of the same acts, the risk that the person concerned would enjoy impunity by virtue of his or her leaving the territory of the state in which he or she was sentenced is avoided.117 The Court was not convinced by the Commission’s argument that EU secondary law instruments providing for consultations between national authorities (including the Framework Decision on conflicts of jurisdiction)118 addressed this objective. The Court noted that these instruments do not lay down an execution condition similar to that of Article 54 CISA and, accordingly, are not capable of fully achieving the objective pursued.119 According to the Court, the options made available to that Member State by those Framework Decisions cannot ensure that, in the AFSJ, persons definitively convicted and sentenced in the EU will not enjoy impunity if the state which imposed the first sentence does not execute the penalties imposed.120 The Court therefore ruled out any incompatibility between the enforcement condition of Article 54 CISA and the right to ne bis in idem as enshrined in Article 50 of the Charter. The Court only adds that, in concreto, when national authorities must assess whether the enforcement clause is met, they can ‘contact each other and initiate consultations in order to verify whether the Member State which imposed the first sentence really intends to execute the penalties imposed’,121 in light of the principle of sincere cooperation enshrined in Article 4(3) TEU. The Court’s approach in Spasic is striking. It is a marked departure from the view of AG Jääskinen, who found that the generalised application of the execution condition in Article 54 CISA does not satisfy the proportionality criterion and cannot be regarded as a justified interference with the right not to be tried or punished twice in criminal proceedings within the meaning of Article 52 of the Charter.122 The ruling is also at odds not only with the Court’s case law on bis and idem, but also with national trends towards extending the protective scope of Article 54 CISA in the light of Article 50 of the Charter,123 with the earlier emphasis on the presumption of mutual trust being 115 ibid para 58; see also Kretzinger (n 88) para 51; Mitsilegas (n 58) 89. 116 Spasic (n 110) paras 61–63. 117 ibid paras 63 and 64 respectively. 118 See more in section IV below. 119 Spasic (n 110) para 68. 120 ibid para 69. 121 ibid para 73. 122 Spasic (n 110) View of AG Jääskinen delivered on 2 May 2014, EU:C:2014:739, paras 91–103. 123 The Greek Supreme Court has found that Member States’ reservations under art 55 CISA have ceased to exist since art 50 of the Charter does not provide for optional exceptions to the ne bis in idem principle similar to those enshrined in art 55 CISA – Areios Pagos, Case 1/2011.

168 Ne Bis in Idem and Conflicts of Jurisdiction transformed in Spasic to an institutionalisation of mutual distrust. The Court seems to have little time for the deliberative and consultative mechanisms introduced by EU law and aiming to facilitate interstate cooperation in cases of conflicts of jurisdiction. The Court found these mechanisms to be weak, but this weakness is explained by Member States’ reluctance to harmonise standards further in the field. This lack of harmonisation is allowed here to foment distrust and allow multiple interventions by national enforcement authorities for the same acts. In Spasic, the Court effectively introduced a security rationale within a fundamental right. However, not only does this rationale (and the emphasis on the need to avoid impunity) not fall within the scope of ne bis in idem, but the Court’s interpretation also opens the door towards divergent interpretations and levels of protection between domestic ne bis in idem cases involving the implementation of EU law (interpreted in conformity with Article 50 of the Charter) and transnational ne bis in idem cases under Article 54 CISA.124 The Court’s approach in Spasic also does very little for the achievement of legal certainty in Europe’s area of criminal justice and raises the spectre of serious impediments to the enjoyment of free movement. It also poses a significant challenge to the essence of the ne bis in idem right as enshrined in Article 50 of the Charter.125

D. Conceptualising Transnational Ne Bis in Idem The ne bis in idem case law is another example of the subordination of criminal law to EU law. Especially in the Court’s first judgments, the principle has been interpreted in the light of the need to ensure that the fundamental rights of the EU legal order, in the form of free movement, are exercised effectively.126 The emphasis on free movement is inextricably linked to a specific view of territoriality in the Schengen area. With the logic of Schengen resulting in the abolition of borders, the Schengen area is viewed as 124 See further M Wasmeier, ‘Ne Bis in Idem and the Enforcement Condition: Balancing Freedom, Security and Justice?’ (2014) 5(4) New Journal of European Criminal Law 534. 125 Mitsilegas (n 58) 89–90. See also JAE Vervaele, ‘Schengen and Charter-Related Ne Bis in Idem Protection in the Area of Freedom, Security and Justice: M and Zoran Spasic’ (2015) 52(5) CML Rev 1339, 1352ff. The Court of Justice upheld the approach in Spasic in a judgment concerning ne bis in idem as provided for by art 4(5) of the European Arrest Warrant Framework Decision (optional ground for non-execution of a European Arrest Warrant), where the enforcement condition is expressly mentioned. In X (Mandat d’arrêt européen – Ne bis in idem) ((n 94) para 98), the Court ruled that, in view of establishing an AFSJ, such a condition ‘is of particular importance’ since, if it is not met, it prevents the application of the ne bis in idem principle. In the same judgment, the Court clarified that the enforcement condition – as envisaged by art 4(5) of the European Arrest Warrant Framework Decision – is satisfied where ‘the requested person has been finally sentenced, for the same acts, to a term of imprisonment, of which part has been served in the third State in which the sentence was handed down, whilst the remainder of that sentence has been remitted by a non-judicial authority of that State, as part of a general leniency measure that also applies to persons convicted of serious acts and is not based on objective criminal policy considerations’ (at para 104). In that case, the remainder of the sentence for grievous bodily harm and attempted murders – which was issued in Iran – had been remitted as part of a general leniency measure proclaimed by the Supreme Leader of Iran to mark the fortieth anniversary of the Islamic revolution (at paras 19–20). 126 On the Court of Justice’s ‘teleological and functional approach’, see C Janssens, The Principle of Mutual Recognition in EU Law (Oxford University Press, 2013) 145–47. Symeonidou-Kastanidou and Naziris claim that the line of reasoning inaugurated in Gözütok and Brügge connecting free movement with ne bis in idem elevated the latter to ‘a European citizen’s right within an ever-integrating Europe’ (Gözütok and Brügge (n 24) 223).

Transnational Ne Bis in Idem: Scope and Content 169 a borderless area, and thus effectively as one territory in which free movement must be ensured and enjoyed. Differences between national criminal justice systems should not pose an obstacle to free movement. However, one must not disregard that freedom in the context of the protective provisions of ne bis in idem within the framework of the Schengen Convention has been included as a safeguard to the substantial security ‘compensatory’ measures introduced by the Schengen Implementing Convention in order to enhance border and police cooperation. Similarly, in the AFSJ – the establishment of which has been one of the EU’s objectives since the Amsterdam Treaty – the high level of security to be guaranteed to EU citizens must go hand in hand with respect for fundamental rights. It is therefore telling that in the most recent judgments on ne bis in idem, the Court of Justice has emphasised that the protection of the freedom of movement should be balanced with the need to combat and prevent crime, and in any case cannot lead to the impunity of persons who have committed crimes. In Spasic, the Court of Justice even overlooked freedom of movement, with a reasoning that strikingly introduces a security rationale within the fundamental right not to be tried or punished twice for the same facts. The following judgments have partly departed from the Spasic approach, yet the emphasis on the ‘security’ rather than the ‘freedom’ dimension of the AFSJ and the Schengen area – and therefore of the ne bis in idem principle – is now more prominent than in the early rulings of the Court. The transposition of the ne bis in idem principle from the national to the EU level has considerable implications for sovereignty and legitimacy of the criminal law at the national level. The application of the ne bis in idem principle in the Schengen context, and then in the AFSJ, effectively prohibits a Member State from prosecuting conduct that could constitute a criminal offence in a wide range of cases. This constitutes a considerable limitation in the capacity of the state to administer criminal justice and may have considerable implications for citizens’ acceptance of such action. The tensions surrounding this issue are evident from the examination of ne bis in idem in Luxembourg, where cases have revealed that national courts are agonising over the extent to which they can define the principle, and the Court of Justice and AGs have to grapple with what constitutes the examination of the merits of a case and with what conditions will prevent a prosecution in EU Member States.127 Tensions are also evident in the fact that there is no common understanding by Member States of what should constitute ne bis in idem at the EU level, as efforts to adopt legal instruments introducing a common EU definition of the principle have failed.128 However, at the same time, absence of harmonisation of ne bis in idem across the EU has not been an obstacle for the Court in developing the principle further. As mentioned above, in Gözütok and Brügge, the Court stated that nowhere in the TEU or the S chengen Convention ‘is the application of Article 54 of the Convention made conditional upon harmonisation, or at least approximation, of the criminal laws of the Member States relating to procedures whereby further prosecution is barred’.129 The Court added that in those circumstances, ‘there is a necessary implication that the 127 The tension between ne bis in idem and the administration of justice is clearly demonstrated in AG Sharpston’s Opinion in Gasparini. 128 See ‘Initiative of the Hellenic Republic’ (n 10). 129 Gözütok and Brügge (n 24) para 32.

170 Ne Bis in Idem and Conflicts of Jurisdiction Member States have mutual trust in their criminal justice systems and that each of them recognises the criminal law in force in the other Member States even when the outcome would be different if its own national law were applied’ (emphasis added).130 The Court reiterated this statement in Van Esbroeck,131 where it added that because of the existence of mutual trust, the possibility of divergent legal classifications of the same acts in two different states or varying criteria protecting legal interests across Member States cannot stop the application of Article 54 of the Schengen Convention.132 Further references to mutual trust can also be found in more recent judgments such as Bourquain and Kossowski.133 Therefore, the Court seems to have disregarded concerns voiced in the context of the application of the principle of mutual recognition in criminal matters in view of the absence of mutual trust among Member States. In the ne bis in idem cases – with some exceptions such as Spasic – the Court assumes the existence of such trust, most notably of a ‘high level’ of trust between Member States. Whether such level of trust actually exists is an open question.134 What is noteworthy is that, in assuming trust and not viewing harmonisation as a necessary condition for interpreting the ne bis in idem in a broad manner, the ne bis in idem principle (which involves the movement of final national criminal law judgments in the Schengen area) is viewed in a manner analogous with the operation of the mutual recognition principle (where national judgments/orders also move across the EU). While the maximum mutual recognition of coercive measures such as the European Arrest Warrant leads to concerns regarding the extension of the state’s punitive sphere, a broad application of ne bis in idem (viewed as a facilitator of free movement) has thus far led to the opposite result, that is, an overall extension of the protective sphere for the individual in the AFSJ. In the absence of ever-elusive EU legislative harmonisation in the field, and the close link of ne bis in idem to the legitimacy of domestic criminal justice systems, standards developed by the Court of Justice may lead to challenges to the formulation and acceptance of these standards in Member States. At present, national definitions of ne bis in idem do not always chime with the definition adopted by the Court. Differences between the EU concept of ne bis in idem and national definitions may lead to double standards – and perhaps reverse discrimination – between those exercising free movement rights and those subject to a purely domestic legal framework. Court-made standards may also encounter resistance in a national context and have a significant impact on national legal systems and cultures – for example, in cases where the Court’s approach in Gözütok and Gasparini-type cases clashes with national rules requiring a substantive determination of innocence or guilt for a case to be ‘finally disposed of ’. Moreover, they may prove inadequate to address the fact that a 130 ibid para 33. See also the Opinion of AG Ruiz-Jarabo Colomer, delivered on 19 September 2002, EU:C:2002:516, paras 119–24, and para 55, where the AG stated that the construction of a Europe without borders, with its corollary of the approximation of the various national legal systems, including the criminal justice systems, presupposes that the states involved will be guided by the same values. 131 Van Esbroeck (n 16) para 30. 132 ibid paras 31 and 32. 133 Bourquain (n 61) para 37 and Kossowski (n 53) paras 50–53 respectively. 134 The assumption that a high level of trust in criminal justice systems across the EU exists would weaken the justification of proposals tabled by the European Commission in order to enhance trust in Member States’ criminal justice systems (most notably the defence rights proposal).

Concurrent Jurisdiction 171 fundamental principle of EU law135 – and EU criminal law – such as ne bis in idem has a strong ‘variable geometry’ dimension, linked primarily with the full Schengen members. With or without harmonisation, the Court will continue to face important questions on the interpretation of ne bis in idem. However, relaunching the effort to harmonise ne bis in idem at the EU level (with binding legislation incorporating the elements of the Luxembourg case law) will be challenging, but may be the only way for these concerns to be addressed.

IV. Concurrent Jurisdiction A question that has been linked with, but is broader than, the definition of the ne bis in idem principle in a borderless AFSJ concerns the extent to which Member States should coordinate prior to initiating prosecutions for offences with a transnational element – thus extending cooperation at the stage prior to the initiation of criminal prosecutions and/or investigations. It has been argued that it is not coherent to allow the extraterritorial reach of national judicial decisions in criminal matters across the EU, without in parallel limiting the number of jurisdictions which can prosecute and can do so effectively.136 Some form of coordination on jurisdiction might complement the operation of mutual recognition and the determination of the fate of prosecutions in accordance with the ne bis in idem principle. In the absence of a uniform criminal law and procedure across the EU, the question arises as to whether any such coordination will result in the worsening of the position of the defendant by aiming at allocating jurisdiction to investigate and prosecute to the Member State where it is easiest to obtain a conviction, and whether ‘effectiveness’ in this context is synonymous with the maximum information gathering possible and maximum convictions. Another issue relates to legitimacy and to the extent to which it is acceptable for a Member State to be prevented from prosecuting an alleged offence where jurisdiction can be established solely on the grounds of ‘effectiveness’. Section IV.A below provides an overview of the EU’s approach to conflicts of jurisdiction in criminal matters, while section IV.B focuses on conflicts of jurisdiction in the field of the protection of the EU’s financial interests (PIF),137 where the issue has become very sensitive in the aftermath of the establishment of the EPPO.

A. Conflicts of Jurisdiction in the EU Conflicts of jurisdiction are usually classified as: (i) ‘positive’, when two or more Member States wish to (or should) prosecute a given case or are already dealing with 135 In Van Esbroeck (n 16), the Court expressly stated that ne bis in idem is a fundamental principle of Community law (para 40). On ne bis in idem as a general principle of EU law, see D Sarmiento, ‘Ne Bis in Idem in the Case Law of the European Court of Justice’ in van Bockel (n 14) 103–30 at 108–12. 136 See D Flore and S de Biolley, ‘Des Organes Jurisdictionnels en Matière Pénale pour l’Union Européenne’ (2003) 5 Cahiers de droit européen 597, 610. 137 PIF stands for ‘protection des intérêts financiers’.

172 Ne Bis in Idem and Conflicts of Jurisdiction it; and (ii) ‘negative’, which occurs when no Member State is willing to investigate or prosecute a crime, although two or more of them would have jurisdiction on it.138 Positive conflicts of jurisdiction tend to flourish in proportion to the growth of cross-border criminality and to the number of national legislations providing for extraterritorial jurisdiction.139 However, currently there is no centralised binding mechanism of jurisdiction allocation in criminal matters in the EU,140 with the exception of the rules of the EPPO Regulation on the choice of forum.141 The only ‘instrument’ that currently regulates conflicts of jurisdiction is the transnational ne bis in idem principle, although this only applies when the proceedings in one Member State have become final.142 Since it is not coupled with a set of rules on jurisdiction, ne bis in idem implies that the first Member State to adjudicate a case, as the ‘sheriff who is quickest on the draw’,143 prevents others from doing the same, ‘even if someone was better placed to fire the shot’.144 A possible way to solve positive conflicts of jurisdiction is the transfer of proceedings, which allows national competent authorities to divest themselves of a case and transfer it to the authorities of another Member State that are better placed to deal with it.145 However, at the EU level, there is no legal instrument that regulates the transfer of proceedings, which therefore takes place mostly in accordance with non-EU rules.146 A proposal for a Council Framework Decision on the matter was tabled in 2009, but was not followed up.147 The (non-binding) powers of the European Union Agency for Criminal Justice Cooperation (Eurojust) with respect to conflicts of jurisdiction should also be mentioned.148 The Eurojust Regulation states that the Agency may ask the competent authorities of 138 See more in, inter alia, Caeiro (n 22) 369ff; ‘Explanatory Note’ in European Law Institute, Ligeti and Robinson (n 99) 15–76 at 16. 139 See, eg, M Böse, ‘Choice of Forum and Jurisdiction’ in M Luchtman (ed), Choice of Forum in C ooperation against EU Financial Crime: Freedom, Security and Justice and the Protection of Specific EU Interests (Eleven International Publishing, 2013) 73–87 at 74. 140 See also A Klip, European Criminal Law: An Integrative Approach, 3rd edn (Intersentia, 2016) 455–56. 141 See more on this in ch 8. Recently, some proposals to fill this gap have been elaborated in the literature: see European Law Institute, Ligeti and Robinson (eds), n 99 above, especially pp 42–76. 142 M Luchtman, ‘Choice of Forum and the Prosecution of Cross-Border Crime in the European Union – What Role for the Legality Principle?’ in Luchtman (ed), n 139 above 3–60 at 38–41; M Wasmeier, ‘The Choice of Forum by the European Public Prosecutor’ in LH Erkelens, AWH Meij and M Pawlik (eds), The European Public Prosecutor’s Office. An Extended Arm or a Two-Headed Dragon?, The Hague, TMC Asser Press & Springer, 2015 139–161 at 145–146. 143 JR Spencer, ‘Mutual Recognition and Choice of Forum’ in Luchtman (n 139) 61–72 at 71. 144 ibid. See also Caeiro (n 22) 376; European Criminal Policy Initiative, ‘A Manifesto on European Criminal Procedure Law. European Criminal Policy Initiative’ (2013) 11 Zeitschrift für Internationale Strafrechtsdogmatik 430, 432. 145 See, eg, ‘Transfer of Proceedings’ (2016) 14 Eurojust News 7–8; A Marletta, ‘Report on the Field Research at Eurojust, February 2015’ in European Law Institute, Ligeti and Robinson (n 99) 86–99 at 95–96. 146 Some EU Member States have ratified the 1972 European Convention on the Transfer of Proceedings in Criminal Matters, Strasbourg, ETS No 73. In addition to this instrument, other non-EU legal bases that are relied upon to transfer criminal proceedings are reportedly art 21 of the 1959 European Convention on Mutual Assistance in Criminal Matters, Strasbourg, ETS No 30, and the 2000 United Nations Convention against Transnational Organized Crime (‘Transfer of Proceedings’ (n 145) 7–8). 147 [2009] OJ C219, 12 September, 7. In the first half of 2019, the Romanian presidency relaunched the debate by publishing and circulating a paper on conflicts of jurisdiction and the application of ne bis in idem (Council Doc 9197/19, Brussels, 15 May 2019), but no further initiative followed. 148 On Eurojust and conflicts of jurisdictions, see C Deboyser, ‘Eurojust’s Role in the Matter of Choice of Forum’ in Luchtman (n 139) 101–08; Marletta (n 145).

Concurrent Jurisdiction 173 Member States to coordinate149 and may also ask these authorities ‘to accept that one of them may be in a better position to undertake an investigation or to prosecute specific acts’.150 Respectful of the wish of Member States to maintain sovereignty in the initiation of investigations and prosecutions, Eurojust may (as in the cases of investigating or prosecuting) only ask – but not oblige – national authorities to consider these issues. Eurojust has been conducting a number of coordination meetings with national officials and, in 2003, adopted a series of (non-binding) Guidelines on ‘which jurisdiction should prosecute’.151 The Guidelines, which were revised in 2016,152 call for a ‘preliminary presumption’153 that a prosecution should take place in the jurisdiction where the majority of criminality occurred or where the majority of the loss was sustained – in reaching the decision, prosecutors ‘should balance carefully and fairly all the factors both for and against commencing a prosecution in each jurisdiction’.154 The Guidelines contain a series of criteria to be taken into account, including the location of the accused, the capacity to extradite or surrender, centralising prosecutions of many suspects in one jurisdiction, and the attendance and protection of witnesses and victims. According to the Guidelines, the relative sentencing powers of the courts must not be a ‘primary’ factor in deciding where to prosecute, but availability and use of evidence is a relevant factor.155 Mechanisms and criteria of allocating jurisdiction do exist in further sectoral EU criminal law instruments. For instance, the 2017 Directive on combating terrorism156 stipulates that when an offence falls within the jurisdiction of more than one Member State and when any of the states concerned can validly prosecute on the basis of the same facts, the Member States concerned must cooperate in order to decide where to prosecute, with the aim if possible of centralising proceedings in one Member State. Member States ‘may have recourse to Eurojust in order to facilitate cooperation between their judicial authorities and the coordination of their action’,157 and, in allocating jurisdiction, account must be taken of the following criteria: the territory of the commission of the acts; the nationality or residence of the perpetrator; the ‘country of origin’ of the victims; and the place where the perpetrator ‘was found’.158 The same list can be found 149 Article 4(2)(c) of Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA, OJ L295, 21 November 2018, 138 (hereinafter the ‘Eurojust Regulation’). For further details on Eurojust, see ch 8. 150 Article 4(2)(b) of the Eurojust Regulation. 151 See the Annex to Eurojust Annual Report 2003, 60ff. On these guidelines, see A Marletta, ‘Forum Choice in the Area of Freedom, Security and Justice’ in European Law Institute, Ligeti and Robinson (n 99) 140–59 at 150–53. 152 Originally included in the Eurojust Annual Report 2016, the ‘Guidelines’ are now a stand-alone document available on Eurojust’s website (www.eurojust.europa.eu/practitioners/operational/pages/guidelineson-jurisdiction.aspx). 153 ibid 3. 154 ibid 2. 155 Eurojust conducted a jurisdiction allocation exercise in the known case concerning the shipwreck of the Prestige tanker in 2002. The College decided that Spain was better placed to prosecute than France on the grounds that a larger amount of evidence was gathered in Spain, and the number of injured parties was also much higher in Spain – see ‘The Prestige Case’ (2013) 10 Eurojust News 14–15. 156 [2017] OJ L88, 31 March, 6. 157 ibid art 19(3). 158 ibid.

174 Ne Bis in Idem and Conflicts of Jurisdiction in the 2008 Framework Decision on the fight against organised crime.159 It is interesting to note that these criteria do not necessarily coincide with the Guidelines developed by Eurojust, with the former being more objective compared to Eurojust’s more subjective, case-by-case approach. Back in 2005, the Commission had launched the debate on whether there should be common rules on conflicts of jurisdiction by linking the issue with the question of the development of an EU definition of ne bis in idem. The Commission Green Paper on conflicts of jurisdiction, published in December 2005,160 was the next step after the freezing of negotiations on the proposal by the Greek presidency for a Framework Decision on ne bis in idem, which encountered substantial difficulties in the Council.161 In the background to the Green Paper, the Commission linked the operation of the ne bis in idem to concurrent jurisdiction: [W]ithout a system for allocating cases to an appropriate jurisdiction while proceedings are ongoing, ne bis in idem can lead to accidental or even arbitrary results: by giving preference to whichever jurisdiction can first take a final decision, its effects amount to a ‘first come first served’ principle. The choice of jurisdiction is currently left to chance, and this seems to be the reason why the principle of ne bis in idem is subject to several exceptions.162

Following the use of this – rather critical – language, the Commission floated the idea of creating an EU mechanism for the choice of jurisdiction, which, if applied, would do away with the exceptions to the ne bis in idem principle. It called for criteria on jurisdiction allocation to be listed in a future EU instrument. It referred to criteria such as territoriality, criteria relating to the suspect or defendant, victims’ interests, criteria relating to the state interests and ‘certain other criteria related to the efficiency and rapidity of the proceedings’.163 It also asserted that: [S]ince new findings can often change the picture of what at first might seem the ‘best place’ to prosecute, it may not be wise to force the competent authorities to make a definitive choice of jurisdiction at an early stage.164

The need to give as much flexibility as possible to prosecutors was also reflected in the response of Eurojust to the Green Paper, where it was noted that immediate centralisation of proceedings in a single Member State ‘is not always the best solution’ and that in complex cases, it might be more appropriate ‘to carry on well coordinated investigations and prosecutions in two or more jurisdictions instead of centralising them in a single Member State’.165 Where does all this leave us? The Commission appears to be advocating centralisation and EU binding legislation in determining jurisdiction allocation criteria. From the tone and the content of the Green Paper – ranging from the criteria of allocating jurisdiction to the dismissive tone regarding the application of the protective ne bis in idem principle – concerns were raised that such criteria would prioritise the goal of

159 [2008]

OJ L300, 11 November, 42, art 7(2). See more in Peers (n 56) ch 6. (2005) 696 final, Brussels, 23 December 2005. section I above. 162 COM (2005) 696 final, 3. 163 ibid 8. 164 ibid 7. 165 ibid 3. Interestingly, Eurojust also placed emphasis on ‘negative’ conflicts of jurisdiction. 160 COM 161 See

Concurrent Jurisdiction 175 prosecutorial efficiency.166 Eurojust’s comments appeared in the same spirit, with the organisation calling for the maximum prosecution possible until a very late stage – in a sense thus defeating the very purpose of centralising prosecutions at an early stage and creating legal certainty (which could then lead to the abolition of ne bis in idem exceptions). Concerns relating to the proliferation of prosecutorial power at the expense of the defendant are coupled with issues of legitimacy. Should Member States be ordered not to prosecute behaviour which may lead to a criminal conviction in their jurisdiction? It is one thing for Member States to be bound by an EU body/instrument to initiate prosecutions, but quite another for these states to be prevented or prohibited from initiating prosecutions for conduct that may be a serious criminal offence under their law. However, the Commission’s Green Paper did not lead to any relevant change in the status quo, and the situation was not remedied by the adoption in 2009 of a Framework Decision on prevention and settlement of conflicts of jurisdiction,167 which merely establishes channels of information exchange and consultation between national authorities.168 The Framework Decision provides a role for Eurojust where it has not been possible to reach a consensus,169 but Member States do not appear to have made wide use of this provision.170 The entry into force of the Treaty of Lisbon may have provided new impetus towards the adoption of EU rules on conflicts of jurisdiction. Article 82(1)(b) TFEU calls on the EU legislators to adopt measures to prevent and settle conflicts of jurisdiction between Member States, while Article 85(1)(c) TFEU states that the tasks of Eurojust following the adoption of post-Lisbon secondary law may include the resolution of such conflicts.171 However, little, if any, progress has been made thus far on the ground. At the time of writing, no use of Article 82(1)(b) has been made, while, as mentioned above, the post-Lisbon Eurojust Regulation does not contain any major change in relation to the latter’s role in the resolution of conflicts of jurisdiction. The 2013 Commission’s proposal for a Regulation on Eurojust had suggested enhancing Eurojust’s powers by providing that the competent national authorities could decide not to follow Eurojust’s opinions on conflicts of jurisdiction only if the reasons for this are justified,172 but such an obligation to give reasons in the case of refusal to follow Eurojust’s opinions was eventually removed from the text.173 These developments reflect the reluctance of Member States to introduce EU-level binding rules which would limit their capacity to prosecute and their real and perceived 166 Note the Commission’s reference to ‘certain other criteria related to the efficiency and rapidity of the proceedings’ when citing criteria of allocation of prosecution. 167 Council Framework Decision 2009/948/JHA of 30 November 2009 on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings [2009] OJ L328, 15 December, 42. 168 Articles 5–9 and 10–13 of Council Framework Decision 2009/948/JHA respectively. See inter alia Marletta (n 151) 145–48. 169 Article 12(2) of Council Framework Decision 2009/948/JHA. 170 European Commission, ‘Report on the implementation by the Member States of Framework Decision 2009/948/JHA of 30 November 2009 on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings’ COM (2014) 313 final, Brussels, 2 June 2014, 4–5. 171 For an in-depth analysis of these two provisions, see M Wasmeier, ‘The Legal Basis for Preventing and Resolving Conflicts of Criminal Jurisdiction in the TFEU’ in European Law Institute, Ligeti and Robinson (n 99) 100–18 at 102ff. 172 COM (2013) 535 final, Brussels, 17 July 2013, arts 4(4) and 23. 173 cf art 4(6) of the Eurojust Regulation. In addition, Recital 14 of the Eurojust Regulation clarifies that the ‘written opinions of Eurojust are not binding on Member States’.

176 Ne Bis in Idem and Conflicts of Jurisdiction power to deliver justice in criminal matters for their citizens. Indeed, binding EU powers in the field would considerably limit the powers of Member States: in cases of positive conflicts of jurisdiction, a binding EU decision excluding one Member State from prosecuting would raise serious questions on its capacity to deliver justice domestically (as seen above, similar questions have been raised in the context of ne bis in idem cases). In cases of negative conflicts of jurisdiction, a binding EU decision would have the effect of obliging a Member State to prosecute a case which it would not normally have prosecuted, something that would raise a number of legitimacy and efficiency concerns (similar concerns have been raised in the context of the debate on the application of proportionality in the operation of the European Arrest Warrant).174 In all these cases, concerns relating to the delivery of justice are exacerbated in the absence of detailed and clear remedies for affected individuals.

B. Protection of the EU’s Financial Interests and Conflicts of Jurisdiction The above-mentioned concerns on legitimacy and effectiveness of the criminal justice response to crime, as well as on the protection of individuals’ fundamental rights, arose in particular in the context of the negotiations on the Regulation establishing a European Public Prosecutor’s Office (hereinafter the ‘EPPO Regulation’).175 The EPPO Regulation includes some provisions on the choice of forum in relation to vertical investigations and prosecutions. The EPPO is the EU Office that is competent to investigate and prosecute crimes affecting the EU’s financial interests (so-called ‘PIF crimes’). Within the limits set out in the Regulation, which for instance provides for some thresholds for minor cases, the EPPO will in principle be able to deal with both national and crossborder PIF crimes. As for the latter, the negotiators had to decide on some criteria to allocate jurisdiction in cases where more than one Member State participating in the EPPO176 would be competent to investigate and prosecute the same crime. The establishment of the EPPO therefore poses new challenges in the field of EU criminal justice with respect to the allocation of jurisdiction. So far, decisions on choice of forum have been taken by competent national authorities, sometimes with the support of Eurojust. With the EPPO, the power to adopt these decisions – when they concern PIF crimes that fall within the EPPO mandate – will instead lie with an EU body. After heated debates, negotiators agreed that, in principle, the EPPO should begin investigations in the Member State where the focus of the criminal activity is or, if several connected offences within the competence of the EPPO have been committed, the Member State where the bulk of the offences has been committed.177 However, deviations from this rule are possible, since investigations can be moved to another Member State, taking into account the following criteria ‘in order of priority’:178 (a) the place of 174 See ch 4. 175 [2017] OJ L283, 31 October, 1 (hereinafter the ‘EPPO Regulation’). 176 The EPPO was established by means of enhanced cooperation. At the time of writing, Ireland, Denmark, Poland, Hungary and Sweden do not participate in the Office. 177 Article 26(4) of the EPPO Regulation. 178 ibid.

Concurrent Jurisdiction 177 the suspect or accused person’s habitual residence; (b) the suspect or accused person’s nationality; and (c) the place where the main financial damage has occurred.179 The same rules apply to the choice of the Member State where the case should be brought to judgment.180 The Regulation relies on broad notions such as ‘focus of the criminal activity’ and the ‘bulk of the offences’ that may require further clarification in the future,181 and allows the EPPO – within certain limits – to ‘“switch” between different legal orders’182 during the investigation or at the stage of prosecution. Bearing in mind that EPPO activities will largely be regulated by the national law of the Member State where they will take place,183 the suspect might never be sure that investigations will continue, and that the trial will take place, in a given Member State. Consequently, he or she may be confronted with different substantive and procedural criminal legislation during the investigations and up to the prosecution phase.184 The investigations and prosecutions of the EPPO should be guided by the principle of ‘fairness towards the suspect or accused person’,185 yet the change of jurisdiction in the course of its activities may prevent accused persons from organising an effective defence strategy.186 The issue is further complicated by the lack of judicial review at the EU level on the EPPO’s decision on choice of forum. This decision can only be reviewed by national courts,187 although these can lodge requests for preliminary rulings to the CJEU.188 As some authors argue, the national judiciary would be in a better position to take a swift decision on the matter compared to the CJEU, would have access to the case file

179 ibid. 180 See art 36(3) of the EPPO Regulation. 181 See M Luchtman, ‘Forum Choice and Judicial Review under the EPPO’s Legislative Framework’ in W Geelhoed, AWH Meij and L Erkelens (eds), Shifting Perspectives on the European Public Prosecutor’s Office 9TMC Asser Press/Springer, 2018) 155–70 at 157–58, who raises the following doubts: ‘How is the “focus” or “bulk” determined? Do we only count the number of offences? Or do we also take into account such factors as the legal interests involved, the nature and degree of the offences and/or the penalties? Is the focus or bulk of the offences also determined by the status of the alleged offenders (perpetrator, accomplice, etc.)? Do attempt and the separate criminalization of preparatory acts play a role?’ 182 F Zimmermann, ‘Choice of Forum and Choice of Law under the Future Regulation on the Establishment of a European Public Prosecutor’s Office’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stiftelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015) 156–77 at 167. 183 See more in ch 8. 184 See also JAE Vervaele, ‘Judicial and Political Accountability for Criminal Investigations and Prosecutions by a European Public Prosecutor’s Office: The Dissymmetry of Shared Enforcement’ in M Scholten and M Luchtman (eds), Law Enforcement by EU Authorities. Implications for Political and Judicial Accountability (Edward Elgar, 2017) 247–71 at 256–57. 185 Recital 65 of the EPPO Regulation. 186 See S Ruggeri, ‘Criminal Investigations, Interference with Fundamental Rights and Fair Trial Safeguards in the Proceedings of the European Public Prosecutor’s Office: A Human Rights Law Perspective’ in L Bachmaier Winter (ed), The European Public Prosecutor’s Office: The Challenges Ahead (Springer, 2018) 201–33 at 209–15 and 227. 187 Almost all EPPO acts and decisions will be subject to judicial review by national courts, although one would expect that the nature of the EPPO as an EU body requires judicial review by the CJEU (see more in ch 8). As for the judicial review of the choice of forum, Recital 87 of the EPPO Regulation reads as follows: ‘Procedural acts that relate to the choice of the Member State whose courts will be competent to hear the prosecution, which is to be determined on the basis of the criteria laid down in [the] Regulation … should … be subject to judicial review by national courts, at the latest at the trial stage’ (emphasis added). 188 Article 42(2) of the EPPO Regulation.

178 Ne Bis in Idem and Conflicts of Jurisdiction and could in any case resort to the Court of Justice pursuant to Article 267 TFEU.189 Nonetheless, a number of equally valid arguments can be marshalled for the opposite conclusion of bestowing the judicial review of the EPPO’s choice of forum upon the Court of Justice. The decision on the choice of forum follows criteria set out by EU rules (the EPPO Regulation)190 and should not raise concerns in terms of confidentiality, since the investigations are over. True, a quick decision on the conflict of jurisdiction is necessary, especially if suspects are being deprived of their liberty, but the Rules of Procedure of the CJEU already lay down some provisions concerning expedited procedures.191 Furthermore, as the Commission pointed out back in 2001, if control over the choice of forum is left to national courts, ‘there could be a few cases of declined jurisdiction and possibly even of negative conflicts of jurisdiction’.192 If investigations are initiated in State A and later moved to State B, and the case is finally brought to prosecution in State C, the suspect can challenge the jurisdiction of State C before the courts of this Member State. Assuming that the courts of State C reject their jurisdiction, the EPPO could lodge an appeal against the decision if national law so provides. If the appeal fails or if the EPPO considers it more appropriate to initiate the prosecution in another Member State, say State B, the case can be brought before courts in State B. Here again, the courts could refuse their jurisdiction: assuming they decline their jurisdiction as well, a negative conflict of jurisdiction would arise, as foreseen by the Commission’s Green Paper. As things stand, this conflict could not be settled at the European level by a European court. The only way to avoid a stalemate would be for national authorities to find an agreement pursuant to the 2009 Framework Decision on conflicts of jurisdiction and/or involving Eurojust.193 The provision in the EPPO Regulation on the judicial review of choice of forum may therefore amount to negating an effective remedy against acts which may have significant consequences for the protection of fundamental rights, including respect of the principles of legality (including foreseeability)194 and equality before the law.195 Lack of legal certainty with regard to choice of forum decisions at the national level was found 189 F Falletti, ‘The European Public Prosecutor’s Office and the Principle of Equality’ (2017) 1 Eucrim 25, 26. See also H-H Herrnfeld, ‘Choice of Forum and Case Allocation in the EPPO Regulation’ in European Law Institute, Ligeti and Robinson (n 99) 305–22 at 315–18. 190 The Preamble to the EPPO Regulation makes it clear that the Member State where the trial following the EPPO investigations will take place ‘is to be determined on the basis of the criteria laid down in [the] Regulation’ (Recital 87). 191 On the expedited procedures before the Luxembourg Court, see M Wathelet, ‘Accelerated Procedures before the European Court of Justice’ in K Bradley, N Travers and A Whelan (eds), Of Courts and Constitutions: Liber Amicorum in Honour of Nial Fennelly (Hart Publishing, 2014) 33–46. 192 Commission, ‘Criminal-law protection of the financial interests of the Community and the establishment of a European Public Prosecutor’ (Green Paper), COM (2001) 715 final, Brussels, 11 December 2001, 56. 193 F Giuffrida, ‘Cross-border Crimes and the European Public Prosecutor’s Office’ (2017) 3 Eucrim 149, 153–54. 194 V Mitsilegas, ‘The European Public Prosecutor before the Court of Justice: The Challenge of Effective Judicial Protection’ in G Giudicelli-Delage, S Manacorda and J Tricot (eds), Le Contrôle Judiciaire du Parquet Européen. Nécessité, Modèles, Enjeux (Collection de l’UMR de Droit Comparé de Paris (Université Paris 1), Société de Législation Comparée, vol 37, 2015) 84. On the principle of legality as foreseeability in this context, see Zimmermann (n 182); M Panzavolta, ‘Choice of Forum and the Lawful Judge Concept’ in Luchtman (n 139) 143–66. 195 Mitsilegas (n 194) 84. See also in this context Fundamental Rights Agency, Opinion on a Proposal to Establish a European Public Prosecutor’s Office, FRA Opinion 1/2014, Vienna, 4 February 2014.

Concurrent Jurisdiction 179 to be in violation of Article 7 ECHR by the ECtHR. In the case of Camilleri v Malta,196 the Court found that national law providing for two different possible punishments depending on the procedure chosen by the Attorney General failed to satisfy the foreseeability requirement and provide effective safeguards against arbitrary punishment as provided in Article 7. The Court noted in this context that: It would therefore appear that the applicant would not have been able to know the punishment applicable to him even if he had obtained legal advice on the matter, as the decision was solely dependent on the prosecutor’s discretion to determine the trial court. While it may be true that the Attorney General gave weight to a number of criteria before taking his decision, it is also true that any such criteria were not specified in any legislative text or made the subject of judicial clarification over the years. The law did not provide for any guidance on what would amount to a more serious offences or a less serious one … An insoluble problem was posed by fixing different minimum penalties … The decision was inevitably subjective and left room for arbitrariness, particularly given the lack of procedural safeguards.197

It is clear that this reasoning is likely to apply to transnational choice of forum decisions, including decisions by the EPPO, something which necessitates not only a clear procedure involving the defendant leading to the decision on the choice of forum, but also effective remedies at the EU level against choice and transfer of forum decisions by the EPPO.198 Finally, the establishment of the EPPO poses two further challenges. First, conflicts in the allocation of jurisdiction will also have a ‘vertical’ – rather than purely ‘horizontal’ – dimension. In other words, the rules on the choice of forum that have been discussed so far aim to identify the Member State in which the EPPO will carry out its activities among the different Member States where the EPPO could in principle exercise its powers. Therefore, from a ‘horizontal’ perspective, these provisions intend to avoid that the same facts are investigated and prosecuted in more than one country by the same EU body. However, once the competent Member State has been identified, it will also be necessary to prevent the EPPO and national public prosecutors from investigating and prosecuting the same PIF offence at the same time. This issue of the ‘vertical’ allocation of jurisdiction (or, more correctly, competence) between national and EU authorities comes to the fore for the first time in EU criminal law, as the EPPO is the first EU body that can investigate and prosecute individuals. The overarching principle is that if the EPPO decides to exercise its competence, ‘the competent national authorities shall not exercise their own competence in respect of the same criminal conduct’.199 Second, conflicts of competence may also arise at the EU level between two EU bodies with similar missions. As discussed in Chapter 8, the European Anti-Fraud Office (OLAF) is competent to conduct investigations on fraud and other illegal activities affecting the EU’s financial interests. However, unlike the EPPO, OLAF can carry out administrative investigations, but cannot conduct criminal prosecutions; it can only share the outcome of its investigations with national authorities, which will then decide

196 ECtHR,

Camilleri v Malta, App No 42931/10, judgment of 22 January 2013. paras 42–43. 198 Mitsilegas (n 194) 84. 199 Article 25(1) of the EPPO Regulation. 197 ibid

180 Ne Bis in Idem and Conflicts of Jurisdiction whether or not to indict the person(s) on whose allegedly illegal activities OLAF investigated. Even though the two bodies have different powers, their mandate is very similar, that is, protecting the EU budget against fraud and other illegal activities. OLAF investigations may at times be as intrusive as criminal investigations, and the 2013 Regulation on OLAF indeed provides for some procedural safeguards that are similar to those in criminal proceedings.200 It is therefore to be welcomed that the EU legislator tries to reduce duplication of investigations at the EU level requiring that where the EPPO conducts a criminal investigation, ‘OLAF shall not open any parallel administrative investigation into the same facts’.201 This prohibition of parallel investigation, in spite of the differences between OLAF administrative and EPPO criminal investigations, is in line with the recent case law of the CJEU and the ECtHR on the debated issue, which is addressed in the section below, of whether the same person can be subject to administrative and criminal penalties for the same conduct.

V. Application of Ne Bis in Idem to Criminal and Administrative Proceedings Concerning the Same Facts The Court of Justice and the ECtHR have recently decided an increasing number of cases concerning the applicability of ne bis in idem to concurring administrative and criminal proceedings. The key question in this context is whether the same person can be subject to both administrative and criminal penalties for the same facts.202 This is a new dimension of ne bis in idem: it has national scope, as criminal and administrative penalties are issued within the same Member State, but goes beyond criminal law stricto sensu. There are several fields where criminal and administrative law go hand in hand, notably when it comes to the regulation of economic activities, and the same conduct could thus be subject, according to some criteria laid down by national legislators, to criminal and administrative sanctions (so-called ‘twin-track’ or ‘double-track’ systems). At the EU level, the combination of criminal and administrative law is common in the regulation of areas such as the protection of the EU’s financial interests and market abuse. The recent Directive on the fight against fraud by means of criminal law (hereinafter the ‘PIF Directive’) obliges Member States to introduce criminal penalties for fraud and other illegal conducts affecting the EU budget, including money 200 See art 9 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 [2013] OJ L248, 18 September, 1, as amended by Regulation (EU, Euratom) 2020/2223 of the European Parliament and of the Council of 23 December 2020 amending Regulation (EU, Euratom) No 883/2013, as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of the European Anti-Fraud Office investigations [2020] OJ L437, 28 December, 49. 201 Article 101(2) of the EPPO Regulation. See also art 12d of Regulation (EU, Euratom) 883/2013, as amended by Regulation (EU, Euratom) 2020/2223. For some remarks on those limited cases where OLAF is allowed to conduct its administrative investigations upon request of the EPPO and in the framework of the latter’s investigations, see section V.B.vi.c in ch 8. 202 See Tomkin (n 2) 1405–07.

Application of Ne Bis in Idem to Criminal 181 laundering or misappropriation.203 At the same time, there are several further illegal forms of conduct that do not amount to crime, but still affect the EU’s financial interests; they are referred to as ‘irregularities’ and are punished with administrative sanctions.204 Similarly, in accordance with the Market Abuse Directive,205 Member States should penalise serious forms of conduct such as insider dealing or market manipulation, while administrative sanctions are provided for the violations of a number of provisions laid down in the Market Abuse Regulation.206 The European Courts have addressed the issue of concurring criminal and administrative proceedings and penalties in a way that has changed over time. As the following sections illustrate, two phases in their case law can be identified: the CJEU and the ECtHR were first inclined to rule out the compatibility of double-track systems with the ne bis in idem principle; however, after some years, they partially modified and softened their approach.207

A. The ‘First Phase’: Incompatibility between Double-Track Systems and Ne Bis in Idem In Bonda,208 the Court of Justice dealt with the case of a Polish national who received an administrative penalty for some violations of Regulation (EC) 1973/2004 on EU agriculture subsidies.209 He had declared he owned much more land than that he actually had and was therefore excluded from the subsidy for the subsequent year, pursuant to Article 138(1) of the Regulation. After the administrative penalty had been issued, the public prosecutor then opened an investigation for fraud: Mr Bonda was convicted in the first instance and acquitted in the second, whereas the Polish Supreme Court asked the Court of Justice to decide on the legal nature of the penalty provided for in Article 138(1) of Regulation (EC) 1973/2004. If such a penalty had been of a criminal nature, the Polish legislation on ne bis in idem would have applied and Mr Bonda should have been acquitted in the criminal proceedings. Confirming its previous case law on the common agricultural policy, the Court denied the criminal nature of penalties issued within the framework of this policy area. It referred to the Engel criteria used by the ECtHR to ascertain whether a given sanction can be considered of a criminal nature, and namely legal classification of the offence

203 [2017] OJ L198, 28 July, 29. 204 In accordance with art 1(2) of Council Regulation (EC, Euratom) No 2988/95 of 18 December 1995 on the protection of the European Communities financial interests [1995] OJ L312, 23 December, 1, irregularity ‘shall mean any infringement of a provision of Community law resulting from an act or omission by an economic operator, which has, or would have, the effect of prejudicing the general budget of the Communities or budgets managed by them, either by reducing or losing revenue accruing from own resources collected directly on behalf of the Communities, or by an unjustified item of expenditure’. The notion of ‘fraud’ in the PIF Directive instead covers only intentional acts or omissions (art 3(1) of the PIF Directive). 205 [2014] OJ L173, 12 June, 179. 206 ibid 1. 207 For an analysis of the recent case law of the European Courts on the matter, see Ligeti (n 99) 160–81. 208 Case C-489/10, Bonda, judgment of 5 June 2012, EU:C:2012:319. 209 OJ L345, 20 November 2004, 1.

182 Ne Bis in Idem and Conflicts of Jurisdiction under national law, the very nature of the offence, and the nature and degree of s everity of the penalty.210 The application of these criteria led it to conclude that the refusal to pay a farmer the year after the presentation of the false statement was not a criminal penalty: it is not classified as such in Regulation (EC) 1973/2004, is not punitive as it only intends to ‘protect the management of European Union funds by temporarily excluding a recipient who has made incorrect statements in his application for aid’,211 and, finally, is not a severe measure, since it only deprives the farmer of the prospect of obtaining financial aid.212 Even though this decision shows a positive convergence between the case law of the Court of Justice and that of the ECtHR in relation to the qualification of penalties, it is surprising that the CJEU – unlike AG Kokott – has not referred to Article 50 of the Charter, which is now the key provision in EU law setting out the ne bis in idem principle. It is not clear whether this silence is justified by the special position of Poland vis-a-vis the Charter. In accordance with Protocol No 30 to the Treaties: ‘The Charter does not extend the ability of the Court of Justice of the European Union, or any court or tribunal of Poland … to find that the laws, regulations or administrative provisions, practices or action of Poland … are inconsistent with the fundamental rights, freedoms and principles that it reaffirms.’213 However, as AG Kokott noted, this provision, which ‘does not distinguish itself by great clarity’,214 does not equate to an opt-out by Poland from the Charter.215 By contrast, ne bis in idem was looked at from the perspective of Article 50 in Fransson,216 where the Court assessed whether the Charter precludes a Member State – Sweden in that case – from imposing both a tax (formally non-criminal) penalty and a criminal sanction on the same person.217 The Court argued that Article 50 of the Charter only applies if the two sets of proceedings concerning the same facts are of a criminal nature. As in Bonda, it noted that the evaluation of whether a given penalty is ‘criminal’, and therefore apt to trigger the ne bis in idem principle, has to be done in accordance with the Engel criteria. However, in Bonda, the rules on one of the two penalties – the administrative one – were to be found in EU legislation. Arguably because all the relevant provisions in Fransson were national, the Court did not itself proceed to the application of the Engel criteria to Swedish legislation, but simply clarified that it is for the national 210 Bonda (n 208) para 37. 211 ibid para 40. 212 ibid paras 37–45. 213 Article 1(1) of Protocol (No 30) on the application of the Charter of Fundamental Rights of the European Union to Poland and to the United Kingdom [2016] OJ C202, 7 June 2016, 312. 214 Bonda (n 208) Opinion of AG Kokott delivered on 15 December 2011, EU:C:2011:845, para 23. 215 ibid. Therefore, since ‘the prohibition of double penalties laid down in Article 50 of the Charter had … already been recognised as a general European Union law principle, and according to the previous case-law such a principle would also have been applicable to the case at issue … an extension of the ability of the Court of Justice within the meaning of the protocol cannot come into question’ (ibid). 216 Case C-617/10, Åkerberg Fransson, 26 February 2013, EU:C:2013:105. For some commentaries, see T Lock, ‘Fishing for Better Rights Protection: The Court of Justice on the Application of the Charter in the Member States and the Reach of Ne Bis in Idem’ and M Bergström, ‘The Impact of Case C-617/10: Åkerberg Fransson at National Level – The Swedish Example’ in Mitsilegas, di Martino and Mancano (n 24) 245–58 and 259–70 respectively. 217 For the legal background on the case and its effects on the Swedish system, see the analysis in X Groussot and A Ericsson, ‘Ne Bis in Idem in the EU and ECHR Legal Orders’ in van Bockel (n 14) 53–102 at 90–102.

Application of Ne Bis in Idem to Criminal 183 competent authorities to assess the possible criminal nature of tax penalties.218 When, as in the case of Fransson, the condition laid down in Article 51 of the Charter is met – ‘The provisions of [the] Charter are addressed to … the Member States only when they are implementing Union law’219 – domestic authorities are therefore obliged to disapply national legislation that is incompatible with the EU fundamental right to ne bis in idem.220 In other words, in Fransson the Court of Justice clearly ruled out the idea that a person could be subject to criminal and formally administrative – but in reality criminal – sanctions for the same tax violation: ‘if the tax penalty is criminal in nature for the purposes of Article 50 of the Charter and has become final … that provision precludes criminal proceedings in respect of the same acts from being brought against the same person’.221 This conclusion was partially revised in some decisions handed down by the Grand Chamber of the Court of Justice in March 2018. The partial revirement of the CJEU was in turn triggered by some developments in the case law of the ECtHR. The ECtHR had dealt with the possible violation of ne bis in idem in the case of concurring administrative and criminal sanctions in a seminal judgment delivered in 2014: Grande Stevens v Italy.222 In that case, the applicants had been punished by the Italian National Companies and Stock Exchange Commission (CONSOB) and were subsequently prosecuted for the same facts. Applying the Engel criteria, the ECtHR found that the proceedings before the CONSOB did involve a ‘criminal charge’ for the purposes of Article 6 ECHR; therefore, Article 4 of Protocol No 7 to the ECHR on ne bis in idem applied.223 Since national authorities were called to adjudicate the same facts already punished by the CONSOB and did not stop the proceedings, the Court concluded that there had been a violation of the ne bis in idem principle. The reasoning of the ECtHR draws significantly upon the above-mentioned Zolotukhin case, which laid down the – now established – interpretation of the ‘idem’ element as a set of facts inextricably linked together in time and space.224 The ECtHR also mentioned the Fransson case, yet only to clarify that it is true that the CJEU ‘allowed’ the issuing of tax penalties and criminal sanctions against

218 Fransson (n 216) paras 32–37. For further possible explanations of the differences in the Court’s approach in Bonda and Fransson, see PJ Wattel, ‘Ne Bis in Idem and Tax Offences in EU Law and ECHR Law’ in van Bockel (n 14) 167–217 at 183–85. 219 Article 51(1) of the Charter. In that respect, the CJEU argued that: ‘Given that the European Union’s own resources include … revenue from application of a uniform rate to the harmonised VAT assessment bases determined according to European Union rules, there is thus a direct link between the collection of VAT revenue in compliance with the European Union law applicable and the availability to the European Union budget of the corresponding VAT resources, since any lacuna in the collection of the first potentially causes a reduction in the second. It follows that tax penalties and criminal proceedings for tax evasion, such as those to which the defendant in the main proceedings has been or is subject because the information concerning VAT that was provided was false, constitute implementation of Articles 2, 250(1) and 273 of Directive 2006/112 … and of Article 325 TFEU and, therefore, of European Union law, for the purposes of Article 51(1)’ (Fransson (n 216) paras 26–27, emphasis added). For further remarks on the relevance of the Fransson ruling in clarifying the circumstances in which the Charter applies, see ch 1. 220 ibid para 45. 221 ibid para 34. 222 ECtHR, Grande Stevens v Italy, App No 18640/10, judgment of 4 March 2014. 223 ibid paras 94–101 and 222. 224 See section III.B above.

184 Ne Bis in Idem and Conflicts of Jurisdiction the same person for the same facts, but this was admissible only when the tax penalties are not criminal in nature.225 However, about two and a half years later, the Strasbourg Court delivered a judgment where it partially modified its approach, and, as anticipated, this led to some changes in the CJEU case law as well.

B. The ‘Second Phase’: (Partial) Compatibility between Double-Track Systems and Ne Bis in Idem In A and B v Norway,226 concerning the field of tax offences, the ECtHR ruled that, under some conditions, twin-track systems do not violate the ne bis in idem principle: States should be able legitimately to choose complementary legal responses to socially offensive conduct (such as … non-payment/evasion of taxes) through different procedures forming a coherent whole so as to address different aspects of the social problem involved, provided that the accumulated legal responses do not represent an excessive burden for the individual concerned.227

Therefore, a violation of Article 4 of Protocol No 7 does not occur in the case of ‘an integrated system enabling different aspects of the wrongdoing to be addressed in a foreseeable and proportionate manner forming a coherent whole, so that the individual concerned is not thereby subjected to injustice’ (emphasis added).228 Between the different procedures concerning the same person, there should be ‘sufficiently close connection … in substance and in time’ (emphasis added),229 and the Court then listed some factors to assess whether there was such sufficiently close connection in substance.230 As for the connection in time, the Court argued that this connection must be ‘sufficiently close to protect the individual from being subjected to uncertainty and delay and from proceedings becoming protracted over time’,231 but did not give any further detail that might guide national authorities in the evaluation of whether administrative and criminal proceedings are truly close in time.232

225 ibid

para 229. A and B v Norway, App Nos 24130/11 and 29758/11, judgment of 15 November 2016. 227 ibid para 121. 228 ibid para 122. 229 ibid para 125. 230 They include: 226 ECtHR,

– whether the different proceedings pursue complementary purposes and thus address, not only in abstracto but also in concreto, different aspects of the social misconduct involved; – whether the duality of proceedings concerned is a foreseeable consequence, both in law and in practice, of the same impugned conduct (idem); – whether the relevant sets of proceedings are conducted in such a manner as to avoid as far as possible any duplication in the collection as well as the assessment of the evidence, notably through adequate interaction between the various competent authorities to bring about that the establishment of facts in one set is also used in the other set; – and, above all, whether the sanction imposed in the proceedings which become final first is taken into account in those which become final last, so as to prevent that the individual concerned is in the end made to bear an excessive burden … (para 132; emphasis added). 231 ibid para 135. 232 See also S Mirandola and G Lasagni, ‘The European Ne Bis in Idem at the Crossroads of Administrative and Criminal Law’ (2019) 2 Eucrim 126, 128.

Application of Ne Bis in Idem to Criminal 185 The A and B judgment runs counter to the previous case law of the ECtHR (and of the CJEU), as demonstrated by the vehemently critical dissenting opinion by Judge Pinto de Albuquerque, who concluded his opinion by stating that: The combination of criminal penalties and administrative penalties with a criminal nature was specifically rejected by the Court in Grande Stevens and Others, as well as by the Luxembourg Court in Hans Åkerberg Fransson. After the delivery of its death certificate in that Italian case, such an approach is now being resuscitated … The progressive and mutual collaboration between the two European courts will evidently once again be deeply disturbed, Strasbourg going the wrong way and Luxembourg going the right way. The Grand Chamber examining the Sergey Zolotukhin case would not have agreed to downgrade the inalienable individual right to ne bis in idem to such a fluid, narrowly construed, in one word illusory, right.233

These words of the dissenting opinion capture three main problems connected with the A and B judgment: its contentious rejection of the principles laid down in Grande Stevens; the vagueness of the criteria endorsed (the close connection in substance and time);234 and the consequences for the consistency between the case law of the ECtHR and the CJEU. After A and B, the Court of Justice was required to rule again on the issue of ne bis in idem in the case of administrative and criminal proceedings on the same facts and to clarify whether it would accept the new stance of the ECtHR or whether it would stick to the more protective Fransson approach. With some exceptions and without spelling it out, the CJEU seems to have taken the first path. In Menci, it dealt with a case of a proprietor of a sole trading business who had been subject to a final administrative penalty for his failure to pay VAT within the time limit stipulated by law.235 Criminal proceedings were subsequently initiated for the same facts. Had the Fransson principles applied, the case should have been dismissed by the criminal law authorities upon verification of the criminal law nature of the administrative penalty. However, endorsing to a certain extent the ECtHR case law, the Court reached a different conclusion through the following steps. First, along the lines of Fransson, the CJEU clarified that the matter fell within the scope of EU law, as the provisions on VAT collection constitute, for the purposes of Article 51(1) of the Charter, implementation of Article 325 TFEU236 and of the VAT Directive.237 Article 50 of the Charter therefore applies in this context.238 Second, relying on the Engel criteria, which it had expressly endorsed in Bonda, the Court suggested that the administrative penalty issued against Menci was of a criminal nature, in the 233 A and B (n 226) Dissenting Opinion of Judge Pinto de Albuquerque, para 80. 234 See Luchtman (n 101) 1728; Mirandola and Lasagni (n 232) 128–29, who also note that the ECtHR’s case law following A and B has not dispelled the several interpretative doubts that have been raised by the vague criteria laid down in A and B. 235 Case C-524/15, Menci, judgment of 20 March 2018, EU:C:2018:197. 236 Article 325 TFEU lays down the EU’s and Member States’ obligation to protect the EU’s financial interests by requiring them to counter fraud and any other illegal activities affecting the EU budget through effective and dissuasive measures (art 325(1)). 237 Directive 2006/112/EC on the common system of value added tax [2006] OJ L347, 11 December, 1. A similar conclusion had already been taken in Fransson (see n 219). See G Lo Schiavo, ‘The Principle of Ne Bis in Idem and the Application of Criminal Sanctions: Of Scope and Restrictions’ (2018) 14(3) European Constitutional Law Review 644, 649–50. 238 Menci (n 235) paras 17–25.

186 Ne Bis in Idem and Conflicts of Jurisdiction light of its punitive purpose and its high degree of severity (a fine of 30 per cent of the VAT due, which was added to the payment of that tax).239 Third, it acknowledged that the facts that led to the imposition of the administrative penalty and those under prosecution were the same so that, in principle, an issue of ne bis in idem arose.240 Had the Court stuck to the Fransson approach, the above findings would have been sufficient to conclude that the criminal case against Menci, which was opened after the conclusion of formally administrative (but in essence criminal) proceedings, had to be dropped. Instead, the Court stated that the duplication of proceedings and penalties constituted a limitation of the fundamental right protected by Article 50 of the Charter,241 and it could therefore be legitimate as long as it complied with the conditions set out in Article 52(1) of the Charter. It has already been mentioned that, pursuant to Article 52(1), any limitation on the exercise of the rights and freedoms recognised by the Charter must:242 (i) be provided for by law; (ii) respect the essence of those rights; and (iii) be subject to the principle of proportionality, be necessary and genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others. The CJEU cursorily addressed the first and second requirements, as well as that concerning the objectives of general interest. First, the criterion under (i) did not raise any problems in this case, as the duplication was provided for by Italian law.243 Second, the Court did not pay too much attention to the criterion under (ii) either, since it simply acknowledged that the essence of the right to ne bis in idem was not jeopardised because national law allows the duplication of proceedings and penalties under exhaustive and precise conditions.244 This statement is rather contentious, since the CJEU did not really engage with the issue of whether the essence of the ne bis in idem is safeguarded in circumstances such as those in the case. By contrast, it contented itself with repeating, as it did in the assessment of criterion (i) (limitation provided for by law), that the duplication of proceedings and penalties is provided for by national law without any further explanation of the reason why this does not affect the essence of the right protected by Article 50.245 Third, the CJEU accepted that the collection of the due VAT was an objective of general interest that may justify limitations to ne bis in idem.246 It then moved on to the assessment of the proportionality of such limitation and laid down further criteria to apply. More precisely, the respect of the proportionality principle requires that national legislation must: (i) provide for ‘clear and precise rules allowing individuals to predict which acts or omissions are liable to be subject to … a duplication of proceedings 239 ibid paras 26–33. However, the Court clarified that it is for the referring court to determine whether that administrative penalty has a criminal nature (para 33). 240 ibid paras 34–39. 241 ibid para 39. 242 See the analysis of the Spasic case in section III.C above. 243 Menci (n 235) para 42. 244 ibid para 43. 245 Luchtman (n 101) 1730–31; Mirandola and Lasagni (n 232) 130. Also in Spasic, where the CJEU had already accepted some limitations to the ne bis in idem principle, albeit different from those discussed in Menci, the Court had overlooked a detailed examination of whether such limitations affect the essence of ne bis in idem (see van Bockel (n 101),28). 246 Menci (n 235) paras 44–45.

Application of Ne Bis in Idem to Criminal 187 and penalties’,247 which, once again, was not contentious in the Menci case;248 and (ii) ensure that the disadvantages for the persons concerned following on from such a duplication ‘are limited to what is strictly necessary in order to achieve’249 the objective of general interest that underlies that legislation (namely, in the Menci case, the collection of VAT). In turn, this second criterion calls for two further assessments. First, there should be rules that ensure coordination between administrative and criminal proceedings in order to ‘reduce to what is strictly necessary the additional disadvantage associated with [the] duplication for the persons concerned’.250 Second, there should also be rules to ensure that ‘the severity of all penalties imposed corresponds with the seriousness of the offence concerned’.251 While the Court delved into, and positively evaluated, the provisions of Italian law that allow the competent authorities to limit the severity of the penalties imposed on persons in the same situation as Menci,252 its assessment of the rules on the coordination between proceedings was not very convincing. In that respect, it merely stated that Italian law provides for duplication of penalties and proceedings with respect to offences that are particularly serious (unpaid VAT amounting to more than €50,000), but did not consider whether there was any real coordination between proceedings. In the light of this multi-step approach, the Court concluded its reasoning by noting that it would eventually be for the referring court to ‘assess the proportionality of the practical application of [national] legislation … by balancing, on the one hand, the seriousness of the tax offence at issue and, on the other hand, the actual disadvantage resulting for the person concerned from the duplication of proceedings and penalties’.253 Finally, it acknowledged that the level of protection guaranteed to the ne bis in idem principle, as interpreted by the Court itself, should not conflict with that ensured by the ECtHR, which in the A and B judgment did not rule out a duplication of administrative and criminal proceedings as long as they have a sufficiently close connection in substance and time.254 In Menci, the CJEU decided to partially follow the steps of the Strasbourg Court by overruling the Fransson decision – in the same way that the ECtHR had overruled Grande Stevens – and lowering the standards relating to the ne bis in idem principle. While the AG had suggested the opposite path, notably not to align with the ECtHR case law and stick to the more protective Fransson principle,255 the Court backtracked. 247 ibid para 49. 248 ibid paras 50–51. 249 ibid para 52. 250 ibid para 53. 251 ibid para 55. 252 The Court underlined that, on the one hand, the enforcement of administrative penalties of a criminal nature is suspended during criminal proceedings and definitely excluded if the person concerned is sentenced by criminal law authorities, and, on the other hand, the voluntary payment of the tax debt constitutes a special mitigating factor that criminal courts must take into account when deciding on the conviction of the person concerned (ibid para 56). 253 ibid para 59. 254 ibid paras 60–62. 255 Menci (n 235) Opinion of AG Campos Sánchez-Bordona delivered on 12 September 2017, EU:C:2017:667, paras 57ff. The AG noted that while art 52(3) of the Charter calls for interpreting the Charter rights that correspond to rights guaranteed by the ECHR as having the same meaning and scope of those rights, it also explicitly allows EU law to provide for more extensive protection.

188 Ne Bis in Idem and Conflicts of Jurisdiction As long as the conditions laid down in Menci are respected – and especially objectives of general interest pursued by the legislation on double-track systems, rules on coordination, and proportionality of the sanctions – a duplication of criminal and administrative proceedings and penalties does not violate Article 50 of the Charter. On the same day as the Menci judgment. the CJEU also delivered the judgment in Garlsson,256 which seems to suggest that it holds a more protective approach than the ECtHR. In Garlsson, the CJEU dealt with the same problem of Menci, but in the opposite scenario: the criminal conviction – concerning facts of market manipulation – had become final first and the competent national authorities were therefore uncertain as to whether an administrative penalty could be issued for the same facts. The CJEU approached the matter with the same reasoning of Menci, but reached a different conclusion. The decision began with the acknowledgement that Article 50 of the Charter applies in the main proceedings, as the relevant national provisions on market manipulation constitute implementation of EU law for the purposes of Article 51(1) of the Charter.257 Likewise, the Court claimed that, in accordance with the Engel-Bonda criteria, the administrative penalty that can be imposed on the defendants was of a criminal nature due to its punitive purpose and its severity258 – an administrative fine that can be up to 10 times greater than the profit obtained from market manipulation.259 After clarifying that the existence of the same offence for the purposes of Article 50 of the Charter was not contentious in this case either,260 the Court embarked upon the multi-step assessment of whether the duplication of proceedings and penalties – which is a limitation of ne bis in idem – complied with the above-mentioned requirements of Article 52(1) of the Charter. As in Menci, this limitation is provided for by Italian law,261 respects the essence of the right not to be tried or punished twice for the same facts,262 and meets objectives of general interest, which in this context are the ‘integrity of the financial markets of the European Union and public confidence in financial instruments’.263 However, the difference in Menci lies in the assessment of the proportionality of such limitation. In particular, while Italian law meritoriously provides for some coordination between the administrative and criminal proceedings,264 the Court held that the bringing of the proceedings relating to an administrative fine of a criminal nature after a criminal

256 Case C-537/16, Garlsson Real Estate and Others, judgment of 20 March 2018, EU:C:2018:193. 257 ibid paras 21–27. The Court in particular referred to some provisions of Directive 2003/6/EC of the European Parliament and of the Council of 28 January 2003 on insider dealing and market manipulation (market abuse) [2003] OJ L96, 12 April, 16 (see Garlsson (n 256) paras 22–23). 258 ibid paras 28–35. However, the Court clarified that the power to qualify an administrative penalty as having a criminal nature lies with the referring court. 259 ibid paras 34–35. 260 ibid paras 36–41. 261 ibid para 44. 262 ibid para 45. Along the lines of Menci, the CJEU did not give any consideration to the respect of the essence of ne bis in idem, except to remark that the duplication of penalties and proceedings is allowed ‘under certain conditions which are exhaustively defined’ (ibid). 263 ibid para 46. 264 See ibid para 57.

Application of Ne Bis in Idem to Criminal 189 conviction for the same facts ‘exceeds what is strictly necessary’265 in order to achieve the objective of protecting the integrity of the financial markets and the public confidence in financial instruments. And so it is even in those cases where, as in the main proceedings, the criminal penalty is extinguished as a result of a pardon.266 With a reasoning that is not easy to combine with that of Menci, the Court therefore appears to assume that if criminal proceedings become final first, there is a sort of presumption that – arguably for the inherent higher severity of criminal sanctions – issuing administrative penalties for the same facts is excessive and would therefore violate the right to ne bis in idem. In the opposite scenario, which was addressed in Menci, the Court seems instead to suggest that administrative proceedings and sanctions do not prevent ensuing criminal proceedings and penalties for the same facts. That the time issue – in other words, what set of proceedings ends first – can play such a prominent role in the limitation of a fundamental right is contentious, as it is a random criterion that depends entirely on the specificities of each concrete case.267 This can also create further inconsistencies between the approaches of the two European Courts, as the ECtHR ruled that ‘the order in which the proceedings are conducted cannot be decisive of whether dual or multiple processing is permissible’.268 No further clarity can be gleaned from the third judgment issued by the Court of Justice on the same day of Menci and Garlsson. Di Puma and Zecca originated from a request for a preliminary ruling lodged by the Italian courts, which inquired in essence as to whether the final acquittal of the defendants in criminal proceedings would prevent administrative penalties for the same facts from being imposed on them.269 The Italian Code of Criminal Procedure (CCP) includes a provision – Article 654 – pursuant to which final judgments in criminal proceedings, be them acquittals or convictions, have the force of res judicata in administrative proceedings. As a consequence, since the defendants had been acquitted on the ground that the acts constituting the offence of insider dealing were not established, they could not be subject to any administrative penalty for the same facts. Nonetheless, the Italian courts doubted that such provision respected the obligation resting upon the Italian Republic to punish insider dealing with effective, proportionate and dissuasive administrative penalties,270 and at the same time wondered how to reconcile this obligation with the ne bis in idem principle. The Court of Justice argued that Article 654 CCP did not violate either EU law or Article 50 of the Charter. However, the Court’s reasoning was centred on the principle of res judicata, while ne bis in idem played a secondary role. The Court recalled its established case law on the importance of the principle of res judicata at the EU and the national levels, according to which ‘EU law does not preclude the application of national procedural rules conferring res judicata effects on a judicial decision’.271

265 ibid para 59. Again, the Court ruled that it is for national courts to finally ascertain that the duplication at hand does not comply with art 52 of the Charter, and therefore violates art 50 on ne bis in idem (para 61). 266 ibid para 62. 267 See also Luchtman (n 101) 1736. 268 A and B v Norway (n 226) para 128. 269 Joined Cases C-596/16 and C-597/16, Di Puma and Zecca, judgment of 20 March 2018, EU:C:2018:192. 270 Article 14(1) of Directive 2003/6/EC. 271 Di Puma and Zecca (n 269) para 31.

190 Ne Bis in Idem and Conflicts of Jurisdiction In the Di Puma and Zecca case, there were no particular circumstances that justified a different approach. In particular, the Court noted that the Italian competent administrative authority was free to participate in criminal proceedings concerning insider dealing and was required to share with judicial authorities the documents collected during the exercise of its supervision. In criminal proceedings, judicial authorities are therefore in a position to take a decision that takes into account all the evidence at the disposal of both the criminal and administrative authorities.272 It follows that a provision such as Article 654 CPP, which provides for res judicata effects of an acquittal in administrative proceedings, does not violate the obligation of Member States to ensure effective, dissuasive and proportionate administrative sanctions for insider dealing.273 It was at this point of the judgment that the Court referred to ne bis in idem, claiming that its above reasoning was ‘confirmed’ by Article 50 of the Charter.274 As mentioned above, in Di Puma and Zecca, the ne bis in idem perspective came after – and as a mere support to – the arguments on the res judicata effects. The Court unsurprisingly stated that the duplication of penalties and proceedings is a limitation to the right enshrined in Article 50 and, as in Garlsson, claimed that the bringing of proceedings for an administrative fine of a criminal nature after an acquittal in criminal proceedings ‘clearly exceeds what is necessary to achieve’275 the objectives of national and EU legislation on insider dealing. The Court’s conclusion in Di Puma and Zecca seems to confirm the (contentious) relevance of the time issue in double-track systems: as long as criminal proceedings come to an end first – independently of their outcome (acquittal or conviction) – the bringing of administrative proceedings of a criminal nature for the same facts is likely to violate the ne bis in idem principle. Conversely, where administrative proceedings terminate before criminal ones, there seems to be more margin of appreciation for the national authorities to allow both administrative and criminal penalties for the same facts. The case law of the European Courts on ne bis in idem in double-track systems is therefore complex and multi-faceted. The CJEU and the ECtHR have progressively abandoned their initial approach, which was very protective towards individuals, in favour of an interpretation of the ne bis in idem principle that tries not to turn national legal orders that build on the double-track punitive system upside down. This has led both Courts to flesh out a number of criteria that national authorities should follow to assess whether ne bis in idem is violated. Some of these criteria are rather vague, such as those laid down by the ECtHR in A and B v Norway. In addition, the European Courts themselves have at times applied those criteria in an unclear way, as was the case with the CJEU’s assessment of whether the duplication of penalties and proceedings respects the essence of the ne bis in idem principle.276 Likewise, while the Court of Justice states that duplication of penalties must not be excessive, it does not really explain how such an evaluation should be conducted.277 272 ibid paras 31–36. 273 For some critical remarks on such an importance attached to the res judicata principle, see Lo Schiavo (n 237) 662–63. 274 Di Puma and Zecca (n 269) para 37. 275 ibid para 44. 276 cf Menci (n 235) para 43 and Garlsson (n 256) para 45. 277 Lo Schiavo (n 237) 660; Luchtman (n 101) 1732.

Conclusion 191 Although the conclusions they reach are similar, the two European Courts take an approach that is different in several aspects;278 this does not bode well for legal certainty and puts national authorities in a situation where they are confronted with different standards that are both relevant for their decisions. While the ECtHR has adopted the criterion of the close connection in substance and time, the CJEU, which overall seems to ensure more protection to the ne bis in idem principle than the Strasbourg Court,279 prefers to focus on the proportionality of double-track systems, especially with respect to the overall severity of penalties.280 While there is some correspondence between the proportionality assessment and that on the close connection in substance,281 the extent to which the CJEU values the connection in time for the purposes of Article 50 of the Charter is instead unclear.282

VI. Conclusion The application of ne bis in idem in criminal matters, including the surrounding grey area of ‘administrative law of a criminal nature’, has represented one of the most debated issues in the development of the EU AFSJ over the last years. The frequent – albeit not always consistent – interpretation of this principle by the Court of Justice has given partial answers to questions that the EU legislator has not yet addressed, such as those on the settlement of conflicts of jurisdiction at the European level. Concerns of prosecutorial forum shopping lurk behind such conflicts. When more than one Member State is competent to try a given case, the risk is that the choice will fall on the system that yields more chances of conviction, while other relevant interests at stake, such as those of the defendants or the victims, are neglected.283 The settlement of conflicts of jurisdiction is not only a pressing need from the perspective of the individuals concerned, but is also a matter of efficient administration of justice. It would be unreasonable for the authorities of different Member States to exercise their jurisdiction with regard to the same facts, especially if they act in an AFSJ that is (or at least should be) founded on 278 See also Luchtman (n 101) 1732. 279 ibid 1730 (‘the ECJ does establish a higher ne bis in idem threshold than the ECtHR, although the ECJ itself makes no mention of that difference, nor does it refer to the … final sentence of Article 52(3) CFR’; the final sentence of art 52(3) of the Charter clarifies that the required consistency between the CJEU’s and the ECtHR’s case law ‘shall not prevent Union law providing more extensive protection’). 280 Lo Schiavo (n 237) 657–60. 281 When the CJEU examined the proportionality principle, it mentioned the importance of rules that provide for the coordination of different proceedings and of those that ensure the proportionality of the severity of all penalties (cf Menci (n 235) paras 53–57 and Garlsson (n 256) para paras 55–58). In a somewhat similar vein, the ECtHR argued that, in the assessment of the close connection in substance, national courts should evaluate whether ‘the relevant sets of proceedings are conducted in such a manner as to avoid as far as possible any duplication in the collection as well as the assessment of the evidence, notably through adequate interaction between the various competent authorities to bring about that the establishment of facts in one set is also used in the other set’ and whether ‘the sanction imposed in the proceedings which become final first is taken into account in those which become final last, so as to prevent that the individual concerned is in the end made to bear an excessive burden’ (A and B v Norway (n 226) para 132, emphasis added). 282 Luchtman (n 101) 1732–33; Mirandola and Lasagni (n 232) 131. 283 Böse (n 139) 74–75; Wasmeier (n 142) 144. As far as victims’ role in this context is concerned, see M Simonato, ‘What Role for Crime Victims in the Forum Choice?’ in European Law Institute, Ligeti and Robinson (n 99) 283–304.

192 Ne Bis in Idem and Conflicts of Jurisdiction mutual trust. In the silence of EU legislation, national courts have requested the Court of Justice to interpret the general wording of Article 54 of the Schengen Implementing Convention (and then Article 50 of the Charter) on ne bis in idem, which is one of the two EU ‘instruments’ that currently provide for some binding rules in case of conflicts of jurisdiction – the other being the EPPO Regulation with respect to conflicts of jurisdiction among Member States that participate in the EPPO. In accordance with Article 54 CISA and Article 50 of the Charter, once a Member State has had the opportunity to rule on a case and its authorities have thus adopted a final decision dealing with the merits of it, other EU Member States cannot investigate or punish the same conduct again. As is the case with mutual recognition instruments, the case law on ne bis in idem has prompted a rethinking of territoriality within the EU. The CJEU had initially interpreted the ne bis in idem principle broadly, focusing on the need to achieve a high degree of legal certainty in order to ensure free movement in a borderless AFSJ. This broad interpretation is underpinned by the existence of mutual trust in an area where national criminal procedural laws have not been harmonised. The need to achieve the effective enjoyment of free movement takes precedence over national priorities with regard to the delivery of criminal justice. The Court’s approach presumes mutual trust in the absence of harmonisation of criminal justice systems. However, unlike its use in the European Arrest Warrant system, this presumption of trust here serves to enhance, and not to challenge, the protection of fundamental rights in Europe’s AFSJ. This teleological approach is evident in the Court’s interpretation of the concepts of idem and bis. As for the former, the criterion of the identity of facts ensures a broad application of the ne bis in idem principle. Allowing Member States to prosecute the same offences simply because of their different legal classifications or the different legal interests protected would unreasonably limit the scope of the right not to be tried or punished twice and, as a consequence, the freedom of movement within the EU. As far as the concept of ‘bis’ is concerned, the Court had originally also included in it cases the outcome of which was settled without involving a substantive examination of their merits, such as cases of settlement (‘transaction’) between the defendant and the public prosecutor terminating the prosecution (Gözütok and Brügge) or of time-barred prosecutions (Gasparini). However, further litigation on ne bis in idem has demonstrated the limits of mutual trust, as it appears that the Court is in the process of rebalancing its case law by taking into account national mistrust to a greater extent, at the expense of the protection of fundamental rights and the achievement of legal certainty and free movement. Recent judgments have clarified that the application of transnational ne bis in idem requires not only a decision to be final according to the law of the Member State where it was issued, but also that that decision deals with the merits of the case. As the Court notably argued in Spasic, the protection of legal certainty and individuals’ fundamental rights cannot lead to impunity, which they would enjoy if no Member State authority examines the merits of their case. While the Lisbon Treaty could have prompted the adoption of new legal instruments concerning jurisdiction issues within the EU,284 there was no political will for this.

284 See

arts 82(1)(b) and 85(1)(c) TFEU.

Conclusion 193 The Lisbon Treaty has nonetheless ‘emancipated’ the ne bis in idem principle by elevating it to a fundamental right in the Charter, and this may serve to limit demands for restrictions to the protective scope of the transnational ne bis in idem principle. The constitutionalisation of the ne bis in idem principle in this manner is also important in underpinning a mechanism of managing interstate cooperation on prosecution with fundamental rights principles. In terms of the evolution of horizontal coordination mechanisms at the EU level more broadly, the constitutionalisation of ne bis in idem serves to remind us of the necessity to underpin any EU law or practice on choice of forum and conflicts of jurisdiction with clear and effective safeguards for affected individuals. Further European integration in the field should not lead to prosecutorial forum shopping. In addition, the inclusion of ne bis in idem in the Charter, which has now the same legal value as the Treaties,285 can justify the disapplication of national legislation that violates Article 50. As the CJEU clarifies in Garlsson, the right to ne bis in idem enshrined in Article 50 of the Charter ‘is not subject, according to the very wording of that provision, to any conditions and is therefore directly applicable in the context of the dispute in the main proceedings’.286 As the Court had already stated in Fransson, national courts, as long as the matter under their scrutiny falls within the implementation of EU law, shall therefore disapply national law that violates the right provided for by Article 50 of the Charter, as interpreted by the Court itself.287 In sum, the case law on ne bis in idem unveils a sensitive balancing exercise. On the one hand, in the name of mutual trust, the Court tries to enhance freedom of movement and the protection of fundamental rights and legal certainty. On the other hand, in the name of the fight against impunity, the Court cannot ignore that the AFSJ is not a coherent system of rules and procedures, but rather is an ‘area’ indeed, which is composed of several national criminal justice systems. This imposes some limitations on the blind trust that each Member State can have in other Member States’ judgments, with the consequence that, for instance, it would not be acceptable for a Member State to give up on its jurisdiction simply because the authorities of another EU Member State have dismissed the case without any evaluation whatsoever of the merits of it. A similar balancing act underpins the case law of the CJEU and the ECtHR on the compatibility of double-track systems with the right to ne bis in idem. The two supranational Courts have been asked to find a difficult compromise that pays due attention to the well-established twin-track systems of several (EU) countries, which cope with some forms of criminality by means a combined criminal-administrative approach, while at the same trying not to downplay the fundamental right to ne bis in idem. The outcome of this exercise has generated some solutions that are not entirely convincing and, above all, not easily applicable by national authorities. It remains to be seen how the two Courts will deal with the matter in upcoming cases and to what extent they will take into account each other’s case law. It is noteworthy that, unlike Bonda and Fransson, where the case law of the ECtHR was followed very closely, the more recent CJEU

285 Article

6(1) TEU. (n 256) para 66. para 67. See also Fransson (n 216) para 45. In the literature, see Tomkin (n 2) 1410.

286 Garlsson 287 ibid

194 Ne Bis in Idem and Conflicts of Jurisdiction decisions in Menci and Garlsson stress the autonomy of EU law.288 In its first judgments on double-track systems, the CJEU thus aimed to ensure a high degree of consistency between its case law and that of the ECtHR, while in the following ones it seems to claim some room for manoeuvre. As noted in the literature,289 it will also be interesting to assess whether the status quo will change due to some recent developments in the EU and the Council of Europe’s legal frameworks. On the one hand, the ECtHR is now empowered to give some sort of (non-binding) ‘preliminary rulings’ upon the request of national courts;290 on the other hand, the CJEU will be increasingly called upon to decide ex post – rather than only ex ante via the preliminary reference procedure – on the validity of administrative decisions of a criminal nature that will be issued by EU entities such as the European Central Bank and the European Securities and Markets Authority.291 In addition to these issues of ‘external’ consistency (CJEU/ECtHR), at least four issues of ‘internal’ consistency within the EU itself will also have to be addressed in the future. First, it is scarcely tenable to attach different meanings to the same fundamental right according to the policy area where the issue of ne bis in idem arises (eg, criminal law or competition law). One may therefore wonder whether and when the notion of ‘idem’ will eventually be interpreted in a consistent way by the Court of Justice. Second, it is still an open question whether the enforcement condition laid down in Article 54 CISA should survive the constitutionalisation of the right to ne bis in idem in the aftermath of Lisbon. The Court’s solution in Spasic is striking and should be revised. Third, it can be expected that the Court of Justice will sooner or later be called upon to decide whether its interpretation of ne bis in idem with respect to double-track systems can have a transnational application, namely whether criminal law judgments in one Member State may impact on the (possibility to adopt) decisions on administrative penalties of a criminal nature in other Member States, and vice versa.292 Fourth, the sections above have pointed out that the field of the protection of the EU’s financial interests represents a limited exception when it comes to (multi-)jurisdiction issues in the EU. The PIF sector has traditionally been a sort of ‘laboratoire juridique’293 for the development of EU criminal law, and it is in this area that the first EU body with direct criminal law powers vis-a-vis individuals (the EPPO) has been set up. The establishment of the EPPO enriches the ne bis in idem principle with new dimensions, both at the vertical level (EPPO/national authorities) and at the EU horizontal level (EPPO/OLAF). The EPPO Regulation is also the first EU legal instrument that provides 288 Lo Schiavo (n 237) 656. cf Menci (n 235) para 23 and Garlsson (n 256) para 25. 289 Mirandola and Lasagni (n 232) 132–33. 290 Pursuant to Protocol No 16 to the ECHR, which entered into force in August 2018, the highest courts of States Parties to the ECHR may request the ECtHR to give ‘advisory opinions on questions of principle relating to the interpretation or application of the rights and freedoms defined in the Convention or the protocols thereto’ (art 1 of the Protocol). However, such opinions are not binding (art 5 of the Protocol). The first advisory opinion was handed down in April 2019 (ECtHR, Advisory opinion concerning the recognition in domestic law of a legal parent-child relationship between a child born through a gestational surrogacy arrangement abroad and the intended mother – Requested by the French Court of Cassation (Request no P16-2018-001), 10 April 2019). 291 Mirandola and Lasagni (n 232) 133. 292 Luchtman (n 101) 1741–47. 293 L Salazar, ‘La Protection des Intérêts Financiers de l’UE: Un Grand Avenir derrière Elle …’ (2008) 3–4 Eucrim 115, at 115.

Conclusion 195 for a set of binding rules that national authorities should follow in the allocation of jurisdiction among the Member States that participate in the EPPO. Now that the EPPO has started to investigate and prosecute PIF offences (on 1 June 2021), it will be soon necessary to examine whether this mechanism works and whether it can be used as a blueprint for a set of binding rules that apply beyond the boundaries of the PIF sector. However, for the time being, one cannot help but notice that while the EPPO Regulation’s rules on the choice of forum can ensure some legal certainty, at the same time they overlook the need to subject such a choice to judicial review at the European level. This raises some concerns both for the EPPO’s expected effectiveness and for the protection of the fundamental rights of individuals who will be involved in EPPO activities.

4 Mutual Recognition and Mutual Trust I. Introduction Mutual recognition has been the motor of European integration in criminal matters. Its application in the field of criminal law was premised upon the uncritical acceptance of presumed mutual trust between – and in – the legal systems of EU Member States. The EU legislator has established a comprehensive system whereby national judicial decisions in criminal matters are recognised and executed across the EU quasiautomatically, with a minimum of formality and with the aim of speedy execution. This model of mutual recognition – and its application in the sensitive sphere of criminal law – has raised fundamental questions on the relationship between national legal systems in the EU, as well as questions on the feasibility of putting forward automaticity of mutual recognition in a system which may have significant negative consequences for the protection of the rights of affected individuals. These questions have become urgent after the entry into force of the Lisbon Treaty and the constitutionalisation of the protection of fundamental rights that it entails. By focusing primarily on the operation of the European Arrest Warrant (EAW) system, this chapter will examine the evolution of the application of the principle of mutual recognition in criminal matters and will critically evaluate the parameters of mutual trust and the relationship between the effectiveness of EU law in achieving law enforcement objectives with the constitutional requirement of protection of fundamental rights and safeguarding the rule of law. It will also track the evolution of mutual recognition and mutual trust through their contested and ongoing development in courts, including through direct and indirect judicial dialogue at the national and EU levels.

II. Mutual Recognition and Mutual Trust: Origins and Legal Architecture Proposals to introduce the principle of mutual recognition in EU criminal law can be seen as a balancing act between, on the one hand, the need to address concerns with regard to the slow pace of improvement of judicial cooperation in criminal matters in the EU post-Maastricht, and, on the other hand, the need to reassure Member States sceptical of further EU harmonisation in criminal matters, in particular at a time (the late 1990s) when ambitious proposals for criminal law uniformity in the EU such as

Mutual Recognition and Mutual Trust: Origins and Legal Architecture 197 the corpus juris had emerged.1 In this light, during its EU presidency in 1998, the UK government put forward the idea of applying the mutual recognition principle in the field of criminal law, leading to the recognition by the European Council at Cardiff of ‘the need to enhance the ability of national legal systems to work closely together’ and a request to the Council ‘to identify the scope for greater mutual recognition of decisions of each other’s courts’.2 The emphasis on mutual recognition was justified by the UK on the grounds that the differences between Member States’ legal systems limit the progress which is possible by other means and render harmonisation of criminal law time-consuming, difficult to negotiate and (if full-scale) unrealistic.3 According to Jack Straw, the then UK Home Secretary, one could be inspired from the way in which the internal market was ‘unblocked’ in the 1980s4 and, instead of opting for total harmonisation, conceive of a situation ‘where each Member State recognises the validity of decisions of courts from other Member States in criminal matters with a minimum of procedure and formality’.5 The momentum for enhancing cooperation in criminal matters in the EU via mutual recognition was maintained in the following years.6 In its 1999 Tampere Conclusions, setting up a five-year agenda for EU Justice and Home Affairs, the European Council endorsed the principle of mutual recognition, which in its view ‘should become the cornerstone of judicial cooperation’ in criminal matters.7 This led in 2001 to the adoption by Member States of a very detailed Programme of measures to implement the principle of mutual recognition of decisions in criminal matters, which called on the Council to adopt no fewer than 24 measures in the field.8 The previous year, the Commission published a Communication presenting the institution’s thoughts on mutual recognition.9 The Commission expressed the view that the traditional system of cooperation is slow, cumbersome and uncertain, and provided its own understanding of how mutual recognition might work: Thus, borrowing from concepts that have worked very well in the creation of the Single Market, the idea was born that judicial co-operation might also benefit from the concept of 1 On the background to EU legislative production in criminal matters post-Maastricht and the corpus juris proposals, see ch 2. 2 Doc SN 150/1/98 REV 1, para 39. 3 See the document submitted by the UK delegation to the (then) K.4 Committee: Doc 7090/99, Brussels, 29 March 1999, paras 7 and 8. 4 For further discussion on the links with the internal market, see V Mitsilegas, EU Criminal Law (Hart Publishing, 2009) ch 3. 5 In Ministère de la Justice, L’espace judiciaire européen. Actes du Colloque d’Avignon (La documentation française, 1999) 89 (my translation). 6 For a detailed look at negotiations at the time, see H Nilsson, ‘Mutual Trust or Mutual Mistrust?’ in G de Kerchove and A Weyembergh (eds), La confiance mutuelle dans l’espace pénal européen (Éditions de l’Université de Bruxelles, 2005) 29–33. For an overview of the development of the internal market principle in criminal matters, see also S Peers, ‘Mutual Recognition and Criminal Law in the European Union: Has the Council Got it Wrong?’ (2004) 41 CML Rev 5; and S Lavenex, ‘Mutual Recognition and the Monopoly of Force: Limits of the Single Market Analogy’ (2007) 14(5) Journal of European Public Policy 762. 7 Tampere Conclusions, https://www.europarl.europa.eu/summits/tam_en.htm, para 33. The reference to mutual recognition as the ‘cornerstone’ of judicial co-operation in criminal matters in the EU was reiterated five years later, in the Hague Programme extending the EU JHA agenda to 2009 – para 3.3.1. 8 [2001] OJ C12, 15 January, 10. 9 Communication from the Commission to the Council and the European Parliament, Mutual Recognition of Final Decisions in Criminal Matters, COM (2000) 495 final, Brussels, 26 July 2000.

198 Mutual Recognition and Mutual Trust mutual recognition which, simply stated, means that once a certain measure, such as a decision taken by a judge in exercising his or her official powers in one Member State, has been taken, that measure – in so far as it has extranational implications – would automatically be accepted in all other Member States, and have the same or at least similar effects there. (Emphasis added)10

Thus, the turn of the century saw a consensus on the desirability of the application of the mutual recognition principle in the criminal law sphere in the EU. For those opposing harmonisation in criminal matters, mutual recognition came in handy as it can provide results for judges and prosecutors when cooperating across borders, while prima facie Member States do not have to change their domestic criminal law to implement EU standards. For supporters of integration, on the other hand, mutual recognition was also welcome. It helps avoid EU legislative stagnation in criminal matters by pushing forward a detailed legislative agenda to achieve mutual recognition and promoting cooperation. On the other hand, as evidenced in the Commission’s 2000 Communication,11 supporters of integration also view mutual recognition as a motor for harmonisation, as – like in the internal market – the smooth functioning of mutual recognition would require minimum harmonisation of standards among Member States and thus lead to a ‘spill-over’ of further measures in the field.12 The application of the principle of mutual recognition in the field of criminal law along these lines was based on the presumption of a high level of mutual trust between EU Member States and the authorities operating the system. In order to understand the relationship between mutual recognition and mutual trust in Europe’s area of criminal justice, it is necessary to cast light on the very design of the AFSJ as such. While a key feature of the development of such an Area is the abolition of internal borders between Member States and thus the creation of a single European area where freedom of movement is secured, this single area of movement is not accompanied by a single area of law. The law remains territorial, with Member States retaining their sovereignty to a great extent, especially in the field of law enforcement. A key challenge for European integration in the field has therefore been how to make national legal systems interact in the borderless AFSJ. Member States have thus far declined unification of law in Europe’s criminal justice area. The focus has largely been on the development of systems of cooperation between Member State authorities, with the aim of extending national enforcement capacity throughout the AFSJ in order to compensate for the abolition of internal border controls. The simplification of movement that the abolition of internal border controls entails has led, under this compensatory logic, to calls for a similar simplification in interstate cooperation via automaticity and speed. Following this logic, the construction of the AFSJ as an area without internal frontiers intensifies and justifies automaticity in interstate cooperation.13 10 ibid 2. 11 ibid 4. 12 See V Mitsilegas, ‘Trust-Building Measures in the European Judicial Area in Criminal Matters: Issues of Competence, Legitimacy and Inter-institutional Balance’ in S Carrera and T Balzacq (eds), Security versus Freedom: A Challenge for Europe’s Future (Ashgate, 2006) 279–90. 13 V Mitsilegas, ‘The Limits of Mutual Trust in Europe’s Area of Freedom, Security and Justice: From Automatic Inter-state Cooperation to the Slow Emergence of the Individual’ (2012) 31 Yearbook of European Law 319.

Mutual Recognition and Mutual Trust: Origins and Legal Architecture 199 Automaticity in interstate cooperation means that a national decision will be enforced beyond the territory of the issuing Member State by authorities in other EU Member States across the AFSJ without many questions being asked and with the requested authority having at its disposal extremely limited – if any at all – grounds to refuse the request for cooperation. The method chosen to secure such automaticity has been the application of the principle of mutual recognition in the fields of judicial cooperation in criminal matters. Mutual recognition is attractive to Member States resisting further harmonisation or unification in European criminal law, as mutual recognition is thought to enhance interstate cooperation in criminal matters without, as seen above, Member States having to change their national laws to comply with EU harmonisation requirements.14 Mutual recognition creates extraterritoriality:15 in a borderless AFSJ, the will of an authority in one Member State can be enforced beyond its territorial legal borders and across this area. The acceptance of such extraterritoriality requires a high level of mutual trust between the authorities which take part in the system and is premised upon the acceptance that membership of the EU means that all EU Member States are fully compliant with fundamental rights norms. It is the acceptance of the high level of integration among EU Member States which has justified automaticity in interstate cooperation and has led to the adoption of a series of EU instruments that in this context go beyond pre-existing, traditional forms of cooperation set out under public international law, which have previously afforded a greater degree of scrutiny of requests for cooperation. Membership of the EU presumes the full respect of fundamental rights by all Member States, which creates mutual trust, and this in turn forms the basis of automaticity in interstate cooperation in Europe’s area of criminal justice. Framed in this manner, mutual recognition has emerged as the motor of European integration in criminal matters under the third pillar. The adoption in 2001 by the Council of a detailed programme of measures to implement the principle of mutual recognition of decisions in criminal matters16 has been followed by the adoption of a wide range of Framework Decisions putting forward a comprehensive system of mutual recognition in the field of criminal justice. These Framework Decisions have been adopted essentially in three stages, one shortly post-9/11, an intermediary stage consisting of the adoption of the Framework Decision on the European Evidence Warrant (now superseded by the post-Lisbon Directive on the European Investigation Order) and another in the years leading up to the adoption of the Lisbon Treaty.17 Their ambit covers all stages of the criminal process extending from the pre-trial (recognition of arrest warrants,18 evidence warrants,19 14 V Mitsilegas, ‘The Constitutional Implications of Mutual Recognition in Criminal Matters in the EU’ (2006) 43 CML Rev 1277. 15 K Nicolaidis and G Shaffer, ‘Transnational Mutual Recognition Regimes: Governance without Global Government’ (2005) 68 Law and Contemporary Problems 263; K Nicolaidis, ‘Trusting the Poles? Constructing Europe through Mutual Recognition’ (2007) 14 Journal of European Public Policy 682. 16 [2001] OJ C12, 15 January, 10. 17 V Mitsilegas, ‘The Third Wave of Third Pillar Law: Which Direction for EU Criminal Justice?’ (2009) 34 European Law Review 523. 18 Framework Decision 2002/584/JHA of 13 June 2002 on the European Arrest Warrant [2002] OJ L190/1. 19 Framework Decision 2008/978/JHA of 18 December 2008 on the European Evidence Warrant [2008] OJ L350/72. Post-Lisbon, this was replaced by the Directive on the European Investigation Order – see n 28 below.

200 Mutual Recognition and Mutual Trust freezing orders20 and decisions on bail)21 to the post-trial stage (recognition of confiscation orders,22 decisions on financial penalties,23 probation orders24 and decisions on the transfer of sentenced persons).25 The system of mutual recognition was completed pre-Lisbon by a Framework Decision on judgments in absentia, which amended a number of the preceding Framework Decisions to specify cases when recognition of a judgment could or could not be refused in such cases.26 PostLisbon, mutual recognition measures included a European Protection Order27 and two important instruments amending or repealing pre-Lisbon mutual recognition acquis: the Directive on the European Investigation Order (EIO),28 and, for the first time, a Regulation on the mutual recognition of confiscation orders.29 The main features of the application of the principle of mutual recognition in criminal matters, premised upon the judicialisation of cooperation, are automaticity, speed and the execution of judicial decisions with a minimum of formality. Based on mutual trust, the system includes very limited grounds to refuse the recognition and execution of a judicial decision or to raise questions regarding the legal system of the Member State of the issuing authority. Automaticity has presented a number of challenges, most notably with regard to the protection of the fundamental rights of affected individuals. These challenges have arisen in particular in the context of the European Arrest Warrant Framework Decision (EAW FD), which is emblematic of the application of the principle of mutual recognition in the field of criminal law. Automaticity in the operation of interstate cooperation under the EAW FD has been introduced at three levels.30 First, cooperation must take place within a limited timeframe, under strict deadlines and on the basis of a pro-forma document annexed to the Framework Decision – this means that in practice, few questions can be asked by the executing authority beyond what has been included in the form.31 Second, the executing authority is not allowed to verify the 20 Framework Decision 2003/577/JHA of 22 July 2003 on the mutual recognition of orders freezing property or evidence [2003] OJ L196/45. 21 Framework Decision 2009/829/JHA of 23 October 2009 on the application, between Member States of the European Union, of the principle of mutual recognition to decisions on supervision measures as an alternative to provisional detention [2009] OJ L294/20. 22 Framework Decision 2006/783/JHA of 6 October 2006 on the mutual recognition of confiscation orders [2006] OJ L328/59. 23 Framework Decision 2005/214/JHA of 24 February 2005 on the mutual recognition of judgments imposing financial penalties [2005] OJ L76/16. 24 Framework Decision 2008/947/JHA of 27 November 2008 on the application of the principle of mutual recognition to judgments and probation decisions with a view to the supervision of probation measures and alternative sanctions [2008] OJ L337/102. 25 Framework Decision 2008/909/JHA of 27 November 2008 on the transfer of custodial sentences (sentenced persons) [2008] OJ L327/27. 26 Framework Decision 2009/299/JHA of 26 February 2009 [2009] OJ L81/24. 27 Directive 2011/99/EU of the European Parliament and of the Council of 13 December 2011 on the European protection order OJ [2011] L338/2. See ch 6. 28 Directive 2014/41 regarding the European Investigation Order in criminal matters [2014] OJ L130/1. 29 Regulation 2018/1805 on the mutual recognition of freezing orders and confiscation orders [2018] OJ L303/1. For an analysis, see F Meyer, ‘Recognising the Unknown: The New Confiscation Regulation’ (2020) 10 European Criminal Law Review 140. 30 The EAW FD introduced a number of surrender-specific innovations, including the bar on surrender of own nationals and the narrowing of the scope of the political offence exception; see Mitsilegas (n 14). 31 See Articles 15, 17 and 23 of the EAW FD. The Court confirmed the limited role of the executing authority in examining the content of the EAW in its ruling in Case C-261/09, Gaetano Mantello [2010] ECR I-11477.

Mutual Recognition and Mutual Trust: Origins and Legal Architecture 201 existence of dual criminality in respect of a list of 32 categories of offence listed in the Framework Decision32 – this means that the executing state is asked to deploy its law enforcement mechanism, and to arrest and surrender an individual for conduct which is not an offence under its domestic law.33 The third level of automaticity arises from the inclusion of limited grounds of refusal to recognise and execute an EAW under the Framework Decision. The Framework Decision includes only three, in their majority procedural, mandatory grounds for refusal34 which are complemented by a series of optional grounds for refusal35 and provisions on guarantees underpinning the surrender process.36 However, non-compliance with fundamental rights is not included as a ground to refuse to execute an EAW.37 This legislative choice reflects the view that cooperation can take place on the basis of a high level of mutual trust in the criminal justice systems of Member States, premised upon the presumption that fundamental rights are in principle respected fully across the EU. Mutual recognition in criminal matters has thus been premised on the objective of giving priority to the enforcement interests of the issuing Member State. The CJEU has viewed the effectiveness of the system as almost synonymous with achieving the enforcement objectives of the issuing state rather than a European vision of enforcement. The interests of the issuing state are dominant in the case law of the CJEU on the operation of mutual recognition. The executing state can introduce a series of criminal procedural safeguards in the execution of the EAW, but only if these do not undermine the execution deadlines set out by the EAW FD;38 the concept of detention will not include periods of curfew if this is not permitted by the law of the issuing state, even if this is allowed by the law of the executing state.39 Periods of deduction of the sentence possible under the law of the executing state will not apply if not provided by the law of the issuing state;40 the executing state is not permitted to enforce a sentence via the imposition of a fine, even though this is the only option permissible under its national law for this kind of case, if enforcement in the issuing state take place under a custodial sentence;41 and the executing authority is not allowed to substitute its own assessment of the criminal responsibility of the minor in cases of differences between the issuing

32 EAW FD, art 2(2). 33 See the Court’s ruling in Case C-303/05, Advocaten voor de Wereld VZW v Leden van de Ministerraad [2007] ECR I-3633. 34 EAW FD, art 3. 35 ibid art 4. 36 ibid arts 5, 27 and 28. 37 The general provision of art 1(3) includes the general statement that ‘this Framework Decision shall not have the effect of modifying the obligation to respect fundamental rights and fundamental legal principles as enshrined in Article 6 of the TEU’. References to fundamental rights are also included under a general wording in the Preamble to the Framework Decision (Recital 12). 38 Case C-168/13 PPU, Jeremy F, judgment of 30 May 2013, ECLI:EU:C:2013:358. 39 Case C-294/16 PPU, JZ v Prokuratura Rejonowa Łódź –Śródmieście, ECLI:EU:C:2016:610. 40 Case C-554/14, Ognyanov, ECLI:EU:C:2016:835. For more on this, see S Montaldo, ‘Offenders’ Rehabilitation and the Cross-border Transfer of Prisoners and Persons Subject to Probation Measures and Alternative Sanctions: A Stress Test for EU Judicial Cooperation in Criminal Matters’ (2019) 5 Revista Brasilera de Direito Processual Penal 925, 953–54. 41 Case C-514/17, Sut, ECLI:EU:C:2018:1016. Paragraph 47 requires the sentence to ‘actually be enforced, in order to ensure that the custodial sentence imposed is enforced and thereby to avoid any risk of that person going unpunished’.

202 Mutual Recognition and Mutual Trust and the executing states on the delimitation of the age of criminal responsibility.42 In addition, the executing state must ensure that a custodial sentence is actually enforced on its territory if it applies the grounds for refusal under Article 4(6) of the EAW FD, even if its national law provides otherwise.43 All these rulings demonstrate a failure of imagination in developing a European concept of enforcement which takes into account the legal systems of all Member States involved and, importantly, the fundamental rights and interests of the individuals subject to these enforcement measures.44 However, in the evolution of the operation of the principle of mutual recognition in criminal matters – and of the FD EAW in particular – the question of whether the system should always entail the prioritisation of the interests and standards of the issuing state became increasingly contested. A key issue of controversy has been the extent to which mutual trust should be taken for granted – whether trust should be ‘blind’. National authorities operating the system, national courts and increasingly the CJEU and the ECtHR have been facing questions lying at the heart of the legitimacy and credibility of the EU mutual recognition system: to what extent can cooperation based on mutual trust disregard adverse fundamental rights and rule of law consequences of the execution of a judicial decision? To what extent does a system based on a high level of mutual trust allow for effective scrutiny of such consequences by the executing authorities? And what, if any, are the parameters of mutual trust and the EU benchmarks of fundamental rights and rule of law protection in the operation of mutual recognition in criminal matters? The chapter will address these issues in detail by focusing primarily on the evolution of the CJEU case law in the field. As will be seen below, changing the parameters of mutual trust and developing a more fundamental rights-friendly approach has not been a straightforward task for the Court. It involved important interventions by national constitutional courts and the ECtHR, as well as ongoing questions by national courts under the preliminary rulings mechanism. This chapter will map the evolution of case law from the initial stages, where the CJEU adopted an approach privileging law enforcement at the expense of taking rights seriously on the basis of an uncritical acceptance of a high level of mutual trust, to a more nuanced approach recognising that trust is not blind, that the fundamental rights impact of execution must be scrutinised and that recognition should ultimately not take place if there are breaches of fundamental rights. The precise parameters of these answers are constantly evolving.

III. Mutual Trust, Legality and Dual Criminality: From Advocaten voor de Wereld to Grundza A major constitutional and fundamental rights concern arising after the adoption of the EAW FD has centred on the abolition of the requirement by the executing a uthority

42 Case C-367/16, Piotrowski, ECLI:EU:C:2018:27. 43 Case C-579/15, Poplawski I, ECLI:EU:C:2017:503; Case C-573/17, Poplawski II, ECLI:EU:C:2019:530. See the remarks on the creation of a risk of impunity in para 86 of Poplawski II. 44 V Mitsilegas, ‘Conceptualising Impunity in the Law of the European Union’ in S Montaldo and L Marin (eds), The Fight against Impunity in EU Law (Hart Publishing, 2020) 13–45.

Mutual Trust, Legality and Dual Criminality 203 to verify the existence of dual criminality – whether conduct outlined in the EAW also constitutes a criminal offence in the executing state. Dispensing with the requirement to verify dual criminality, which underpins the system of mutual recognition in criminal matters, was seen to constitute a breach of the legality principle. It was noted that the abolition of dual criminality is contrary to the – constitutionally enshrined in a number of Member States – principle of legality (or nullum crimen sine lege). It was noted that constitutionally, it is not acceptable to execute an enforcement decision relating to an act that is not an offence under the law of the executing state.45 The executing state should not be asked to employ its criminal enforcement mechanism to help prosecuting/punishing behaviour which is not a criminal offence in its national legal order. Concerns in this context particularly involve offences such as murder which have not been harmonised at the EU level, although harmonisation does not always provide the answer.46 Issues arising from the abolition of the requirement to verify the existence of dual criminality formed the basis of the first landmark case where the Court of Justice was called upon to rule upon the EAW FD constituted a reference from a preliminary ruling from the Belgian Arbitragehof.47 The reference involved the assessment of the validity of the EAW and was submitted during the course of an action brought before the national court seeking the annulment of the Belgian implementing law of the relevant Framework Decision.48 Annulment was sought on three grounds: that EU third pillar legislation on the EAW ought to have been adopted by way of a Convention and not a Framework Decision since, under Article 34(2)(b) TEU, Framework Decisions may be adopted only for the purpose of approximation of national laws; that the domestic provisions implementing Article 2(2) of the Framework Decision which abolishes dual criminality for a number of offences infringes the principle of equality and non-discrimination as they differentiate without objective and reasonable justification between offences for which dual criminality is abolished and offences for which dual criminality is retained; and that the implementing legislation fails to satisfy the conditions of the principle of legality in criminal matters as it lists vague categories of undesirable behaviour rather than offences having a sufficiently clear and precise legal content. This leads to a disparate application of the legislation and thus also infringes the principle of equality and non-discrimination.49

45 See in particular M. Kaiafa-Gbandi, To poiniko dikaio stin Europaiki Enossi [Criminal Law in the European Union] (Sakkoulas, 2003) 328 (in Greek, my translation). 46 For instance, offences such as participation in a criminal organisation, although ‘harmonised’, still leave great discretion to Member States in relation to implementation, which may lead to considerable discrepancies in the treatment of the offence in national criminal laws. See V Mitsilegas, ‘Defining Organised Crime in the European Union: The Limits of European Criminal Law in an Area of Freedom, Security and Justice’ (2001) 26 European Law Review 565. See also ch 2. 47 Advocaten voor de Wereld VZW (n 33). 48 For comments on the case, see D Sarmiento, ‘European Union: The European Arrest Warrant and the Quest for Constitutional Coherence’ (2008) 6(1) International Journal of Constitutional Law 171; F Geyer, ‘Case Note: European Arrest Warrant. Court of Justice of the European Communities’ (2008) 4 European Constitutional Law Review 149; A Hinarejos, ‘Recent Human Rights Developments in the EU Courts: The Charter of Fundamental Rights, the European Arrest Warrant and Terror Lists’ (2007) 7(4) Human Rights Law Review 793. 49 See Advocaten voor de Wereld VZW (n 33) paras 11–13.

204 Mutual Recognition and Mutual Trust The Court dismissed all three arguments in a relatively short judgment. On the choice of legal instrument (a Framework Decision instead of a Convention), the Court stressed the discretion of the Council as to the adopted form of legal instrument and held that it is within this discretion to give preference to a Framework Decision if the conditions for the adoption of such a measure are satisfied.50 In this context, the Court rejected the argument that the adoption of Framework Decisions under Article 34(2)(b) TEU must relate only to areas mentioned in Article 31(1)(e) TEU, which provides a legal basis for criminal law approximation (and which do not include the EAW).51 More generally, the Court confirmed that there is no distinction in the third pillar as to the type of measures which may be adopted on the basis of the subject matter to which EU action relates52 and that Article 34(2) TEU does not establish any order of priority between the different instruments included therein.53 It also dismissed the argument that the EAW should have been adopted by a Convention since it replaces earlier EU Conventions on extradition; it used effectiveness in this context, stating that any other interpretation to the one give in this case ‘would risk depriving of its essential effectiveness the Council’s recognised power to adopt framework decisions in fields previously governed by international conventions’.54 On the questions involving the substance of the implementing law and the Framework Decision, the Court began by stressing that the EU is founded on the principle of the rule of law and respects fundamental rights as general principles of Community law.55 Referring explicitly to the Charter of Fundamental Rights, the Court added that it is ‘common ground’ that these general principles include both the principle of legality and the principle of equality and non-discrimination.56 If the reference to the Charter is noteworthy (in that it is one of the first times the Court of Justice has done so, all more importantly on a subject matter with fundamental human rights implications),57 it is also noteworthy that the Court exports the review of EU institutions on the basis of the general principles of Community law (including the protection of fundamental rights) to review of action under Union law, in the third pillar. This is yet another example of the Court treating third pillar law as subject to the same constitutional principles applying to the first pillar. The Court summarily dismissed the argument that the Framework Decision infringes the principle of equality and non-discrimination. It held first that the Council 50 ibid para 41. On discretion, see also Sarmiento (n 48) 178–180. 51 Para 38. 52 ibid para 36. 53 ibid para 37. 54 ibid para 42. The judgment here reflects to some extent the emphasis of AG Ruiz-Jarabo Colomer on effectiveness. In his Opinion, delivered on 12 September 2006, the AG stated that Member States (and the institutions) are required to achieve the objectives of art 2 TEU (which include the establishment of an ‘area of freedom, security and justice’) and are obliged to use the most appropriate tools to meet that requirement; Member States and the institutions are bound to ensure the effectiveness of Community law in general and of EU law in particular. It follows from this that the Council was ‘not only entitled but, moreover, obliged, to establish a mechanism for the European Arrest Warrant’ in a Framework Decision (at para 67, emphasis added). 55 ibid para 45. 56 ibid para 46. 57 The Court has invoked the charter for the first time in a case concerning the Family Reunification Directive: Case C-540/03, Parliament v Council [2006] ECR I-5769, para 38.

Mutual Trust, Legality and Dual Criminality 205 was able to form the view that the 32 categories of offences for which the verification of dual criminality has been abolished under Article 2(2) of the Framework Decision are serious enough in terms of adversely affecting public order and public safety for such abolition to be justified (thus implying that these offences are not comparable with the offences for which verification of dual criminality remains).58 The Court added that even if one were to assume that the situation of persons suspected of having committed or convicted of having committed Article 2(2) offences is comparable to the situation of persons similarly relating to other offences, ‘the distinction is, in any event, objectively justified’ (emphasis added).59 It also dismissed the argument that the lack of precision in the definition of the categories of offences in question leads to discrimination: employing a reasoning similar to the one applied in earlier ne bis in idem cases,60 the Court held that the objective of the Framework Decision is not to harmonise the substantive criminal law of Member States and nothing in the third pillar makes the application of the EAW conditional on criminal law harmonisation.61 In examining the compatibility of the EAW with the principle of legality, the Court stressed the link between this principle and the protection of fundamental rights. It confirmed that the legality principle is one of the general legal principles underlying the constitutional traditions common to the Member States, and also referred to the ECHR.62 It further defined the principle by reference to the Strasbourg case law.63 However, it dismissed the argument that the Framework Decision infringes the legality principle on the ground that the principle is ensured by the fact that legislation is defined in the issuing Member State. It noted that the Framework Decision does not seek to harmonise the criminal offences set out in Article 2(2) and that even if Member States reproduce word for word the list of categories included in Article 2(2) for the purposes of implementation, the actual definition of those offences and the penalties applicable are those which follow from the law of the issuing Member State.64 The definition of Article 2(2) offences and the applicable penalties continue to be matters determined by the law of the issuing Member State: [W]hich, as is, moreover, stated in Article 1(3) of the Framework Decision, must respect fundamental rights and fundamental legal principles as enshrined in Article 6 EU, and consequently, the principle of the legality of criminal offences and penalties.65

The approach of the Court with regard to the assessment of the compatibility of the EAW FD with fundamental rights (in particular the principle of legality in the light of

58 ibid para 57. 59 ibid para 58. 60 See section IV below and ch 3. 61 Parliament v Council (n 57) para 59. 62 ibid para 49. 63 ‘This principle implies that legislation must define clearly offences and the penalties which they attract. That condition is met in the case where the individual concerned is in a position, on the basis of the wording of the relevant provision and with the help of the interpretative assistance given by the courts, to know which acts or omissions will make him criminally liable’ (ibid para 50). The Court also referred to the definition of legality in Advocaten in its recent judgment on the interpretation of the Ship-Source Pollution Directive – see Case C-308/06, Intertanko, judgment delivered on 3 June 2008, paras 70–71. 64 Parliament v Council (n 57) para 52. 65 ibid para 53.

206 Mutual Recognition and Mutual Trust the abolition of dual criminality) is noteworthy, especially when compared with the approach of AG Ruiz-Jarabo Colomer and the case law of national constitutional courts. The Court did not follow the ‘procedural’ approach of the Advocate General, who argued that the enhanced safeguards of criminal law do not apply in this context as the EAW is not ‘punitive in nature’, but merely a mechanism facilitating judicial cooperation in criminal matters in the EU.66 Moreover, the Court – while taking care to address national concerns in proclaiming that the EU (including in activities under the third pillar which contained the legal basis for the Framework Decision) does respect fundamental rights and the rule of law – did not follow or address the emphasis that a number of national constitutional courts have placed in the special bond between citizen and state.67 Rather, the Court chose to follow an approach based on the logic and structure of mutual recognition: on the basis of this approach, it held that the legality requirement is met by the existence of legislation in the issuing Member State. In addressing potential concerns emanating from lack of trust among Member States in this context, the Court added a second layer of human rights protection (along with protection at the EU level): using the very broad human rights clause in the Framework Decision itself, it stated that the issuing Member State must respect fundamental rights and consequently the legality principle. The wording is significant, as it implies that the performance of national authorities when applying the Framework Decision is subject to a fundamental rights review by Luxembourg.68 The CJEU was called upon to give guidance on how national authorities should assess the occurrence of dual criminality in cases not falling within the list of Article 2(2) of the EAW FD. In the case of Grundza,69 concerning the application of FD 2008/909/JHA, the CJEU noted that Article 7(3) of the Framework Decision authority of the executing state to verify whether the acts in question ‘also constitute an offence’ under the national law of that state, ‘whatever its constituent elements or however it is described’.70 The necessary and sufficient condition for the purpose of assessing dual criminality resides in the fact that the acts giving rise to the sentence imposed in the issuing state also constitute an offence in the executing state – the offences do not need to be identical in

66 According to the AG, the legality principle ‘comes into play during the exercise of the State’s right to punish and during the application of acts which may be strictly construed as imposing a penalty’. Conversely, the Framework Decision ‘does not provide for any punishments or even seek to harmonise the criminal laws of the Member States’; instead, it creates a mechanism of assistance between the courts of Member States (ibid para 103, emphasis added). In this light, the arrest and surrender procedure entailed in the execution of an EAW ‘is not punitive in nature’ (para 105). For an analysis of the implications of this reasoning for the protection of fundamental rights in EU criminal law, see V Mitsilegas, ‘The Transformation of Criminal Law in the ‘Area of Freedom, Security and Justice’ (2007) 26 Yearbook of European Law 1. 67 See Mitsilegas (n 14). 68 In a more recent case, the CJEU set limits to the possible abuse of the EAW system at the issuing stage. The Court held that the issuing authorities cannot rely on an ex post change in national law in order to bypass the dual criminality penalty thresholds. According to the Court, art 2(2) of the EAW FD must be interpreted as meaning that in order to ascertain whether the offence for which an EAW has been issued is punishable in the issuing Member State by a custodial sentence or a detention order for a maximum period of at least three years, as it is defined in the law of the issuing Member State, the executing judicial authority must take into account the law of the issuing Member State in the version applicable to the facts giving rise to the case in which the European arrest warrant was issued; Case C-717/18, X, ECLI:EU:C:2020:142. 69 Case 289/15, Grundza, ECLI:EU:C:2017:4. 70 ibid para 33.

Mutual Trust, Fundamental Rights and Proportionality: Radu 207 the two Member States concerned.71 There does not have to be an exact match between the constituent elements of the offence, as defined in the law of the issuing state and the executing state, respectively, or between the name given to or the classification of the offence under the national law of the respective states.72 A flexible approach in the assessment of the condition of dual criminality is required.73 The condition of dual criminality must be considered to be met in a situation where the factual elements underlying the offence, as reflected in the judgment handed down by the competent authority of the issuing state, would also per se be subject to a criminal sanction in the territory of the executing state if they were present in that state.74 The CJEU again here embraces a recognition-friendly approach, focusing on substance rather than formality. While the approach towards the assessment of the existence of dual criminality is clearly articulated, national authorities will inevitably employ a margin of discretion as to how they assess the occurrence of dual criminality, in particular as regards their perception of the occurrence of the factual elements underlying the offence.75

IV. Mutual Trust, Fundamental Rights and Proportionality: Radu The entry into force of the Lisbon Treaty and the enhanced protection of fundamental rights via the constitutionalisation of the Charter has raised expectations regarding the reconfiguration of the relationship between enforcement-focused, uncritical mutual trust and the protection of fundamental rights in Europe’s area of criminal justice. A key question in this context was whether the Court would apply its newly developed approach on fundamental rights scrutiny in EU asylum law, consisting of the recognition of legal avenues to refuse to cooperate in the system of mutual recognition established by the Dublin system.76 In the field of asylum law, the Court held that a conclusive presumption of compliance with fundamental rights could itself be regarded as undermining the safeguards which are intended to ensure compliance with fundamental rights by the EU and its Member States77 and that such a presumption is rebuttable,78 leading to calls for the application of this approach to the field of mutual

71 ibid para 34. 72 ibid para 35. 73 ibid para 36. 74 ibid para 54. 75 For an analysis applying the Grundza test to the Puigdemont case, see M Muñoz de Morales Romero, ‘Dual Criminality under Review: On the Puigdemont Case’ (2018) 8 European Criminal Law Review 167. For critical views of the approach of the German judiciary in the Puigdemont case, see L Bachmaier, ‘European Arrest Warrant, Double Criminality and Mutual Recognition: A Much Debated Case’ (2018) 8 European Criminal Law Review 152; and A Nieto Martín, ‘The Foundations of Mutual Recognition and the Meaning of Dual Criminality’ (2018) 8 European Criminal Law Review 160. 76 Joined Cases C-411/10 and C-493/10, NS (C-411/10) v Secretary of State for the Home Department and ME and Others (C-493/10) v Refugee Applications Commissioner and Minister for Justice, Equality and Law Reform, ECLI:EU:C:2011:865 (Grand Chamber). 77 ibid para 100. 78 ibid para 104.

208 Mutual Recognition and Mutual Trust recognition in criminal matters.79 The question of the extent to which the executing authority can refuse to execute an EAW when there are concerns that execution and surrender will have adverse fundamental rights consequences arose in the case of Radu. The case involved prosecution warrants issued by German authorities and addressed to their Romanian counterparts. Following challenges to the execution of these warrants in the issuing state, the Constanta Court of Appeal decided to stay the proceedings and refer a number of questions to the CJEU for a preliminary ruling. These included in particular questions on the legal status and force of fundamental rights provisions of the ECHR and the Charter under EU primary law; whether the execution of an EAW entailing deprivation of liberty and forcible surrender without the consent of the requested person constituted interference with these rights; whether such interference satisfied the requirements of necessity in a democratic society and of proportionality in relation to the objective pursued; and, crucially, whether the executing authority could refuse to execute an EAW on the grounds of fundamental rights while being in compliance with EU law. A number of detailed answers to these questions were provided by AG Sharpston in her Opinion.80 The AG addressed the fundamental rights questions at three levels: on the status of fundamental rights under EU law; on the place of fundamental rights in the system of mutual recognition in criminal matters; and on whether execution of an EAW could be refused on fundamental rights grounds. The AG held that Charter rights form part of the primary law of the EU and that ECHR rights constitute general principles of EU law.81 She noted that while the obligations imposed on the Member States by the EAW FD relate to matters that are essentially procedural, this does not mean that the legislature failed to take fundamental and human rights into account when enacting the Framework Decision.82 The EAW FD incorporated express references to fundamental rights in the FD in the Preamble and in Article 1(3)83 and specific provisions on the rights pf the requested persons,84 while also intending to protect victims.85 Moreover, the high level of mutual trust underpinning the operation of the FD is predicated on the observance by each of the Member States of the rights enshrined in the ECHR and the Charter, and of the rights which form part of the constitutional traditions common to the Member States.86 AG Sharpston thus elevated the protection of fundamental rights as an element underpinning the system of mutual recognition based on mutual trust, while (following NS) affirming that the presumption of Member States’ compliance with fundamental rights is rebuttable.87

79 V Mitsilegas, ‘The Limits of Mutual Trust in Europe’s Area of Freedom, Security and Justice: From Automatic Inter-state Cooperation to the Slow Emergence of the Individual’ (2012) 31 Yearbook of European Law 319. 80 Case C-396/11, Radu, ECLI:EU:C:2012:648, Opinion of AG Sharpston delivered on 18 October 2012. 81 ibid para 52. 82 ibid para 36. 83 ibid para 37. 84 ibid para 39. 85 ibid para 40. 86 ibid para 38. 87 ibid para 41. The AG acknowledged that the record of the Member States in terms of complying with their human rights obligations is ‘not pristine’.

Mutual Trust, Fundamental Rights and Proportionality: Radu 209 This approach to mutual recognition and mutual trust led to the acknowledgement by the AG that it is possible for an authority to refuse to execute an EAW on fundamental rights grounds. The AG did not confine herself into a narrow textual interpretation of the EAW FD, which, as seen above, does not contain an express ground of refusal to execute on fundamental rights grounds. Such a narrow approach which would exclude human rights considerations altogether is not supported by the wording of the EAW FD or by the case law.88 The AG went on to essentially construct a ground for refusal to execute on fundamental rights grounds implicitly from Article 1(3) of the EAW FD, although this provision was specifically included in a part of the EAW FD other than the specific provisions on grounds for refusal.89 She also drew support from other AG Opinions on EAW cases,90 notwithstanding the fact that the part of these Opinions had not been endorsed expressly by the CJEU itself, which insisted in favour of a law enforcement-heavy, blind trust approach on the EAW. AG Sharpston held that it is clear that the judicial authorities of an executing Member State are bound to have regard to the fundamental rights set out in the Convention and the Charter when considering whether to execute an EAW,91 and went on to assess when must executing authorities refuse to execute and what factors they should take into account. The AG started by referring to Strasbourg case law92 and to the CJEU ruling in NS,93 but went on to differentiate the fundamental rights test employed by executing authorities under EU law from the test developed by the Strasbourg Court, in particular as regards ‘flagrant denial’.94 AG Sharpston then proceeded to give concrete answers as to the criterion to be employed by the executing authority – that the deficiency or deficiencies in the trial process should be such as to fundamentally destroy its fairness95 – and on the standard and burden of proof.96 Importantly, the AG also extended the fundamental rights ground to refuse to execute an EAW if it is proved that there has been a breach of a fundamental procedural requirement as to the issuing of the warrant.97 The AG also addressed in detail questions relating to, but also distinct from, the broader issue of fundamental rights grounds for refusal, namely questions relating to the parameters of the principle of proportionality in the operation of the EAW. AG Sharpston addressed two different aspects of proportionality: proportionality in detention and proportionality in the issuing of an EAW. In terms of proportionality of detention, the AG held that in order to avoid being arbitrary, such detention must be carried out in good faith; it must be closely connected to the ground of detention relied on by the executing judicial authority; the place and conditions of detention should be appropriate; and the length of the detention should not exceed that reasonably required for the purpose pursued (thus satisfying the proportionality test). Article 6 of the Charter falls to be construed in the same way as Article 5(1) of the Convention 88 ibid para 69. 89 According to the AG, art 1(3) permeates the Framework Decision; it is implicit that fundamental rights may be taken into account in founding a decision not to execute a warrant (ibid para 70). 90 ibid paras 71–72. 91 ibid para 73. 92 ibid paras 74–75. 93 ibid para 76. 94 ibid paras 79–83. 95 ibid para 83. 96 ibid paras 84–89. 97 ibid para 95.

210 Mutual Recognition and Mutual Trust in this context.98 The AG also addressed proportionality concerns with regard to the decision to issue an EAW. These concerns were prominent at the time in Member States such as the UK, where executing authorities were of the view that EAWs were issued for offences which would be considered minor or not be prosecuted under the system of the executing Member State, yet which would fall within the broad scope of the EAW FD.99 Calls for the introduction of a proportionality check in the operation of the EAW system have been put forward in order to ensure that pressure on the criminal justice systems of executing Member States and disproportionate results for the requested individuals are avoided.100 This concern regarding the proportionality of issuing EAWs was also raised by AG Sharpston101 from the perspective of its compliance with Article 49 of the Charter. The AG stated eloquently, as an obiter, that: I would add one thing. At the hearing, counsel for Germany used the example of a stolen goose. If that Member State were asked to execute a European arrest warrant in respect of that crime where the sentence passed in the issuing Member State was one of six years, she thought that execution of the warrant would be refused. She considered that such a refusal would be justifiable on the basis of the doctrine of proportionality and referred the Court to Article 49(3) of the Charter, according to which ‘the severity of penalties must not be disproportionate to the criminal offence’. This Court has yet to rule on the interpretation of that article. In the context of the Convention, the Court of Human Rights has held that while, in principle, matters of appropriate sentencing largely fall outside the scope of the Convention, a sentence which is ‘grossly disproportionate’ could amount to ill-treatment contrary to Article 3 but that it is only on ‘rare and unique occasions’ that the test will be met. It would be interesting to speculate as to the interpretation to be given to Article 49(3) of the Charter having regard to the interpretation given by the Court of Human Rights of the provisions of Article 3 of the Convention.102

In its ruling in Radu,103 the Court did not follow the AG’s Opinion. It answered the question on whether mutual recognition could be refused on fundamental rights grounds in the negative.104 It also reaffirmed the adoption of a teleological interpretation reiterating the purpose of establishing a simplified and more effective system of surrender based on mutual recognition.105 Such a system will contribute to the EU’s objective of becoming an Area of Freedom, Security and Justice by basing itself on the high degree of confidence which should exist between the Member States.106 Refusal to execute can only take place on the basis of the mandatory and optional grounds for refusal set out in the Framework Decision.107 On the basis of this presumption of mutual trust, the

98 ibid para 62. 99 For an overview of the debate, see T Ostropolski, ‘The Principle of Proportionality under the European Arrest Warrant – with an Excursus on Poland’ (2014) 5 New Journal of European Criminal Law 167. 100 For a discussion, see Joint Committee on Human Rights, The Human Rights Implications of UK Extradition Policy, Fifteenth Report, session 2010–12, 40–43; Sir S Baker, A Review of the United Kingdom’s Extradition Arrangements, presented to the Home Secretary on 30 September 2011, paras 5.120–5.155. 101 Radu (n 80) para 60. 102 ibid para103. 103 Case C-396/11, Radu, EU:C:2013:39. 104 The CJEU did not engage with the question of proportionality in the issuing of an EAW. 105 EAW FD, paras 33 and 34. 106 ibid para 34. 107 ibid para 36. See also earlier case law: Case C-388/08 PPU, Leymann and Pustovarov [2008] ECR I-8993, para 51; and Case C-261/09, Mantello [2010] ECR I-11477, para 37.

Mutual Trust, Fundamental Rights and Proportionality: Radu 211 Court found that the observance of Articles 47 and 48 of the Charter does not require that a judicial authority of a Member State should be able to refuse to execute an EAW issued for the purposes of conducting a criminal prosecution on the ground that the requested person was not heard by the issuing judicial authorities before that warrant was issued.108 Once again, the Court placed effectiveness considerations at the forefront of its reasoning. It pointed out that such an obligation would inevitably lead to the failure of the very system of surrender109 and added that in any event, the right to be heard will be observed in the executing Member State in such a way as not to compromise the effectiveness of the EAW system.110 Radu thus follows the Court’s earlier case law in two respects: it confirms that it is satisfied with the provision of fundamental rights protection in one of the two states which take part in the cooperative mutual recognition system (here, it is the executing state which is under the duty to uphold the right to be heard); and it places the protection of fundamental rights within a clear framework of effectiveness of the enforcement cooperation system which is established by the EAW FD. If the level of protection of fundamental rights (in both the issuing and the executing state) were to be too extensive, it would undermine the effectiveness of law enforcement cooperation in this context. The reluctance of the CJEU to recognise the existence of fundamental rights grounds for refusal to execute an EAW came as a disappointment to many, with the ruling being deemed a missed opportunity to engage seriously with fundamental rights in the context of the operation of mutual recognition in criminal matters.111 As will be seen in the following section, the CJEU further entrenched its position in favour of almost blind trust in immediately subsequent litigation, but the issues raised in the proceedings in Radu and by the AG did not go away. The proceedings in Radu are also of importance in raising the question of proportionality in the operation of the EAW system. The Opinion of AG Sharpston in Radu highlighted two important aspects of proportionality in this context, with the insights provided in the Opinion continuing to be relevant for addressing and interpreting proportionality today. The first aspect involves the emphasis on procedural aspects of proportionality in the issuing of an EAW, an issue which is inextricably linked with the protection of fundamental rights of the requested person and the acknowledgement that triggering the EAW mechanism will result in deprivation of liberty. As will be seen below, the importance of ensuring effective scrutiny of proportionality in the issuing of the EAW has been reflected clearly in the case law of the CJEU on defining the concept of ‘judicial authority’ for the purposes of issuing an EAW as an autonomous concept of EU law – the CJEU has held that a key constituent element of this concept is the availability of an effective remedy against the decision to issue an EAW, including the proportionality of such decision.112 108 EAW FD, para 39. 109 ibid para 40. 110 ibid para 41. 111 R Raffaelli, ‘Judgment pf the Court of Justice of the European Union, 29 January 2013, Radu’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis, (Hart Publishing, 2019) 363–79. 112 Joined Cases C-508/18 OG, Public Prosecutor’s Office of Lübeck, and C-82/19 PPU PI, Public Prosecutor’s Office of Zwickau, ECLI:EU:C:2019:456. According to para 75 of the judgment, the decision to issue and, inter alia, the proportionality of such a decision must be capable of being the subject in the issuing state of court proceedings which meet the requirements inherent in effective judicial protection in full.

212 Mutual Recognition and Mutual Trust The second aspect of proportionality involves the question of issuing an EAW for minor offences. There has been recognition by EU institutions that proportionality must be taken into account in the operation of mutual recognition in criminal matters, but that this should occur at the stage of issuing a judicial decision. The requirement to introduce a proportionality check in the issuing state has also been introduced at the EU level in the Directive on the EIO, which states that the issuing authority may only issue an EIO where the issuing of the latter is necessary and proportionate, and where the investigative measures indicated in the EIO could have been ordered under the same conditions in a similar domestic case.113 Although such a clause is absent from the EAW FD, the Commission Guidance on how to issue and execute an EAW includes a proportionality check in the issuing Member State.114 A more prominent role for proportionality is envisaged, as will be seen later in the volume in the post-Brexit legal landscape under the EU-UK Trade and Cooperation Agreement, which introduced a higher degree of scrutiny of proportionality compared with internal EU law.115

V. Mutual Trust and the Primacy and Autonomy of EU Law: From Melloni to Opinion 2/13 The CJEU continued to prioritise enforcement on the basis of automaticity and mutual trust at the expense of extensive scrutiny of fundamental rights considerations in two landmark cases, where mutual trust has been linked to broader objectives of ensuring the primacy and autonomy of EU law. In the first case, Melloni, an EAW-relating case, the CJEU ruled essentially on the primacy of EU secondary law over national constitutional law. Complementing this internal dimension, the second ruling, Opinion 2/13, evoked a vision of a high level of presumed mutual trust in order to cement at the external level the autonomy of EU law vis-a-vis ‘third’ legal orders, and in this case the legal order of the ECHR. In both cases, the Court subsumed fundamental rights considerations within the priority of securing adherence to other constitutional objectives of EU law. As will be seen below, this approach – including the Court’s insistence on a version of almost blind trust – caused a backlash and eventually resulted in a change of approach.

A. Mutual Trust, Primacy and Fundamental Rights: Melloni The focus on the effective operation of mutual recognition was reiterated by the Court of Justice in the case of Melloni.116 In Melloni, the Court effectively confirmed the primacy 113 EIO Directive, art 6(1)(a) and (b) respectively. 114 Commission Notice – Handbook on how to issue and execute a European arrest warrant [2017] OJ C335/1, 6 October, para 2.4. The Commission provided detailed guidance on factors to be taken into account by the issuing authority in this context including: ‘(a) the seriousness of the offence (for example, the harm or danger it has caused); (b) the likely penalty imposed if the person is found guilty of the alleged offence (for example, whether it would be a custodial sentence); (c) the likelihood of detention of the person in the issuing Member State after surrender; (d) the interests of the victims of the offence.’Furthermore, judicial authorities should consider whether other judicial cooperation measures could be used instead of issuing an EAW. 115 See ch 12. 116 Case C-399/11, Melloni v Ministerio Fiscal, EU:C:2013:107.

Mutual Trust and the Primacy and Autonomy of EU Law 213 of third pillar law (the EAW FD as amended by the Framework Decision on judgments in absentia, interpreted in the light of the Charter) has primacy over national constitutional law providing a higher level of fundamental rights protection. In order to arrive at this far-reaching conclusion, the Court followed a three-step approach. The first step for the Court was to demarcate the scope of the EAW FD as amended by the Framework Decision on judgments in absentia (and in particular Article 4a(1) thereof) in order to establish the extent of the limits of mutual recognition in such cases. The Court reiterated its reasoning in Radu in adopting a teleological interpretation of the EAW FD and stressing that under the latter Member States are in principle obliged to act upon an EAW.117 In the light of these findings, the Court adopted a literal interpretation of Article 4a(1), confirming that that provision restricts the opportunities for refusing to execute an EAW.118 That interpretation is confirmed by the mutual recognition objectives of EU law.119 The second step was to examine the compatibility of the above system with fundamental rights and in particular the right to an effective judicial remedy and the right to fair trial set out in Articles 47 and 48(2) of the Charter. By reference to the case law of the ECtHR,120 the Court of Justice found that the right of an accused person to appear in person at their trial is not absolute and can be waived.121 It further stated that the objective of the Framework Decision on judgments in absentia was to enhance procedural rights whilst improving mutual recognition of judicial decisions between Member States,122 and found Article 4a(1) to be compatible with the Charter. Having asserted the compatibility of the relevant provision with the Charter, the third step for the Court was to rule on the relationship between the secondary EU law in question with national constitutional law, which provided a higher level of protection. The Court rejected an interpretation of Article 53 of the Charter as giving general authorisation to a Member State to apply the standard of protection of fundamental rights guaranteed by its own constitution when that standard is higher than that deriving from the Charter and, where necessary, to give it priority over the application of provisions of EU law:123 That interpretation of Article 53 would undermine the principle of the primacy of EU law inasmuch as it would allow a Member State to disapply EU legal rules which are fully in compliance with the Charter where they infringe the fundamental rights guaranteed by that State’s constitution. (Emphasis added)124

Article 53 of the Charter provides freedom to national authorities to apply national human rights standards ‘provided that the level of protection provided for by the Charter, as interpreted by the Court, and the primacy, unity and effectiveness of EU law are not thereby compromised’ (emphasis added).125 In the present case, ‘Article 4a(1) of 117 ibid paras 36–38. 118 ibid para 41. 119 ibid para 43. 120 Medenica v Switzerland, App No 20491/92 (ECtHR); Sejdovic v Italy, App No 56581/00 (ECtHR); Haralampiev v Bulgaria, App No 29648/03 (ECtHR). 121 Melloni (n 116) 49. 122 ibid para 51. 123 ibid paras 56–57. 124 ibid para 58. 125 ibid para 60.

214 Mutual Recognition and Mutual Trust Framework Decision 2002/584 does not allow Member States to refuse to execute a European arrest warrant when the person concerned is in one of the situations provided for therein’.126 The Framework Decision on judgments in absentia ‘is intended to remedy the difficulties associated with the mutual recognition of decisions rendered in the absence of the person concerned at his trial arising from the differences as among the Member States in the protection of fundamental rights’ and ‘reflects the consensus reached by all the Member States regarding the scope to be given under EU law to the procedural rights enjoyed by persons convicted in absentia who are the subject of a European arrest warrant’:127 Consequently, allowing a Member State to avail itself of Article 53 of the Charter to make the surrender of a person convicted in absentia conditional upon the conviction being open to review in the issuing Member State … in order to avoid an adverse effect on the right to a fair trial and the rights of the defence guaranteed by the constitution of the executing Member State, by casting doubt on the uniformity of the standard of protection of fundamental rights as defined in that framework decision, would undermine the principles of mutual trust and recognition which that decision purports to uphold and would, therefore, compromise the efficacy of that framework decision. (Emphasis added)128

In Melloni, the Court once again gave priority to the effectiveness of mutual recognition based on presumed mutual trust. Secondary pre-Lisbon third pillar law whose primary aim is to facilitate mutual recognition has primacy over national constitutional law which provides a high level of protection of fundamental rights. In reaching this conclusion, the Court interpreted fundamental rights in a restrictive manner. It emphasised the importance of the Framework Decision on judgments in absentia for the effective operation of mutual recognition, a Framework Decision which, as the Court admitted, restricts the opportunities for refusing to execute an EAW.129 This aim sits uneasily with the Court’s assertion that the Framework Decision on judgments in absentia also aims to protect the procedural rights of the individual. By privileging the teleology of mutual recognition and upholding the text of the Framework Decision on judgments in absentia and the subsequently amended EAW FD – via the adoption of a literal interpretation – over the protection of fundamental rights, the Court has shown a great (and arguably undue) degree of deference to the European legislator.130 The Court’s reasoning also seems to deprive national executing authorities of any discretion to examine the compatibility of the execution of an EAW with fundamental rights in a wide range of cases involving in absentia rulings.131 This deferential approach may be explained by

126 ibid para 61. 127 ibid para 62. 128 ibid para 63. 129 For critical analysis of the harmonisation capacity of the Framework Decision on judgments in absentia, see ch 5. 130 LFM Besselink, ‘The Parameters of Constitutional Conflict after Melloni’ (2014) 39 European Law Review 531, 542; A Torres Pérez, ‘Melloni in Three Acts: From Dialogue to Monologue’ (2014) 10 European Constitutional Law Review 308, 317–18. 131 See also the Opinion of AG Bot, who linked national discretion to refuse surrender with the perceived danger of forum shopping by the defendant – Melloni (n 116) Opinion of AG Bot, delivered on 2 October 2012, para 103.

Mutual Trust and the Primacy and Autonomy of EU Law 215 the fact that the Court was asked to examine the human rights implications of measures which have been subject to harmonisation at the EU level, with the Court arguing that the Framework Decision reflects a consensus among EU Member States with regard to the protection of the individual in cases of in absentia rulings within the broader system of mutual recognition.132 It has been argued that national constitutional standards will be more readily applicable in cases where EU law has not been harmonised.133 The Court’s ruling in the case of Jeremy F134 has been cited as an example of this approach.135 In Jeremy F, the Court found that the EAW FD as amended by the Framework Decision on judgments in absentia did not preclude Member States from providing for appeals with suspensive effect, provided that such appeals comply with the time-limits set out in the EAW FD.136 The Court noted that the absence of an express provision on the possibility of bringing an appeal with suspensive effect against a decision to execute an EAW does not mean that the Framework Decision prevents the Member States from providing for such an appeal or requires them to do so.137 However, Jeremy F must be distinguished from Melloni: while Melloni concerned the possibility of refusing the execution of a mutual recognition request on fundamental rights grounds, Jeremy F did not question the essence of the mutual recognition system so fundamentally. Rather, the question in Jeremy F was a meta-question, concerning the specific procedural rules which apply in the process of the execution of a warrant. Even in this case, the discretion left to Member States to protect fundamental rights is limited and circumscribed by the deadlines set out in the mutual recognition instruments aiming at achieving the desired speed linked to the perceived efficiency of the system.138 The Court’s deferential approach gives undue weight to what are essentially intergovernmental choices (the choices of Member States adopting a third pillar measure without the involvement of the European Parliament), which sit alongside each other even more uneasily in the post-Lisbon, post-Charter era. The emphasis of the Court on the need to uphold the validity of harmonised EU secondary law over primary constitutional law on human

132 See also the Opinion of AG Bot, according to whom the Court cannot rely on the constitutional traditions common to the Member States in order to apply a higher level of protection (ibid para 84) and that the consensus between Member States leaves no room for the application of divergent national levels of protection (para 126). 133 See K Lenaerts and J Gutiérrez-Fons, ‘The European Court of Justice and Fundamental Rights in the Field of Criminal Law’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook of European Criminal Law (Edward Elgar, forthcoming); B de Witte, ‘Article 53’ in S Peers, T Hervey, J Kenner and A Ward (eds), The EU Charter of Fundamental Rights: A Commentary (Hart Publishing, 2014); Melloni (n 116) Opinion of AG Bot, para 124. According to the AG, it is necessary to differentiate between situations in which there is a definition at the EU level of the degree of protection which must be afforded to a fundamental right in the implementation of an action by the EU and those in which that level of protection has not been the subject of a common definition. 134 Jeremy F (n 38). 135 Lenaerts and Gutiérrez-Fons (n 133). 136 Jeremy F (n 38). 137 ibid para 38. 138 See also the restrictive approach adopted by the Court in the more recent case of Lanigan, where it found that art 12 of the Framework Decision read in conjunction with art 17 thereof and in the light of art 6 of the Charter must be interpreted as not precluding the holding of the requested person in custody, even if the total duration for which that person has been held in custody exceeds the time limits provided for in the EAW FD – Case C-237/15 PPU, Lanigan, ECLI:EU:C:2015:474 para 58.

216 Mutual Recognition and Mutual Trust rights (at both the national and the EU level) constitutes a challenge for human rights protection.139 It further reveals, in the context of EU criminal law, a strong focus by the Court on the need to uphold the validity of a system of quasi-automatic mutual recognition in criminal matters which will enhance interstate cooperation and law enforcement effectiveness across the EU.

B. Mutual Trust, Fundamental Rights and the Autonomy of the EU Legal Order: Opinion 2/13 The emphasis of the Court of Justice on the centrality of mutual trust as a factor privileging the achievement of law enforcement objectives via mutual recognition over the protection of fundamental rights has been reiterated beyond EU criminal law in the broader context of the accession of the EU to the ECHR. The Court’s Opinion 2/13140 included a specific part dealing with mutual trust in EU law. The Court distilled its current thinking on mutual trust into the following two key paragraphs: [I]t should be noted that the principle of mutual trust between the Member States is of fundamental importance in EU law, given that it allows an area without internal borders to be created and maintained. That principle requires, particularly with regard to the area of freedom, security and justice, each of those States, save in exceptional circumstances, to consider all the other Member States to be complying with EU law and particularly with the fundamental rights recognised by EU law. Thus, when implementing EU law, the Member States may, under EU law, be required to presume that fundamental rights have been observed by the other Member States, so that not only may they not demand a higher level of national protection of fundamental rights from another Member State than that provided by EU law, but, save in exceptional cases, they may not check whether that other Member State has actually, in a specific case, observed the fundamental rights guaranteed by the EU. (Emphasis added)141

From the perspective of the relationship between EU criminal law and fundamental rights, this passage is striking. It follows a series of comments on the role of Article 53 of the Charter in preserving the autonomy of EU law, with the Court citing the Melloni requirement for upholding the primacy, unity and effectiveness of EU law.142 The Court then put forward a rather extreme view of presumed mutual trust leading to automatic mutual recognition. It thus represents a significant challenge to our understanding of the EU constitutional order as a legal order underpinned by the protection of fundamental rights. The Court deified mutual trust and endorsed a system whereby the protection of fundamental rights must be subsumed by the abstract requirements of upholding mutual trust, instead of endorsing a model of a EU whereby cooperation on the basis

139 According to Besselink ((n 130) 542), attaching this importance to secondary legislation as ‘harmonisation of EU fundamental rights’ risks erasing the difference between the primary law nature of fundamental rights and secondary law as the subject of these rights. 140 Opinion 2/13, delivered on 18 December 2014. 141 ibid paras 191–92. 142 ibid para 188.

Mutual Trust and the Primacy and Autonomy of EU Law 217 of mutual trust must be underpinned by the effective protection of fundamental rights. The Court boldly asserted that mutual trust is not only a principle, but also a principle of fundamental importance in EU law. However, this assertion seems to disregard the inherently subjective nature of trust and the difficulties in providing an objective definition which meets the requirements of legal certainty. It is also clear that although mutual trust is viewed by the Court as inextricably linked with the establishment of an area without internal borders (at the heart of which is the free movement principle and the rights of EU citizens), the Court perceives mutual trust as limited to trust ‘between the Member States’ – the citizen or individual affected by the exercise of state enforcement power under mutual recognition is markedly absent from the Court’s reasoning. This approach leads to the uncritical acceptance of presumed trust across the EU: not only are Member States not allowed to demand a higher national level of protection of fundamental rights than the one provided by EU law (thus echoing Melloni), but also, and remarkably, Member States are not allowed to check (save in exceptional circumstances) whether fundamental rights have been observed in other Member States in specific cases. This finding is striking as it disregards a number of developments in secondary EU criminal law aiming to grant executing authorities the opportunity to check whether the execution of a judicial decision by the authorities of another Member State would comply with fundamental rights. It also represents a fundamental philosophical and substantive difference in the protection of fundamental rights between the Luxembourg and Strasbourg Courts. The Luxembourg Court’s approach in Opinion 2/13 is strikingly at odds with the approach of the Strasbourg Court. The willingness of the Court of Justice to sacrifice an individualised case-by-case assessment of the human rights implications of the execution of a mutual recognition order in the name of uncritical presumed mutual trust is a clear challenge for the effective protection of fundamental rights in the EU and runs the risk of resulting in a lower level of protection of fundamental rights in systems of interstate cooperation within the EU compared to that provided by the Strasbourg Court in ECHR cases. This difference in approaches raises the real prospect of a conflict between the ECHR and EU law, especially in cases of interstate cooperation between EU Member States under the principle of mutual recognition. Eeckhout has commented that Opinion 2/13 confirms a radical pluralist conception of the relationship between EU law and the ECHR.143 In the case of mutual recognition, this ‘outward-looking’, external pluralist approach, which can be seen as an attempt to preserve the autonomy of EU law, is combined with the parallel strengthening of an internal, intra-EU pluralist approach that stresses the importance of mutual trust, which is elevated by the Court to the status of a fundamental principle of EU law. Both internal and external pluralist approaches undermine the position of the individual in Europe’s area of criminal justice by limiting the judicial avenues of examination of the fundamental rights implications of quasi-automatic mutual recognition on a case-by-case basis.

143 P Eeckhout, Opinion 2/13 on EU Accession to the ECHR and Judicial Dialogue – Autonomy or Autarchy?, Jean Monnet Working Paper 01/15 36.

218 Mutual Recognition and Mutual Trust

VI. Mutual Trust as a Challenge to Fundamental Rights and Constitutional Identity: The Response from the ECtHR and National Constitutional Courts The CJEU’s approach in Melloni and Opinion 2/13 has been perceived as a challenge to fundamental rights review by both the ECtHR and national constitutional courts. The two questions of who has the final say in interpreting and upholding rights and what constitutes the appropriate human rights benchmark in an EU consisting of diverse national legal orders are inextricably linked in this context. Questions on the protection of fundamental rights in EU law are inextricably linked with national constitutional identity concerns.144 Reactions by national constitutional courts and by the Strasbourg Court, along with questions submitted by national courts in the form of references for preliminary ruling, have led to the considerable evolution of the CJEU approach towards mutual trust in the system of mutual recognition in criminal matters and the parameters of accommodating fundamental rights benchmarks in the cooperative process of recognition.145

A. The European Court of Human Rights The first signs of concern in Strasbourg regarding the ‘blind’ trust approach of the CJEU towards mutual recognition appeared in the case of Tarakhel,146 which involved transfers under the Dublin mutual recognition system. Rather than requiring a general finding of systemic deficiency in order to examine the compatibility of state action with fundamental rights, the Strasbourg Court stated that the presumption of compliance with fundamental rights was rebuttable147 and that effective protection of fundamental rights always requires an assessment of the impact of a decision on the rights of the specific individual in the specific case before the Court.148 In Tarakhel, this reasoning has resulted in a finding of a breach of the Convention with regard to specific individuals even in a case where generalised systemic deficiencies in the receiving state had not been ascertained.149 The Strasbourg Court built upon this approach shortly after the 144 For a view of constitutional identity understood as the product of an interactive process creating or interpreting constitutional sources, see G van der Schyff, ‘Member States of the European Union, Constitutions, and Identity: A Comparative Perspective’ in C Callies and G van der Schyff (eds), Constitutional Identity in a Europe of Multilevel Constitutionalism (Cambridge University Press 2020), 305–47, at 328. 145 See also V Mitsilegas, ‘Judicial Dialogue, Legal Pluralism and Mutual Trust in Europe’s Area of Criminal Justice’ (2021) 46 European Law Review 579, upon which sections VI–X build. 146 Tarakhel v Switzerland, App No 29217/12, judgment of 4 November 2014. It should be noted that in the following discussion, the term ‘CJEU’ will be used throughout to refer to the Court of Justice in all time contexts. 147 ibid para 103. 148 Halberstam sees Tarakhel as a strong warning signal to Luxembourg that the CJEU’s standard should accord either in words or in practice with what Strasbourg demands; otherwise, the Dublin system violates the Convention. See D Halberstam, ‘‘It’s the Autonomy, Stupid!’ A Modest Defense of Opinion 2/13 on EU Accession to the ECHR, and the Way Forward’, Michigan Law School, Public Law and Legal Theory Research Paper Series, Paper No 432, February 2015, 27. 149 Tarakhel (n 146) 115.

Mutual Trust as a Challenge to Fundamental Rights and Constitutional Identity 219 change in the CJEU approach in Aranyosi150 in the case of Avotiņš,151 which involved the assessment of the compatibility with the Convention of acts implementing the EU system of mutual recognition of decisions in civil matters. While the outcome of the judgment appeared conciliatory to the EU legal order,152 in its reasoning the Strasbourg Court, it questioned the CJEU approach in Opinion 2/13, noting that the fundamental rights scrutiny threshold therein ‘could in practice, run counter to the requirement imposed by the Convention according to which the court in the State addressed must at least be empowered to conduct a review commensurate with the gravity of any serious allegation of a violation of fundamental rights in the State of origin, in order to ensure that the protection of those rights is not manifestly deficient’.153 As to who has ultimate authority to scrutinise fundamental rights compliance, the Court reserved this power for itself, stating that ‘it must verify that the principle of mutual recognition is not applied automatically and mechanically to the detriment of fundamental rights’.154 National courts also have duties to review fundamental rights compliance of automatic mutual recognition. This duty arises ‘if a serious and substantiated complaint is raised before them to the effect that the protection of a Convention right has been manifestly deficient and that this situation cannot be remedied by European Union law’. In such situations, according to the Strasbourg Court, national courts cannot refrain from examining that complaint on the sole ground that they are applying EU law.155

B. National Constitutional Courts In terms of the outcome of judicial dialogue between the CJEU and the Spanish Constitutional Court in Melloni, the receiving national court was willing to accommodate the substance of the CJEU ruling in terms of the extent of fundamental rights protection in executing the EAW in these cases and to revisit Spanish domestic law in this light156 by modifying its previous interpretation of the Constitution in order to avoid conflict with EU law.157 However, the Spanish Constitutional Court did so without at the same time fully accepting the primacy of EU law; it stated that the Charter is only one of the sources of interpretation of the right to fair trial, along with the ECHR, and that both sources have mere interpretative value. Hence, as Torres Pérez has noted, the Spanish 150 See section VII below. 151 Avotiņš v Latvia, App No 17502/07, judgment of 23 May 2016. 152 P Gragl, ‘An Olive Branch from Strasbourg? Interpreting the ECtHR’s Resurrection of Bosphorus and Reaction to Opinion 2/13 in the Avotins Case: ECtHR 23 May 2016, Case No 17502/07, Avotiņš v Latvia’ (2017) 13 European Constitutional Law Review 551; J Snell, ‘Is Opinion 2/13 Obsolescent?’ (2017) 4 EL Rev 449. 153 Avotiņš (n 151), para 114. 154 ibid para 116. See also L Glas and J Krommendijk, ‘From Opinion 2/13 to Avotiņš: Recent Developments in the Relationship between the Luxembourg and Strasbourg Courts’ (2017) 17 Human Rights Law Review 567; D Düsterhaus, ‘The ECtHR, the CJEU and the AFSJ: A Matter of Mutual Trust’ (2017) 42 EL Rev 396. 155 Avotiņš (n 151) 116. 156 STC 26/2014, 13 February 2014. For an analysis, see L Bachmeier Winter, ‘Bypassing or Intensifying the Dialogue between Courts? The Impact of Melloni at the National Level’ in Mitsilegas, di Martino and Mancano (n 111) 404–20. 157 G van der Schyff, ‘Member States of the European Union, Constitutions, and Identity: A Comparative Perspective’ in Callies and van der Schyff (n 144) 358.

220 Mutual Recognition and Mutual Trust Constitutional Court portrayed the outcome of the case as if it has been autonomously reached and sent a clear message that it retains the last word in the event of a clash between the Spanish Constitution and EU law.158 A similar approach in reaction to Melloni, emphasising the final say by national constitutional courts that also set out the benchmark for fundamental rights scrutiny, was adopted by the German Constitutional Court (hereinafter ‘BVerG’).159 Unlike Melloni, this case did not involve a reference to Luxembourg – the BVerG declined to refer invoking the acte clair doctrine.160 It framed the issue, which involved the compatibility of the execution of an EAW with fundamental rights, as one of constitutional identity: it introduced the requirement of identity review of measures implementing the EAW when the principle of human dignity is at stake, using the principle of individual guilt to establish a direct link between the execution of an EAW and human dignity as an absolute right protected by the German Constitution. According to the BVerG, the constitutional identity review was a matter for itself and not for the CJEU. In this identity review, it is the national constitution and not EU law which provides the appropriate benchmark to assess compatibility with core rights.161 The ruling of the BVerG (hereinafter ‘the BVerG “EAW” Decision’) is also significant regarding its approach to the relationship between the protection of fundamental rights and mutual trust. The BVerG found that mutual trust has its limits and ‘can be shaken’162 if there are indications based on facts that the requirements indispensable for the protection of human dignity would not be complied with in the case of an EAW. While the BVerG ultimately found that the system established by EU law was not unconstitutional, it put forward a detailed mechanism of scrutiny of fundamental rights concerns by the executing authority on an individualised basis.163 The BVerG established for German authorities or courts when executing an EAW the constitutional obligation to ensure that the principles of Article 1, section 1 of the German Basic Law (the GrundGesetz) – as a manifestation of the principle of individual guilt – are complied with in the context of extraditions on the basis of an EAW. In particular, this obligation involves ensuring that the minimum guarantees of the rights of the accused will also be observed in the requesting Member State. Otherwise and where this is possible, extradition must not take place. The principle of mutual trust is limited by human dignity guaranteed under Article 1, section 1 GG.164 According to the BVerG, the fact that mutual trust is not applicable without limits even pursuant to EU law signifies that the national judicial authorities, when relevant indications exist, are authorised and obliged under EU law to review whether the rule of law requirements have been complied, even if the requirements of the EAW Framework Decision are formally met.165 The requirements

158 A Torres Pérez, ‘Melloni in Three Acts: From Dialogue to Monologue’ (2014) 10 European Constitutional Law Review 320. 159 BVerfG, Order of the Second Senate of 15 December 2015–2 BvR 2735/14 (the EAW I Decision). 160 ibid para 125. 161 See in this context G Anagnostaras, ‘Solange III? Fundamental Rights put under the National Identity Review’ (2017) 42 EL Rev 234. 162 EAW I Decision (n 159) para 67. 163 See ibid paras 63–72. 164 ibid para 83. 165 ibid para 105.

Mutual Trust as a Challenge to Fundamental Rights and Constitutional Identity 221 under EU law are not lower than the minimum guarantees prescribed under German law.166 The BVerG found that the German Act implementing the EAW FD did not raise concerns regarding the principle of individual guilt,167 but that it was the interpretation by the Higher Regional Court which was deficient in this case.168 Having ascertained that the obligation by national authorities to undertake a fundamental rights review was also a duty stemming from EU law,169 the BVerG developed detailed parameters for this review. There have to be reasonable grounds to believe that there is a risk of treatment contrary to human rights. As a rule, the obligation to produce specific factual prima facie evidence can only be dispensed with if there is a continuous practice of gross, obvious or systematic violations of human rights in the requesting state. Extradition to states that have a continuous practice of widespread and systematic violations of human rights will usually result in a violation of fundamental principles of the German constitutional order being probable.170 As a rule, an assurance that is given in extradition proceedings and that is binding under public international law is suitable to overcome potential concerns with regard to the permissibility of the extradition, unless it is to be expected that the assurance will not be complied with in the individual case.171 In terms of the basis of the review, the BVerG distinguished between two types of evidence: specific factual prima facie evidence and evidence that there is a continuous practice of gross, obvious or systematic violations of human rights in the requesting state, with the former only dispensed if the latter exists. The Court went on to grant wide leeway to courts in the evidence they may use, which can be ‘any means that, according to the rules of logic, to general or to scientific knowledge, are, or might be, suitable to convince themselves that facts that are essential for the decision exist and that the assessment or evaluation of facts is correct’.172 The BVerG established that the national court deciding on an extradition is obliged to proceed on a case-by-case examination by investigating the facts of the case, including the treatment that the requested person must expect in the requesting State.173 This applied irrespective of the existence of mutual trust within Europe.174 It is not possible to determine the content and the extent of the procedural obligation to investigate in judicial extradition proceedings in an abstract and general manner, as these are dependent upon the circumstances of the individual case.175 This investigation includes the legal situation and legal practice of the requesting Member State if the requested person has invoked sufficient indications that such an examination is warranted. If it is established that the requesting state does not comply with the minimum standards of human dignity, extradition must be declared impermissible.176 Thus, the BVerG here rejected the framing of mutual recognition in criminal matters on the basis of automaticity and

166 ibid

para 107. para 108. para 109. 169 ibid para 105. 170 ibid para 71. 171 ibid para 70. 172 ibid. 173 ibid paras 63–65. 174 Ibid. 175 ibid para 64. 176 ibid para 110. 167 ibid 168 ibid

222 Mutual Recognition and Mutual Trust almost blind trust, as promoted by the text of the EAW FD and by the case law of the CJEU. It put forward a system of a case-by-case examination of fundamental rights compliance by the executing authority on the basis of the acceptance that the presumption of mutual trust, stemming from the uncritical acceptance that fundamental rights are always respected in all EU Member States in the operation of the EAW system, is rebuttable. The approach of the BVerG on maintaining its prerogative to ultimately scrutinise compliance of EU law and its implementation on the basis of the Basic Law is reminiscent of its approach in the development of the Solange litigation.177 The BVerG EAW ruling has been criticised in evoking the identity review mechanism without the latter really fitting the facts of the case, as EU secondary law was found to be compliant with the German Constitution.178 According to Meyer, the BVerG artificially created a conflict in order to render the identity reservation applicable, claiming an unfettered and self-standing power of review.179 In doing so, the BVerG put down a marker regarding its ultimate authority to review the operation of mutual trust under EU law and the primacy of the German Constitution as a review benchmark. This emphasis on national authority is also demonstrated by the fact that the BVerG declined from embarking on a direct dialogue with Luxembourg by questionably declaring that the issue in question constituted ‘acte clair’. Limits to constitutional accommodation are clearly discerned here in terms of the BVerG statement of who is ultimately responsible to rule on the compatibility of mutual recognition with fundamental rights. In order to ascertain its authority, the BVerG also adopted a legally questionable approach from the perspective of EU law as regards the trigger of the identity review, as it extended the principle of guilt to cover the operation of the EAW and linked the guilt principle to the absolute right of human dignity.180 Linking the principle of guilt with the operation of the EAW further appears to be in contrast with the CJEU interpretation of the principle of legality in its first landmark ruling on the operation of the EAW, Advocaten voor de Wereld, where it found that the EAW is a matter of procedural law, involving cooperation between national authorities and not the substantive determination of guilt or innocence which will be determined under the law of the issuing Member State.181 In spite of these shortcomings, the ruling by the BVerG is of great significance for the evolution of the operation of mutual trust in Europe’s area of criminal justice. The BVerG rejected the evolution of the CJEU approach viewing mutual recognition in criminal 177 These similarities have prompted commentators to use the term ‘Solange III’ by referring to this ruling. See Anagnostaras (n 161); M Honig, ‘Human Dignity, Identity Review of the European Arrest Warrant and the Court of Justice as a Listener in the Dialogue of Courts: Solange III and Aranyosi’ (2016) 12 European Constitutional Law Review 549. 178 F Meyer, ‘“From Solange II to Forever I”: The German Federal Constitutional Court and the European Arrest Warrant (and How the CJEU Responded)’ (2016) 7 New Journal of European Criminal Law 283. Meyer eloquently distils his concerns by arguing that ‘the principle of individual guilt forms a congenial alliance with the identity reservation and, as a result, even minor procedural shortcomings may be tantamount to violations of human dignity. It is not difficult to see what a formidable tool such a bloated substantive principle could be in the hands of a court eager to regain jurisdictional primacy’ (at 281). 179 ibid. 180 J Nowag, ‘EU Law, Constitutional Identity, and Human Dignity: A Toxic Mix? Bundesverfassungsgericht: Mr R’ (2016) 53 CML Rev 1447. Nowag talks about human dignity as a ‘super human right’. For a discussion on human dignity as an absolute right, see Honig (n 177). 181 Advocaten voor de Wereld VZW (n 33).

A Paradigm Change by the Court of Justice 223 matters as operating on the basis of automaticity and blind trust with constitutional and fundamental rights concerns located at the periphery of the CJEU reasoning – and thus, as has been noted, contesting the actual capacity of the CJEU to guarantee a constitutionally acceptable level of fundamental rights protection.182 The BVerG elevated fundamental rights concerns arising from the operation of the EAW into constitutional concerns, rejected the operation of mutual recognition under blind trust or always presumed trust, and put forward detailed criteria for the scrutiny of fundamental rights compliance in the operation of the EAW system. It placed national courts under a duty to ensure that fundamental rights are complied with and provided detailed guidance on how such compatibility will be assessed. Although it declined to engage in a direct judicial dialogue with Luxembourg, the BVerG indirectly but clearly sent a clear signal that, while for now the compatibility of EU mutual recognition law with the German Constitution is accepted, fundamental rights concerns must be taken seriously in order for the EU system to maintain its legality.

VII. A Paradigm Change by the Court of Justice: The Dialogical and Interactive Model of Scrutinising Mutual Trust in Aranyosi The Court of Justice had the opportunity to directly examine the relationship between fundamental rights, mutual recognition and mutual trust – and arguably to respond indirectly to the BVerG – in the joined cases of Aranyosi and Căldăraru (hereinafter Aranyosi)183 both of which were referred to the CJEU for a preliminary ruling by a German court, the Higher Regional Court of Bremen. The reference was another opportunity for the CJEU to directly address the question of whether the execution of an EAW could be refused on the grounds of concerns over the violation of fundamental rights. The cases involved both prosecution and conviction warrants issued by authorities in states (Romania and Hungary) where concerns on serious violations of fundamental rights had emerged. The concerns of the German authorities centred on the impact of execution on Article 4 of the Charter in view of the existence of pilot judgments by the ECtHR confirming breaches of Article 3 ECHR on the grounds of the unacceptable state in prison conditions in both countries.184 The German Court raised two broad questions at the heart of the discussion on defining the parameters of mutual trust: the extent to which serious fundamental rights concerns could lead to the inadmissibility of an EAW; and the legal framework and content relating to the provision of assurances by the issuing authorities asserting compliance with fundamental rights. In a departure from earlier judgments, the CJEU crucially moved on to provide detailed guidelines to the executing authorities on how they must proceed when assessing the existence of a risk of inhuman or degrading treatment arising from the execution 182 Anagnostaras (n 161). 183 Joined Cases C-404/15 and C-659/15 PPU, Pál Aranyosi and Robert Căldăraru v Generalstaatsanwaltschaft Bremen, ECLI:EU:C:2016:198. 184 ibid paras 43–44 and 60–61.

224 Mutual Recognition and Mutual Trust of an EAW. The CJEU put forward a two-step approach. First, a general assessment of the risk must take place. Where the judicial authority of the executing Member State is in possession of evidence of a real risk of inhuman or degrading treatment of individuals detained in the issuing Member State, it is bound to assess the existence of that risk when it is called upon to decide on the surrender to the authorities of the issuing Member State of the individual sought by an EAW.185 To that end, the national court may rely on information that is objective, reliable, specific and properly updated on the detention conditions prevailing in the issuing Member State and that demonstrates that there are deficiencies, which may be systemic or generalised, or which may affect certain groups of people, or which may affect certain places of detention. Sources may include judgments of international courts, such as judgments of the ECtHR and judgments of courts of the issuing Member State, and also decisions, reports and other documents produced by bodies of the Council of Europe or under the aegis of the UN.186 National authorities are under a positive obligation to ensure that any prisoner is detained in conditions which guarantee respect for their human dignity, that the way in which detention is enforced does not cause the individual concerned distress or hardship of an intensity exceeding the unavoidable level of suffering that is inherent in detention, and that, having regard to the practical requirements of imprisonment, the health and wellbeing of the prisoner are adequately protected.187 However, a finding by the executing judicial authority that there is a real risk of inhuman or degrading treatment by virtue of general conditions of detention in the issuing Member State does not automatically signify that the execution of the EAW must be refused.188 Therefore, in addition to a general assessment of the risk, it will also be necessary for the executing judicial authority as a second step to proceed to a further specific and precise assessment of whether there are substantial grounds to believe that the individual concerned will be exposed to that risk because of the conditions for their detention envisaged in the issuing Member State.189 The executing authority is bound to determine whether, in the particular circumstances of the case, there are substantial grounds to believe that, following the surrender of that person to the issuing Member State, they will run a real risk of being subject in that Member State to inhuman or degrading treatment.190 Central to the assessment of risk at this stage is the establishment of a cooperative mechanism of interaction between the executing and the issuing authorities, in accordance with Article 15(2) of the EAW FD. A request must be made as a matter of urgency regarding all necessary supplementary information on the conditions in which it is envisaged that the individual concerned will be detained in that Member State.191 Such a request may also relate to the existence, in the issuing Member 185 ibid para 88. 186 ibid para 89. 187 ibid para 90. 188 ibid para 91. 189 ibid para 92. According to the CJEU, this is because the mere existence of evidence that there are deficiencies, which may be systemic or generalised, which may affect certain groups of people or which may affect certain places of detention with respect to detention conditions in the issuing Member State does not necessarily mean that, in a specific case, the individual concerned will be subject to inhuman or degrading treatment in the event that they are surrendered to the authorities of that Member State (at para 93). 190 ibid para 94. 191 ibid para 95.

A Paradigm Change by the Court of Justice 225 State, of any national or international procedures and mechanisms for monitoring detention conditions, linked, for example, to visits to prisons, which make it possible to assess the current state of detention conditions in those prisons.192 A time limit for the receipt of the supplementary information may be fixed, which must be adjusted to the particularities of each case and must equally respect time limits set in Article 17 of that Framework Decision.193 The issuing judicial authority is obliged to provide that information to the executing judicial authority.194 If on the basis of the information provided the executing judicial authority finds that there exists a real risk of inhuman or degrading treatment for the individual in respect of whom the EAW was issued, then the execution is postponed, but it cannot be abandoned.195 Until the point of obtaining supplementing information that would discount the existence of a risk of inhuman or degrading treatment, a decision on the surrender must be postponed, but if the existence of that risk cannot be discounted within a reasonable time, the executing judicial authority must decide whether the surrender procedure should be brought to an end.196 Aranyosi is a landmark judgment and a turning point in the Court’s approach on mutual trust. It confirms a shift from automatic mutual recognition based on uncritical mutual trust (or, as the CJEU President Koen Lenaerts has put it, ‘blind trust’)197 to earned trust on the basis of an individualised assessment of the fundamental rights consequences of surrender on the ground.198 Aranyosi is significant here in two respects: in confirming the requirement for the executing authority to examine the impact of the surrender on an individual basis; and in emphasising the need for an assessment not only of the law, but also of the practice of fundamental rights protection as regards the individual concerned.199 From a pluralist perspective, Aranyosi is significant in establishing a dialogical model of interaction between the authorities operating mutual recognition and in launching a cooperative relationship between national authorities responsible for operating the EAW, with the Court providing reasonably detailed guidance on the dialogue between national authorities under Article 15 of the EAW FD. In this context, the CJEU appears to have been inspired by the fundamental rights review approach adopted by the BVerG,200 Although Aranyosi is not the outcome of a direct dialogue between the CJEU on the one hand and the BVerG on the other, its reasoning and outcome can be seen as a recognition by the CJEU of the approach taken by the BVerG regarding mutual trust.201 In taking on board the approach of the BVerG, the CJEU in Aranyosi also avoided, from a vertical perspective, a constitutional clash 192 ibid para 96. 193 ibid para 97. 194 ibid para 97. 195 ibid para 98. 196 ibid para 104. 197 K Lenaerts, ‘La Vie Après L’Avis: Exploring the Principle of Mutual (Yet Not Blind) Trust’ (2017) 54 CML Rev 806. According to President Lenaerts, mutual trust is not to be confused with blind trust. 198 Writing on the need for earned trust before Aranyosi, see Mitsilegas, (n 4) ch 5. 199 V Mitsilegas, ‘Re-setting the Parameters of Mutual Trust: From Aranyosi to LM’ in Mitsilegas, di Martino and Mancano (n 111) 421–36. 200 See also G Anagnostaras, ‘Mutual Confidence is Not Blind Trust! Fundamental Rights Protection and the Execution of the European Arrest Warrant: Aranyosi and Caldararu’ (2016) 53 CML Rev 1702. 201 Lanearts (n 197) 807. According to President Lenaerts, the contours of principle are not set in stone, but will take concrete shape by means of a constructive dialogue between the CJEU, the ECtHR and national courts.

226 Mutual Recognition and Mutual Trust with the German court and recognised implicitly but clearly national constitutional concerns. While a number of questions regarding the mode and substance of fundamental rights scrutiny and the extent of dialogue between national authorities remain open, Aranyosi has been a game-changer in terms of both the vertical and the horizontal relations of courts in Europe.

VIII. Aranyosi as a Catalyst for Calm in the Battle for Authority and Primacy The ruling in Aranyosi has signified a step-change in its relations with the ECtHR and the BVerG. The post-Aranyosi era has led, at least in the short term, to a more open approach by both the Strasbourg Court and the BVerG to Luxembourg’s new approach on mutual recognition. Both courts made steps to accommodate the method of fundamental rights scrutiny via judicial dialogue and interaction introduced in Aranyosi, and both framed the protection of fundamental rights within the broader objectives of cooperation underpinning the intra-EU system of mutual recognition in criminal matters, while at the same time maintaining their own prerogatives for fundamental rights scrutiny.

A. The European Court of Human Rights The ECtHR case law has evolved significantly in this context. The ECtHR confirmed the applicability of its ruling in Avotiņš (which involved the scrutiny of an EU mechanism of mutual recognition in civil matters based on a Regulation) to the system of mutual recognition set up by the EAW FD and developed its approach further, taking into account developments in Luxembourg.202 In the case of Pirozzi,203 the ECtHR reiterated its recognition of the importance of mutual recognition mechanisms for the construction of the AFSJ and of the mutual trust they necessitate and of the legitimacy of the AFSJ, but stressed that its construction must not breach fundamental rights.204 It reiterated the applicability of the Bosphorus presumption205 in cases where there was no margin of appreciation, but again confirmed that this presumption is rebuttable. Following Avotiņš,206 the Court must verify that the principle of mutual recognition is not applied in an automatic and mechanical manner/fashion to the detriment of fundamental rights.207 The Strasbourg Court confirmed that if there are concerns regarding the manifest inadequacy in the protection of Convention rights in an EU Member State and EU law cannot remedy this inadequacy, states cannot renounce their obligation 202 On Avotiņš see section 3 above. 203 Pirozzi v Belgium, App No 21055/11, judgment of 17 April 2018. 204 ibid paras 59–61. 205 Bosphorus Hava Yolları Turizm ve Ticaret Anonim Şirketi v Ireland, App No 45036/98, judgment of 30 June 2005. 206 Avotiņš v Latvia (n 151). 207 Pirozzi (n 203) para 62.

Aranyosi as a Catalyst for Calm in the Battle for Authority and Primacy 227 to examine the complaint on the sole ground that they are applying EU law – they must apply EU law in conformity with the ECHR.208 For the Strasbourg Court, it is thus the ECHR (and not the Charter or EU law) which is the ultimate benchmark for the scrutiny of respect for fundamental rights in the EU system of mutual recognition. And it is the Strasbourg Court which retains the authority to review the compatibility of the operation of mutual recognition with the Convention. The ECtHR fine-tuned its approach in the more recent judgment in Romeo Castańo.209 It accepted the approach of the CJEU regarding the scrutiny of the fundamental rights consequences of the execution of the EAW, requiring a concrete and substantiated examination of the situation and the identification of a real and individualised risk of human rights violations in the issuing state.210 It found the executing authorities in breach of their obligations for failing to conduct such an individualised and complete examination.211 It is noteworthy that the Court based its reasoning on the violation of the duty of cooperation emanating from Article 2 ECHR,212 this entailing a duty for states to act jointly and to cooperate in order to protect human rights, which also means that states must in good faith exhaust possibilities for cooperation.213 Evoking the duty of cooperation could be seen as mirroring the use by the CJEU of the EU law principle of loyal cooperation as the foundation of a dialogical model of fundamental rights scrutiny in the operation of mutual recognition. In this manner, the Strasbourg Court translates the cooperative and dialogical model of interaction between national authorities in the context of the operation of mutual recognition in criminal matters in EU law to a similar cooperative model as regards upholding ECHR rights, with national authorities placed under such duties under the ECHR. The ruling in Romeo Castańo is remarkable in highlighting (in a similar way, as will be seen below, with the BVerG) the importance of not too readily refusing to execute an EAW: the ECtHR found an EU Member State to be in violation of the Convention for refusing to execute an EAW on fundamental rights grounds too readily and for failing to engage seriously with the second stage of human rights scrutiny put forward by the CJEU in Aranyosi.214 In turn, this finding by the ECtHR was subsequently quoted by the CJEU in the case of Dorobantu215 to further back up the requirement by national authorities to carry out an up-to-date and detailed examination of the situation in the issuing state.216 While there appears to be convergence between Strasbourg and Luxembourg as regards the parameters of fundamental rights scrutiny by national authorities, the

208 ibid para 64. 209 Romeo Castańo v Belgium, App No 8351/17, judgment of 9 July 2019. 210 ibid para 86. The national court did not proceed towards a substantiated examination of the situation prevailing in 2016 and did not seek to identify a real and individualised risk of violation of Convention rights or structural deficiencies in detention conditions. 211 ibid paras 86–90. 212 ibid para 91. 213 ibid para 81. 214 The judgment contains express references to the CJEU rulings in Aranyosi and ML: Aranyosi (n 183) para 24. 215 See section IX below. 216 Case C-128/18, Dorobantu, EU:C:2019:857. In Dorobantu, the CJEU referred to Castańo on the requirement to carry out an up-to-date and detailed examination of the situation as it stood at the time of its decision (at para 57). For further analysis of Dorobantu, see section IX below.

228 Mutual Recognition and Mutual Trust situation remains unresolved in terms of ultimate authority – who has the final say on fundamental rights review and under which benchmarks. In Romeo Castańo, the Strasbourg Court did not hesitate to conduct scrutiny itself of the operation of the EU law system of mutual recognition, thus reserving its prerogative to rule on human rights violations in the operation of this system (arguably exactly the situation which the CJEU wished to avoid with Opinion 2/13). In this context, the Strasbourg Court has reiterated – even after Aranyosi – the non-automaticity of mutual recognition and the fact that national jurisdictions cannot refrain from the examination of fundamental rights violations complaints on the sole ground that they apply EU law; these jurisdictions must apply EU law in conformity with the Convention.217 According to the Strasbourg Court, the ECHR remains a benchmark for human rights scrutiny of EU law, and national courts (and the Strasbourg Court) are under a duty to uphold the compliance of EU law with the Convention.218

B. The Bundesverfassungsgericht The post-Aranyosi era has further marked the beginning of a more open and synergetic approach by the BVerG towards the CJEU. The BVerG now encourages national courts to engage with the CJEU on questions of the interpretation of fundamental rights scrutiny of the EAW and to embrace the dialogical model put forward by the Court (and, as seen above, influenced by the case law of the BVerG). In contrast to its earlier ‘acte clair’ acceptance, the BVerG has criticised post-Aranyosi lower German courts which have declined to send preliminary references to Luxembourg for interpretation of questions concerning the parameters of mutual trust in the EAW system.219 Linked to the more cooperative approach by the BVerG is its alignment with the CJEU in terms of the substantive need to avoid impunity in Europe’s area of criminal justice: national courts should not readily refuse to execute EAWs on fundamental rights concerns grounds if they have not made full use of the preliminary reference procedure on matters which have not been already subject to interpretation.220 Once the CJEU has accepted its approach on scrutinising fundamental rights, the BVerG is now content with the former providing guidance on the extent of judicial dialogue between national authorities, and on the EU benchmarks for fundamental rights protection forming the basis for mutual

217 Pirozzi (n 203) para 64, referring to Avotiņš (n 151) para 116. 218 See also the ECtHR judgment of 25 March 2021 in Bivolaru and Moldovan v France, App Nos 40324/16 and 12623/17, where the Strasbourg Court scrutinised a decision by a national authority to execute an EAW and found that in one of the cases, the decision to execute, deferring to the statements of the issuing state on fundamental rights protection, was in breach of art 3 of the Convention. The Court found that in this case, the protection of fundamental rights had therefore been manifestly deficient, such that the presumption of equivalent protection was rebutted. 219 See the judgment of BVerG 2017 2, BvR 424/17 (the EAW II Decision). According to the BVerG, in the event that doubts arise regarding the application or interpretation of EU law, regular courts must, first of all, refer the relevant questions to the CJEU – failure to comply infringes the right to one’s lawful judge guaranteed to the person seeking legal protection in the initial proceedings (para 36). The BVerG has granted a broad remit to the CJEU intervention, noting that the issue at hand has not yet been fully resolved by the CJEU (para 48). 220 IBVerG (EAW II Decision) at para 57.

Aranyosi as a Catalyst for Calm in the Battle for Authority and Primacy 229 trust, with sustained references by German courts generating significant CJEU case law in the field.221 The ultimate review by the BVerG in the event that it is not satisfied with the CJEU responses on the respect of fundamental rights always remains in the background. The openness of the BVerG towards Luxembourg can be explained by another factor: the transfer to the CJEU of the challenging task to develop concrete standards to be followed by national courts in their determination on whether to surrender or not an individual when fundamental rights concerns regarding their surrender have arisen. It has been argued that it is the CJEU which is required to develop precise standards in this context to give guidance to national courts.222 Following the emergence of this judicial dialogue, a further step in reconfiguring the relationship between national constitutional identity and the primacy of EU law in EAW cases was taken by the BVerG in a judgment delivered in December 2020 (the EAW III Decision).223 In this important judgment, the BVerG ruled that it is the fundamental rights of the EU, rather than the German Constitution, which are fundamentally decisive on legal questions that are completely determined by EU law, with the fundamental rights enshrined in the Basic Law not being used as a direct benchmark on these questions.224 A limitation of the primacy of the application of EU law in the context of identity checks on the basis of Article 79(3) of the German Constitution in conjunction with Article 1(1) is not justified in the present case in view of the protection of fundamental rights guaranteed by Article 4 of the Charter.225 However, this move towards accepting the primacy of EU law and the Charter as a benchmark for the assessment of fundamental rights compliance is not absolute. According to the BVerG, in interpreting the Charter, both the ECHR and national constitutional benchmarks must be used,226 with the ECHR being of primary importance in the present case: an interpretation that is ‘friendly’ to EU and international law is essential for mutual trust and requires the indispensable minimum requirements for detention conditions to be determined in accordance with the standards set out by the ECtHR and adopted by the CJEU.227 Moreover, the final say on such an assessment ultimately remains not with Luxembourg, but with the BVerG – identity review remains a limitation to the primacy of EU law.228 It is noteworthy that in the present ruling, the BVerG reverted back to its approach in its earlier EAW ruling and declined to refer itself the question of the compatibility of the execution of the EAW in question with fundamental rights to the CJEU by ruling that this was a case of acte clair.229 It thus appears that the BVerG is content with direct judicial dialogue to be triggered between lower German courts and the CJEU, but not between itself and the CJEU. Referring to case law by the CJEU case law on the basis of

221 See below. 222 S Röß, ‘The Conflict between European Law and National Constitutional Law Using the Example of the European Arrest warrant’ (2019) 25 European Public Law 25. 223 BVerG, judgment of 1 December 2020–2 BvR 1845/18 – Rn 1-85, www.bverfg.de/e/rs20201201_2bvr184518. html (the EAW III Decision). 224 ibid para 36. 225 ibid para 7. 226 ibid para 2. 227 ibid para 63. 228 ibid para 58. 229 ibid para 81 – note the references to Dorobantu.

230 Mutual Recognition and Mutual Trust rulings triggered by preliminary references by German courts (in particular Dorobantu) and by the ECtHR230 (in particular Romeo Castańo),231 the BVerG developed itself the interpretation of fundamental rights compatibility of the execution of the EAW, ruling that the CJEU approach is compatible with fundamental rights,232 and applying its case law to reverse decisions of lower courts and ruling that surrender would be in breach of fundamental rights.233 The BVerG thus triggered the elaboration of fundamental rights benchmarks by the CJEU by requiring lower courts to send preliminary reference requests to Luxembourg, and then used the ensuing CJEU case law by offering its own interpretation to apply to domestic cases. This approach can be seen as another veiled sign to influence Luxembourg as to its interpretation of future cases involving fundamental rights concerns on the EAW.234 The BVerG declined to refer to the CJEU a question that could be seen as a natural candidate for a preliminary reference and to which it is likely that the CJEU would have given a different, more EAW-friendly answer.

IX. Contesting the Parameters of Mutual Trust after Aranyosi: Fundamental Rights The CJEU’s ruling in Aranyosi has resulted in ongoing dialogue between national courts in order to establish the parameters of mutual trust in cases where fundamental rights concerns have arisen regarding the execution of an EAW. A number of further questions have arisen in the course of this dialogue regarding the extent to which the executing authority can examine the compatibility of execution with fundamental rights and, relating to this matter, the extent to and manner in which the executing authority can scrutinise the legal system of the issuing Member State to ensure that fundamental rights will be upheld. The absence of clear answers to these questions has led to a second level of judicial dialogue between national courts and the CJEU. This dialogue takes the form of the submission of preliminary references, where the Luxembourg Court is asked to develop benchmarks underpinning the operation of mutual trust in Europe’s area of criminal justice. This dialogue is also ongoing, and in the field of fundamental rights protection has been driven primarily thus far by German courts, following the BVerG opening up to Luxembourg post-Aranyosi. The first major case in determining the parameters and limits of horizontal judicial dialogue was ML,235 which concerned the determination of fundamental rights compliance of detention conditions in the issuing state. This was another reference by the High Court in Bremen, which posed the CJEU with a number of questions about the extent 230 ibid paras 43–55. 231 See this section above. 232 The BVerG endorsed in principle the CJEU’s approach in Aranyosi as developed in Dorobantu (EAW III Decision (n 223) paras 45–56). For a commentary, see M Wendel, ‘Grundrechtswende zur Jahreswende’ Verfassungsblog (1 January 2021), https://verfassungsblog.de/grundrechtswende-zur-jahreswende. 233 EAW III Decision (n 223) para 70. 234 On the role of preliminary references by German courts, see also W Michl, ‘Brott statt Böller’ Verfassungsblog (30 December 2020), https://verfassungsblog.de/brot-statt-boller. 235 Case C-220/18 PPU, ML (Generalstaatsanwaltschaft,- Conditions of Dentention in Hungary), EU:C: 2018:589.

Contesting the Parameters of Mutual Trust after Aranyosi: Fundamental Rights 231 of the obligation of assessment by the executing authority of detention conditions in the state of the issuing authority. The Court found that requesting information about all the prisons located in the issuing state leading to an obligation on the part of the executing judicial authorities to assess the conditions of detention in all the prisons in which the individual concerned might be detained was clearly excessive and runs counter to the effectiveness of the EAW surrender system on the basis of facilitating and accelerating surrenders within the strict time limits set out in the Framework Decision.236 The Court linked the existence of mutual trust between Member States with the model of speedy cooperation established under the tight deadlines for execution set out in the EAW FD to assert that executing authorities are solely required to assess the conditions of detention in the prisons in which, according to the information available to them, it is actually intended that the person concerned will be detained, including on a temporary or transitional basis. According to the CJEU, the compatibility with the fundamental rights of the conditions of detention in the other prisons in which that person may possibly be held at a later stage is a matter that falls exclusively within the jurisdiction of the courts of the issuing Member State.237 This narrow interpretation of the remit of assessment by the executing authority was linked with a broader attempt by the Court not to strengthen distrust in the operation of the dialogue mechanism established by Article 15 of the EAW FD and the Aranyosi ruling. In ML, the Court noted that the executing authority (the Bremen Public Prosecutor’s Office) had sent no fewer than 78 questions to its Hungarian counterparts.238 The Court noted that those questions, because of their number, scope and content, in practice made it impossible for the authorities of the issuing Member State to provide a useful answer, given, in particular, the short time limits laid down in Article 17 of the EAW FD.239 A request of that nature, which according to the CJEU results in the operation of the EAW being brought to a standstill, is not compatible with the duty of sincere cooperation under Article 4(3) TEU, which must inform the dialogue between the executing and issuing judicial authorities when, inter alia, information is provided pursuant to Article 15(2) and (3) of the EAW FD.240 The Court applied the duty of loyal cooperation ‘in full mutual respect’ not only to the requests of information by the issuing authority but also to the provision of assurances by the executing authority concerning the actual and precise conditions in which the person concerned will be detained in the issuing Member State.241 According to the Court, in view of the mutual trust which must exist between the judicial authorities of the Member States and on which the EAW system is based, the executing authority must rely on the assurance given by the issuing authority, at least in the absence of any specific indications that the detention conditions in a particular detention centre are in breach of Article 4 of

236 ibid paras 81–84. The Court also justified this view on the basis of the need to avoid impunity of the requested persons, and in particular in this case where it was deemed that the requirements of art 4(6) of the EAW FD were not met (at paras 85–86). 237 ibid para 87. 238 ibid para 107. 239 ibid para 103. 240 ibid para 104. 241 ibid paras 109 and 110.

232 Mutual Recognition and Mutual Trust the Charter.242 A failure to give effect to such an assurance, insofar as it may bind the entity that has given it, may be relied on as against that entity before the courts of the issuing Member State.243 A key follow-up to ML was the case of Dorobantu,244 where the Higher Regional Court of Hamburg, which had been criticised (as seen above) by the BVerG for failing to refer to Luxembourg,245 effectively asked the CJEU to provide it with a precise, harmonised minimum size of prison cells which would be considered compatible with the Charter.246 In its response, the Court again attempted to balance the requirement for an effective fundamental rights scrutiny with effectiveness in the operation of the system of mutual recognition in criminal matters. In terms of the extent and scope of review by the issuing authority, the Court followed ML to find that an obligation on the part of the executing authorities to assess the conditions of detention in all the prisons in which the individual concerned might be detained in the issuing Member State would be clearly excessive and that it would be impossible to fulfil such an obligation within the periods prescribed in Article 17 of the Framework Decision.247 The Court went on to place considerable weight on the provision of assurances by the executing authority. When the assurance that the person concerned will not suffer inhuman or degrading treatment on account of the actual and precise conditions of their detention, irrespective of the prison in which they are detained in the issuing Member State, has been given or at least endorsed by the issuing judicial authority, the executing judicial authority must rely on that assurance, at least in the absence of any specific indications that the detention conditions in a particular detention centre are in breach of Article 4 of the Charter.248 It is only in exceptional circumstances, and on the basis of precise information, that the executing authority can find that, notwithstanding such an assurance, there is a real risk of the person being subject to inhuman or degrading treatment.249 In its attempt to ensure the effectiveness of the EAW FD when fundamental rights are being scrutinised by national authorities, the Court of Justice went further than its ruling in ML by bringing back Melloni with a vengeance and stating that the executing authority may make surrender subject only to compliance with the requirements of Article 4 of the Charter and Article 3 ECHR, and not with those resulting from its own national law, even if the standards of the latter are higher.250 On the other hand, the Court reiterated the absolute character of Article 4 of the Charter,251 stating expressly that the finding of a real risk

242 ibid para 112. 243 ibid para 111. 244 Dorobantu (n 216). 245 See section VIII.B above. 246 In support of detailed guidance by the CJEU, see S Röß, ‘The Conflict between European Law and National Constitutional Law Using the Example of the European Arrest Warrant’ (2019) 25 European Public Law 25. 247 Dorobantu (n 216) para 64. 248 ibid para 68. 249 ibid para 69. 250 ibid para 79, with a direct reference to Melloni (n 116) para 63. The Court noted that by casting doubt on the uniformity of the standard of protection of fundamental rights as defined by EU law, the opposite solution would undermine the principles of mutual trust and recognition and would therefore compromise the efficacy of the Framework Decision. 251 Dorobantu (n 216) para 82.

Contesting the Parameters of Mutual Trust after Aranyosi: Fundamental Rights 233 of a breach cannot be weighed, for the purposes of deciding on that surrender, against considerations relating to the efficacy of judicial cooperation in criminal matters and to the principles of mutual trust and recognition.252 ML and Dorobantu demonstrate that key aspects of the parameters of establishing mutual trust via judicial dialogue between national authorities remain contested. They also demonstrate that the Court, in its position as interlocutor with national courts at the second level of judicial dialogue under the preliminary reference procedure, is facing the challenge of developing credible and concrete guidance principles for the interaction between national courts, while at the same time being in the delicate position of balancing the respect of fundamental rights requested by national courts with the maintenance of a degree of mutual trust which will not undermine the effectiveness of the enforcement objectives of mutual recognition in criminal matters. The case law thus far has not always got the balance right, most notably regarding the degree of mutual accommodation it has allowed in the system and regarding the effectiveness of fundamental rights scrutiny its rulings will allow. There are two principal shortcomings in the Court’s case law thus far: the limits it places on judicial dialogue in terms of the scrutiny of fundamental rights by the issuing authority; and, linked to that, the uncritical faith in the concept and provision of assurances. Both of these elements may end up bringing back automaticity and blind trust through the back door. In terms of limits to judicial dialogue by strictly circumscribing the parameters of fundamental rights scrutiny by the issuing authority, the Court has admittedly attempted to strike a balance in the face of cases showing a substantial level of mistrust towards the executing state. It evoked the principle of loyal cooperation to introduce in essence a proportionality test regarding the use of the cooperative mechanism under Article 15 EAW FD by the executing authorities – the questions they raise must not be excessive. However, the Court’s insistence on the focus on scrutiny of individual instances of fundamental rights protection in the executing state is limiting. In a number of cases, it may be difficult to reconcile this approach with the existence of real concerns of the executing authority with regard to the fundamental rights risks for the individual after the execution of the EAW, as the criminal justice process proceeds in the executing state. The limits of the Court’s approach are further demonstrated in the resurgence of the Melloni doctrine in Dorobantu. This can be seen as another attempt to promote an uncritically accepted concept of mutual trust by reiterating the primacy and autonomy of EU law over national constitutional benchmarks. While the BVerG has gradually moved from mistrust to trust, the opposite trend can be discerned here. Yet the applicability of Melloni in this case can be questioned. In Melloni, the Court based its ruling on the perceived (but questionable)253 harmonisation of national law on the basis of the existence of secondary EU law on judgments in absentia. Yet, as the Court accepted in Dorobantu, no such harmonisation exists currently with respect to detention conditions.254 Thus, it is unclear what the ‘European’ benchmark on detention 252 ibid para 84. 253 For a critique, see V Mitsilegas, ‘The Symbiotic Relationship between Mutual Trust and Fundamental Rights in Europe’s Area of Criminal Justice’ (2015) 6(4) New Journal of European Criminal Law 460. 254 See Dorobantu (n 216) para 71. The Court appears to leave the door open for future harmonisation in the field, referring to the absence, currently, of minimum standards in EU law.

234 Mutual Recognition and Mutual Trust conditions currently is, with this being defined on a case-by-case, incremental basis, with the Court basing its findings on Strasbourg case law and refraining from adopting generalised standards in the field,255 notwithstanding calls for greater clarity by national courts.256 The option left for national courts seems to be to refer questions of interpretation of these benchmarks to Luxembourg on an ongoing basis and brings into the fore the question of the need for further harmonisation of criminal procedure rules at the EU level (including in the field of detention) in order to provide clearer fundamental rights benchmarks for judicial dialogue. A further limit to promoting mutual accommodation and effective scrutiny of fundamental rights in the executing state arises from the growing reliance of the CJEU upon the concept of assurances. This is a concept of public international law uncritically transplanted into the EU legal order, with questions arising in this context, including how assurances given by governments in the context of international extradition law can be translated into assurances given by a judicial authority as regards the criminal process as a whole (including detention conditions and subsequent trial) in the executing state.257 Importantly, the blind faith in assurances underlines everything that has been copiously gained and entrenched after many years in Aranyosi in terms of moving from presumed/blind trust to earned trust based on effective and substantive dialogue between judicial authorities. What place is left for such dialogue if the issuing authority is asked to blindly accept at face value an assurance from the executing authority? This approach risks re-introducing ‘blind trust’ – which it is claimed that the Court rejected in Aranyosi258 – by the back door during a later stage of the EAW procedure. Blind trust now applies at the second stage of the Aranyosi review of fundamental rights compliance. The over-reliance on assurances is problematic as it may serve to evade meaningful scrutiny of fundamental rights compliance at the second stage of the Aranyosi review, while at the same time – by focusing on the execution of specific mutual recognition requests – to disincentivise Member States from striving to improve fundamental rights protection at a more systemic level. While leading to some short-term enforcement victories leading to the execution of certain EAWs, this approach is shortsighted in doing nothing to address the bigger underlying issues of mutual mistrust among Member States by refraining from tackling head-on systemic problems of fundamental rights compliance in the criminal justice systems of Member States in the AFSJ. These shortcomings bring to the fore the need to rigorously monitor the meeting of assurances, based on the principle of loyal cooperation, and the need to discuss more

255 See ibid, where it is noted that on that basis, it must be noted that the Court has relied – having regard to the considerations referred to in para 58 of the present judgment, and in the absence (currently) of minimum standards in that respect under EU law – on the case law of the ECtHR in relation to art 3 ECHR and, more specifically, on the judgment of 20 October 2016, Muršić v Croatia (CE:ECHR:2016:1020JUD000733413). 256 Röß (n 246). 257 P Caeiro, ‘“Scenes from a Marriage”: Trust, Distrust and (Re)assurances in the Execution of a European Arrest Warrant’ in S Carrera, D Curtin and A Geddes (eds), 20 Years Anniversary of the Tampere Programme: Europeanisation Dynamics of the EU Area of Freedom, Security and Justice (European University Institute, 2020) 239–50. Caeiro notes that the notion of assurances in ML seems to correspond broadly to that used in classic judicial cooperation, because the assurances refer to the way in which the surrendered person will be dealt with, in cases that presuppose, to some extent, a situation of distrust (at 241). 258 Lenaerts (n 197).

Contesting the Parameters of Mutual Trust after Aranyosi: The Rule of Law 235 broadly the need for establishing a meaningful level playing field for fundamental rights protection in Europe’s area of criminal justice.259

X. Contesting the Parameters of Mutual Trust after Aranyosi: The Rule of Law In Aranyosi, ML and Dorobantu, the Court of Justice attempted to develop guidelines on judicial dialogue in cases involving concerns regarding violations of the absolute right enshrined in Article 3 ECHR and Article 4 of the Charter. The question has thus arisen as to whether the same approach applies regarding violations of other rights – and, in particular, the right to fair trial. The question is inextricably linked to the broader question of the existence and extent of mutual trust in Europe’s area of criminal justice and the extent of mutual accommodation of national diversity in cases where serious rule of law concerns arise. Growing and persistent rule of law concerns linked to attacks on the independence of the judiciary in certain EU Member States have led to an emerging dialogue between both issuing and executing authorities, but also between executing authorities and the Court of Justice, which is increasingly called upon to rule on the extent of mutual accommodation in cases if serious rule of law concerns raised by the authorities requested the execution of an EAW.

A. Extending the Aranyosi Test to the Rule of Law: LM The first landmark judgment by the Court of Justice which extended dialogue between national courts to ascertaining the compatibility of EAW execution with the rule of law followed a preliminary reference from the Irish High Court.260 The High Court argued that ‘the rule of law in Poland has been systematically damaged by the cumulative impact of all legislative changes that have taken place over the last two years’261 and noted that it was difficult to see ‘how individual guarantees can be given by the issuing judicial authority as to fair trial when it is the system of justice itself that is no longer operating under the rule of law’ (emphasis added).262 Addressing the issue in LM,263 the Court of Justice extended the Aranyosi approach to cases where the rule of law is at stake from the perspective of the right to a fair trial viewed under Article 47 of the Charter. It stated from the outset that judicial independence ‘forms part of the essence of the fundamental right to a fair trial, a right which is of cardinal importance as a guarantee that all the rights which individuals derive from EU law will be protected and that the values common to the Member States set out in Article 2 TEU, in particular the value of the rule of law, will be safeguarded’.264 It expressly referred to safeguards for

259 On

the establishment of a level playing field on fundamental rights, see further section XI below. for Justice and Equality v Artur Celmer [2018] IEHC 119. 261 ibid para 124. 262 ibid para 142. 263 Case-216/18 PPU, Minister for Justice and Equality v LM, EU:C:2018:586. 264 ibid para 48. 260 Minister

236 Mutual Recognition and Mutual Trust judicial independence in the context of domestic cases it developed in its judgment of February 2018 concerning the reduction in the remuneration of Portuguese judges,265 where the CJEU linked judicial independence to safeguarding the rule of law and the right to an effective remedy,266 and noted that judicial independence is also essential in the context of the EAW mechanism.267 The CJEU also applied the Aranyosi two-step test in rule of law cases.268 Rule of law deficiencies in the legal system of the issuing state are not enough to suspend execution; the executing authority is required to assess whether there is a risk of violation in the particular circumstances of the case.269 The executing authority should enter into dialogue with the issuing authority270 and follow the two-step text even when the Commission has already adopted a reasoned proposal ascertaining rule of law breaches in accordance with Article 7(1) TEU regarding the issuing Member State.271 The Court’s ruling in LM is of far-reaching significance as it paves the way for rule of law scrutiny in the context of the operation of the EAW. The dialogue between the Irish Court and the CJEU, and the resulting application of the Aranyosi test triggering a dialogue between national authorities, constitutes a key example of ongoing, bottomup scrutiny of the rule of law across the EU. This bottom-up scrutiny can go a long way towards addressing the shortcomings of law and practice in relation to the operation of Article 7 TEU and the role and limits of EU institutions in effectively scrutinising rule of law compliance in Member States.272 This scrutiny is central for the credible and effective operation of the EAW system, involving cross-border cooperation based on mutual trust. Rule of law scrutiny here occurs in a mechanism involving courts rather than the executive. It is a mechanism which promotes dialogue and horizontal interactions, and stresses the importance of rule of law compliance and scrutiny on the ground – thus, to use the words of President Lenaerts, upholding the rule of law through judicial dialogue.273 This dialogue enables executing authorities to scrutinise the rule of law situation in the issuing state in detail and to involve a variety of sources, thus amplifying the sources of rule of law scrutiny on the ground. However, LM is not without its shortcomings. The Court has insisted on applying the Aranyosi two-step test even in cases where there are serious rule of law concerns arising from the initial level of dialogue and scrutiny of the system of the issuing state undertaken by the executing authority. In such situations, it is not realistic to expect the executing authority to accommodate the outcome of a legal and criminal justice system which it deems to be rule of law-deficient; the

265 Case-64/16, Associação Sindical dos Juízes Portugueses v Tribunal de Contas (ASJP), EU:C:2018:117. See LM (n 263) paras 51–54. 266 See A Arnull, ‘Article 47 CFR and National Procedural Autonomy’ (2020) 45 European Law Review 681. 267 LM (n 263) para 55. 268 ibid paras 59–66. 269 ibid para 68. 270 ibid para 76. 271 ibid para 69. It is only upon the determination of a serious and persistent breach by the European Council that the obligation ceases to exist (at para 70). 272 S Carrera and V Mitsilegas, ‘Upholding the Rule of Law by Scrutinising Judicial Independence’, CEPS Commentary (2018), https://www.ceps.eu/publications/upholding-rule-law-scrutinising-judicial-independenceirish-courts-request-preliminary. 273 K Lenaerts, ‘Upholding the Rule of Law through Judicial Dialogue’ (2019) 38 Yearbook of European Law 3. Lenaerts views the EU protection of the national judicial function as a basis for mutual trust (at 6–8).

Contesting the Parameters of Mutual Trust after Aranyosi: The Rule of Law 237 key question arising here is whether it is feasible to expect that the execution of an EAW will be fundamental rights-compliant in cases where an individual is surrendered in a system where the rule of law is not respected.274

B. Challenging the Aranyosi Two-Step Test: L and P (Openbaar Ministerie) The application of the Aranyosi two-step test has not been an easy task for national executing authorities, which, in cases involving Polish EAWs, have shifted their position towards non-execution, taking into account ongoing political and judicial developments regarding the independence of the judiciary in recent months. A test case for the feasibility of the applicability of the Aranyosi two-step approach and the extent of mutual accommodation and mutual trust in cases of serious rule of law concerns raised by the executing authority has been raised in the Netherlands, where initially EAWs continued to be executed in spite of rule of law concerns in Poland, as the burden of proof regarding a breach of the right to a fair trial after surrender fell to the requested person.275 Eventually, rule of law concerns led to the submission of two requests for a preliminary ruling from the District Court of Amsterdam.276 The Amsterdam District Court embarked in judicial dialogue with Polish authorities: it received responses by the issuing judicial authority to some of its questions, but not to those concerning the Disciplinary Chamber of the Polish Supreme Court, to which no answers were received either by the issuing authority or by the Supreme Court.277 The Amsterdam District Court considered that the independence of the Polish courts, including of the court which issued the EAW at issue in the main proceedings, was not guaranteed.278 It based its view on both legislative and operational developments in Poland in 2019 and 2020,279 action by the European Commission against Poland,280 and recent case law of the CJEU 274 For a critique of the application of the two-step tests in rule of law cases, see also P Bard and W van Ballegooij ‘Judicial Independence as a Precondition for Mutual Trust? The CJEU in Minister for Justice and Equality v LM’ (2018) 9 New Journal of European Criminal Law 353. The authors argue that meaningful dialogue is questionable where the issuing authority is effectively asked to prove its independence. 275 See the analysis in A Martufi and D Gigengack, ‘Exploring Mutual Trust through the Lens of an Executing Judicial Authority: The Practice of the Court of Amsterdam in EAW Proceedings’ (2020) 11 New Journal of European Criminal Law 282. 276 Joined Cases C-354/20 PPU and C-412/20 PPU, L and P (Openbaar Ministerie), EU:C:2020:1033. 277 ibid paras 12–13. 278 ibid para 15. 279 These include the judgment of the Supreme Court, Chamber of Labour and Social Insurance of 5 December 2019, in which that court, ruling in the dispute which gave rise to the request for a preliminary ruling in Case C-585/18, holding that the National Council of the Judiciary, Poland was not, in its current composition, an impartial body independent of the legislature and the executive; the adoption on 20 December 2019 by the Republic of Poland of a new law on the system of justice, which entered into force on 14 February 2020 and led the Commission to initiate infringement proceedings on 29 April 2020 by sending that Member State a letter of formal notice concerning that new law and; the holding of a hearing on 9 June 2020 before the Supreme Court, Disciplinary Chamber concerning the lifting of the criminal immunity of a Polish judge and the delivery of a judgment on the same date, according to official information received by the referring court. 280 The action for failure to fulfil obligations brought by the European Commission against the Republic of Poland (Case C-791/19), and the order of 8 April 2020, Commission v Poland (C-791/19 R, EU:C:2020:277).

238 Mutual Recognition and Mutual Trust concerning judicial independence in Poland.281 On the basis of the above, the Amsterdam District Court essentially asked the CJEU to revisit the Aranyosi two-step test in cases arising from rule of law concerns of that magnitude. As reformulated by the CJEU, the question in essence involved whether – where the executing judicial authority has evidence of systemic or generalised deficiencies concerning the independence of the judiciary in the Member State that issues that arrest warrant which existed at the time of issue of that warrant or which arose after that issue – that authority may deny the status of ‘issuing judicial authority’ to the court which issued that arrest warrant and may presume that there are substantial grounds for believing that that person will, if they are surrendered to that Member State, run a real risk of their fundamental right to a fair trial, as guaranteed by the second paragraph of Article 47 of the Charter, being breached, without carrying out a specific and precise verification which would take account of, inter alia, their personal situation, the nature of the offence in question and the factual context in which that warrant was issued.282 The Amsterdam District Court asked the Court to essentially limit the Aranyosi test to its first step and to discard the second step in cases of that nature. The reference by the Amsterdam District Court again highlighted the relationship between mutual trust and the rule of law as expressed in its judicial independence component. In this context, the CJEU had two lines of case law on judicial independence at its disposal that were potentially applicable in this case. The first line of case law, stemming from the Court’s ruling in ASJP,283 involved the development of EU benchmarks on judicial independence to address domestic law and domestic systems of individual Member States.284 The second line of case law emerged more specifically in relation to mutual recognition and mutual trust in criminal matters, with the Court of Justice developing judicial independence as a key component of the term ‘judicial authority’ for the purposes of operating the EAW system as an autonomous concept of EU law. The Court’s case law on autonomous concepts serves to manage legal diversity and pluralism in Europe’s area of criminal justice by developing what is aimed to be a uniform European approach towards the definition of key concepts underpinning EU law.285 As will be seen below,286 in treating the concept of ‘judicial authority’ as an autonomous concept of EU law, the Court aimed to establish a European benchmark for judicial independence underpinning the whole system of judicial cooperation under the EAW.287 The requirement of judicial independence is key to the definition of a judicial authority responsible for issuing an EAW in the CJEU’s case law. In a ruling on the 281 The judgments of 19 November 2019, AK and Others (Independence of the Disciplinary Chamber of the Supreme Court) (C-585/18, C-624/18 and C-625/18, EU:C:2019:982) and of 26 March 2020, Miasto Łowicz and Prokurator Generalny (C-558/18 and C-563/18, EU:C:2020:234). 282 L and P (n 276) para 33. Emphasis added. 283 See the ruling in ASJP (n 265). 284 See also the case law on Poland in n 281. 285 V Mitsilegas, ‘Managing Legal Diversity in Europe’s Area of Criminal Justice: The Role of Autonomous Concepts’ in R Colson and S Field (eds), EU Criminal Justice and the Challenges of Legal Diversity: Towards a Socio-legal Approach to EU Criminal Policy (Cambridge University Press, 2016) 125–60. 286 See section XI. 287 V Mitsilegas, ‘Autonomous Concepts, Diversity Management and Mutual Trust in Europe’s Area of Criminal Justice’ (2020) 57 CML Rev 45.

Contesting the Parameters of Mutual Trust after Aranyosi: The Rule of Law 239 independence of German Public Prosecutors (OG and PI),288 the Court held that the issuing authority under Article 6(1) of the EAW FD must be capable of exercising its responsibilities objectively without being exposed to the risk of its decision-making power being subject to external directions or instructions in particular from the executive, such as that it is beyond doubt that the decision to issue an EAW lies with that authority and not, ultimately, with the executive.289 The issuing authority must be in a position to give assurances to the executing authority that it acts independently, with independence requiring that there are statutory rules and an institutional framework capable of guaranteeing that the issuing judicial authority is not exposed when adopting a decision to issue to any risk of being subject, inter alia, to an instruction in a specific case from the executive.290 The answer to the question of the applicability of this line of case law on autonomous concepts in the case in question was eagerly awaited, especially since it was clear from the facts of the case that the issuing authority was unable to directly answer questions on judicial independence and referred these to the Polish Supreme Court, which declined to engage in dialogue with the executing authority.291 The Court of Justice declined to revise the Aranyosi two-step test. The Court started again by emphasising the importance of mutual trust underpinning mutual recognition in criminal matters292 and cited its case law on judicial independence underpinning the execution of a ‘judicial decision’ issued by a ‘judicial authority’ within the meaning of Article 6(1) of the EAW FD.293 However, it distinguished its case law on judicial independence of the issuing authority for the purposes of the operation of the EAW from the question of whether there are systemic or generalised deficiencies on judicial independence in the issuing state. An executing authority which has evidence of such systemic or generalised deficiencies cannot deny the status of ‘issuing judicial authority’ within the meaning of Article 6(1) of the EAW FD to all judges or all courts of that Member State acting by their nature entirely independently of the executive – the existence of such deficiencies does not necessarily affect every decision that the courts of that Member State may be led to adopt in each particular case.294 The Court justified this distinction on a twofold basis: on the need to uphold mutual trust in the operation of mutual recognition in criminal matters;295 and on the basis of the need to uphold the continuation of the system of judicial dialogue under Article 267 TFEU, as it was deemed that applying the case law on autonomous concepts in cases of systemic or generalised rule of law deficiencies would mean that no court of that Member State could any longer be regarded as a ‘court or tribunal’ for the purposes of the application of other provisions

288 Joined Cases C-508/18 and C-82/19 PPU, OG and PI, EU:C:2019:456. 289 ibid para 73. 290 ibid para 74. 291 See n 277 above. 292 L and P (n 276) paras 33–35. 293 ibid para 38. 294 ibid paras 41–42. 295 According to the Court, an interpretation to the contrary would amount to extending the limitations that may be placed on the principles of mutual trust and mutual recognition beyond ‘exceptional circumstances’, leading to a general exclusion of the application of those principles in the context of EAWs issued by the courts of the Member State concerned by those deficiencies (ibid para 43).

240 Mutual Recognition and Mutual Trust of EU law.296 It cannot be inferred by the case law on autonomous concepts in OG and PI that systemic or generalised deficiencies in relation to concerns the independence of the issuing Member State’s judiciary, however serious, may be sufficient, on their own, to enable an executing judicial authority to consider that all the courts of that Member State fail to fall within the concept of an ‘issuing judicial authority’, within the meaning of Article 6(1) of Framework Decision 2002/584.297 This is on the basis of a rather formalistic interpretation of the judicial independence benchmark developed in OG and PI – according to the Court, the requirement of judicial independence was not met: [N]ot on the basis of material indicating the existence of systemic or generalised deficiencies concerning the independence of the judiciary of the Member State to which those public prosecutors belonged, but on account of statutory rules and an institutional framework, adopted by that Member State by virtue of its procedural autonomy, which made those public prosecutors’ offices legally subordinate to the executive and thus exposed them to the risk of being subject to directions or instructions in a specific case from the executive in connection with the adoption of a decision to issue a European arrest warrant.298

On the basis of these arguments, the Court upheld the Aranyosi two-step test as developed in LM.299 The need to ensure the effectiveness of the EAW enforcement system was central to this approach: as with earlier case law upholding the enforcement objectives of the issuing authority, the Court stressed the need to fight impunity;300 moreover, it clearly noted that an automatic refusal to execute any arrest warrant issued by that Member State would lead to a de facto suspension of the implementation of the EAW mechanism in relation to that Member State, even before the European Council and the Council of Ministers acted on the rule of law under Article 7 TEU.301 All that is left to the executing authority having credible rule of law concerns on grounds of systemic or generalised deficiencies in judicial independence in the issuing state is to exercise ‘vigilance’ at the second step of the Aranyosi test.302 The Court’s ruling did little to accommodate the rule of law concerns of the executing authority and to address these concerns directly. By declining to apply and further develop its case law on autonomous concepts, the Court created an artificial distinction between judicial independence for the purposes of defining a ‘judicial authority’ issuing an EAW, and judicial independence when there is evidence of generalised and systemic rule of law deficiencies in that context. The Court appears unwilling to address the latter directly in the context of its case law on mutual trust and the EAW. In this manner, it

296 This would mean that no court of that Member State could be regarded as a ‘court or tribunal’ for the purposes of the application of other provisions of EU law any longer, in particular art 267 TFEU (ibid para 44 with reference to the ASJP ruling (n 265)). 297 L and P (n 276) para 50. 298 ibid para 48. 299 ibid paras 51–61. 300 ibid paras 62–64. On the centrality of claims on the importance of the fight against impunity in the development of the CJEU approach on mutual trust, see Mitsilegas (n 44). 301 L and P (n 276) para 59. The AG expressed this approach more directly as follows: an automatic refusal to execute all EAWs, once the seriousness of the systemic or generalised deficiencies identified in the issuing Member State has been established, amounts to the simple disapplication of the Framework Decision itself: Opinion of AG Campos Sanchez Bordona, delivered on 12 November 2020, para.65. 302 ibid para 60.This applies to both prosecution and execution warrants (paras 65–68).

Contesting the Parameters of Mutual Trust after Aranyosi: The Rule of Law 241 weakens both the EAW system and the protection of the rule of law in the EU in two respects. First, it weakens and dilutes the meaning of the concept of a judicial authority for the purposes of the operation of the EAW by adopting an unduly formalistic concept of judicial independence focusing on hierarchy and subordination under formal law. Second, it weakens the protection of the rule of law across the EU by turning a blind eye to ongoing, serious and grave rule of law concerns in an EU Member State. Both justifications put forward by the Court for its narrow approach can be rebutted. First, it does not necessarily follow that limiting the Aranyosi test to its first leg would automatically exclude all Polish courts from functioning under EU law, including under Article 267 TFEU. The finding that there are systemic and generalised rule of law deficiencies in the issuing Member State would limit the operation of the EAW vis-a-vis this jurisdiction, but would not deprive courts in the issuing state from their characterisation, status or function as courts for the purposes of general EU law.303 The Court’s ruling in OG and PI involved a public prosecutor, not a court, and the effects of limiting the Aranyosi twostep test would apply to the operation of the EAW specifically. Second, the insistence of the Court on privileging the fight against impunity and the effectiveness of enforcement under the EAW system over serious rule of law concerns threatens not only the protection of fundamental rights and the rule of law in the EU, but also the very credibility of the EAW system per se. The Court’s modest development of the Aranyosi-LM two-step test by requiring executing authorities to exercise ‘vigilance’ in their performance of the second step of scrutiny does little to address the real issues of limits to effective judicial dialogue between issuing and executing authorities in cases where evidence of systemic and generalised rule of law deficiencies exists. Moreover, while both LM304 and the present judgment have had as immediate effect the surrender of the persons involved in the issuing state, the lack of responsiveness by the Court with regard to real rule of law concerns by executing authorities may lead to growing unwillingness by the latter to operate the EAW in cases where concerns persist and remain unaddressed,305 leading to a further intervention by national constitutional courts and litigation before the ECtHR. The Amsterdam District Court has recently decided to refuse the execution of an EAW in one of the two cases referred to Luxembourg on the basis that rule of law deficiencies in Poland, including the launch of disciplinary proceedings, would have a direct impact on the protection of fundamental rights in the case in question.306 The latest ruling of the CJEU does not address the impractical and

303 AG Campos Sanchez Bordona expressed concerns on the impact of abandoning the Aranyosi two-step test on courts as follows: ‘The systemic or generalised deficiencies which can be identified in relation to the independence of Polish courts do not, in my view, deprive those courts of their nature as courts. They continue to be courts, even though the independence of the judiciary, taken to mean a group of courts which exercise jurisdiction, is threatened by governmental structures (or, also, by the anomalous performance of disciplinary functions). A finding that there are such deficiencies, as serious as they may be, cannot deprive the courts of that status’ (ibid para 72). 304 See Minister for Justice v Celmer (No 5) [2018] IEHC 639, 19 November. 305 The Karlsruhe Higher Court has now on two occasions suspended surrender to Poland on rule of law grounds, reflecting ongoing concerns with the rule of law situation in Poland: Ausl 301 AR 95/18, 17 February 2020 and Ausl 301 AR 104/19, 27 November 2020. For an overview, see A Wojkic, ‘A German Court Refuses to Extradite a German Citizen to Poland Because of the State of the Polish Judicial System’, 14 January 2021, https://ruleoflaw.pl/german-court-european-arrest-warrant-poland. 306 Amsterdam District Court, RK 20/771 13 / 751021-20, 10 February 2021.

242 Mutual Recognition and Mutual Trust heavy obligations placed upon executing authorities to assess rule of law deficiencies on an ongoing and case-by-case basis,307 and leaves the compatibility of EU law in the EAW system with the rule of law from the perspective of national constitutions and the ECHR open to challenge.308 The Court’s hesitancy and reluctance to accommodate legitimate rule of law concerns by the executing authority may be counterproductive for the authority of EU law and may lead in the future to a repeat of Aranyosi, a further reset of the Court’s case law to address ongoing and legitimate constitutional concerns.

XI. Mutual Trust through a Judicially Developed Level Playing Field: Autonomous Concepts Autonomous concepts have been developed by the Court of Justice in order to manage national legal diversity and in doing so enhance the effectiveness and autonomy of EU law.309 The CJEU has been developing autonomous concepts in a number of areas of EU criminal law, with a key challenge being that, unlike other areas of EU law, a number of key criminal law concepts have evolved in a purely or primarily national context, linked to broader national constitutional and rule of law developments.310 The Court has developed autonomous concepts underpinning the functioning of EU criminal law and, in particular, mutual recognition in criminal matters.311 For the purposes of this chapter, the analysis will focus on the development of the autonomous concept of ‘judicial authority’ as a concept linked to judicial independence and underpinning mutual trust in the system of mutual recognition. The evolution of the Court’s case law will be examined from the perspective of the potential of judicially developed concepts to establish a level playing field for the operation of mutual trust in Europe’s area of criminal justice. From the outset, it must be recalled that a key innovation of EU criminal law in terms of cooperation under the EAW has been the judicialisation of surrender, 307 The Amsterdam District Court appeared to attempt to apply the Aranyosi two-step test by refusing to surrender on the grounds of the impact of rule of law deficiencies on the specific case. This was a different outcome from the other of the two cases referred to the CJEU, where the Amsterdam Court decided to execute the EAW, notwithstanding its finding of systemic rule of law deficiencies in Poland, on the grounds that it had not been demonstrated how these would affect the individual case in question: RK 20/3065 and 13/751520-20, 27 January 2021. However, in both cases, the Amsterdam Court stressed its finding that systemic rule of law deficiencies in Poland are prevalent and that rule of law concerns are extenuated over time. It may become increasingly difficult for executing authorities to operate a meaningful assessment of the second step by asking to assess in detail the rule of law-deficit consequences in individual cases in the face of the limits of judicial dialogue and the persistence of these rule of law concerns. 308 A potential conflict of the ECJ approach with the ECHR was raised by Robert Spano, the President of the ECtHR: R Spano, ‘The Rule of Law as the Lodestar of the European Convention on Human Rights: The Strasbourg Court and the Independence of the Judiciary’ European Law Journal (forthcoming), https:// onlinelibrary.wiley.com/doi/full/10.1111/eulj.12377. President Spano notes that the Strasbourg Court will have to examine the compatibility of EAWs issued in the context of judicial independence in view of the flagrant denial of justice test employed by the Strasbourg Court in Pirozzi (n 203). 309 L Azoulai, ‘The Europeanisation of Legal Concepts’ in U Neergaard and R Nielsen (eds), European Legal Method in a Multi-level EU Legal Order (DJØF Publishers, 2012) 165–82; V Mitsilegas, ‘Managing Legal Diversity in Europe’s Area of Criminal Justice: The Role of Autonomous Concepts’ in Colson and Field (n 285) 125–60. 310 Mitsilegas (n 309). 311 Mitsilegas (n 287), on which this section builds. See also section II of this chapter and ch 5.

Mutual Trust through a Judicially Developed Level Playing Field 243 with the actors involved in the process of surrender now being judicial and not executive authorities.312 Judicialisation thus underpins the very system of mutual recognition under the Framework Decision. However, the definition of what constitutes a ‘judicial authority’ for the purposes of the EAW FD is not clear, with the CJEU attempting to treat the term as an autonomous concept of EU law in three recent cases. Two of these cases (Poltorak and Kovalkovas) involved the definition of ‘judicial authority’ issuing an EAW under Article 6(1) of the EAW FD, whereas the third case (Özcelik) involved the concept of judicial authority issuing a national arrest warrant which formed the basis for an EAW under Article 8(1)(c) of the EAW FD.313 In all three cases, the Court treated the concept of judicial authority as an autonomous concept in EU law.314 It confirmed that the words ‘judicial authority’ are not limited to designating only the judges or courts of a Member State, but may extend more broadly to the authorities required to participate in administering justice in the legal system concerned.315 However, as regards the issuing of EAWs, the CJEU held that national police authorities and a national executive authority such as a ministry do not fall within this definition of ‘judicial authority’.316 The Court justified this exclusion on the grounds of the need to respect the rule of law and the principle of separation of powers on the one hand,317 and of the need to uphold mutual trust stemming from the judicialisation of cooperation on the other. It noted that the entire surrender procedure is covered by judicial supervision.318 The issuing of an EAW by a non-judicial authority, such as a police service, or by an entity coming under the executive, does not provide the executing judicial authority with an assurance that the issuing of that EAW has undergone judicial approval and therefore cannot suffice to justify the high level of confidence between the Member States which forms the very basis of the Framework Decision.319 In Özcelik, which involved the issuing of a national warrant forming the basis of an EAW, the Court departed from the other two rulings and found that a public prosecutor who has confirmed a warrant issued by a police service did fall within the concept of judicial authority for the purposes of issuing an EAW, as such confirmation provides the executing authority with an assurance that the EAW is based on a decision that had undergone judicial approval, thus justifying a high level of confidence between Member States.320 In this trio of rulings, the CJEU has used autonomous concepts in an effort to uphold and set clear parameters for the judicialisation of the EAW process. However, the rulings have left a number of questions unanswered in terms of consistency and clarity in the definition of judicial authority for the purposes of the EAW FD. In this context, the cases involving the issue of an EAW (Poltorak and Kovalkovas) can be 312 See section II above. 313 For confirmation of the requirement for a national arrest warrant to underpin the issuing of an EAW, see the CJEU ruling in Case C-241/15, Bob-Dogi, ECLI:EU:C:2016:385. 314 Case C-452/16 PPU, Poltorak, ECLI:EU:C:2016:858, para 32; Case C-477/16 PPU, Kovalkovas, ECLI:EU:C:2016:861, para 33; and Case C-453/16 PPU, Özcelik, ECLI:EU:C:2016:860, para 33. 315 For the purposes of the operation of art 6(1) of the European Arrest Warrant Framework Decision, see Poltorak (n 314) para 33; and Kovalkovas (n 314) para 34. For the purposes of the operation of art 8(1)(c) of the Framework Decision, see Özcelik (n 314) para 32. 316 Poltorak (n 314) para 34 and Kovalkovas (n 314) para 35 respectively. 317 Poltorak (n 314) para 35; Kovalkovas (n 314) para 36. 318 Poltorak (n 314) paras 39–42; Kovalkovas (n 314) para 37. 319 Poltorak (n 314) para 45; Kovalkovas (n 314) para 44. 320 Özcelik (n 314) para 36.

244 Mutual Recognition and Mutual Trust distinguished from Özcelik, which involved the issue of a national arrest warrant. The CJEU upheld judicialisation in the issuing of an EAW by excluding certain authorities deemed not to be ‘judicial’ (the police or a ministry) from the scope of the EAW FD, but without developing detailed criteria underpinning the definition of the concept of judicial authority. The CJEU mentioned the requirement of ‘judicial approval’ as a prerequisite of mutual trust in a judicialised system of cooperation, but the details on what constitutes such ‘judicial approval’ may have to be interpreted by the CJEU in future litigation. The CJEU did not hesitate to overcome reactions by Member States claiming that their implementation of the EAW in this context reflects well-established design of their criminal justice system,321 but by being ‘negative’ outcome cases, the judgments do not provide at this stage a high level of content and uniformity in the definition of the concept of ‘judicial authority’, which may have to be re-examined on a context-specific, case-by-case basis in the future depending on the origins of domestic litigation and the individual features of the domestic criminal justice system involved. The quest for consistency in the definition of ‘judicial authority’ across the board has not necessarily been furthered by the CJEU ruling in Özcelik concerning the issue of national arrest warrants. The CJEU appears to have adopted a more conciliatory stance towards respecting the diversity of domestic criminal justice systems by departing from a strict separation of powers approach322 and accepting a public prosecutor’s office would constitute a judicial authority for the purposes of issuing national warrants under the EAW FD if actions have been subject to judicial approval on the basis of the fact that these are authorities which administer criminal justice.323 The CJEU appears to be prepared to accept national established practices regarding the issuing of a national warrant, in contrast to national practices regarding the issuing of a European warrant. From the point of view of the impact of the CJEU ruling on national legal diversity, this difference in approach is at first sight understandable. The interpretation of the concept of a judicial authority issuing a European warrant could require changes in national law and practice narrowly relating to the operation of the EAW system. Whereas the interpretation of the concept of judicial authority issuing a national warrant which would not be consistent with national law and practice would lead to a fundamental rethinking of the balance of power in and design of the domestic criminal justice system as a whole, including fundamental questions on the role and position of the public prosecutor. However, further developments have demonstrated that it is not always straightforward to differentiate between the European level and the national level in practice. The question of whether a national public prosecutor’s office can fall within the autonomous concept of a judicial authority for the purposes of issuing an EAW has recently come before the CJEU in two cases sent by the Irish Supreme Court – one concerning the German public prosecutor324 and one concerning the Lithuanian 321 ibid para 51. The AG’s Opinion reveals that Sweden replied negatively to an earlier recommendation by the Council that it should take appropriate measures to ensure that, in cases of enforcement of sentences, EAWs were issued by a judicial authority or under the supervision of a judicial authority (at paras 58–59). 322 V Covolo, ‘La Notion Autonome et Protéiforme d’ autorité judiciaire en droit de l’Union’ (2017) 100 KritV 217, 227. 323 Özcelik (n 314) paras 32 and 33. 324 Joined Cases C-508/18 OG, Public Prosecutor’s Office of Lübeck and C-82/19 PPU PI, Public Prosecutor’s Office of Zwickau, ECLI:EU:C:2019:456.

Mutual Trust through a Judicially Developed Level Playing Field 245 public prosecutor.325 In OG and PI, concerning the German prosecutor, the CJEU found that the concept of ‘judicial authority’ is capable of including authorities which, although not necessarily judges or courts, participate in the administration of criminal justice, with public prosecutors’ offices being capable of being regarded as participating in the administration of criminal justice.326 The CJEU placed emphasis on the dual level of protection in issuing of national warrants and EAWs and on the significant impact of the execution of the EAW on fundamental rights, in particular on the right to liberty.327 The protection to be provided in the EAW process means that the judicial authority must review observance of conditions necessary for the issuing of the warrant and examine proportionality in the issuing of the EAW.328 There is a requirement to protect fundamental rights even where the EAW is based on a national decision issued by a court.329 Placing the analysis within a strong framework of fundamental rights protection, the CJEU went on to elaborate on two constituent elements which must apply cumulatively in order for the autonomous concept of judicial authority for the purposes of issuing an EAW to be established. The first constituent element is independence. According to the CJEU, the issuing authority under Article 6(1) of the EAW FD must be capable of exercising its responsibilities objectively without being exposed to the risk that its decision-making power be subject to external directions or instructions in particular from the executive, such as that it is beyond doubt that the decision to issue an EAW lies with that authority and not, ultimately, with the executive.330 The issuing authority must be in a position to give assurances to the executing authority that it acts independently, with independence requiring that there are statutory rules and an institutional framework capable of guaranteeing that the issuing judicial authority is not exposed when adopting a decision to issue to any risk of being subject, inter alia, to an instruction in a specific case from the executive.331 The second constituent element of the autonomous concept of judicial authority is the availability of an effective remedy against the decision to issue an EAW, including the proportionality of such a decision.332 Having set out these elements of the definition of judicial authority for the purposes of Article 6(1) of the EAW FD, the CJEU went on to examine the specific position of the German public prosecutor’s office and found the latter wanting in terms of meeting the requirement of independence. It found that the German public prosecutor’s office was exposed to the risk of being influenced by the executive and that it cannot be guaranteed that they act independently in issuing an EAW.333 The CJEU stressed in this context that it cannot be ruled out that the executive can issue instructions to the prosecutors.334 325 Case C-509/18 PF, Prosecutor General of Lithuania, ECLI:EU:C:2019:457. 326 OG and PI (n 288) paras 51 and 62–63. 327 ibid paras 67–68. In stressing the impact of the execution of the EAW on fundamental rights, the CJEU followed the Opinion of AG Campos Sanchez Bordona, delivered on 30 April 2019, in particular para 70: ECLI:EU:C:2019:337. 328 ibid para 71. See also Kovalkovas (n 314) para 47. 329 OG and PI (n 288) para 72. 330 ibid para 73. 331 ibid para 74. 332 According to ibid para 75, the decision to issue and, inter alia, the proportionality of such a decision must be capable of being the subject in the issuing state of court proceedings which meet the requirements inherent in effective judicial protection in full. 333 ibid para 88. 334 ibid paras 82–83.

246 Mutual Recognition and Mutual Trust Importantly, it found that the existence of the second element of the concept of judicial authority in domestic law (namely the existence of effective remedies) does not remedy the fact that the first element of the concept (namely independence) is not guaranteed.335 Thus, the German public prosecutor’s office cannot be included within the autonomous concept of judicial authority for the purposes of issuing an EAW. In contrast, this is not the case with the Lithuanian public prosecutor’s office. In the ruling concerning the latter,336 the CJEU applied the same steps as in OG and PI, but on the basis of the facts reached a different conclusion regarding the independence of the Prosecutor General. It found that the requirement of independence was met in this case, stressing in particular that the responsibility for the issuing of EAWs lies ultimately with this authority,337 that its independence is constitutionally enshrined and that the prosecutor can act freely of any external influence.338 However, fulfilling the requirement of independence is not enough for inclusion in the concept of judicial authority; the referring court must also determine whether the second constituent element of the concept stands, namely whether a decision to issue an EAW may be the subject of court proceedings which meet the full requirements inherent in effective judicial protection.339 The rulings by the CJEU in OG and PI have made significant steps in terms of developing and giving substance to the concept of judicial authority for the purposes of issuing an EAW. The CJEU made the important decision not to exclude, in principle, public prosecutors from the concept of judicial authority. This is a significant departure from the Opinion of AG Campos Sanchez-Bordona, who linked expressly the required protection of fundamental rights and achievement of effective judicial protection to the issuing of an EAW by a judge.340 The choice of the CJEU to include public prosecutors within the scope of the authorities who can issue an EAW in principle is significant in operational terms, following the approach of the AG would have had a dramatic effect on the day-to-day operation of the system. Departing from the AG Opinion enabled the CJEU not to come into direct conflict with its approach regarding the issuing of national arrest warrants in Ozturk. However, the CJEU can be seen as compensating for not excluding an authority which is not a judge or a court from the scope of a judicial authority issuing an EAW by setting out the provision of effective judicial protection as an additional requirement to that of independence. The CJEU departure from the Opinion of the AG is also significant for determining the meaning and substance of independence. Limiting the scope of the concept of judicial authority to a court or a judge enabled the AG to expressly refer to the criteria for independence set out by the CJEU in its ‘rule of law’ litigation regarding the execution of the EAW341 in LM342 – and, by reference, to the now well-known independence criteria set out by the CJEU

335 ibid paras 84–85. 336 Prosecutor General of Lithuania (n 325). 337 ibid para 54. 338 ibid para 55. 339 ibid para 56. 340 OG and PI (n 288) paras 64 and 65. According to the AG, effective judicial protection is in essence the protection provided by a judge (at para 66). 341 ibid paras 85–86, AG Sanchez-Bordona. 342 Case C-216/18 PPU, Minister for Justice and Equality (Défaillances du système judiciaire), ECLI:EU:C: 2018:586.

Mutual Trust through a Judicially Developed Level Playing Field 247 in ASJP.343 The CJEU appears to distinguish between two different concepts of judicial authority depending on the stage of operation of the mutual recognition process under the EAW FD: the stage before execution, when an EAW is being issued, where public prosecutors can, under certain conditions, be considered independent enough to fall within the concept of judicial authority; and the stage after execution, when the executing authority is under the duty to examine more broadly the independence of the judiciary in the issuing state and to ascertain whether the execution of an EAW would be compatible with the rule of law and the protection of the right to a fair trial. It is noteworthy that, unlike the AG, the CJEU in OG and PI did not refer expressly to its case law in LM and ASJP in defining the meaning of independence. However, what unites the two lines of case law is the emphasis on independence from external influence and the Aranyosi-led requirement for executing authorities to establish a dialogue with their counterparts in the issuing state in order to ascertain whether guarantees of independence are being met.344 Moreover, the CJEU began by stressing the link between mutual trust and upholding the rule of law as outlined in LM,345 but – as seen above – has subsequently declined to join up the two lines of case law.346 In OG and PI as well as PF, the CJEU took important steps in developing the requirements underpinning the concept of judicial authority for the purposes of issuing an EAW and in adding substance and clarity to the conditions of what constitutes independence for these purposes. The CJEU leaves the final decision with national authorities, but the guidance given is more detailed than in its initial rulings concerning the development of the autonomous concept of judicial authority for the purposes of issuing an EAW and the inclusion of executive bodies within this concept. The CJEU’s emphasis on independence in practice and on the ground – and not on presumed independence – is a welcome fundamental rights safeguard and is in line with its emphasis on protection of fundamental rights on the ground in the post-Aranyosi era. The definition of the concept of judicial authority on the basis of a European meaning of independence set out by the CJEU in OG and PI has the potential to have a significant impact on the organisation of criminal justice (at least for EAW purposes) in Member States, challenging domestic perceptions of independence and trust towards state authorities.347 The ruling in PI and OF has already generated a debate in Germany not only on how to change the national legislation on the designation of ‘judicial authorities’ with powers to issue EAWs in order to comply with the CJEU ruling in OG and PI, but also on the independence of public prosecutors in domestic law more broadly.348 343 Case C-64/16, Associação Sindical dos Juízes Portugueses, EU:C:2018:117. 344 On building trust via this dialogical model of cooperation between national authorities operating the EAW, see V Mitsilegas ‘Mutual Recognition and Criminal Law’ in S Iglesias Sanchez and M Dominguez (eds), Fundamental Rights in the EU Area of Freedom, Security and Justice (Cambridge University Press, 2021) 253–71. 345 OG and PI (n 288) para 43. 346 See section X.B above. 347 For an overview of the position of public prosecutors within national criminal justice systems, see European Commission, The 2019 EU Justice Scoreboard, https://ec.europa.eu/info/sites/default/files/justice_ scoreboard_2019_en.pdf, 52. 348 See G von Luckner, ‘German Prosecutors are Insufficiently Independent to Issue European Arrest Warrants’ European Law Blog (11 June 2019), https://europeanlawblog.eu/2019/06/11/german-prosecutorsare-insufficiently-independent-to-issue-european-arrest-warrants.

248 Mutual Recognition and Mutual Trust The CJEU further developed the concept of ‘issuing judicial authority’ in a number of subsequent references by national courts.349 In litigation concerning the independence of the French public prosecutor’s office,350 the CJEU expanded on the judicial independence criteria developed in its earlier case law. The question concerned the independence of the investigative judge in France, with the referring court being uncertain, first, whether a judicial assessment of the proportionality of the prospective issuing an EAW carried out at the time of issuing the national arrest warrant, and thus prior to the actual decision by the Public Prosecutor’s Office to issue the EAW, fulfils, in essence, the requirements set out in paragraph 75 of OG and PI.351 The CJEU went the extra mile in order to accommodate the specificities of the French system within its assessment of independence for the purposes of issuing an EAW. In terms of the structural/institutional independence criterion, it accepted a distinction between external instructions (from bodies outside the judiciary), which are not acceptable, and internal instructions (given to prosecutors by their hierarchical superiors), which are acceptable.352 Nor is the independence of the Public Prosecutor’s Office called into question by the fact that it is responsible for conducting prosecutions.353 The CJEU accepted the claims by the French government that public prosecutors constitute judicial authorities whose independence is guaranteed by the French Constitution and the Code of Criminal Procedure, and that under no circumstances can those general instructions have the effect of preventing a public prosecutor from exercising their discretion as to the proportionality of issuing an EAW.354 The CJEU also demonstrated flexibility regarding the second criterion for judicial independence, namely the provision of an effective remedy. The Court offered significant leeway to the national system in this regard. It accepted that it is not a requirement for a national system to provide a separate right of appeal against the decision to issue an EAW.355 It also accepted that procedural rules in the French system demonstrated that the proportionality of the decision of the Public Prosecutor’s Office to issue an EAW may be subject to judicial review before or almost at the same time as it is issued and, in any event, after the EAW has been issued, since such scrutiny may take place, depending on the circumstances, before or after the actual surrender of the requested person.356 The CJEU went on to state that protection is offered not only by the EAW FD itself, but also 349 The Court also interpreted the concept of a ‘European arrest warrant’ referred to in art 1(1) of the EAW FD as including warrants issued by the public prosecutor’s offices of a Member State, despite the fact that those public prosecutor’s offices are exposed to the risk of being subject, directly or indirectly, to directions or instructions in a specific case from the executive, such as a minister of justice, in the context of the issue of those arrest warrants, provided that those arrest warrants are subject, in order to be transmitted by those public prosecutor’s offices, to endorsement by a court which reviews independently and objectively, having access to the entire criminal file to which any specific directions or instructions; see Case C-489/19 PPU, NJ, ECLI:EU:C:2019:849. The Court also held that an EAW must be regarded as invalid where it is not based on a ‘[national] arrest warrant or any other enforceable judicial decision having the same effect’ for the purposes of that provision: Case C-414/20, MM, ECLI:EU:C:2021:4; see also Bob-Dogi (n 313) para 58. 350 Joined Cases C-566/19 PPU and C-626/19 PPU, JR and YC, ECLI:EU:C:2019:1077. 351 ibid paras 34 and 35. 352 ibid para 56. 353 ibid para 57. 354 ibid para 54. 355 ibid para 65. 356 ibid para 70.

Mutual Trust through a Judicially Developed Level Playing Field 249 by EU rules on procedural rights, including the Directive on access to a lawyer and the Directive on the right to information.357 The emphasis by the CJEU on the importance of effective implementation of EU rules appears to compensate for the Court’s acceptance of a more limited procedural protection according to domestic law. This flexibility and considerable leeway given to national systems was confirmed in another ruling issued on the same day concerning the independence of the Swedish authorities.358 The Court accepted that effective judicial protection may differ between national systems – in particular regarding a right to a direct remedy against the decision of a judicial authority which is not a court.359 In this case, the Court accepted the adequacy of the national system on the basis of the Swedish government’s observations that the proportionality of the issuing of the EAW is properly assessed at the stage of the assessment of the decision on provisional detention,360 whose issuance is subject to appeal.361 The CJEU further reiterated the protection offered by the EU procedural rights Directives in this context.362 Effective judicial protection standards are more diluted in the case of execution warrants. In the third case issued on the same day, the CJEU accepted a national system (that in Belgium) which did not provide a distinct right to a remedy against an execution warrant, which can be issued by an authority other than a court.363 It subsumed the proportionality check in execution warrants within the underpinning criminal conviction.364 The development of the Court’s case law on the autonomous concept of issuing judicial authority reveals the tension between establishing a meaningful level playing field across the EU and respecting the diversity and historical evolution of national systems. While in the first wave of case law the CJEU attempted to establish clear criteria of what constitutes independence, and therefore the autonomous EU concept of a judicial authority for the purposes of issuing an EAW, these criteria have been diluted considerably in subsequent case law – in particular in the rulings concerning the French and Swedish authorities. The evolution of the Court’s case law raises challenges for both the establishment of a meaningful level playing field and for the protection of fundamental rights. The Court’s recent case law has been subject to valid criticism in terms of employing a somewhat artificial distinction between internal and external instructions, or instructions from the executive in a specific case and general instructions in matters of criminal policy.365 In terms of deference to national traditions, it has been noted that in the French prosecutors’ case, the reasoning of the CJEU appears to be founded on the inquisitorial tradition of the criminal justice system, built on the concept that prosecutors are ‘impartial’ and exercise their powers in an ‘objective manner’ – an approach which does not reflect the system in several EU Member States and stands at odds

357 ibid para 72–73. On the Directives, see ch 5. 358 Case C-625/19 PPU, XD, ECLI:EU:C:2019:1078. 359 ibid para 43. 360 ibid paras 46–48. 361 ibid paras 50–51. 362 ibid paras 54–55. 363 Case C-627/19 PPU, ZB, ECLI:EU:C:2019:1079, para 39. 364 ibid para 38. 365 T Harkin, ‘The Case Law of the Court of Justice of the European Union on “Judicial Authority” and Issuing European Arrest Warrants’ (2021) 12 New Journal of European Criminal Law (forthcoming).

250 Mutual Recognition and Mutual Trust with the current evolution of European criminal justice systems, where we see a trend towards an increasing role of defence lawyers during the investigative phase.366 In terms of effective remedy, the Court leaves it up to Member States to organise such effective judicial protection, which, by virtue of the principle of procedural autonomy, may vary from one national system to another.367 The Court in this context tried to take a holistic approach to national systems and also emphasised protection offered by EU procedural rights measures. However, this approach risks perpetuating diversity in fundamental rights protection in the operation of mutual recognition, especially in view of the present divergences in implementation of the (in any case minimum) EU standards.368 Fundamental rights concerns further persist in view of the Court’s reluctance to adopt a joined-up approach and apply the criteria in the case law on autonomous concepts to the development of its approach on refusal to execute an EAW on the grounds of rule of law deficiencies.369 In the development of the Court’s case law, the key question remains as to whether it is feasible to develop autonomous concepts of EU law which provide a true common understanding and meaningful guidance and a level playing field across the EU. The evolution of the case law on judicial independence in the context of the autonomous concept of judicial authority for the purposes of operating the EAW demonstrates the challenges in that regard. The Court developed a number of important criteria underpinning the concept, yet, in recent case law, it diluted these criteria by showing a high degree of deference towards national systems and national legal traditions. This approach leaves us at a crossroads and questions the very usefulness of harmonisation attempts via autonomous concepts: if the concepts and the underpinning criteria established by the Court are too flexible, dilutable or malleable and are dependent on national systems, then are these concepts truly autonomous and uniform? The case law on judicial authority has demonstrated that rather than serving as guidance for national self-assessment, the CJEU case law has led to even further litigation in Luxembourg – rather than adopting a broad, general concept of judicial authority, in reality we have the Court assessing national systems on a case-by-case basis. This may be inevitable to a degree in the absence of underpinning legislative harmonisation in the field, with autonomous concepts potentially developing in a more legally certain way if they interpret existing EU harmonising rules at a meta-level.370 The CJEU has continued to interpret the meaning of judicial authority for the purposes of the EAW. It held that effective judicial protection underpinning the concept of an issuing judicial authority does not include judicial review of a prosecutor’s decision to issue an EAW which takes place only after the requested person is

366 L Baudrihaye-Gérard, Can Belgian, French and Swedish Prosecutors Issue European Arrest Warrants? The CJEU Clarifies the Requirement for Independent Public Prosecutors’ EU Law Analysis (2 January 2020), http://eulawanalysis.blogspot.com/2020/01/can-belgian-french-and-swedish.html. 367 ibid. 368 See ch 5. 369 See section X.B above. 370 The example of procedural rights standards is key in this context; see ch 5.

Mutual Trust through a Judicially Developed Level Playing Field 251 surrendered.371 The Court also applied the criteria used for defining the concept of an issuing judicial authority to the definition of the autonomous concept of ‘executing judicial authority’ for the purposes of the EAW FD372 and held that in the present case, the Dutch authorities fell short of the independence criterion as the public prosecutor of a Member State who, although they participate in the administration of justice, may receive in exercising their decision-making power an instruction in a specific case from the executive, does not constitute an ‘executing judicial authority’ within the meaning of those provisions.373 The Court further differentiated between the concept of ‘issuing judicial authority’ for the purposes of the EAW FD and for the purposes of the EIO Directive. The CJEU held that the EAW-relating finding that the concept of ‘issuing judicial authority’, within the meaning of that provision, does not cover the public prosecutor’s offices of a Member State which are exposed to the risk of being subject to individual instructions from the executive is not applicable in the context of the EIO Directive.374 The Court noted the ‘textual, contextual and teleological differences’ between the EAW FD and the EIO Directive,375 emphasising in particular the fundamental rights and proportionality checks inherent in the issuing of an EIO under the EIO Directive376 and the more adverse impact of the EAW on fundamental rights, as the EAW involves (unlike the EIO Directive) deprivation of liberty.377 While the outcome of this case may be understood in view of the Court’s reluctance to ‘shake up’ existing national systems on cooperation in the field of evidence, the ruling raises questions on the impact of the differentiation between the EAW and the EIO on fundamental rights, on developing a coherent and holistic concept of judicial authority and on the protection of fundamental rights in the field of mutual recognition in criminal matters. Differentiation based on a hierarchisation of fundamental rights is problematic.378 Such hierarchisation does not reflect a coherent approach by the CJEU as it is at odds with the Court’s approach in the context of a fundamental rights scrutiny of the execution of the EAW post-Aranyosi, with considerations on a number of fundamental rights beyond Article 4 of the Charter (including most notably the right to a fair trial linked to the rule of law)379 being included in such scrutiny. Fundamental rights protection in the operation of other mutual recognition instruments must be equally and consistently high.380

371 Case C-648/20 PPU, PI, ECLI:EU:C:2021:187, para 57. 372 Case C-510/19, Openbaar Ministerie, EU:C:2020:953. 373 ibid para 70. 374 Case C-584/19, A and Others (Staatsanwaltschaft Wien), EU:C:2020:1002, para 74. 375 ibid. 376 ibid paras 56–68. 377 ibid para 73. 378 Mitsilegas (n 287). 379 See section X.B above. 380 On the importance of a high level of scrutiny in the context of the EIO Directive, see the Opinion of AG Bot in Gavanozov: Case C-324/17, Gavanozov I, ECLI:EU:C:2019:312, Opinion delivered on 11 April 2019, paras 56–57. In its ruling, the CJEU adopted a narrow approach that focused on a minimalist interpretation of the information required in the form of the EIO: Case C-324/17, Gavanozov I, ECLI:EU:C:2019:892.

252 Mutual Recognition and Mutual Trust

XII. Conclusion The application of mutual recognition in the field of European criminal law was originally based on a maximalist concept of mutual trust between national criminal justice systems. The existence of trust was presumed, unquestioned and taken for granted. EU mutual recognition measures have been designed to achieve quasi-automaticity in law enforcement cooperation across the EU, with little space being left for the examination of the consequences of recognition and execution for the rights of affected individuals. It was only a matter of time before this approach, espoused by the EU legislator under third pillar law and initially by the CJEU, came under scrutiny from national courts and the ECtHR. Fundamental rights concerns on the application of the principle of mutual recognition in criminal matters have become broader questions of constitutional identity, of the relationship between national law and EU law, and ultimately of the legitimacy and credibility of an EU system of cooperation which is seen as disregarding fundamental principles and values in the name of an artificial concept of mutual trust. The strength and persistence of reactions have led the CJEU to change its approach and adopt a more dialogical model of cooperation, whereby blind faith in the interests and the system of the issuing Member State is replaced by a more open, pluralist approach aiming towards mutual accommodation of different systems and concepts of rights and justice.381 In this process, the parameters of mutual trust are evolving via multi-level judicial dialogue: between national judicial authorities operating mutual recognition; between national courts and the CJEU via the preliminary reference procedure; and, directly or indirectly, between national constitutional courts and the ECtHR on the one hand, and the CJEU on the other. In this evolution, the tension between maintaining the effectiveness of law enforcement cooperation and sustaining the mutual recognition system on the one hand, and providing meaningful protection of fundamental rights and the rule of law on the other remains. Moreover, the question of whether mutual trust can really exist without a level playing field on the protection of fundamental rights and criminal procedure remains. As will be seen in the following chapter, and contrary to the expectations of the sovereigntist promoters of mutual recognition, the latter has actually led to harmonisation in the field of criminal procedure. However, this harmonisation remains incomplete, at the level of minimum standards, and currently excludes key affected areas such as detention. At the same time, there are serious underlying rule of law problems in parts of the EU, which judicial intervention may not be able to address fully. With the protection of fundamental rights slowly being taken more seriously in the operation of mutual recognition, rule of law concerns in a number of EU Member States render fundamental questions of whether a state can continue to operate within the EU mutual recognition system if its institutional set-up or legislation lead to fundamental rights breaches. These questions – linked closely to the feasibility and credibility of the Aranyosi two-step test – are not going to go away. In a pending case on the European Investigation Order, AG Bobek went to the heart of the issue by posing the

381 See

also Mitsilegas (n 145).

Conclusion 253 following question: is a Member State able to issue EIOs even though it is aware that those acts breach the minimum standards of the ECHR and therefore the minimum level of protection required under EU law?382 Making the case for considering temporary suspension from the system, he added: [W]hoever wishes to use the system of judicial assistance and mutual recognition under Directive 2014/41, or under any other instrument of judicial cooperation and mutual recognition for that matter, must come, metaphorically speaking, with clean hands, or rather, cannot come with hands that are knowingly dirty. The failure to observe that rule of basic hygiene, which has been repeatedly recognised and systematically emphasised, may indeed lead to that person being asked to leave the room and to come back only after having found some soap and carried out the necessary procedures.383

382 Case C-852/19, Gavanozov II, ECLI:EU:C:2021:346, Opinion of AG Bobek delivered on 29 April 2021, para 71. 383 ibid para 91.

5 Legislating for Human Rights The EU Legal Framework on the Rights of Individuals in Criminal Proceedings I. Introduction The entry into force of the Lisbon Treaty has enabled an unprecedented development in EU criminal law: the adoption by the EU legislator of secondary legislation on human rights applicable in Europe’s area of criminal justice. The legislation in question consists of a series of Directives introducing minimum standards on the rights of the individual in criminal proceedings. Legislating for human rights at the EU level in this context has been made a reality following the inclusion in the Lisbon Treaty of an express legal basis – Article 82(2) TFEU – conferring on the EU express competence to adopt minimum standards on criminal procedure. This chapter will provide an analysis of the evolution and content of the EU legal framework on the rights of the defendant by beginning with an overview of the constitutional background underpinning substantive legislative developments in the field: an analysis of the preLisbon difficulties in legislating on the rights of the defendant will be accompanied by an overview of the post-Lisbon possibilities to legislate in the light of the express legal basis provided in the TFEU. This analysis of the constitutional framework will be followed by an overview of the content of the substantive EU law on the rights of the individual in criminal proceedings by focusing on the Directives which have already been adopted at the EU level at the time of writing. The chapter will then assess the impact of EU law on procedural rights on the protection of fundamental rights in Europe’s area of criminal justice by focusing in particular on the strengthened enforcement avenues that the adoption of post-Lisbon secondary law in the field provides, but will also more broadly assess the impact of EU law on national legal systems and, in particular, national legal diversity. It will conclude with an analysis of the potential of EU defence rights law to transform justice in the development of EU criminal law.

The Rocky Road towards EU Law on the Rights of the Defendant before Lisbon 255

II. The Rocky Road towards EU Law on the Rights of the Defendant before Lisbon Calls for the adoption of legislation on the rights of the defendant in criminal proceedings at the EU level emerged following the policy and legislative choice by EU institutions – and Member States in particular – to push forward with the application of the principle of mutual recognition in the field of criminal law, as the main motor of European integration in criminal matters post-Amsterdam and Tampere. Calls for EU action in the field of the rights of the defendant arose most prominently following the adoption in 2002 of the EU emblematic mutual recognition measure in the field of European criminal law, the Framework Decision on the European Arrest Warrant.1 The operation of the European Arrest Warrant system – based on automaticity, speed and a minimum of formality – has caused grave concerns with regard to the impact of judicial cooperation under this system on the rights of affected individuals, in particular in view of the fact that non-compliance with fundamental rights has not been included as one of the grounds for refusal to recognise and execute a European Arrest Warrant under the Framework Decision.2 In view of these challenges, the Commission already started work on proposals for EU third pillar law on the rights of the defendant in 2002, with its consultation continuing to mid-2003.3 At the end of April 2004, it eventually tabled a draft Framework Decision ‘on certain procedural rights in criminal proceedings throughout the European Union’.4 The proposal aimed at minimum standards and contains provisions on the right to legal advice, the right to translation and interpretation, the right to communication and specific attention and the duty to inform a suspect of their rights in writing through a common EU ‘Letter of Rights’. Although modest in its scope and aiming at establishing minimum EU standards, the Commission’s proposal has proved to be controversial with Member States. A number of Member States feared that the proposal has potentially far-reaching implications for the integrity of their domestic criminal justice systems. This was also linked to a reluctance by certain Member States to accept that the EU has competence in this matter and to bring issues of procedural rights within the framework of EU law. In negotiations, Member States voiced concerns regarding both the existence and extent of EU competence in the field, and the content of each individual article.5 Member States’ concerns, combined with decision-making by unanimity under the third pillar, resulted in considerable delay in the negotiations. Although the adoption of the proposal was a priority under The Hague Programme, negotiations nearly stalled during the UK presidency of the EU in the second half of 2005. Inactivity led the Austrian presidency of the EU to relaunch a consultation with Member States, addressing fundamental issues such as the 1 Framework Decision of 13 June 2002 on the European Arrest Warrant and the surrender procedures between Member States, 2002/584/JHA [2002] OJ L190, 18 July. 2 V Mitsilegas, EU Criminal Law (Hart Publishing, 2009) ch 3. 3 See C Morgan, ‘Proposal for a Framework Decision on Procedural Safeguards for Suspects and D efendants in Criminal Proceedings throughout the European Union’ (2003) 4 ERA Forum 91. 4 COM (2004) 328 final. 5 See Council, Document 12353/05.

256 Legislating for Human Rights scope of the proposal, its relationship with the ECHR and the contested issue of the legal basis.6 These efforts resulted in the inclusion of a statement on the necessity of measures on defence rights in The Hague Programme, but not in an agreement on a legal text. A new legislative proposal was then tabled by the German presidency of the Council of the European Union in 2007.7 The proposal followed attempts by the Austrian Council Presidency to reach agreement, but these were undermined by the tabling of a parallel text for a non-binding Resolution by the UK, the Czech Republic, Ireland, Malta, Cyprus and Slovakia.8 The German presidency devoted a number of Council Working Group meetings to the proposal, and attempted to make it as consistent as possible with the ECHR, in this process asking the opinion of the Council of Europe.9 With the German presidency aiming to reach agreement on the proposal, its text has been watered down (in particular, the ‘Letter of Rights’ provisions were dropped) and concessions appeared to have been made to Member States that wished to exclude proceedings against suspected terrorists from the scope of the measure.10 However, agreement on the proposal has not been reached. The failure to reach agreement on EU legislation on the rights of the defendant under the third pillar is due to three interrelated concerns put forward by a number of Member States during negotiations: concerns over the existence and extent of the competence of the EU to legislate in the field; concerns over the impact of EU legislation on the rights of the defendant on the diversity and the special characteristics of domestic criminal justice systems; and (not always voiced expressly, but underlying legal diversity concerns) concerns relating to the impact of EU legislation on Member States’ choices towards national law privileging security over the protection of human rights. With regard to competence, the proposed legal basis of the Commission’s proposal was Article 31(c) TEU, which enabled common action to be taken on judicial cooperation in criminal matters ‘ensuring compatibility in rules applicable in the Member States, as may be necessary to improve such co-operation’. The Commission defended this choice by stating that the proposal constitutes the ‘necessary complement’ to the mutual recognition measures that are designed to increase efficiency of prosecution.11 However, it has been argued by Member States that the TEU did not contain an express legal

6 Council, Document 7527/06, Brussels, 27 March 2006. 7 For an analysis of this draft and a comparison with the earlier Commission proposals, see M Jimeno-Bulnes, ‘The Proposal for a Council Framework Decision on Certain Procedural Rights in Criminal Proceedings throughout the European Union’ in E Guild and F Geyer (eds), Security versus Justice? Police and Judicial Cooperation in the European Union (Ashgate, 2008) 171–202. 8 See House of Lords European Union Committee, Breaking the Deadlock: What Future for EU Procedural Rights? (2nd Report, session 2006–07, HL Paper 20). See also Council, Document 7349/07, Brussels, 13 March 2007. 9 For background, see Council, Document 10287/07, Brussels, 5 June 2007. For the Council of Europe comments, see Council, Document 5431/07, Brussels, 18 January 2007. 10 See Preamble, indent 5 of Document 10287/07, which states that: ‘Without prejudice to Article 7 [a nonregression clause] the provisions of the Framework Decision are not intended to affect special measures based on national legal provisions to combat crime which is aimed at destroying the foundations of the rule of law. Prosecution of these serious and complex forms of crime, in particular terrorism, may justify restrictions on procedural standards, provided that such restrictions are strictly necessary and proportionate and that the procedural rights are not drained of their substance.’ 11 COM (2004) 328 final, para 51.

The Lisbon Breakthrough 257 basis conferring upon the EU powers to legislate in the field.12 Negotiations have also been fraught with difficulties in terms of reaching a unanimous understanding of key criminal justice concepts which would underpin EU law on the rights of the defendant, including the concept of ‘criminal proceedings’13 and those such as individuals ‘arrested’ and ‘charged’ with a criminal offence.14 Agreement at the EU level on such concepts which would not be entirely consistent with domestic criminal law d efinitions was deemed by Member States to be an undue challenge to the diversity of their national criminal justice systems and (implicitly) also, for some, to their internal policy and the legal balance between the pursuit of security and the protection of fundamental rights.15 As will be seen below, these concerns were also prevalent in the negotiation of EU defence rights law after Lisbon.

III. The Lisbon Breakthrough: The Emergence of an Express EU Competence to Legislate on Criminal Procedure The entry into force of the Lisbon Treaty has tackled doubts about the existence of EU competence to adopt legislation on the rights of individuals in criminal procedure headon. Article 82(2)(b) TFEU confers upon the EU competence to adopt minimum rules on the rights of individuals in criminal procedure. EU competence in the field is not self-standing, but functional: competence to adopt rules on procedural rights has been conferred on the EU only to the extent necessary to facilitate mutual recognition (which, under Article 82(1) TFEU, is the basis of judicial cooperation in criminal matters) and police and judicial cooperation in criminal matters with a cross-border dimension. EU competence to legislate on the rights of the defence is thus conditional upon the need to demonstrate that defence rights are necessary for mutual recognition. In a strategy similar to the one followed in the pre-Lisbon Framework Decision, the ensuing Directives on procedural rights adopted post-Lisbon have been justified by linking the adoption of EU measures in the field with the enhancement of mutual trust. The Preamble to the Directive on the right to interpretation and translation states that: [M]utual recognition of decisions in criminal matters can operate effectively in a spirit of trust in which not only judicial authorities but all actors in the criminal process consider decisions of the judicial authorities of other Member States as equivalent to their own, implying not only trust in the adequacy of other Member States’ rules, but also trust that those rules are correctly applied. (Emphasis added)16

12 For details, see V Mitsilegas, ‘Trust-Building Measures in the European Judicial Area in Criminal Matters: Issues of Competence, Legitimacy and Inter-institutional Balance’ in S Carrera and T Balzacq (eds), Security versus Freedom? A Challenge for Europe’s Future (Ashgate, 2006) 279–89. 13 The general definition used in art 1 of Doc 10287/07 was ‘any proceedings which could lead to a criminal penalty ordered by a criminal court’ (art 1(1)). 14 Article 1(2) states that these terms will be interpreted in accordance with the Strasbourg case law. 15 See the exceptions to the scope of the proposed Framework Decision in art 1(5) of Document 10287/07. 16 Directive 2010/64/EU on the right to interpretation and translation in criminal proceedings [2010] OJ L280/1, Recital 4.

258 Legislating for Human Rights The same wording is used in the Preamble to the Directive on the right to information17 and the right to access to a lawyer.18 In this manner, it can be argued that the European legislator attempts to address the consequences of the perceived moral distance inherent in mutual recognition via the harmonisation of criminal procedural law.19 The emphasis on the need to ensure the effective application of human rights rules in Member States is welcome. However, the use of mutual trust as an element justifying the adoption of EU measures in the field is problematic in two respects: first, it fails to provide a direct and clear link between the defence rights proposed and their necessity for the operation of mutual recognition; and, second, it is based on a concept (of mutual trust) which is too subjective for it to meet the criteria set out by the Court of Justice when ascertaining the legality of EU instruments, namely that the choice of legal basis must be based on objective factors which are amenable to judicial review, including the aim and the content of the measure.20 The concept of trust is subjective and not objective. An alternative way forward could be to justify EU defence rights measures as necessary to address the effects of the operation of automatic interstate cooperation, as expressed by mutual recognition, on the individual. The aim and content of the measures in question are the strengthening of the protection of procedural rights. The necessity requirement of Article 82(2) TFEU would thus be viewed from the perspective of the individual and not of the state or of the authorities which are called upon to apply interstate cooperation.21 In any case, the functional framing of EU competence in the field of procedural rights effectively embeds procedural rights within Europe’s area of criminal justice by making the effective operation of mutual recognition conditional upon a degree of harmonisation of procedural rights at the EU level. In this manner, procedural rights assume a central role in an increasingly integrated area of criminal justice. As will be seen below, this legal basis has been used to establish, via EU secondary law, human rights standards applicable across the board, embracing not only cross-border cases involving mutual recognition, but also purely domestic cases. In this manner, the functional legal basis of Article 82(2) TFEU has led to the adoption of self-standing EU human rights standards in the field of criminal procedure.

17 ibid Recital 4. 18 ibid Preamble, Recital 6. Earlier drafts of the Directive on access to a lawyer expanded the link between defence rights and trust by stating that common minimum rules ‘should increase confidence in the criminal justice systems of all Member States, which in turn should lead to more efficient judicial cooperation in a climate of mutual trust and to the promotion of a fundamental rights culture in the Union’ (Directive 2013/48/ EU on the right of access to a lawyer in criminal proceedings and in European Arrest Warrant proceedings, and on the right to have a third party informed upon deprivation of liberty and to communicate with third persons and with consular authorities while deprived of liberty [2013] OJ L294/1). 19 V Mitsilegas, EU Criminal Law after Lisbon (Hart Publishing, 2016) ch 5. 20 See recently Case C-540/13, European Parliament v Council, judgment of 16 April 2015, EU:C:2015:224, para 30; and Joined Cases C-317/13 and C-679/13, European Parliament v Council, judgment of 16 April 2015, EU:C:2015:223, para 40. 21 V Mitsilegas, ‘The Limits of Mutual Trust in Europe’s Area of Freedom, Security and Justice: From Automatic Inter-state Cooperation to the Slow Emergence of the Individual’ (2012) 31 Yearbook of European Law 319.

The Renewed Momentum towards EU Procedural Rights in the Light of Lisbon 259

IV. The Renewed Momentum towards EU Procedural Rights in the Light of Lisbon At the time when the Lisbon Treaty entered into force (on 1 December 2009), there was already renewed political momentum in the Council towards the adoption of EU legislation on procedural rights. Helped by the strengthening of defence rights by the ECtHR in the case of Salduz,22 the fresh momentum for EU legislation in the field was created by the Swedish presidency of the Council of the European Union in the second half of 2009. From the very outset of its presidency, the Swedish government tabled a ‘Roadmap with a view to fostering protection of suspected and accused persons in criminal proceedings’.23 On the basis of this plan, the presidency secured the adoption by the Council of a Resolution on a Roadmap for strengthening procedural rights of suspected or accused persons in criminal proceedings, which was adopted one day before the entry into force of the Lisbon Treaty.24 The Roadmap injected fresh momentum into the adoption process of EU legislation on procedural rights. Its Preamble recognised that there is further room for EU action in relation to and beyond the ECHR to ensure full implementation of and respect for the Convention standards and, where appropriate, to ensure the consistent application of the applicable standards and to raise existing standards.25 The Roadmap referred expressly to the need to re-balance the relationship between security and human rights in the EU, and linked the protection of human rights to broader EU free movement objectives: according to the Preamble, efforts should be deployed to strengthen procedural guarantees and the respect of the rule of law in criminal proceedings, regardless of where citizens decide to travel, study, work or live in the EU.26 In order to avoid the stagnation encountered in negotiations of procedural rights by previous EU presidencies, Sweden adopted an incrementalist and gradual approach. Rather than resuscitating calls for the adoption of a single EU legal instrument on procedural rights, a ‘roadmap’ was proposed, anticipating the entry into force of the Lisbon Treaty and consisting of the step-by-step adoption of a series of specific measures on procedural rights, including measures on interpretation and translation (measure A), information on rights and information about the charges (measure B), legal advice and legal aid (measure C), communication with relatives, employers and consular authorities (measure D), special safeguards for suspected or accused persons who are vulnerable (measure E) and a Green Paper on pre-trial detention (measure F). This gradual approach was justified in order to enable problems to be identified and addressed in a way that will give added value to each measure.27 As will be seen further below, this step-by-step approach has led to the adoption of more detailed 22 Salduz v Turkey, judgment of 27 November 2008. On the impact of Salduz in this context, see J Jackson, ‘Cultural Barriers on the Road to Providing Suspects with Access to a Lawyer’ in R Colson and S Field (eds), EU Criminal Justice and the Challenges of Legal Diversity. Towards A Socio-legal Approach to EU Criminal Policy (Cambridge University Press, 2016) 181–98. 23 Council Document 11457/09, Brussels, 1 July 2009. 24 Resolution of the Council of 30 November 2009 on a Roadmap for strengthening procedural rights of suspected or accused persons in criminal proceedings [2009] OJ C29, 4 December, 1. 25 ibid Preamble, Recital 2. 26 ibid Recital 10. 27 ibid Preamble, Recital 11.

260 Legislating for Human Rights standards, while enabling EU institutions – and, in particular, Member States within the Council – to focus on the challenges that EU harmonisation in the field of procedural rights may pose to the coherence of domestic criminal justice systems. Notwithstanding the renewed political impetus provided by the Roadmap, which has also been reflected in the Stockholm Programme adopted by the European Council during the Swedish presidency,28 the transition from the third pillar to the Lisbon Treaty has not been entirely straightforward from an institutional perspective. Following the Roadmap approach before the entry into force of the Lisbon Treaty, in July 2009 the Commission tabled a proposal for a Framework Decision on the right to interpretation and translation in criminal proceedings.29 Although the Council did manage to reach a general approach in October 2009, it was not possible to adopt the Framework Decision before the entry into force of the Lisbon Treaty. This led to Member States calling for the exercise of their revised right of initiative post-Lisbon to table a new proposal on the right to interpretation and translation,30 and to the eventual tabling by a number of Member States of a draft Directive in the field shortly after the entry into force of the Lisbon Treaty (as early as 11 December 2009).31 The tabling of this proposal demonstrated Member States’ sensitivity and willingness to assert their powers of initiative at an early stage after the entry into force of the Treaty. The Commission’s response was to propose its own initiative for a Directive on the right to interpretation and translation in criminal proceedings, which was tabled in March 2010.32 The Commission’s proposal can be seen as an attempt to defend its own right of initiative in the field of criminal law after Lisbon. The tabling of a new proposal in the field caused concerns for Member States, which wrote to express concerns with regard to perceived confusion to the outside world including national parliaments and the potential of delay.33 The Directive on the right to interpretation and translation was eventually deemed to be agreed as a Member State initiative,34 but the subsequently adopted measures on procedural rights were adopted as Commission initiatives, with the decision-making process now being fully ‘Lisbonised’.

V. The Content of EU Procedural Rights The adoption of measures on procedural rights thus far has followed the Roadmap structure but not entirely the order envisaged by the Roadmap. This section will examine in 28 European Council, The Stockholm Programme – An Open and Secure Europe Serving and Protecting the Citizens [2010] OJ C115, 4 May. The European Council invited the Commission to put forward the foreseen proposals in the Roadmap for swift implementation and to examine further elements of minimum procedural rights and to assess whether other issues (for instance, the presumption of innocence) need to be addressed to promote better cooperation in this area (at point 2.4). 29 COM (2009) 338 final, Brussels, 8 July 2009. 30 Council Document 16741/09, Brussels, 23 November 2009. 31 Initiative for a Directive on the rights to interpretation and translation in criminal proceedings tabled by Belgium, Germany, Estonia, Spain, France, Italy, Luxembourg, Hungary, Austria, Portugal, Romania, Finland and Sweden, Council Document 16801/09, Brussels, 11 December 2009. 32 COM (2010) 82 final, Brussels, 9 March 2010. 33 Council Document 7598/10, Brussels, 17 March 2010. 34 Directive on the right to interpretation, Preamble, Recital 2.

The Content of EU Procedural Rights 261 detail the content of the measures which have already been adopted by the Council and the European Parliament.

A. The Directive on the Right to Interpretation and Translation The Directive on the right to interpretation and translation35 strengthens the visibility of these rights by translating into secondary EU law rights that have been developed by the case law of the ECtHR and at times extending the Strasbourg protection further.36 With regard to the right to interpretation, the Directive places upon Member States a duty to: [E]nsure that suspected or accused persons who do not speak or understand the language of the criminal proceedings concerned are provided, without delay, with interpretation during criminal proceedings before investigative and judicial authorities, including during police questioning, all court hearings and any necessary interim hearings.37

Member States must: [E]nsure that, where necessary for the purpose of safeguarding the fairness of the proceedings, interpretation is available for communication between suspected or accused persons and their legal counsel in direct connection with any questioning or hearing during the proceedings or with the lodging of an appeal or other procedural applications.38

Member States must ‘ensure that a procedure or mechanism is in place to ascertain whether suspected or accused persons speak and understand the language of the criminal proceedings and whether they need the assistance of an interpreter’39 and that: [I]n accordance with procedures in national law, suspected or accused persons have the right to challenge a decision finding that there is no need for interpretation and, when interpretation has been provided, the possibility to complain that the quality of the interpretation is not sufficient to safeguard the fairness of the proceedings.40

AG Bot has interpreted Articles 1(2) and 2(1) of the Directive as allowing an individual who is the subject of a judicial decision in criminal matters and who does not know the language of the proceedings to launch an appeal in their own language, while the onus for ensuring the enjoyment of this right falls upon the competent national court.41

35 Directive 2010/64/EU on the right to interpretation and translation in criminal proceedings [2010] OJ L280/1. 36 For an analysis, see S Monjean-Decaudin, ‘L’Union Européenne Consacre le Droit à l’Assistance Linguistique dans les Procédures Pénales. Commentaire de la Directive Relative aux Droits à l’interprétation et à la traduction dans les procedures pénales’ (2011) 47 Revue Trimestrielle du Droit Européen 763. 37 Directive 2010/64/EU, art 2(1). 38 ibid art 2(2). 39 ibid art 2(4). 40 ibid art 2(5). 41 Case C-216/14, Criminal Proceedings against Gavril Covaci, ECLI:EU:C:2015:305, Opinion of AG Bot, delivered on 7 May 2015, para 81.

262 Legislating for Human Rights With regard to the right to translation, the Directive places Member States under a duty to: [E]nsure that suspected or accused persons who do not understand the language of the criminal proceedings concerned are, within a reasonable period of time, provided with a written translation of all documents which are essential to ensure that they are able to exercise their right of defence and to safeguard the fairness of the proceedings.42

Essential documents must include ‘any decision depriving a person of his liberty, any charge or indictment, and any judgment’.43 The competent authorities must, ‘in any given case, decide whether any other document is essential. Suspected or accused persons or their legal counsel may submit a reasoned request to that effect’.44 Exceptionally, ‘an oral translation or oral summary of essential documents may be provided instead of a written translation on condition that such oral translation or oral summary does not prejudice the fairness of the proceedings’.45 Member States must: [E]nsure that, in accordance with procedures in national law, suspected or accused persons have the right to challenge a decision finding that there is no need for the translation of documents or passages thereof and, when a translation has been provided, the possibility to complain that the quality of the translation is not sufficient to safeguard the fairness of the proceedings.46

B. The Directive on the Right to Information The Directive on the right to information47 places Member States under an express duty48 to: [E]nsure that suspects or accused persons are provided promptly with information concerning at least the following procedural rights, as they apply under national law, in order to allow for those rights to be exercised effectively: (a) (b) (c) (d) (e)

the right of access to a lawyer; any entitlement to free legal advice and the conditions for obtaining such advice; the right to be informed of the accusation … the right to interpretation and translation; the right to remain silent.49

Member States must ‘ensure that the information … is given orally or in writing, in simple and accessible language and taking into account any particular needs of vulnerable suspects or vulnerable accused persons’.50 A key component of the right 42 Directive 2010/64/EU, art 3(1). 43 ibid art 3(2). 44 ibid art 3(3). 45 ibid art 3(7). 46 ibid art 3(5). 47 Directive 2012/13/EU on the right to information in criminal proceedings [2012] OJ L142/1. 48 Preamble 18: ‘The right to information about procedural rights, which is inferred from the case-law of the European Court of Human Rights, should be explicitly established by this Directive.’ 49 ibid art 3(1). 50 ibid art 3(2).

The Content of EU Procedural Rights 263 to information is the provision of a Letter of Rights. Member States must ‘ensure that suspects or accused persons who are arrested or detained are provided promptly with a written Letter of Rights’. The Letter of Rights was one of the key innovations put forward by the Commission in its original proposal for a Framework Decision on procedural rights in 2004. According to the Directive, suspects and accused persons must ‘be given an opportunity to read the Letter of Rights and must be allowed to keep it in their possession throughout the time that they are deprived of liberty’.51 In addition to the information set out in Article 3 of the Directive (which sets out the procedural rights for which the right to information applies as a minimum), the Letter of Rights must also: [C]ontain information about the following rights as they apply under national law: (a) (b) (c) (d)

the right of access to the materials of the case; the right to have consular authorities and one person informed; the right of access to urgent medical assistance; and the maximum number of hours or days suspects or accused persons may be deprived of liberty before being brought before a judicial authority.52

The Letter of Rights must ‘also contain basic information about any possibility, under national law, of challenging the lawfulness of the arrest; obtaining a review of the detention; or making a request for provisional release’.53 It must ‘be drafted in simple and accessible language’, with Annex 1 to the Directive containing an indicative model Letter of Rights.54 Member States must: [E]nsure that suspects or accused persons receive the Letter of Rights written in a language that they understand. Where a Letter of Rights is not available in the appropriate language, suspects or accused persons [must] be informed of their rights orally in a language that they understand. A Letter of Rights in a language that they understand [must] then be given to them without undue delay.55

The duty of Member States to ensure the provision of a Letter of Rights also extends to European Arrest Warrant proceedings.56 The right of information of the applicable procedural rights is complemented by provisions on the right to information about the accusation and the right of access to the materials of the case. The Directive thus reflects the case law of the ECtHR, which views the right to information in this context as inextricably linked with the defendant’s right to an adversarial procedure.57 As regards the right to information about the accusation, the Directive provides that Member States must: [E]nsure that suspects or accused persons are provided with information about the criminal act they are suspected or accused of having committed. That information must be provided

51 ibid

art 4(1). art 4(2). art 4(3). 54 ibid art 4(4). 55 ibid art 4(5). 56 ibid art 5. 57 Dayanan v Turkey, App No 7377/03, 13 October 2009 (ECtHR), paras 35 and 36. 52 ibid 53 ibid

264 Legislating for Human Rights promptly and in such detail as is necessary to safeguard the fairness of the proceedings and the effective exercise of the rights of the defence.58

Member States must ‘ensure that suspects or accused persons who are arrested or detained are informed of the reasons for their arrest or detention, including the criminal act they are suspected or accused of having committed’ and that: [A]t the latest on submission of the merits of the accusation to a court, detailed information is provided on the accusation, including the nature and legal classification of the criminal offence, as well as the nature of participation by the accused person.59

Member States must further ‘ensure that suspects or accused persons are informed promptly of any changes in the information given … where this is necessary to safeguard the fairness of the proceedings’.60 With regard to the right of access to the materials of the case, the Directive provides that this will be provided free of charge:61 Where a person is arrested and detained at any stage of the criminal proceedings, Member States [must] ensure that documents related to the specific case in the possession of the competent authorities which are essential to challenging effectively, in accordance with national law, the lawfulness of the arrest or detention, are made available to arrested persons or to their lawyers.62

Member States must: [E]nsure that access is granted at least to all material evidence in the possession of the competent authorities, whether for or against suspects or accused persons, to those persons or their lawyers in order to safeguard the fairness of the proceedings and to prepare the defence.63

Access to these materials must be granted: [I]n due time to allow the effective exercise of the rights of the defence and at the latest upon submission of the merits of the accusation to the judgment of a court. Where further material evidence comes into the possession of the competent authorities, access [must] be granted to it in due time to allow for it to be considered.64

By way of derogation, but: [P]rovided that this does not prejudice the right to a fair trial, access to certain materials may be refused if such access may lead to a serious threat to the life or the fundamental rights of 58 Directive 2010/64/EU, art 6(1). In Case C-615/18, UY, ECLI:EU:C:2020:37, the CJEU held that art 6 of the Directive precludes legislation of a Member State under which a person residing in another Member State incurs a criminal penalty if, from the date on which it acquires the force of res judicata, that person does not comply with an order which has imposed a driving ban on them, even though that person was unaware of the existence of that order on the date on which they breached the driving ban resulting from that order. 59 Directive 2010/64/EU, art 6(2) and (3). 60 ibid art 6(4). The CJEU has held that art 6(4) of the Directive and art 48 of the EU Charter must be interpreted as meaning that they do not preclude national legislation according to which the accused person can, during the trial proceedings, request the imposition of a negotiated penalty where the acts on which the accusation is based have been modified, but not where the legal classification of the acts to which the accusation relates has been modified: Case C-646/17, Moro, ECLI:EU:C:2019:489. 61 Directive 2010/64/EU, art 7(5). 62 ibid art 7(1). 63 ibid art 7(2). 64 ibid art 7(3).

The Content of EU Procedural Rights 265 another person or if such refusal is strictly necessary to safeguard an important public interest, such as in cases where access could prejudice an ongoing investigation or seriously harm the national security of the Member State in which the criminal proceedings are instituted. Member States [must] ensure that, in accordance with procedures in national law, a decision to refuse access to certain materials in accordance with this paragraph is taken by a judicial authority or is at least subject to judicial review.65

The Directive further includes express provisions on verification and remedies applicable to all rights contained therein. In particular, Member States must ‘ensure that when information is provided to suspects or accused persons … this is noted using the recording procedure specified in the law of the Member State concerned’.66 Moreover, they must ‘ensure that suspects or accused persons or their lawyers have the right to challenge, in accordance with procedures in national law, the possible failure or refusal of the competent authorities to provide information’.67 The Directive thus re-affirms the backing up of the introduction of procedural rights with provisions on remedies.

C. The Directive on the Right of Access to a Lawyer The right of access to a lawyer is the cornerstone of procedural rights in criminal proceedings. It has been characterised as a ‘gateway’ right, permitting the exercise of other rights and helping to make all these rights real and effective.68 Notwithstanding its importance and the fact that the right of access to a lawyer is inextricably linked with the right to a fair trial, which all EU Member States are under an obligation to respect within the framework of the ECHR, negotiations on the Directive on access to a lawyer – which, as should be recalled, would have the modest aim of introducing merely minimum standards in the field under the legal basis of Article 82(2) TFEU – have proven to be complex. Negotiations focused on how best to achieve meaningful minimum standards without (as some Member States feared) jeopardising unduly national legal diversity in the field of criminal procedure.69 The need to find compromises in order to reach agreement between the Council and the European Parliament in the post-Lisbon co-decision era has led to the adoption of a text accompanied by a lengthy Preamble consisting of no fewer than 59 recitals. As has been noted, the greater emphasis on the Preambular provisions reflects a strategy whereby areas where no agreement on the imposition of express obligations can be reached in negotiations are moved to the Preamble or where parties to negotiations (and in particular Member States) aim to achieve a high level of precision in the adopted standards.70 A number 65 ibid art 7(4). 66 ibid art 8(1). 67 ibid art 8(2). 68 See the submission of Fair Trials International in AT v Luxembourg, App No 30460/13, 9 April 2015 (ECtHR), para 58; and D Sayers, ‘Protecting Fair Trial Rights in Criminal Cases in the European Union: Where Does the Roadmap Take Us?’ (2014) 14 Human Rights Law Review 733, 748. 69 On the main issues arising in negotiations, see S Cras, ‘The Directive on the Right of Access to a Lawyer in Criminal Proceedings and in European Arrest Warrant Proceedings’ (2014) 1 Eucrim 32. 70 H Nowell-Smith, ‘Behind the Scenes in the Negotiation of EU Criminal Justice Legislation’ (2012) 3 New Journal of European Criminal Law 381. On the application of this approach to the access to a lawyer Directive, see also Cras (n 69).

266 Legislating for Human Rights of compromises also had to be reached within the main body of the Directive,71 which includes a number of provisions on exceptions and derogations. Having said that, and as with the other Directives discussed thus far, the Directive constitutes a decisive step towards strengthening procedural rights by translating into concrete secondary law the principles emanating from Strasbourg case law and at times developing these principles further and providing for more extensive protection.72 As will be seen below, a further positive feature in expressly legislating for human rights in EU secondary law is the triggering of the application of fundamental rights and institutional and enforcement safeguards offered by the EU legal order. The scope and content of the right to access to a lawyer is spelt out in Article 3 of the Directive. The opening paragraph states as a general rule that Member States must ‘ensure that suspects and accused persons have the right of access to a lawyer in such time and in such a manner so as to allow the persons concerned to exercise their rights of defence practically and effectively’.73 This provision reflects the approach of the Strasbourg Court, according to which the lawyer must be able to provide effective and concrete assistance, and not merely abstract assistance by virtue of the fact that they are present in the proceedings:74 Suspects or accused persons [must] have access to a lawyer without undue delay. In any event, suspects or accused persons [must] have access to a lawyer from whichever of the following points in time is the earliest: (a) before they are questioned by the police or by another law enforcement or judicial authority; (b) upon the carrying out by investigating or other competent authorities of an investigative or other evidence-gathering act in accordance with point (c) of paragraph 3; (c) without undue delay after deprivation of liberty; (d) where they have been summoned to appear before a court having jurisdiction in criminal matters, in due time before they appear before that court.75

71 Directive 2013/48/EU on the right of access to a lawyer in criminal proceedings and in European Arrest Warrant proceedings, and on the right to have a third party informed upon deprivation of liberty and to communicate with third persons and with consular authorities while deprived of liberty [2013] OJ L294/1. 72 For a positive assessment of the Directive on the right of access to a lawyer, see J Hodgson, ‘Criminal Procedure in Europe’s Area of Freedom, Security and Justice: the Rights of the Suspect’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on European Criminal Law (Edward Elgar, 2016) 148–67; and I Anagnostopoulos, ‘The Right of Access to a Lawyer in Europe: A Long Road Ahead?’ (2014) 4 European Criminal Law Review 3. 73 Directive 2010/64/EU, art 3(1). The CJEU has held that the Directive on access to a lawyer and the Directive on the right to information apply to judicial proceedings which authorise, on therapeutic and safety grounds, the committal to a psychiatric hospital of persons who, in a state of insanity, have committed acts representing a danger to society: Case C-467/18, EP, ECLI:EU:C:2019:765. The Directives, together with art 47 of the Charter, must be interpreted as precluding national legislation, which provides for judicial proceedings authorising the committal to a psychiatric hospital where that legislation does not enable the court with jurisdiction to verify that the procedural rights covered by those Directives were respected in proceedings prior to those before that court, which were not subject to such judicial review. The CJEU also applied the Directive on the presumption of innocence in judicial proceedings on committal, finding that art 3 of the latter requires that the Public Prosecutor’s Office provides proof that the person whose committal is sought is the perpetrator of acts deemed to constitute such a danger. 74 AT v Luxembourg (n 68) para 87. 75 Directive 2010/64/EU, art 3(2).

The Content of EU Procedural Rights 267 The right of access to a lawyer is further articulated as entailing the following elements: (a) Member States [must] ensure that suspects or accused persons have the right to meet in private and communicate with the lawyer representing them, including prior to questioning by the police or by another law enforcement or judicial authority; (b) Member States [must] ensure that suspects or accused persons have the right for their lawyer to be present and participate effectively when questioned. Such participation must be in accordance with procedures under national law, provided that such procedures do not prejudice the effective exercise and essence of the right concerned. Where a lawyer participates during questioning, the fact that such participation has taken place must be noted using the recording procedure in accordance with the law of the Member State concerned; (c) Member States [must] ensure that suspects or accused persons must have, as a minimum, the right for their lawyer to attend the following investigative or evidence-gathering acts where those acts are provided for under national law and if the suspect or accused person is required or permitted to attend the act concerned: identity parades; confrontations; reconstructions of the scene of a crime.76 Member States [must] endeavour to make general information available to facilitate the obtaining of a lawyer by suspects or accused persons. Notwithstanding provisions of national law concerning the mandatory presence of a lawyer, Member States [must] make the necessary arrangements to ensure that suspects or accused persons who are deprived of liberty are in a position to exercise effectively their right of access to a lawyer, unless they have waived that right in accordance with Article 9 [of the Directive].77

The Directive thus articulates in detail in EU secondary law the fundamental right of access to a lawyer as enshrined in Strasbourg case law and, in particular, in the case of Salduz.78 The Directive clarifies and strengthens the impact of Salduz on national law by narrowing the national margin of appreciation in implementing the access to a lawyer obligation and, in particular, by expressly extending the application of the right of access to a lawyer in cases where no deprivation of liberty is involved.79 The challenges which even minimum harmonisation of the right to access to a lawyer was perceived to pose for the integrity of national criminal justice systems and policies have led to the watering-down of harmonisation in four main respects: in limiting the reach of the application of the Directive by attempting to exclude minor offences from its scope;80 in introducing temporary derogations to rights;81 in attempting to reach a

76 ibid art 3(3). 77 ibid art 3(4). According to art 9(1) of the Directive, ‘without prejudice to national law requiring the mandatory presence or assistance of a lawyer, Member States must ensure that, in relation to any waiver of a right referred to in Article 3 … (a) the suspect or accused person has been provided, orally or in writing, with clear and sufficient information in simple and understandable language about the content of the right concerned and the possible consequences of waiving it; and (b) the waiver is given voluntarily and unequivocally’. Such a waiver may be subsequently revoked (art 9(3)). 78 Salduz v Turkey, judgment of 27 November 2008 (ECtHR). 79 See Directive 2010/64/EU, art 2(1). See also Cras (n 69); Hodgson (n 72). 80 Directive 2010/64/EU, art 2(4). 81 ibid arts 3(5) and (6) and 5(3).

268 Legislating for Human Rights compromise in the provision on confidentiality of communications between lawyers and defendants;82 and in excluding from the scope of the present instrument provisions on legal aid, which (as seen above) are the subject of negotiations of a separate Directive under the Roadmap.83 The same is the case with provisions on the rights of vulnerable persons, the detail of which is being negotiated under a separate Directive.84 It is important to analyse here in detail the exceptions introduced by the Directive regarding minor offences and temporary derogations. With regard to minor offences, Article 2(4) states that without prejudice to the right to a fair trial, the Directive will only apply to the proceedings before a court having jurisdiction in criminal matters in respect of minor offences ‘where the law of a Member State provides for the imposition of a sanction by an authority other than a court having jurisdiction in criminal matters, and the imposition of such a sanction may be appealed or referred to such a court’, or ‘where deprivation of liberty cannot be imposed as a sanction’. In any event, Article 2(4) continues by stating that the Directive will ‘fully apply where the suspect or accused person is deprived of liberty, irrespective of the stage of the criminal proceedings’. Moreover, the Preamble to the Directive confirms that ‘the scope of application … in respect of minor offences should not affect the obligations of Member States under the ECHR’.85 Even with these important caveats, this provision may act as a limit to the effective application of the right to access to a lawyer in a significant number of cases. However, this exception, which also applies in the Directives on the right to translation and interpretation and the right to information,86 sits at odds with the case law of the ECtHR and, in particular, the Engel jurisprudence according to which Article 6 ECHR is applicable in cases where there is a ‘criminal charge’ against the affected individual.87 This inconsistency with the protection afforded by the Strasbourg Court is even more evident when one reads Recital 13 to the Directive, according to which: [W]ithout prejudice to the obligations of Member States under the ECHR to ensure the right to a fair trial, proceedings in relation to minor offending which take place within a prison and proceedings in relation to offences committed in a military context which are dealt with by a commanding officer should not be considered to be criminal proceedings for the purposes of [the] Directive.

82 See ibid art 4, according to which ‘Member States [must] respect the confidentiality of communication between suspects or accused persons and their lawyer in the exercise of the right of access to a lawyer provided for under this Directive’, with such communication including ‘meetings, correspondence, telephone conversations and other forms of communication permitted under national law’. On the negotiations and the emergence of this compromise wording, see Cras (n 69). 83 According to art 11, the Directive is ‘without prejudice to national law in relation to legal aid, which [must] apply in accordance with the Charter and the ECHR’. 84 The Directive on access to a lawyer contains a general provision according to which Member States must ‘ensure that the particular needs of vulnerable suspects and vulnerable accused persons are taken into account in [its] application’ (art 13). 85 Directive 2013/48/EU, Recital 18. 86 See also art 1(3) of the Directive on the right to interpretation and art 2(2) of the Directive on the right to information: ‘Where the law of a Member State provides for the imposition of a sanction regarding minor offences by an authority other than a court having jurisdiction in criminal matters, and the imposition of such a sanction may be appealed to such a court, this Directive shall apply only to the proceedings before that court following such an appeal.’ 87 See also Sayers (n 68) 740.

The Content of EU Procedural Rights 269 It is difficult to see how this blanket exclusion can apply without undermining the level of human rights protection provided by the ECHR. In addition to limits to applicability with regard to minor offences, the Directive introduces a number of temporary derogations from the right to access to a lawyer: In exceptional circumstances and only at the pre-trial stage, Member States may temporarily derogate from [the right to access to a lawyer without undue delay after deprivation of liberty] where the geographical remoteness of a suspect or accused person makes it impossible to ensure the right of access to a lawyer without undue delay after deprivation of liberty.88

Similarly: In exceptional circumstances and only at the pre-trial stage, Member States may temporarily derogate from the application of the [access to a lawyer rights provided for in Article 3(3) of the Directive] to the extent justified in the light of the particular circumstances of the case, on the basis of one of the following compelling reasons: (a) where there is an urgent need to avert serious adverse consequences for the life, liberty or physical integrity of a person; (b) where immediate action by the investigating authorities is imperative to prevent substantial jeopardy to criminal proceedings.89

A similar temporary derogation also applies to the right to have a third person informed of the deprivation of liberty, as set out in Article 5 of the Directive.90 Member States may also limit or defer the exercise of the right to communicate, while deprived of liberty, with third parties, as provided in Article 6 of the Directive, ‘in view of imperative requirements or proportionate operational requirements’.91 The Directive sets out a number of general conditions of temporary derogations under Article 3(5) and (6) (access to a lawyer) or Article 5(3) (the right to have a third person informed of the deprivation of liberty). According to Article 8 of the Directive, any temporary derogation under these provisions must ‘(a) be proportionate and not go beyond what is necessary; (b) be strictly limited in time; (c) not be based exclusively on the type or

88 Directive 2010/64/EU, art 3(5). 89 ibid art 3(6). 90 ibid art 5(3). However, where Member States temporarily derogate from the application of this right in relation to a suspect or accused person under 18, ‘they must ensure that an authority responsible for the protection or welfare of children is informed without undue delay of the deprivation of liberty of the child’ (art 5(4)). 91 ibid art 6(2). However, no temporary derogation or limitation is envisaged regarding the right to communicate with consular authorities, set out in art 7, according to which ‘Member States [must] ensure that suspects or accused persons who are non-nationals and who are deprived of liberty have the right to have the consular authorities of their State of nationality informed of the deprivation of liberty without undue delay and to communicate with those authorities, if they so wish’ (art 7(1)). ‘Suspects or accused persons also have the right to be visited by their consular authorities, the right to converse and correspond with them and the right to have legal representation arranged for by their consular authorities, subject to the agreement of those authorities and the wishes of the suspects or accused persons concerned’ (art 7(2)). Article 7(3) states that the exercise of the rights laid down therein ‘may be regulated by national law or procedures, provided that such law or procedures enable full effect to be given to the purposes for which these rights are intended’.

270 Legislating for Human Rights the seriousness of the alleged offence; and (d) not prejudice the overall fairness of the proceedings’.92 Temporary derogations under Article 3(5) or (6) may be authorised only by a duly reasoned decision taken on a case-by-case basis, either by a judicial authority, or by another competent authority on condition that the decision can be submitted to judicial review.93

The provisions on judicial review are consistent with the Directive’s overall emphasis on the importance of remedies. According to Article 12 of the Directive: Member States [must] ensure that suspects or accused persons in criminal proceedings, as well as requested persons in European arrest warrant proceedings, have an effective remedy under national law in the event of a breach of the rights under this Directive.94

The Directive further specifies that: Without prejudice to national rules and systems on the admissibility of evidence, Member States [must] ensure that, in criminal proceedings, in the assessment of statements made by suspects or accused persons or of evidence obtained in breach of their right to a lawyer or in cases where a derogation to this right was authorised in accordance with Article 3(6), the rights of the defence and the fairness of the proceedings are respected.95

D. Legal Aid Directive 2016/1919/EU on legal aid for suspects and accused persons in criminal proceedings and for requested persons in European Arrest Warrant proceedings96 is inextricably linked to the Directive on access to a lawyer. The Roadmap on procedural rights viewed legal advice as ‘fundamental in order to safeguard the fairness of the proceedings’ and legal aid as a mechanism which would ‘ensure access to the aforementioned right to legal advice’.97 Legal aid was finally not covered within the parameters of the Directive on access to a lawyer. Eventually, on 27 November 2013, the Commission released a separate proposal on legal aid,98 which formed part of a package of three legislative proposals concerning procedural rights99 and accompanied by a Commission recommendation.100 The proposal on legal aid received mixed reactions regarding its

92 ibid art 8(1). 93 ibid art 8(2). 94 ibid art 12(1). 95 ibid art 12(2). 96 Directive 2016/1919/EU on legal aid for suspects and accused persons in criminal proceedings and for requested persons in European Arrest Warrant proceedings [2016] OJ L297/1. 97 ibid 3. 98 Commission, ‘Proposal for a Directive of the European Parliament and of the Council on provisional legal aid for suspects or accused persons deprived of liberty and legal aid in European Arrest Warrant proceedings’ COM (2013) 824 final. 99 The two others proposals involved the presumption of innocence and the right to be present at a trial (COM (2013) 821 final), which became Directive 2016/343/EU, and on procedural safeguards for suspected or accused children (COM (2013) 822 final), which became Directive 2016/800/EU. 100 Commission, Recommendation of 27 November 2013 on the right to legal aid for suspects or accused persons in criminal proceedings [2013] OJ C378/11.

The Content of EU Procedural Rights 271 scope and importantly due to the fact that numerous elements had been included in the non-binding Recommendation, even though these organically belonged to the binding Directive.101 The purpose of Directive 2016/1919/EU is to ensure the effectiveness of the right to access to a lawyer, as detailed in Directive 2013/48/EU, by laying down minimum rules concerning the right to legal aid for suspects or accused persons in criminal proceedings who are deprived of liberty and in certain other situations. The Directive also ensures that legal aid is made available in European Arrest Warrant proceedings following the arrest of the requested person in the executing state. The scope of its application includes a right to ordinary legal aid – rather than a provisional right, as was originally foreseen in the Commission proposal102 – at all stages of the criminal justice process. It includes a means test (to ascertain whether the person lacks sufficient resources to pay for legal assistance) and a merits test (to assess whether the provision of legal aid would be in the interests of justice in the light of the circumstances of the case), which may be used in order to determine whether a person is eligible for legal aid. In terms of territorial application, Ireland does not participate in this Directive (and nor did the UK before it left the EU), which had to implemented by the participating Member States by 25 May 2019.103 At this point, it must be noted that the Directive on safeguards for children provides a self-standing right for children to be granted legal aid in certain circumstances.104 The personal scope of the Directive has been a controversial aspect in the negotiations. The Commission proposal envisaged the right to legal aid as applying to all suspects and accused persons who are deprived of liberty and who have the right of access to a lawyer, pursuant to Directive 2013/48/EU. However, a number of (mostly Northern European) Member States disagreed with this approach and sought to reduce the scope of the Directive not only due to the financial implications,105 but also due to the view that legal aid should not made available in relation to minor or less serious offences.106 This restrictive approach was in striking contrast with the quite ambitious agenda of the European Parliament in negotiations, whereby the Rapporteur took the view that scope of the Directive should be aligned to the scope of Directive 2014/48/EU on access to a lawyer, namely to all suspects and accused persons irrespective of whether they were deprived of liberty or not.107 The negotiations proved difficult to the extent that the European Parliament requested an internal impact assessment on the financial implications of an enlarged scope of the Directive. This impact assessment demonstrated that the amendments proposed by the European Parliament would enhance

101 Steven Cras, ‘The Directive on the Right to Legal Aid in Criminal and EAW Proceedings’ (2017) 1 Eucrim 34, 36. 102 For a discussion of how Member States shifted from provisional legal aid to general legal aid, see ibid 39. 103 Directive 2016/1919/EU, art 12. 104 See arts 6 and 18 of Directive 2016/800/EU. See S Cras, ‘The Directive on Procedural Safeguards for Children Who are Suspects or Accused Persons in Criminal Proceedings’ (2016) 2 Eucrim 109. 105 However, it is worth noting that when Member States were asked to give information on financial implications if an extended scope of the Directive would be preferred, it seemed impossible to obtain a complete answer. See Cras (n 101) 37. See also Council, Documents 12845/15 and 13302/15. 106 Cras (n 101) 36. 107 ibid 37.

272 Legislating for Human Rights the protection of suspects and accused persons in criminal proceedings at an increased financial cost, but not to an unreasonable level.108 In the end, it was agreed that although deprivation of liberty would remain as a necessary pre-requisite for considering legal aid, two other circumstances were added. Therefore, according to Article 2(1), the Directive applies to suspects and accused persons in criminal proceedings who have a right of access to a lawyer and who are either: (a) deprived of liberty; (b) required to be assisted by a lawyer in accordance with EU or national law (mandatory assistance); or (c) required or permitted to attend an investigative or evidence-gathering act, including (as a minimum) identity parades, confrontations and reconstructions of the scene of a crime. Furthermore, the scope of the Directive includes persons who were not initially suspects or accused, but became so in the course of questioning by the policy or by another law enforcement authority.109 At the same time, Article 4(4) of the Directive excludes from its scope minor offences in the following cases: where the law of the Member State provides for the imposition of a sanction by an authority other than a court having jurisdiction in criminal matters and the imposition of such a sanction may be appealed or referred to such a court; or where deprivation of liberty cannot be imposed as a sanction. In such cases, the Directive applies only to the proceedings before a court having jurisdiction in criminal matters. In terms of eligibility for legal aid, the basic rule replicates the third indent of Article 47 of the EU Charter and Article 6(3) ECHR. Notably, the rules were transferred from the Recommendation of the Commission that accompanied the three proposals at the behest of the European Parliament. In particular, Article 4(1) of the Directive states that Member States must ensure that suspects and accused persons who lack sufficient resources to pay for the assistance of a lawyer have the right to legal aid when the interests of justice so require. In order to determine who is eligible for such legal aid, Article 4(2) envisages three possible options allowing discretion to Member States; a means test, a merits test or both. Under the means test, all relevant and objective factors, such as income, capital and family situation, as well as the costs of the assistance of a lawyer and the standard of living in that Member State are to be taken into account. Therefore, as has been correctly pointed out, if a person offers to prove their lack of sufficient resources and there are not clear indications to the contrary, it seems that the conditions relating to lack of sufficient resources is fulfilled.110 Under the merits test, Member States shall take into account the seriousness of the criminal offence, the complexity of the case and the severity of the sanction at stake in order to determine whether the interests of justice require legal aid to be granted. These criteria stem directly from the case law of the ECtHR in Quaranta v Switzerland.111 As Cras points out, the E uropean Parliament requested the addition of another criterion relating to the social and personal circumstances of the person concerned.112 However, such an addition was blocked, as it was deemed that it should be possible for Member States

108 Council,

Document 8047/16. 2010/64/EU, art 2(3). 110 Cras (n 101) 40. See ECtHR, Pakelli v Germany, App No 8398/78 (25 April 1983), para 34. 111 ECtHR, Quaranta v Switzerland, App No 12744/87 (24 May 1991), paras 32–34. See Cras (n 101) 40. 112 Ibid. 109 Directive

The Content of EU Procedural Rights 273 to exclude eligibility for legal aid in respect of certain categories of offences.113 Thus, Recital 13 makes reference to such possibility in relation to certain minor offences. Even so, a provision to address the concerns of the European Parliament was inserted concerning vulnerable persons, whose particular needs should be taken into consideration. Given the ample space for Member States left by the merits test, Article 4(4) provides for a safety net – identical to that included in the Directive on procedural safeguards of children114 – where it is stated that in any event, the merits shall be deemed to have been met: (a) when a suspect or an accused person is brought before a competent or judge in order to decide on d etention at any stage of the proceedings within the scope of the Directive; and (b) during detention. Detention in this context has a limited meaning and is linked to pre-trial procedure. Moreover, since the detention has to be ordered by a court, police custody and other similar forms of deprivation of liberty are excluded from this notion.115 Furthermore, according to Article 4(5) of the Directive, legal aid must be granted in a timely manner (‘without undue delay’) and at the latest before questioning or before an investigative or evidence-gathering act is carried out. For those cases where Member States are unable to grant legal aid, Recital 19 calls for at least emergency or provisional legal aid before questioning or before investigative or evidence-gathering acts are carried out. The decision for granting legal aid is to be taken by ‘a competent authority’ in each Member State, which, according to Recital 24, must be an independent authority that is competent to take decisions regarding the granting of legal aid, or a court, including a judge sitting alone. However, in urgent situations, the temporary involvement of the police and the prosecution should also be possible, insofar as this is necessary to be able to grant legal aid in a timely manner.116 In that respect, the Directive also allows considerable discretion to Member States by not interfering in matters of national administration. Legal aid must not only be granted without undue delay, but must also be of adequate quality: Article 7 of the Directive requires Member States to take all necessary measures regarding funding to ensure that there is an effective legal aid system of an adequate quality and that legal aid services are of an adequate quality to safeguard the fairness of the proceedings. The Directive is thus an important benchmark to ensure the effective protection of rights on the ground and the achievement of the full effectiveness of the right to access to a lawyer and to judicial protection more broadly. Key terms such as ‘without undue delay’ or ‘adequate quality’ are not defined in the text, but, as will be seen below, should be treated as autonomous concepts of EU law by the CJEU. As for the extent of the right to legal aid in European Arrest Warrant proceedings, Article 5 of the Directive provides for double aid in both the issuing and the executing Member State, whereby the appointment of a lawyer in the issuing Member State is meant to assist the lawyer in the executing Member State by providing them with information and advice. The issue of double aid proved to be the subject of much debate, 113 Ibid. 114 Directive on procedural safeguards for children who are suspects or accused persons in criminal proceedings [2016] OJ L132/1. See below. 115 Cras (n 101) 41. 116 Directive 2016/1919/EU, Recital 24.

274 Legislating for Human Rights with a number of Member States opposing such a possibility. Eventually Member States grudgingly accepted the insertion of provisions on double legal aid, but subject to two conditions: only in relation to cases of European Arrest Warrant proceedings for the purpose of conducting a criminal prosecution; and only ‘in so far as such aid is necessary to ensure effective access to justice’.117 Recital 21 further clarifies that this would be the case where the lawyer in the executing Member State cannot fulfil their tasks as regards the execution of a European Arrest Warrant effectively and efficiently without the assistance of a lawyer in the issuing Member State. Therefore, Member States are granted considerable leeway in the implementation of the Directive; whilst there is no merits test – since this is met with the issuance of a European Arrest Warrant – Member States are allowed to introduce a means test.118

E. Procedural Rights of Children The aim of the Directive on procedural safeguards for children who are suspects or accused persons in criminal proceedings119 is to set out common minimum rules to ensure that suspected or accused children, who are subject to particular vulnerabilities, are able to understand and follow criminal proceedings so that their right of defence is safeguarded effectively. The main innovation of Directive 2016/800/EU involves the right of children to receive assistance from a lawyer without undue delay, unless such assistance is not proportionate in light of the circumstances of the case. Furthermore, child-specific rights to information, to an individual assessment,120 to a medical examination and to audio-visual recording of questioning are envisaged, as well as specific safeguards for children deprived of their liberty, in particular during pre-trial and posttrial detention.121 Such measures are meant to facilitate the re-integration of children into society after being involved in the criminal justice system. The Directive applies to children – defined as those persons below the age of 18-122 who are suspects or accused persons in criminal proceedings or children who are requested persons.123 Therefore, other types of proceedings, which might entail restrictive measures or significant consequences for children’s lives and thus influence the development processes that shape their personalities, are left outside the scope of the Directive.124 117 ibid art 5(2). 118 ibid art 5(3). 119 Directive of the European Parliament and of the Council of 11 May 2016 on procedural safeguards for children who are suspects or accused persons in criminal proceedings [2016] OJ L132/1. 120 ibid art 7. This right obliges Member States that the specific needs of children concerning protection, education, training and social integration are taken into account, by considering personality, maturity, social and family background or vulnerabilities. 121 Article 10 prescribes that deprivation of liberty should be limited to the shortest appropriate period of time, taking due account of the age and individual situation of the child and of the particular circumstance of the case. Detention should be considered as a measure of last resort, must be reasoned and must be subject to judicial review by a court and a periodic review at reasonable intervals of time. 122 ibid art 2(1). 123 ibid Recital 10. 124 On that matter, see European Parliament, Report of 12 February 2015 on the proposal for a directive of the European Parliament and of the Council on procedural safeguards for children suspected or accused in criminal proceedings, A8-0020/2015, amendment 6. See also Recital 17 of the Directive on procedural safeguards for children.

The Content of EU Procedural Rights 275 This issue of formal classification of legal proceedings was much debated, with the European Parliament calling for an extension of the scope on the basis of the Engel criteria and in line with the case law of the ECtHR, but in the end the issue was not addressed sufficiently. At the behest of the European Parliament, the personal scope of the Directive was extended to individuals until the age of 21 in cases where these persons were children when they became subject to the proceedings, but subsequently reached the age of 18 and the application of the Directive seems appropriate based on all the circumstances of the case, including the maturity and vulnerability of the person concerned.125 Therefore, this extension is not mandatory for Member States, which enjoy discretion in this regard. Overall, Recital 12 states that Member States are ‘encouraged’ to apply the Directive in cases of persons until the age of 21, at least when these concern offences that are committed by the same suspect or accused persons and that they are jointly investigated and prosecuted as inextricably linked. In terms of its temporal application, the Directive applies until the final determination of the question of whether a person has committed a criminal offence, including, where applicable, sentencing and the resolution of any appeal.126 However, the sensitive question concerning the age of criminal liability is not covered by the Directive. The right of information is encompassed in Article 4 and covers all rights prescribed in the Directive. Information about the existence of certain rights, such as the right of assistance by a lawyer, must take place promptly when children are made aware that they are accused or are suspects. Other rights, such as the right to an individual assessment or medical examination, must be made known to the child at the earliest appropriate stage in the proceedings.127 Given the needs of children, such information must be provided in simple and accessible language.128 A groundbreaking provision of the Directive is Article 6 regarding legal assistance. In comparison to the final text, the Commission proposal was quite ambitious and referred to mandatory access by a lawyer without exceptions,129 but the Council distinguished between the right to have access to the a lawyer, which is exercised in accordance to Directive 2013/48/EU, and the right to be assisted by a lawyer, on the basis of the provisions of Directive 2016/800/EU. Consequently, the relationship between the two legal instruments is construed as follows; according to Directive 2013/48/EU, the existence of the right of access to a lawyer is a pre-requisite for assistance from a lawyer. Where the application of a provision of a general nature would make it impossible for the child to be assisted by a lawyer under Directive 2016/800/EU, then that provision should be disapplied. At the same time, any derogation in that latter Directive should not affect the general right of access to a lawyer in accordance with the Directive on access to a lawyer.130 As for the content of the right, mandatory legal assistance entitles children 125 Directive on procedural safeguards for children, art 2(2). The European Parliament advocated only in relation to the first part of this provision. The second requirement of appropriateness was added by the Council. 126 ibid art 2. 127 ibid art 4(1)(b). 128 ibid art 4(2). 129 Commission, ‘Proposal for a Directive of the European Parliament and of the Council on procedural safeguards for children suspected or accused in criminal proceedings’ COM (2013) 822 final, art 6. 130 Directive on procedural safeguards for children, Recital 26.

276 Legislating for Human Rights to be assisted ‘without undue delay’ once they are made aware that they are suspects or accused persons.131 Such assistance includes the right to meet in private and communicate with the lawyer representing them, including prior to questioning by the police or another law enforcement body; assistance when questioned; and assistance during certain investigative and evidence-gathering acts (identity parades, confrontations and reconstructions of the crime scene). The Commission proposal provided that children cannot waive their right to be assisted by a lawyer, as there is a high risk that they would not understand the consequence of their actions.132 This provision was watered down during negotiations and the final wording of Article 6 contains rules allowing Member States to derogate from the obligation for mandatory assistance. Member States are given the discretion not to apply this safeguard when it is not proportionate in light of the circumstances of the case, taking into account the seriousness of the offence, the complexity of the case and the measures to be taken in respect of this offence. However, the best interests of the child and the right to a fair trial constitute important considerations before reaching decision in that respect. However, the Directive is mindful to state that when the child is under detention or is brought before the competent court or judge to decide on detention, a lawyer must assist. Another derogation is prescribed in Article 6(8), according to which in exceptional circumstances and only at the pretrial stage, Member States may temporarily derogate from the application of the rights when there is urgent need to avert serious adverse consequences for the life, liberty or physical integrity of a person where immediate action by the investigative authorities is imperative in order to prevent substantial jeopardy to criminal proceedings in relation to a serious criminal offence. Overall, the safeguards recognised in Directive 2016/800/EU constitute a significant step towards effectively protecting the defence rights of children. The rights encompassed go beyond the rights of adults not only through the introduction of specific provisions tailored to the particular needs of children, but also through the enhanced protection offered and the high threshold and limits in relation to deprivation of liberty and detention. Even in cases where the rights offered are limited by derogations, the EU legislator has tried to strike a balance between the Member States’ prerogatives to maintain procedural autonomy and the need to protect children’ rights of defence. Key examples in this respect is that when the obligation to carry out an individual assessment may be derogated where this is warranted by the circumstances of the case, the national authorities must still consider whether this derogation is compatible with the best interests of the child and the right of defence. It is unfortunate that the scope of the Directive both personae and temporis has not been extended to encompass minor offences or cases that are not classified as criminal proceedings under national law, but it should be noted that a significant first step towards more effective protection has been taken.

131 ibid

art 6(3).

132 Commission

(n 129) art 6.

The Content of EU Procedural Rights 277

F. The Presumption of Innocence Directive 2016/343/EU on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings133 was adopted on 9 March 2016. It constitutes part of the package of instruments proposed by the Commission in November 2013 and is based on the exploratory work in view of the 2006 Green Paper issued in that respect.134 As with the other Roadmap Directives, the overarching aim of that Directive is to strengthen mutual trust and confidence between the judicial authorities of the Member States and to facilitate mutual recognition of decisions in criminal matters. The approach taken by the EU legislator is rather broad, as the Directive encompasses two separate issues; the presumption of innocence – linked to the right to remain silent and the right not to incriminate oneself – and the right to be present at one’s trial. Furthermore, Member States will have to respect the following related obligations: before the final judgment, the authorities should abstain from giving the impression that suspects and accused persons are guilty when making public statements or by using measures of physical restraint or presenting them wearing prison clothes, at least where feasible. In addition, the burden of proof for establishing the guilt of suspects and accused persons lies with the prosecution and any reasonable doubts as to guilt should benefit the accused. Moreover, Member States must ensure that suspects and accused persons have an effective remedy if their rights under this Directive are breached.135 The Commission proposal was met with criticism, as it included provisions on the right to be present at the trial, on trials in absentia and on the right to a new trial, aspects which were not foreseen either in the Roadmap or in the Stockholm Programme,136 and which also raised the issue of compatibility with Framework Decision 2009/299/ JHA.137 Furthermore, the added value of the proposal as a whole was questioned, particularly since the Commission contended that ‘the level of safeguards in Member States’ legislation is, in a general way, acceptable and there does not seem to be any systemic problem in this area’.138 In the end, only the UK Parliament issued a reasoned opinion questioning the compliance of the proposal with the principle of subsidiarity, which led to a decision of non-participation in the Directive. Ireland also decided not to participate. Overall, the negotiations moved swiftly and were largely based on a deal between the European Parliament and the Council centring on the deletion of a provision concerning the reversal of the burden of proof, which was strongly advocated by the Council.139

133 Directive 2016/343/EU on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings [2016] OJ L65/1. 134 Commission, ‘Green Paper on the Presumption of Innocence’ COM (2006) 174 final, 26 April 2006. 135 Directive 2016/343/EU, art 10. 136 S Cras and A Erbežnik, ‘The Directive on the Presumption of Innocence and the Right to Be Present on Trial’ (2016) 1 Eucrim 25, 26. 137 Council Framework Decision 2009/299/JHA on trials in absentia [2009] OJ L/81. 138 Commission, ‘Proposal for a Directive of the European Parliament and of the Council on the strengthening of certain aspects of the presumption of innocence and of the right to be present at trial in criminal proceedings’ COM (2013) 821final, Explanatory memorandum, 5. 139 For details on the compromise offer by the European Parliament see Cras and Erbežnik (n 136) 27.

278 Legislating for Human Rights As regards the scope ratione personae of the Directive, it is explicitly stated that it applies to natural persons only.140 Legal persons are not covered; as mentioned in Recital 14, ‘it is premature to legislate at Union level’. A key issue in this respect is that the CJEU has recognised that the rights flowing from the presumption of innocence do not accrue to legal persons in the same way as they do to natural persons. A prime example is competition law, where the CJEU has allowed that enterprises might sometimes be obliged to provide information that could incriminate them.141 In terms of temporal applicability, as in the case of the other legislative instruments in the field of procedural rights, the Directive applies at all stages of the criminal proceedings, from the moment the persons concerned have been made aware – by official notification or otherwise – that they are suspected or accused of having committed a criminal offence until the decision on the final determination of whether that person has committed the criminal offences concerned has become definitive.142 Normally this involves decisions whereby an appeal is no longer possible, and legal actions and remedies which are available only once a decision has become definitive, such as actions before the ECtHR, are excluded from the scope of the Directive.143 An important issue in this respect involves the applicability of the Directive only to ‘criminal proceedings’, thus explicitly excluding punitive administrative or civil proceedings, even where administrative proceedings would lead to the imposition of sanctions, for example, in the context of competition or tax law.144 Such a broad approach was advocated by the European Parliament145 and was grounded on the Engel criteria of the ECtHR, which were also used by the CJEU.146 The disagreement among the EU institutions is reflected in the first sentence of Recital 11, where it is stated that: ‘This Directive should apply only to criminal proceedings as interpreted by the Court of Justice of the European Union (Court of Justice), without prejudice to the case-law of the European Court of Human Rights.’ However, this arguably creates confusion as to whether the scope of the Directive could be broader than proceedings that are formally qualified as criminal by the legislator.147 In that respect, it could be said that the notion of ‘criminal proceedings’ is an autonomous notion of EU law that would be interpreted by the CJEU.148 Article 3 replicates Article 6(2) ECHR and Article 48(1) of the EU Charter by stating that suspected and accused persons should be presumed innocent until proven guilty according to law. Article 4 then involves the concrete action or inaction that should be

140 Directive 2016/343/EU, Recital 12. For criticism of this approach, see S Lamberigts, ‘The Directive on the Presumption of Innocence: A Missed Opportunity for Legal Persons?’ (2016) 1 Eucrim 36. 141 Case C-301/04, Commission v SGL, ECLI:EU:C:2006:432 (CJEU, 29 June 2006), para 41. 142 Directive 2016/343/EU, art 2. 143 ibid Recital 12. 144 ibid Recital 11. 145 The European Parliament wished to include the term ‘similar proceedings’. 146 Case C-489/10, Bonda, ECLI:EU:C:2012:319 (CJEU, 5 June 2012). 147 S Lamberigts, ‘The Presumption of Innocence (and the Right to be Present on Trial) Directive’ (European Law Blog, 3 May 2016), https://europeanlawblog.eu/2016/05/03/the-presumption-ofinnocence-and-the-right-to-be-present-at-trial-directive. 148 V Mitsilegas, ‘Managing Legal Diversity in Europe’s Area of Criminal Justice: The Role of Autonomous Concepts’ in Colson and Field (n 22) 125–60. This was contended by the Commission and the Council. See Council, Document 11112/15, 4.

The Content of EU Procedural Rights 279 taken by the public authorities; public statements that refer to a person as guilty should not be made as long as that person has not been found guilty.149 The Directive does not apply to EU institutions, but rather is aimed at ‘public authorities’, which, according to Recital 17, involve judicial authorities, police or other law enforcement authorities or other authorities such as ministers and public officials. Therefore, cases such as Tillack, in which OLAF (the European Anti-Fraud Office) made statements which had an adverse impact on individuals, are not addressed through this Directive.150 However, this provision is accompanied by the exception of Article 4(3), according to which public authorities are not prevented from publicly disseminating information on the criminal proceedings where strictly necessary for reasons relating to the criminal investigation or to the public interest. Article 5 of the Directive is an addition to the Commission proposal and a provision that has been the subject of considerable debate.151 It involves the presentation of suspects and accused persons as being guilty through the use of measures of physical restraint (handcuffs, glass box cages and leg irons) and constitutes a reflection and codification of the case law of the ECtHR on Article 3.152 It is explained that this does not prevent Member States from applying such measures for case-specific reasons, so an individual assessment is necessary, following consideration of security issues or matters linked to the prevention of suspects or accused persons from absconding or from having contact with third persons. Article 6 envisages that the burden of proof for establishing guilt lies with the prosecution.153 A key problem in this respect involves the possibility of shifting this burden to the defence and, if so, under which circumstances this shifting may take place. Such a possibility was included in the Commission proposal and was supported by the Council, but the European Parliament offered a series of concessions in order to remove these references from the final text. As a form of compromise between the institutions, the Directive instead makes reference to the ‘use of presumptions of fact of law concerning the criminal liability of a suspect or accused person’. Reflecting the ECtHR case law,154 it is further explained that such presumptions should be confined within reasonable limits, taking into account the importance of what is at stake and maintaining the rights of the defence, and that the means employed should be reasonably proportionate to

149 According to the CJEU, arts 4 and 5 of Directive 2016/343/EU do not preclude, where the competent court examines the reasonable grounds for believing that the suspect or the accused person has committed the offence that they are charged with, in order to give a ruling on the legality of a pre-trial detention decision, that court from comparing the elements of incriminating and exculpatory evidence presented to it and giving reasons for its decision, not only stating the evidence relied on, but also ruling on the objections of the defence counsel of the person concerned, provided that that decision does not present the person detained as being guilty. Order of the Court in Case C-8/19, RH, ECLI:EU:C:2019:110. 150 See ch 8. 151 For these reasons, see Cras and Erbežnik (n 136) 29–30. 152 See, eg, ECtHR, Ramishvili and Kokhreidze v Georgia, App No 1704/06, 27 January 2009; and ECtHR, Khodorkovskiy v Russia, App No 5829/04, 31 May 2011. 42; ECtHR, Svinarenko and Slyadnev v Russia, App Nos 32541/08 and 43441/08), 17 July 2014, para 131. 153 The CJEU has held that art 6 of Directive 2016/343/EU does not apply to a national law that makes the release of a person held in detention on remand pending trial conditional on that person establishing the existence of new circumstances justifying that release: Case C-653/19, DK, ECLI:EU:C:2019:1024. 154 ECtHR, Salabiaku v France, App No 10519/83, 7 October 1988, para 28

280 Legislating for Human Rights the legitimate aim pursued. Such presumptions should be rebuttable and, in any event, should be used only where the rights of the defence are respected.155 Article 6(2) further establishes that any doubt as to guilt should be to the benefit of suspected or accused persons, including where the court assesses whether the person concerned should be acquitted. This provision may have significant implications on national criminal justice systems, particularly since the concept of doubt and its threshold is not defined in the Directive. Article 7 of the Directive prescribes the right to remain silent and the right not to incriminate oneself. Both rights are not enshrined in the ECHR, but the ECtHR has attached them to Article 6 ECHR on the right to a fair trial.156 The Commission proposal enshrined these rights as absolute, which was in stark contrast to its approach in the 2006 Green Paper157 and the ECtHR case law in Murray v UK. The fact that existing case law envisaged the rights as non-absolute led to the qualification in the final text of both rights by introducing certain conditions and limits. As regards the right not to incriminate oneself, it is stated that the competent authorities are not prevented from gathering evidence which may be lawfully obtained through the use of legal powers of compulsion and exists independently of the will of suspected or accused persons.158 Recital 29 explains that such evidence includes material acquired pursuant to a warrant, material in respect of which there is a legal obligation of retention and production upon request, breath, blood or urine samples, and bodily tissue for the purpose of DNA testing. This reference to the use of compulsion reflects the ECtHR case law, particularly in the case of Saunders.159 However, it is noteworthy that the use of compulsion is dealt with in a more lenient manner in comparison to the Commission proposal, which included a reference that seemingly endorsed such use.160 In addition, the exercise of both rights must not be used against the defendant or considered as evidence that they have committed the criminal offence in question.161 In that respect, Recital 28 adds that national rules on assessing evidence by courts or judges are not affected as long as the rights of the defence are respected. The second part of Directive 2016/343 deals with the right to be present at the trial and the right to a new trial. The key issue addressed – but only to a certain extent – is the conditions under which Member States could proceed with a trial despite the absence of the suspect or accused person. The Commission proposal provided detailed rules in this respect by replicating the relevant provisions in Framework Decision 2009/299/JHA on trials in absentia. Nevertheless, such an approach was rejected by the Council not only due to the different objectives underpinning the establishment of these two instruments, but also because the elaboration of such detailed rules went

155 Directive 2016/343/EU, Recital 22. 156 ECtHR, Murray v UK, App No 18731/91, 8 February 1996. 157 The Green Paper reads in this respect that ‘adverse inferences could be drawn from a failure to testify’ and that, under certain circumstances, ‘evidence obtained using indirect pressure may be used’. 158 Directive 2016/343/EU, art 7(3). 159 ECtHR, Saunders v UK, App No 19187/91, 17 December 1996. 160 Recital 17 states that: ‘Any compulsion used to compel the suspect or accused person to provide information should be limited.’ 161 ibid art 7(5) and Recital 28.

The Content of EU Procedural Rights 281 beyond the objective of establishing minimum standards.162 As a result, the text of the proposal was significantly watered down by moving a number of provisions from the text to the Preamble, which contains no fewer than 10 recitals aimed at clarifying the content of these rights. The coexistence of different rules on trials in absentia in separate instruments raises issues regarding the relationship between the Framework Decision and the Directive. Given that the latter is designed to ensure common minimum standards in all Member States, thus applying across the board, this suggests that the Framework Decision is the lex specialis in the particular context of considering refusal of mutual recognition. At the same time, the Directive clarifies that in respect of suspected or accused persons whose location is unknown, a trial in absentia could be held and whether the resulting decision could be enforced immediately, in particular if the concerned has been apprehended, an issue that remained unclear under the Framework Decision.163 In order to do so, the Directive provides for two conditions: that Member States must have undertaken reasonable efforts to locate the suspected or accused persons and that if apprehended, suspected or accused persons must be informed of the decision in absentia, as well as of the possibility to challenge the decision and the right to a new trial.164 Finally, the issue of remedies is directly linked to the admissibility of evidence in Member States, where significant variations exist.165 Article 10 constitutes an effort to ‘square the circle’ in that respect. The final text adopts an approach similar to that in Directive 2013/48/EU on the right of access to a lawyer, according to which in the assessment of statements or of evidence obtained in breach of the right to remain silent or not to incriminate oneself, the rights of the defence and the fairness of the proceedings must be respected. In order to accommodate systems where the court or judge may assess evidence freely, it is clarified that this is ‘without prejudice to national rules and systems on the admissibility of evidence’.166 However, following the request of the European Parliament, Recital 45 serves as a firm reminder to Member States of the case law of the ECtHR on inadmissibility of evidence obtained in violation of Article 3 ECHR167 and of the UN Convention against Torture.168 Overall, Directive 2016/343/EU constitutes an ambitious effort to codify and translate fundamental rights enshrined in the ECHR, as interpreted by the ECtHR, into EU secondary law. It is true that the Strasbourg Court has been rather generous in interpreting Article 6(2) ECHR, but at times this approach has not always been consistent or comprehensive, such as in the case of Murray v UK.169 The compromise in the final text of the Directive can be seen as an attempt to mirror the Strasbourg case law to the

162 https://eucrim.eu/articles/directive-presumption-innocence-and-right-be-present-trial. 163 ibid 33. 164 Directive 2016/343/EU, art 8(4). 165 Other Member States apply the exclusionary rule, others look at the fairness of proceedings and yet others apply a system of free assessment of evidence by judges. 166 Directive 2016/343/EU, art 10(2). 167 ECtHR, Gäfgen v Germany, App No 22978/05, 1 June 2010; ECtHR, El Haski v Belgium, App No 649/08, 25 September 2012. 168 See Directive 2016/343/EU, art 15. 169 L Campbell, ‘Criminal Labels, the European Convention on Human Rights and the Presumption of Innocence’ (2013) 76 Modern Law Review 681.

282 Legislating for Human Rights greatest possible extent, even in cases where the Commission proposal provided higher safeguards. However, as will be seen below, translating ECHR rights into more detailed secondary EU law will bring the interpretation of these rights firmly within the competence of the CJEU, which will be called upon to ensure the effective enforcement rights within the specific context of the EU constitutional framework, taking into account the ECHR, but also ensuring full conformity with the Charter. The adoption of the Directive on the presumption of innocence is also a noteworthy attempt to put forward a common EU benchmark in the face of significant divergences among national laws and between the EU institutions negotiating the instrument. In particular, not only do Member States’ rules regarding the admissibility of evidence vary considerably, but there is also limited consensus regarding the scope of the privilege against self-incrimination and the possibilities to limit its application.170 Moreover, as in the case of the Directive on legal aid, the three institutions (the Commission, the Council and the Parliament) had highly divergent views and it is evident that the European Parliament exercised its negotiating power with a view to further strengthening the rights envisaged to the greatest possible extent. This need to find compromises as a way of balancing the interests between Member States and among EU institutions is reflected in the fact that a number of provisions are not stand-alone, but must be read in conjunction with recitals, either for key definitions, or for clarifications. The existence of a multitude of provisions where what is given with the one hand is taken away by the other may frustrate legal certainty and renders the role of the CJEU pivotal in the interpretation of the Directive. Finally, the Directive addresses three main aspects of the principle – statements by public officials, burden of proof and self-incrimination – each of which aims at protecting the suspect from situations which hamper their procedural situation and effective use of procedural rights. However, as has been pointed out, the Directive does not elaborate on the mutual relationship between these rights.171 Nor does it aim to provide a holistic approach to the principle; its title is indicatory of this somewhat piecemeal approach.172 Nevertheless, the Directive is of much added value on its own in terms of addressing the human rights challenges posed by the blurring of the boundaries between the judicial determination of guilt or innocence on the one hand and labelling on the other hand.173

G. Detention During the past decade, the development of common minimum rules for pre-trial detention – understood as covering all stages until a sentence becomes final – has been an issue of concern at the EU level. On the one hand, the ECtHR has elaborated

170 See S Lamberigts, ‘The Privilege against Self-Incrimination: A Chameleon of Criminal Procedure’ (2016) 7 New Journal of European Criminal Law 418. 171 Ferry de Jong and Leonie van Lent, ‘The Presumption of Innocence as a Counterfactual Principle’ (2016) 12 Utrecht Law Review 32, 49. 172 ibid. 173 Campbell (n 169) 707.

The Content of EU Procedural Rights 283 a list of rules and limitations to deprivation of liberty stemming from Article 5 ECHR, which have been codified in the Council of Europe non-binding Recommendation on the use of remand in custody.174 Furthermore, in a series of judgments, the ECtHR has condemned participating states’ practices as regards hygienic conditions of cells or ill-treatment of cellmates.175 At the EU level, detention conditions has been understood as an issue of interest in inextricable connection to mutual recognition, and Member States’ deficiencies have been flagged up consistently in European Arrest Warrant litigation.176 In the Roadmap for strengthening procedural rights of suspected persons, the Council stated that: The time that a person can spend in detention before being tried in court and during the court proceedings varies a lot between the Member States. Excessively long periods of pre-trial detention are detrimental for the individual can prejudice the judicial cooperation between the Member States and do not represent the values for which the European Union stands.

In response to this statement, on 14 June 2011, the Commission released a Green Paper on the application of EU criminal justice legislation in the field of detention discussing the possibility to propose legislation on the matter based on Article 82(2) TFEU.177 The Commission provided a dual rationale for the EU’s interest in the area: first, detention issues are regarded as a relevant aspect of the rights that must be safeguarded in order to promote mutual trust and ensure the smooth functioning of mutual recognition instruments; and, second, the EU is branded as an area of values which must be upheld.178 Consequently, detention issues, including prison overcrowding or allegations of poor treatment of detainees, may negatively affect and undermine the trust that is necessary to underpin judicial cooperation within the EU. Based on the right to liberty and security as enshrined in Article 5 ECHR, the Commission contemplated the adoption of two common standards: length of detention prior to trial and the regularity of review of the grounds for detention.179 Nevertheless, Member States have generally rejected the need for adopting minimum standards on detention.180 In particular, it has been argued that the adoption of an additional Directive in that respect would result in wasted resources181 and lacks legal basis in the Treaty.182 It has been suggested that a clear benefit from the introduction of such legislation will be limited and mostly in relation to the length of detention where extensive ECtHR case

174 Recommendation (2006) 13 of the Committee of Ministers to member states on the use of remand in custody, the conditions in which it takes place and the provision of safeguards against abuse (27 September 2006). 175 There is extensive case law in that respect. For a detailed account of this, see www.echr.coe.int/Documents/ FS_Detention_conditions_ENG.pdf. 176 See the case law on the grounds for refusal to execute a European Arrest Warrant in ch 3. 177 Commission, ‘Green Paper – Strengthening mutual trust in the European judicial area – A Green paper on the application of EU criminal justice legislation in the field of detention’ COM (2011) 327 final. 178 ibid 3. 179 ibid 9–10. 180 European Commission, ‘Analysis of the Replies to the Green Paper on the Application of Criminal Justice Legislation in the Field of detention’, http://ec.europa.eu/justice/newsroom/criminal/opinion/files/110510/ summary_gpreplies_ms_ongs_en.pdf. 181 T Coventry, ‘Pretrial Detention: Assessing European Union Competence under Article 82(2) TFEU’ (2016) 8(1) New Journal of European Criminal Law 43. 182 ibid 52–55.

284 Legislating for Human Rights law against Member States exists.183 All these arguments are reminiscent of Member States’ resistance towards the adoption of the Framework Decision on procedural rights before the entry into force of the Lisbon Treaty. Their force is weakened further in the light of the recent judgment of the Grand Chamber in Aranyosi and Căldăraru184 and its aftermath, where it has been demonstrated that shortcomings in detention conditions in Member States can have a direct adverse effect on the operation of mutual recognition. As with the existing Directives on procedural rights, EU secondary law on detention will create further avenues to ensure full compliance by Member States with fundamental rights on the ground, while at the same time facilitating the operation of mutual recognition.

VI. The Relationship between EU Secondary Law on Defence Rights and National Law The conferral upon the EU of an express competence to harmonise national legislation in the field of the rights of the defendant under Article 82(2) TFEU comes with a number of caveats, including limiting harmonisation to the adoption of minimum rules and mandating that such rules must take into account the differences between the legal traditions of Member States. The ‘minimum rules’ approach has been confirmed by the CJEU in the context of litigation regarding the Directive on the presumption of innocence, stating that in the light of the minimal degree of harmonisation pursued therein, the Directive cannot be interpreted as being a complete and exhaustive instrument intended to lay down all the conditions for the adoption of decisions on pre-trial detention.185 However, limiting harmonisation to minimum rules does not negate the fact that the EU Directives on defence rights have a considerable impact on upholding the protection of fundamental rights in the functioning of criminal justice systems in their interaction with EU law. In addition to the impact generated by bringing to the fore a number of distinct enforcement measures under EU law,186 the text of the Directives themselves and their interpretation by the CJEU have ensured their considerable impact on national systems. Three factors are central to this impact: the enlargement of the scope of the Directives; the requirement of achieving effectiveness in their implementation;, and the insertion throughout of strong nonregression clauses with regard to the level of the protection of fundamental rights at the national level. In terms of the scope and applicability of the Directives, it is important to note that, notwithstanding the fact that competence under Article 82(2) TFEU requires the existence of a link with the effective operation of mutual recognition, adopted measures apply

183 ibid 58–62. 184 Joined Cases C-404/15 and C-659/15 PPU, Pál Aranyosi and Robert Căldăraru v Generalstaatsanwaltschaft Bremen (Grand Chamber, 5 April 2016). 185 Case C-310/18 PPU, Milev, ECLI:EU:C:2018:732, para. 47. 186 See section VIII below.

The Relationship between EU Secondary Law on Defence Rights and National Law 285 not only in cross-border cases involving the operation of the European Arrest Warrant system,187 but also in purely domestic cases.188 This is an important development as the implementation of the EU procedural rights measures in domestic law will have to cover all cases in the field of domestic criminal procedure which fall within the scope of the Directives. As Caeiro has noted, the Directives have created an autonomous, selfdesigned project for the protection of individual rights in criminal proceedings before the authorities of Member States.189 This is notwithstanding the ‘functional’ articulation of the legal basis for EU measures on procedural rights under Article 82(2) TFEU. In addition, the fact that these measures have introduced minimum harmonisation only does not mean that they are deprived of effectiveness. As AG Bot has noted, the minimum standards character of EU law in the field does not mean that this is not as equally binding as other standards of EU law; on the contrary, minimum standards must be interpreted broadly in order to ensure the effectiveness of EU law in a field which is marked by considerable diversity between national legal systems.190 Adopting a teleological approach, the CJEU has consistently stressed the requirement to achieve the effectiveness of the provisions of the Directive.191 Effectiveness includes here the effective exercise of defence rights192 and the obligation of national authorities to interpret national law in accordance with the aims stated in the Directives.193 This approach is important in terms of shifting the focus of European criminal law from a system privileging the effectiveness of enforcement to a system which must also take seriously the effective exercise of fundamental rights as enshrined in secondary EU law aiming to harmonise national law. Another important mechanism in ensuring a high level of protection of fundamental rights at the national level has been established by the inclusion in all harmonisation measures of non-regression clauses, which affirm that nothing in the Directives must be construed as limiting or derogating from any of the rights and procedural safeguards that are ensured under the Charter, the ECHR, other relevant provisions of international law or the law of any Member State which provides a higher level of protection.194 187 However, the CJEU has differentiated between the rights applicable in domestic cases and the rights applicable in European Arrest Warrant cases in the executing state; see Case C-649/19, IR, ECLI:EU:C:2021:75, paras 41–62. 188 See, inter alia, art 1(1) of the Directive on the right to interpretation and translation; art 1 of the Directive on the right to information; and art 1 of the Directive on access to a lawyer. 189 P Caeiro, ‘Introduction (or: Every Criminal Procedure Starts with a Bill of Rights)’ in The European Union Agenda on Procedural Safeguards for Suspects or Accused Persons: The ‘Second Wave’ and its Predictable Impact on Portuguese Law (Instituto Juridico, Faculdade de Direito, Universidade de Coimbra, 2015) 13–18, at 17. 190 Case C-216/14, Covaci, ECLI:EU:C:2015:305, Opinion of AG Bot, paras 32–33. 191 Covaci (n 190); Joined Cases C-124/16, Ianos Tranca, C-188/16, Tanja Reiter and C-213/16, Ionel Opria, ECLI:EU:C:2017:228; Case C-612/15, Kolev and Others, ECLI:EU:C:2018:392, paras 89, 100, 103, 107–08; Case C-278/16, Sleutjes, ECLI:EU:C:2017:757, para 33; see also Opinion of AG Bot in Case C-216/4 Covaci, ECLI:EU:C:2015:305, paras 32–33, 74; Kolev and Others, paras 89 and 103. 192 See in particular Kolev and Others (n 191) paras 89, 100, 103; Ianos Tranca, Tanja Reiter and Ionel Opria (n 191) para 47; Case C-278/16, Sleutjes, ECLI:EU:C:2017:757, para 33; Case C-216/14, Covaci, ECLI:EU:C:2015:305, para 67. 193 Ianos Tranca, Tanja Reiter and Ionel Opria (n 191) para 49; Kolev and Others (n 191) paras 107–08, referring to the objectives of national law corresponding to those of the Directive. 194 Directive on the right to interpretation and translation, art 8; Directive on the right to information, art 10; Directive on access to a lawyer, art 14; Directive on legal aid, art 11; Directive on the rights of children, art 23; Directive on presumption of innocence, art 13.

286 Legislating for Human Rights This is particularly the case in situations not explicitly dealt with by EU law,195 which may arise as the defence rights Directives bring forward minimum harmonisation only.196 The inclusion of express non-regression clauses in instruments aiming to harmonise national provisions on defence rights is of paramount importance in terms of allowing Member States to provide a higher protection of fundamental rights in relation to EU law. In view of the fact that the defence rights Directives have been adopted under Article 82(2) TFEU in order to facilitate the operation of mutual recognition in criminal matters, the non-regression clauses they include bring about a significant change to the CJEU’s approach in Melloni. The existence of non-regression clauses renders the CJEU approach in Melloni questionable, if not obsolete.197 In conformity with the non-regression clauses, national law which provides a high level of protection of procedural rights will apply, even if the level of protection is higher than that provided by EU law (in any case minimum) standards. This is particularly the case in relation to in absentia judgments, as the post-Lisbon harmonisation exercise has resulted in a specific Directive regulating the issue, which coexists alongside the 2009 Framework Decision.198 While it could be argued that the Framework Decision constitutes lex specialis, specifically addressing the parameters of grounds for refusal in mutual recognition instruments, it is submitted that the provisions to take into account when upholding fundamental rights at the national level are those of the post-Lisbon Directive on the presumption of innocence, as this applies across the board on cross-border and domestic cases and has been adopted in order to facilitate the operation of mutual recognition in criminal matters in the first place. As the Preamble to the Directive on access to a lawyer expressly states, a higher level of protection by Member States should not constitute an obstacle to the mutual recognition of judicial decisions that those minimum rules are designed to facilitate.199 On the contrary, it is clear that a higher level of human rights protection would instead facilitate – and not hinder – mutual recognition. In terms of the interaction of national authorities trying to establish mutual trust, it may be a challenge to accept lower standards in fundamental rights in another Member State when EU law only provides for minimum harmonisation (which can constitute the lowest common denominator for protection at times) and leaves a considerable margin of discretion for the adoption of higher standards by Member States. In this kind of legislation where law in the books is inextricably linked with law in action, with effective protection being dependent on how the provisions of the Directives are actually implemented on the ground.

195 See, for instance, Recital 32 of the Directive on the right to interpretation and translation; Recital 40 of the Directive on the right to information. 196 Covaci (n 190) para 48. 197 V Mitsilegas, ‘The Impact of Legislative Harmonisation on Effective Judicial Protection in Europe’s Area of Criminal Justice’ (2019) 12(2) Review of European Administrative Law 117. 198 On the relationship between the two, see A Schneider, ‘In Absentia Trials and Transborder Criminal Procedures. The Perspective of EU Law’ in S Quattrocolo and S Ruggeri (eds), Personal Participation in Criminal Proceedings (Springer, 2019) 605–39. 199 Directive on access to a lawyer, Preamble, Recital 54.

The Relationship of EU Secondary Law with the ECHR and the Charter 287

VII. The Relationship of EU Secondary Law with the ECHR and the Charter The EU defence rights Directives have translated, expanded and clarified in EU secondary law some of the rights enshrined in the ECHR (in particular, Articles 5 and 6) and in the EU Charter of Fundamental Rights (in particular, Articles 47 and 48).200 The Directives themselves include provisions to address the key question of the relationship between general ECHR and Charter norms with the specific provisions of EU secondary law on defence rights. As regards the ECHR, it has been acknowledged from the outset that its provisions constitute the starting point and the benchmark against which the legality of EU secondary legislation on procedural rights should be judged. In the early stages of the development of EU secondary legislation, every effort was made from the outset201 and throughout negotiations to ensure compliance with the ECHR by seeking the opinion of the Council of Europe on draft proposals.202 Moreover, the Preambles to the adopted EU Directives include extensive references to their relationship with the ECHR. In particular, it should be noted that the right to interpretation and translation for those who do not speak or understand the language of the proceedings is enshrined in Article 6 of the ECHR, as interpreted in the case law of the ECtHR, and that the Directive on the right to interpretation and translation facilitates the application of that right in practice.203 The Preamble to the Directive on the right to information states that Article 5 ECHR enshrines the right to liberty and security of persons, adding that any restrictions on that right must not exceed those permitted in accordance with Article 5 ECHR and inferred from the case law of the ECtHR.204 The same provision makes reference to Article 6 of the Charter. On the other hand, the Directive on the right to access to a lawyer, while continuing to refer to the ECHR, contains more detailed provisions and arguably demonstrates a greater emphasis on rights as enshrined in the Charter. It is stated that the conditions in which suspects or accused persons are deprived of liberty should fully respect the standards set out in the ECHR, the Charter, and the case law of the CJEU and of the ECtHR.205 Moreover, the Preamble adopts a holistic approach to rights on the basis of the Charter, stating that the Directive upholds and should be implemented in accordance with the fundamental rights and principles recognised by the Charter, including the prohibition of torture and inhuman and degrading treatment, the right to liberty and security, respect for private and family life, the right to the integrity of the person, the rights of the child, integration of persons with disabilities, the right to 200 The EU Charter of Fundamental Rights includes a general provision on the right to a fair trial (art 47) and a specific provision guaranteeing respect for the rights of defence of anyone who has been charged (art 48(2)). 201 See point 5 of the Roadmap Resolution, which that the Council will act in full cooperation with the European Parliament, in accordance with the applicable rules, and will duly collaborate with the Council of Europe. 202 See Opinion of the Secretariat on the Commission’s proposal for a Directive of the European Parliament and of the Council on ‘the right to access to a lawyer in criminal proceedings and on the right to communicate upon arrest’, Strasbourg, 9 November 2011; Opinion of the Secretariat on the Commission’s proposal for a Directive of the European Parliament and of the Council on ‘the right to information in criminal proceedings’, Strasbourg, 8 December 2010. 203 Directive 2010/64/EU, Preamble, Recital 14. 204 ibid Preamble, Recital 6. 205 ibid Preamble, Recital 29.

288 Legislating for Human Rights an effective remedy and the right to a fair trial, the presumption of innocence and the rights of the defence.206 Both the ECHR and the Charter constitute benchmarks for the provisions of the Directive on access to a lawyer: the level of protection should never fall below the standards provided by the ECHR or the Charter as interpreted in the case law of the CJEU and the ECtHR.207 Greater emphasis on EU law can also be discerned in the adopted subsequently Directives, with Preambles to a number of Directives stating that the fact that EU Member States are parties to the ECHR does not always provide a sufficient degree of trust in the criminal justice systems of other states.208 In the subsequent interpretation of the Directives by the CJEU, a two-level approach on their relationship with the ECHR and the Charter can be discerned. At the first level, the CJEU relies on the ECHR in order to determine the general parameters of the requirements to comply with the right to a fair trial209 and in order to interpret the content of specific provisions of EU secondary law when case law of the Strasbourg Court has already emerged.210 The CJEU has referred to the Charter explanations, according to which Article 48(2) of the Charter corresponds to Article 6(3) ECHR and has the same meaning and scope of the latter, in accordance with Article 52(3) of the Charter.211 However, there may be further scope for the CJEU to interpret the provisions of the defence rights Directives autonomously under the Charter when the relevant Strasbourg case law is not applicable; there may also be cases where the Charter is applicable, following the Fransson doctrine,212 in cases where a Member State’s action is deemed to fall within the scope of EU law, even when such action is not designed to specifically implement the provisions of the Directive. This may be the case, for instance, regarding national measures aimed at the organisation of the criminal justice system on the ground (appointment of lawyers, interpreters etc), which may have an impact on upholding the rights of the defendant in national criminal proceedings. At the second level, specific interpretations of rights under the ECHR and the Charter may give way to broader considerations when the CJEU is called upon to perform a constitutional balancing exercise between the protection of fundamental rights at the national level and other considerations relating to the effectiveness of EU law. A recent example of the CJEU’s approach has been its ruling in Kolev,213 where it focused on the conformity of national procedural measures with fundamental rights in proceedings aiming to safeguard EU financial interests. Kolev is a development of the CJEU Taricco case law, where the CJEU stressed the need to ensure the effectiveness of the fight against fraud against the EU budget, inter alia, by granting Article 325 TFEU direct effect and imposing on national authorities the duty to disapply national law that is contrary to the objectives of EU law in this context.214 206 ibid Preamble, Recital 52. 207 ibid Preamble, Recital 54. 208 See, for instance, Recital 5 of the Presumption of Innocence Directive; Recital 3 of the Directive on legal aid; Recital 3 of the Children’s Rights Directive. 209 See, for instance, Covaci (n 190) para 39. 210 See Kolev and Others (n 191) para 106. 211 ibid para 105. 212 Case C-617/10, Åklagaren v Hans Åkerberg Fransson, ECLI:EU:C:2013:105. 213 Kolev and Others (n 191). 214 Case C-105/14, Taricco and Others, ECLI:EU:C:2015:555; Case C-42/17, MAS and MB, ECLI:EU:C: 2017:936.

Enhancing Defence Rights through Effective Enforcement 289 In Kolev, the CJEU proceeded to enter into a delicate balancing act: on the one hand, it called upon the national legislator to amend rules when there is a systemic risk that acts that may be categorised as offences against the EU’s financial interests may go unpunished, while also ensuring that fundamental rights of accused persons are protected,215 and for the referring court to ensure that, at the various stages of the proceedings, any deliberate and abusive obstruction on the part of the defence in relation to the proper conduct and progress of those proceedings can be overridden.216 On the other hand, the CJEU stated that fundamental rights cannot be defeated by the obligation to ensure the effective collection of the EU’s resources.217 The CJEU then focused on the requirement to protect the right of accused persons to have their case heard within a reasonable time,218 which was treated by the Court as a general principle of EU law enshrined in Article 6(1) ECHR and Article 47 of the Charter.219 The Court referred to Strasbourg case law to determine the temporal applicability of that right in the field of criminal law.220 However, and while the interpretation of the parameters of a specific rights have again been based on Strasbourg case law, it is noteworthy that the CJEU reverted to its internal ‘constitutional’ approach focusing on the general principles of EU law in order to address the broader question of balancing the protection of fundamental rights with the requirement to achieve effective enforcement of EU law in the protection of an EU interest.221 The approach of the CJEU thus far has demonstrated that the interaction between EU secondary law and ECHR and Charter norms has not been problematic, with the CJEU relying on the ECHR to determine the content of specific Directive provisions when there is already Strasbourg case law, but reverting to general principles of EU law when called upon to balance the effectiveness of enforcement with the effectiveness of fundamental rights protection more broadly.

VIII. Enhancing Defence Rights through Effective Enforcement A key element of added value that harmonisation via EU secondary law of rights which may also be enshrined in general human rights instruments such as the ECHR or the Charter is the enforcement mechanisms that the adoption of secondary legislation brings about under EU law. Decentralised enforcement of these standards before national courts is key in this context. A powerful enforcement tool accompanying a number of provisions in the defence rights Directives is direct effect, which empowers individuals to invoke and claim rights directly before their national courts if the EU Directives have not been implemented or have been inadequately implemented in

215 ibid para 65. 216 ibid para 67. 217 ibid para 68. 218 ibid para 70. 219 ibid para 71. 220 ibid. 221 For a similar discussion, see Case C-310/16, Petar Dzivev, ECLI:EU:C:2019:30. For more on this, see the analysis in ch 1.

290 Legislating for Human Rights national legal orders. Direct effect is important and applicable in view of the emphasis in securing defence rights in practice and on the ground in EU law, and means in practice that a suspect or accused person can derive a number of key rights – such as the right to an interpreter or the right to access to a lawyer – directly from EU law.222 Another important enforcement avenue at the national level is the availability of effective remedies in national law for breach of the rights conferred by the Directives.223 A number of the EU defence rights Directives adopted thus far include provisions on remedies;224 however, these provisions are worded in very broad terms and do not circumscribe specific duties to Member States to provide specific remedies under national law,225 which arguably weakens the enforcement of the obligation in national law. This approach may lead to implementation deficits, as demonstrated in the Commission reports on the implementation of the first two Directives adopted: the Directive on the right to translation and interpretation and the Directive on the right to information. The Commission has noted that in terms of the right to challenge and complain provided in Article 2(5) of the Directive on translation and interpretation, only 10 Member States have introduced procedures in their legislation addressing this review procedure, while the remaining Member States have relied on existing general procedures for appealing against decisions of investigating and court authorities and submitting complaints or objections during the course of the criminal proceedings.226 Moreover, fewer than half of Member States made explicit reference to a specific complaint procedure in relation to the right to challenge and complaint regarding the quality of translation under Article 3(5) of the Directive.227 The Commission has further noted that there has been diversity in the implementation of Article 8(2) of the Directive on the right to information, which lays down the obligation to ensure that suspects or accused persons or their lawyers have the right to challenge, in accordance with procedures in national law, the possible failure or refusal of the competent authorities to provide information, with some Member States relying on general provisions, others introducing specific provisions and yet others failing to enact key elements in national law.228 Diversity and gaps in implementation have also been ascertained by the Commission in the context of its scrutiny of the implementation of the Presumption of Innocence Directive; in

222 The Spanish Constitutional Court has confirmed that provisions of the Directive on the right to information entail direct effect; see STC 13/2017 of 30 January 2017. The direct effect of provisions of the procedural rights Directives has been confirmed by the CJEU in Case C-416/20 PPU, TR (Generalstaatsanwaltschaft Hamburg), judgment of 17 December 2020, ECLI:EU:C:2020:1042, para 55. 223 See also to that effect Recital 44 to the Preamble to the Directive on the presumption of innocence. 224 See, for instance, ibid art 10; art 12 of the Directive on access to a lawyer; art 8 of the Directive on legal aid; art 19 of the Children’s Rights Directive. 225 See, for instance, art 10(1) of the Directive on the presumption of innocence, according to which Member States must ensure that suspects and accused persons have an effective remedy if their rights under this Directive are breached; see the similar wording in the Directive on legal aid (art 8) and in the Children’s Rights Directive (art 19). 226 European Commission, ‘Report from the Commission to the European Parliament and the Council on the implementation of Directive 2010/64/EU on the right to interpretation and translation in criminal proceedings’ COM (2018) 857 final, 18 December 2018, 6–7. 227 ibid 9. 228 European Commission, ‘Report from the Commission to the European Parliament and the Council on the implementation of Directive 2012/13/EU of the European Parliament and of the Council of 22 May 2012 on the right to information in criminal proceedings’ COM (2018) 858 final, 18 December 2018, 17.

Enhancing Defence Rights through Effective Enforcement 291 particular, the Commission notes that a large number of Member States had not notified implementation, that the mode of transposition varies between Member States (with a number of them selecting not to introduce specific implementing legislation) and that there are difficulties in implementation regarding the scope of the national measures implementing the Directive, and the transposition of the Directive’s provisions on the prohibition of public references to guilt and on the right not to incriminate oneself.229 The identification of these gaps has been possible – and addressing them may be feasible – through the strong centralised enforcement mechanisms that the adoption of harmonisation measures under secondary EU law entails. The enforcement role of the European Commission and the CJEU are crucial in this context. The ‘Lisbonisation’ of EU criminal law brings with it the full powers of the Commission as the ‘guardian of the Treaties’ in the field of harmonisation in defence rights; the Commission has the duty to monitor the transposition of these measures by Member States, which can lead to it initiating infringement proceedings in cases of failure to implement. The Commission’s first two implementation reports (on the Directives on the right to interpretation and translation, and the right to information) indicate that its role has been critical in ensuring transposition, with it instituting infringement proceedings against a large number of Member States for failure to transpose (against seven Member States regarding the Directive on the right to information and against no fewer than 16 Member States in the case of the Directive on the right to translation and interpretation), leading to the eventual transposition of the Directives by all Member States and the termination of all infringement proceedings by 2018.230 The enforcement powers of the Commission have contributed to Member States at least appearing to take these new ‘minimum standards’ measures seriously, especially in cases (such as with the Directive on translation and interpretation) where transposition could involve considerable financial cost and require change in everyday practices in the national criminal justice systems with a view to upholding rights effectively. The role of the Commission in this context will become even more critical regarding the transposition of key Directives such as the measures on the right to access to a lawyer and on legal aid, where similar issues will arise prominently in the implementation period. The Commission implementation reports have also identified a number of areas where national action appears to fall short of the requirements of secondary EU law. In addition to its role in adjudicating in any infringement proceedings which may be brought by the Commission, the Court of Justice plays a key role in ensuring the effectiveness of EU law in its interpretation of EU law. As noted above, the CJEU has already stressed the importance of achieving the effectiveness of the defence rights Directives, even though they are perceived to only introduce minimum rules. The preliminary

229 European Commission, ‘Report from the Commission to the European Parliament and the Council on the implementation of Directive (EU) 2016/343 of the European Parliament and of the Council of 9 March 2016 on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings’ COM (2021) 144 final, 31 March 2021. 230 See ibid 3; see also European Commission, ‘Report from the Commission to the European Parliament and the Council on the implementation of Directive on the right of interpretation and translation’ COM (2018) 857 final, 18 December 2018, 3.

292 Legislating for Human Rights reference procedure gives national courts a valuable avenue of cooperation with the CJEU, where the latter can address – and rectify – issues concerning the operation of defence rights measures on the ground. As Klip has noted, the Directives on the rights of the defendant have a direct and positive influence during the procedure at the national level, with the CJEU thus far having intervened to dictate what the outcome of the defendant’s protection must be during national proceedings.231

IX. Effectiveness through Interpretation: Autonomous Concepts In a field presenting a considerable degree of diversity in national criminal procedure systems, the interpretative and enforcement role of the CJEU becomes more significant, notably by establishing a level playing field via the development of autonomous concepts of EU law. The Court of Justice has developed autonomous concepts in order to ensure the uniform and independent interpretation of EU law, in cases where the latter does not expressly refer to national law as a tool for interpretation of the relevant EU law provisions. Autonomous concepts have been developed by the Court on the basis of a teleological and contextual interpretation, as well as on the basis of the need to ensure equality across the EU legal order.232 This approach is directly applicable to a number of provisions in EU criminal law.233 In the field of defence rights, the development of autonomous concepts can underpin harmonisation, especially in view of the fact that the need to agree on common EU minimum standards in the field while respecting national legal diversity has led to the inclusion of general, ‘everyday’ and broad terminology which remains undefined in the EU instruments and which is not necessarily defined in accordance with national law. The CJEU has already developed a series of autonomous concepts setting out the parameters of application of the Framework Decision on judgments in absentia. These include the concepts of ‘summoned in person’ and ‘by other means actually received official information’234 and various aspects of the concept of ‘trial resulting in the decision’, including whether it includes an appeal in which there has been an examination of the merits and which resulted in the passing of a (new) sentence,235 the imposition of a cumulative sentence and appeal,236 and the imposition of suspension revocation decisions.237 There is further potential for the Court to develop autonomous concepts in interpreting the provisions of the defence rights Directives. Notwithstanding detailed provisions in the Directives, aspects of their temporal scope of application, including

231 A Klip, ‘Violations of Defence Rights’ Directives’ (2018) 26 European Journal of Crime, Criminal Law and Criminal Justice 271, 273–74, referring to the case of Ianos Tranca (n 192). 232 See, inter alia, Case C-195/06, Oesterreichischer Rundfunk, ECLI:EU:C:2007:613. 233 Mitsilegas (n 148). See also V Mitsilegas, ‘Autonomous Concepts, Diversity Management and Mutual Trust in Europe’s Area of Criminal Justice’ (2020) 57 CML Rev 45. 234 Case C-108/16 PPU, Dworzecki, ECLI:EU:C:2016:346. 235 Case C-270/17 PPU, Tupikas, ECLI:EU:C:2017:628. 236 Case C-271/17 PPU, Zdziaszek, ECLI:EU:C:2017:629. 237 Case C-571/17 PPU, Ardic, ECLI:EU:C:2017:1026.

Effectiveness through Interpretation: Autonomous Concepts 293 the precise time when rights become applicable or cease to become applicable, may be interpreted autonomously by the Court of Justice to create a level playing field across the EU.238 Crucially, autonomous concepts will also be key in defining the content of the rights of suspects and accused persons in order to ensure the effectiveness of EU law. In the absence of a high level of legal certainty in a number of key Directive provisions where consensus has proven to be elusive in negotiations (see in particular the presumption of innocence Directive), the role of the Court of Justice in enforcing key rights will be crucial. Moreover, a number of provisions in the existing acquis on defence rights oblige Member States to ensure that rights are granted ‘promptly’,239 ‘without undue delay’,240 ‘without delay’,241 ‘in due time’242 or ‘within a reasonable period of time’.243 The Court will be called upon to interpret these concepts autonomously, as they are not defined further in the Directives, nor are they defined by reference to national law. Treating these concepts as autonomous will give flesh to the bones of the rights enshrined in the Directives. The same will potentially occur in the Court defining other key concepts inherent in the content of the rights provided by EU law, including what constitutes access to ‘essential’ documents for the purposes of the right to information244 and the right to translation,245 what constitutes interpretation and translation ‘of sufficient quality to safeguard the fairness of the proceedings’ for the purposes of the said Directive,246 what constitutes an ‘effective legal aid system of an adequate quality’ and of ‘legal aid services of a quality adequate to safeguard the fairness of the p roceedings’,247 what constitutes ‘diligence’ in the taking of decisions by national authorities to grant legal aid,248 what constitutes effective participation in a new trial under the Directive 238 For instance, the Directive on access to a lawyer applies to suspects or accused persons in criminal proceedings from the time when they are made aware that they are suspected or accused of having committed a criminal offence until the conclusion of the proceedings, which is understood to mean the final determination of the question whether the suspect or accused person has committed the offence, including, where applicable, sentencing and the resolution of any appeal (art 2(1)). 239 Key rights in the Directive on the right to information include the right to information about rights (art 3(1)), the right to information about the accusation and relevant changes in such information (art 6(1) and (4) respectively) and the provision of the Letter of Rights (art 4(1)). 240 With regard to the Directive on access to a lawyer, see, in particular: the right to access to a lawyer (art 3(2)); the right to communicate with third persons and with consular authorities (arts 6(1) and 7(1) respectively); the obligation to inform a person deprived of liberty in the execution of a European Arrest Warrant that they have the right to appoint a lawyer in the issuing Member State (art 10(4)). See also arts 4(5) and 6 of the Directive on legal aid. 241 The right to interpretation (art 2(1) of the Directive on the right to interpretation and translation). 242 See art 7(3) of the Directive on the right to information on the right of access to the materials of the case. 243 The right to translation (art 3(1) of the Directive on the right to interpretation and translation). 244 According to art 7(1) of the Directive on the right to information, Member States must ensure access to documents relating to the specific case in the possession of the competent authorities which are essential to challenging effectively (and in accordance with national law) the lawfulness of the arrest or detention. 245 Article 3(1) of the Directive on the right to interpretation and translation grants a right to translation of essential documents: Member States must ensure that suspected or accused persons who do not understand the language of the criminal proceedings concerned are, within a reasonable period of time, provided with a written translation of all documents which are essential to ensure that they are able to exercise their right of defence and to safeguard the fairness of the proceedings. 246 ibid arts 2(8) and 3(9) respectively. 247 Article 7(1) of the Directive on legal aid. 248 According to art 6(1) of the Directive on legal aid, decisions on whether or not to grant legal aid and on the assignment of lawyers shall be made, without undue delay, by a competent authority. Member States shall take appropriate measures to ensure that the competent authority takes its decisions diligently, respecting the rights of the defence.

294 Legislating for Human Rights on the presumption of innocence249 and what is the meaning of the right of access to a lawyer ‘in such time and in such a manner so as to allow the persons concerned to exercise their rights of defence practically and effectively’.250 The development by the CJEU of autonomous concepts in this context may serve to address implementation gaps in Member States, some of which the Commission has already identified.251 The treatment of these concepts as autonomous will significantly influence criminal law and practice in EU Member States, in particular in view of the fact that the Directives apply not only to cross-border, but also to purely domestic cases. By superimposing an EU meaning of key domestic law concepts, autonomous concepts can be transformed from an interpretative tool into an effective instrument of enforcement.

X. Conclusion: Towards a Paradigm Change in Europe’s Area of Criminal Justice The entry into force of the Lisbon Treaty has led to a paradigm shift in the development of Europe’s area of criminal justice under the principle of mutual recognition. The inclusion in the Treaty of an express legal basis conferring upon the EU legislators authority to adopt measures harmonising criminal procedure has led to the EU for the first time adopting secondary legislation on fundamental rights in the form of a series of Directives on the rights of suspects and accused persons in criminal proceedings. In this manner, the construction of Europe’s area of criminal justice has moved from a paradigm privileging the interests of the state and of law enforcement under a system of quasi-automatic mutual recognition to a paradigm where the rights of individuals affected by such a system are brought to the fore, protected and enforced in EU law. The Lisbon legal basis enables the adoption of Directives containing only minimum standards. However, the significance of these Directives for the protection of human rights in Europe’s area of criminal justice should not be underestimated. The Directives adopted thus far have a broad scope of application. Importantly, they go beyond the strict requirements of the Article 82(2) TFEU legal basis (which links harmonisation in the field of criminal procedure with the effective operation of mutual recognition) in applying not only to cross-border but also to purely domestic cases. In this manner, national criminal procedural law – to the extent that it implements the Directives – must be applied in conformity with EU law. This means that national rules of criminal procedure must be applied in conformity with EU secondary human rights law (the Directives on procedural safeguards) as well as with EU constitutional human rights law (the Charter). The Court’s case law on the applicability of the Charter indicates that

249 Article 9 of the Directive on the presumption of innocence. 250 ibid art 3(1). 251 According to the ‘Report from the Commission on the implementation of Directive 2010/64/EU on the right to interpretation and translation in criminal proceedings’ COM (2018) 857 final, 18 December 2018, the requirement for interpretation and translation to be provided without delay was explicitly set out by only 11 Member States. According to the Commission Report on right to information, the understanding of ‘essential documents’ as well as the overall scope of access differs in various Member States. Only a few Member States specify the criterion of ‘essential documents’.

Conclusion: Towards a Paradigm Change in Europe’s Area of Criminal Justice 295 the latter is applicable not only in cases where national law specifically implements EU law, but also to cases where national law has a connection to EU law. These findings are applicable to a wide range of national provisions on criminal procedure, which – in integrated national systems – are closely linked to the achievement of the objectives and the effective implementation of the EU Directives on procedural rights, which will in turn result in the effective exercise of these rights on the ground. In addition to these avenues of protection, the normalisation of large aspects of EU criminal law after Lisbon mean that secondary EU law on procedural rights enjoys the enhanced supranational enforcement mechanisms of EU law. At the level of decentralised enforcement, affected individuals can claim direct effect before national courts. At the level of centralised enforcement, the Commission now has full powers to monitor the effectiveness of the implementation of the procedural rights Directives in Member States and take action before the Court of Justice if such implementation is unsatisfactory. In view of the above analysis, the scope of the Commission’s monitoring exercises is broader than to merely check the provision of national legislation adopted to specifically implement the EU Directives in question. The Commission is also entitled to monitor national criminal procedure systems more broadly so as to ensure that effective implementation has taken place, as well as to monitor compliance on the ground in addition to compliance on paper. Achieving effective implementation and enforcement of the Directives on procedural rights will be one of the key objectives in order to ensure that the individual emerges as the key focal point of Europe’s area of criminal justice. The emphasis on fundamental rights is relevant not only in relation to mutual recognition, but also throughout EU criminal law – with the Regulation on the establishment of a European Public Prosecutor’s Office, including specific cross-references to procedural rights in criminal proceedings.252 EU harmonisation and the enforcement of EU secondary fundamental rights law may be a challenge in view of the considerable diversity in national criminal procedure systems and standards; however, the very existence of EU law in the field triggers the intervention of EU institutions and, in particular, the Court of Justice. It will be the task of the Court to develop an effective level playing field of fundamental rights protection across the EU. The Court’s case law on managing diversity (via the development of autonomous concepts in EU law) and ensuring the effective applicability of fundamental rights provides clear guiding principles in this context. Along with ensuring the effective implementation and exercise of procedural rights across the EU, a key priority as a next step must be to further harmonise national systems via the adoption of binding EU rules regarding rights lying at the heart of the operation of EU criminal justice – this will achieve greater legal certainty and alleviate the tasks of national courts and the CJEU to shape rules on an ad hoc, case-by-case basis, in the absence of meaningful harmonisation at the EU (and even at the ECHR) level. Legislating in the field of detention is a matter of urgency in this context.253

252 See ch 8. 253 E Baker, T Harkin, V Mitsilegas and N Peršak, ‘The Need for and Possible Content of EU Pre-trial Detention Rules’ (2020) 3 Eucrim 221.

6 The Place of the Victim in Europe’s Area of Criminal Justice I. Introduction The past 25 years have witnessed the transformation of the EU into an Area of Freedom, Security and Justice, marked by the evolution of the EU constitutional framework in the field via the entry into force of the Amsterdam and Lisbon Treaties, as well as by significant growth in secondary EU legislation in the field. The development of European integration in criminal matters has been a key part of this process, leading to the gradual configuration of a European area of criminal justice. The establishment of such an area presents a number of challenges, which are inextricably linked to the special place that criminal law occupies in the legal and political systems of EU Member States. Any attempt towards further European integration in the field of criminal justice inevitably has to address questions regarding the impact of EU action in the field on state sovereignty with regard to the exercise of state power in criminal matters. These sovereignty questions are accompanied by questions relating to the impact of Europeanisation on national legal diversity, bearing in mind that domestic criminal justice systems reflect diverse and longstanding national legal traditions and concepts of justice. These questions have led to a number of complex solutions to accompany the supranationalisation of EU criminal law post-Lisbon, both in relation to the extent of EU competence to legislate in the field and the means and principles underlying EU legislative intervention. The impact of EU criminal law on state sovereignty, national legal diversity and national concepts of justice thus remains contested. This is the case in particular with regard to the place of the victim in the criminal justice system. When examined at a purely national level, calls to strengthen the position of the victim in criminal procedure have been accompanied by a series of questions and concerns with regard to the impact that victims’ rights could have on the balance of interests in the criminal justice process and, in particular, the potentially negative impact on the rights of the defendant in criminal proceedings. Different legal systems in Europe have provided different answers to these questions, leading to considerable diversity in the protection of the victim and the content and extent of victims’ rights in the domestic criminal justice systems. It is in the context of this debate on the rights of victims in criminal procedure and their impact on criminal justice and the rights of the defendant in a landscape of considerable legal diversity among EU Member States that EU intervention with respect to victims’ rights has taken place. Informed by these factors, the aim of this chapter is to provide a legal analysis of the place of the victim in EU criminal law and the EU area of criminal justice

Victims’ Rights in EU Criminal Law: A Typology 297 more generally. The chapter will begin by putting forward a typology of victims’ rights in EU criminal law by analysing the three different levels within which EU law addresses the position of the victim in the criminal justice process. This typology will be followed by a discussion of the three key challenges facing the evolution of EU criminal law on victims: first, the chapter will address the constitutional challenge, which is related to the extent to which the EU has used its powers to legislate appropriately in the context of legislation on victims’ rights; second, it will deal with the challenge of national legal diversity, which involves an analysis of the extent to which EU victims’ law has had or can have an impact on the domestic criminal justice systems of EU Member States, and of the extent to which EU harmonisation in the field can challenge national diversity; third, it will address the broader question of the challenge that EU criminal law on the victim poses to concepts of criminal justice in the EU Member States and in the EU itself. The analysis will focus on the actual and potential impact of EU victims’ law on the rights of the defence and on the balance of interests in the criminal justice process.

II. Victims’ Rights in EU Criminal Law: A Typology Victims’ rights stem from multiple sources (including both legislation and case law) and have been put forward in various stages of European integration, with pre-occupation with victims’ rights dating from before the attribution to the EU of an express Treaty competence to legislate in criminal matters. EU law has established victims’ rights relating to the criminal justice process in three main ways. The first way has been to limit the power of Member States with regard to the national choices made in the field of criminal justice in order to ensure the protection of the rights of the victim who is an EU citizen – state sovereignty in criminal matters is limited by the need to ensure free movement and to respect fundamental principles of EU law. The second avenue for establishing victims’ rights at the EU level has been to ensure the extraterritorial reach of national decisions granting rights to victims and their enforcement by authorities in other EU Member States by applying the principle of mutual recognition in criminal matters,1 the aim here being again to ensure the free movement of the victim in a borderless Area of Freedom, Security and Justice. The third, and more direct, avenue of victim protection has been the adoption of specific EU legislation setting out a series of rights for the victim in criminal proceedings – such EU harmonisation measures have evolved over time, with the Treaty of Lisbon (and the TFEU) granting an express competence to the EU to adopt minimum standards on the rights of the victim. The rationale for EU intervention here goes beyond the justification of the other avenues for victim protection: the perceived need for the adoption of EU legislation establishing minimum standards on the rights of victims is not limited only to the achievement of the effective enjoyment of free movement in the EU, but is linked more broadly to the need to ensure the effectiveness of the application of the principle of mutual recognition in criminal matters in the EU (Article 82(2) TFEU). In addition to these three general avenues of ensuring the

1 On the principle of mutual recognition, see V Mitsilegas, ‘The Constitutional Implications of Mutual Recognition in Criminal Matters in the EU’ (2006) 43 CML Rev 1277.

298 The Place of the Victim in Europe’s Area of Criminal Justice protection of the rights of victims in the criminal justice process by EU law, a number of further EU law measures relating to the victim have been adopted, ranging from specific measures on victims’ rights in the context of terrorism,2 trafficking in human beings3 and sexual exploitation legislation4 to legislation on victims’ compensation5 and the mutual recognition of civil protection orders.6 These measures may be linked on occasion to the development of the EU criminal justice acquis, but will not be analysed in detail in this chapter, which aims to focus on the general EU framework for the protection of victims in the criminal justice process.

A. Victims’ Rights as Free Movement Rights The first intervention with regard to ensuring the rights of the victim in the criminal process was by the Court of Justice in the 1980s. In an era when the (then) European Community did not possess express competence to legislate in criminal matters, the Court, in a series of rulings, nevertheless found that Community law did have an impact on criminal law by placing limits on national criminal law in cases where the latter was found to be contrary to fundamental principles of Community law, such as free movement.7 The application of this line of judgments in the case of victims of crime led the Court to find that national legislation restricting compensation to victims who were nationals of an EU Member State or holders of a residence permit was contrary to Community law. In the well-known Cowan ruling,8 the Court found that the prohibition of discrimination: [M]ust be interpreted as meaning that in respect of persons whose freedom to travel to a Member State, in particular as recipients of services, is guaranteed by Community law that State may not make the award of State compensation for harm caused in that State to the victim of an assault resulting in physical injury subject to the condition that he hold a residence permit or be a national of a country which has entered into a reciprocal agreement with that Member State.9

The Court reiterated its earlier case law on the impact of Community law on national criminal law10 to state that although in principle criminal legislation and the rules of criminal procedure, among which the national provision is to be found, are matters for which the Member States are responsible, the Court has consistently held that Community law sets certain limits on their power. In the present case, such legislative provisions may not discriminate against persons to whom Community law gives the right to equal 2 Council Framework Decision 2002/475/JHA on combating terrorism [2002] OJ L164/3. 3 Directive 2011/36/EU of the European Parliament and of the Council on preventing and combating trafficking in human beings and protecting its victims [2011] OJ L101/1. 4 Directive 2011/93/EU of the European Parliament and of the Council on combating the sexual abuse and sexual exploitation of children and child pornography [2011] OJ L335/1. 5 Council Directive 2004/80/EC relating to compensation to crime victims [2004] OJ L261/15. 6 Regulation (EU) 606/2013 of the European Parliament and of the Council on mutual recognition of protection measures in civil matters [2013] OJ L181/4. 7 See V Mitsilegas, EU Criminal Law (Hart Publishing, 2009) ch 2. 8 Case 186/87, Cowan v Le Trésor Public [1989] ECR 195. 9 ibid para 20. 10 See in particular Case 203/80, Casati [1981] ECR 2595.

Victims’ Rights in EU Criminal Law: A Typology 299 treatment or restrict the fundamental freedoms guaranteed by Community law.11 By treating tourists as recipients of services and limiting national legislative choices as regards compensation of the victims of crime in order to ensure the effectiveness of Community law, the Court of Justice in Cowan provided the first major avenue for the protection of victims’ rights when exercising free movement rights. Unlike in other cases, where the result of the Court’s interference in national criminal justice choices has been to limit national criminalisation or punishment which was deemed to be disproportionate to the achievement of the effectiveness of Community law and thus enhance the rights of the defendant,12 in Cowan the need to respect Community law resulted in extending the scope of the rights of the victim in the criminal process. The recognition of the links between the protection of victims and ensuring free movement has resulted in the adoption of a Directive relating to compensation of crime victims in 2004.13

B. Mutual Recognition More than 20 years after the Court’s ruling in Cowan, European integration in criminal matters has made spectacular steps forward: from the EC Treaty in the 1980s, which did not contain an express Community competence to legislate in criminal matters, to the entry into force of the Lisbon Treaty in 2009, which has largely ‘supranationalised’ EU criminal law, via the ‘halfway house’ Maastricht, Amsterdam and Nice Treaties. Yet the passage of time and the ensuing constitutional developments at the EU level do not seem to have altered the fundamental aim of granting rights to victims in order to ensure their freedom of movement, this time in a borderless Area of Freedom, Security and Justice. Rather than relying exclusively on the case law of the Court of Justice, the EU legislator has opted for the adoption of a specific post-Lisbon legislative instrument to ensure the protection of victims when they exercise free movement rights in the EU. The measure in question is Directive 2011/99/EU on the European Protection Order.14 This Directive, which was adopted under a legal basis relating to judicial cooperation in criminal matters,15 aims to apply the principle of mutual recognition in criminal matters to orders issued to protect victims in one Member State when these victims find themselves in other EU Member States – in other words, it is intended that the recognition of a European Protection Order by the authority in the executing Member State will mean that the protection will ‘follow’ the victim to the Member State to which they have moved. A European Protection Order is defined as: [A] decision, taken by a judicial or equivalent authority of a Member State in relation to a protection measure, on the basis of which a judicial or equivalent authority of another 11 Cowan (n 8) para 19. 12 See, eg, Case C-193/94, Skanavi and Chryssanthakopoulos [1996] ECR I-929. 13 Council Directive 2004/80/EC of 29 April 2004 relating to compensation to crime victims [2004] OJ L261/15. The CJEU has recently upheld the effectiveness of the Directive in view of defective implementation and narrow interpretation of compensation entitlements at the domestic level; see Case C-129/19, Presidenza del Consiglio dei Ministri, ECLI:EU:C:2020:566. 14 Directive 2011/99/EU of the European Parliament and of the Council of 13 December 2011 on the European Protection Order [2011] OJ L338/2. 15 TFEU, art 82(1)(a) and (d).

300 The Place of the Victim in Europe’s Area of Criminal Justice Member State takes any appropriate measure or measures under its own national law with a view to continuing the protection of the protected person.16

It may only be issued: [W]hen a protection measure has been previously adopted in the issuing State, imposing on the person causing danger one or more of the following prohibitions or restrictions: (a) a prohibition from entering certain localities, places or defined areas where the protected person resides or visits; (b) a prohibition or regulation of contact, in any form, with the protected person, including by phone, electronic or ordinary mail, fax or any other means; or (c) a prohibition or regulation on approaching the protected person closer than a prescribed distance.17

The objective of the European Protection Order Directive is to set out: [R]ules allowing a judicial or equivalent authority in a Member State, in which a protection measure has been adopted with a view to protecting a person against a criminal act by another person which may endanger his life, physical or psychological integrity, dignity, personal liberty or sexual integrity, to issue a European protection order enabling a competent authority in another Member State to continue the protection of the person in the territory of that other Member State, following criminal conduct, or alleged criminal conduct, in accordance with the national law of the issuing State.18

Upon receipt of a European Protection Order: [T]he competent authority of the executing State [must], without undue delay, recognise that order and take a decision adopting any measure that would be available under its national law in a similar case in order to ensure the protection of the protected person.19

The executing authority is granted limited grounds for non-recognition.20 The Directive also puts forward the principle of assimilation by stating that: [A] European Protection Order [must] be recognised with the same priority which would be applicable in a similar national case, taking into consideration any specific circumstances of the case, including the urgency of the matter, the date foreseen for the arrival of the protected person on the territory of the executing State and, where possible, the degree of risk for the protected person. (Emphasis added)21

The free movement rationale of the Directive is evident in the Preamble, where it is stated that: In a common area of justice without internal borders, it is necessary to ensure that the protection provided to a natural person in one Member State is maintained and continued in any other Member State to which the person moves or has moved.

16 ibid

art 2(1). art 5. 18 ibid art 1. 19 ibid art 9(1). 20 ibid art 10. 21 ibid art 15. 17 ibid

Victims’ Rights in EU Criminal Law: A Typology 301 In addition: It should also be ensured that the legitimate exercise by citizens of the Union of their right to move and reside freely within the territory of Member States, in accordance with Article 3(2) of the [TEU] and Article 21 TFEU does not result in a loss of their protection.22

C. Harmonisation The process of harmonisation of national systems with regard to the rights of the victims in criminal procedure began in the era of the third pillar, with the adoption, under Articles 31 and 34(2)(b) TEU, of the Framework Decision on the standing of victims in criminal proceedings.23 The Framework Decision introduced a number of provisions on the place of the victim in the criminal process.24 It opens with a rather general provision on ‘respect and recognition’, calling upon Member States to ‘ensure that victims have a real and appropriate role’ in their criminal justice systems and to ‘continue to make every effort to ensure that victims are treated with due respect for the dignity of the individual during proceedings’ and to ‘recognise the rights and legitimate interests of the victims with particular reference to criminal proceedings’.25 Specific provisions in the Framework Decision call upon Member States to ‘safeguard the possibility for victims to be heard during proceedings and to supply evidence’26 and establish a right to receive information,27 a series of communication safeguards28 and details on specific assistance to the victim.29 Member States must further ‘afford victims who have the status of parties or witnesses the possibility of reimbursement of expenses incurred as a result of their legitimate participation in criminal proceedings’,30 with victims also being ‘entitled to obtain a decision within reasonable time … on compensation by the offender’ in criminal proceedings.31 Member States will ‘seek to promote mediation in criminal cases’.32 Most importantly, in the context of criminal procedure, the Framework Decision provides a ‘right to protection’, which includes a duty for Member States to: [E]nsure that, where there is a need to protect victims – particularly those most vulnerable – from the effects of giving evidence in open court, victims may, by decision taken by the court, be entitled to testify in a manner which will enable this objective to be achieved, by any appropriate means compatible with [their] basic legal principles.33

22 ibid Preamble, Recital 6. 23 Council Framework Decision 2001/220/JHA on the standing of victims in criminal proceedings [2001] OJ L82/1. 24 For an overview of the Framework Decision, see S de Biolley and A Weyembergh, ‘L’Espace Pénal Européen et les Droits des Victimes’ (2005) 31 Revue de la Faculté de Droit, Université Libre de Bruxelles 93. 25 Framework Decision 2001/220/JHA, art 2(1). 26 ibid art 3, first indent. 27 ibid art 4. 28 ibid art 5. 29 ibid art 6. 30 ibid art 7. 31 ibid art 9(1). 32 ibid art 10(1). 33 ibid art 8(4).

302 The Place of the Victim in Europe’s Area of Criminal Justice The Framework Decision thus aims in general to enhance the position of the victim in criminal procedure across the EU. As is noted in its Preamble: ‘Member States should approximate their laws and regulations to the extent necessary to attain the objective of affording victims of crime a high level of protection, irrespective of the Member State in which they are present.’34 However, its provisions are drafted in rather general terms and do not provide a high standard of legal certainty. This may be explained by the considerable diversity as regards the position of the victim in the national criminal justice systems of Member States, the decision-making limits placed by unanimity in third pillar law, and Member States’ concerns with regard to the impact that the Framework Decision could have on their criminal justice systems, with the Preamble attempting to ensure minimum interference by stating that its provisions ‘do not impose an obligation on Member States to ensure that victims will be treated in a manner equivalent to that of a party to proceedings’.35 Although the Framework Decision on the rights of victims in criminal procedure has now been replaced by a post-Lisbon Directive (see below), it remains significant in that its provisions have formed the basis for the development of the case law of the Court of Justice in the field.36 The Framework Decision also forms an important benchmark in relation to which post-Lisbon developments can be assessed. The entry into force of the Lisbon Treaty led to the adoption of a new Directive on the rights of the victims of crime.37 A deliverable under the so-called Budapest Roadmap on the rights of victims in criminal proceedings,38 the Directive was adopted under Article 82(2) TFEU, which confers upon the EU competence to establish minimum rules on the rights of the victims of crime to the extent necessary to facilitate mutual recognition of judgments and judicial decisions, and police and judicial cooperation in criminal matters having a cross-border dimension. According to Article 82(2), such minimum rules must take into account the differences between the legal traditions and systems of the Member States. The Directive thus constitutes an attempt to establish minimum rules on the rights of victims in the face of the considerable diversity in national criminal justice systems as regards the position and rights of the victim. The Preamble to the Directive reflects this diversity by recognising that: [T]he role of victims in the criminal justice system and whether they can participate actively in criminal proceedings vary across Member States, depending on their national system, and is determined by one or more of the following criteria: whether the national system provides for a legal status as a party to criminal proceedings; whether the victim is under a legal requirement or is requested to participate actively in criminal proceedings, for example as a witness; and/or whether the victim has a legal entitlement under national law to participate actively in criminal proceedings and is seeking to do so, where the national system does not provide that victims have the legal status of a party to the criminal proceedings.39

34 ibid Preamble, Recital 4. 35 ibid Preamble, Recital 9. 36 See section IV below. 37 Directive 2012/29/EU of the European Parliament and of the Council establishing minimum standards on the rights, support and protection of victims of crime, and replacing Council Framework Decision 2001/220/ JHA [2012] OJ L315/57. 38 Council Resolution on a roadmap for strengthening the rights and protection of victims, in particular in criminal proceedings [2011] OJ C187/1. 39 Directive 2012/29/EU, Preamble, Recital 20.

Victims’ Rights in EU Criminal Law: A Typology 303 As will be seen below,40 national legal diversity is further reflected in the text of the Directive by the inclusion of a number of references to national procedural rules as regards the enforcement of the rights set out in the Directive. According to the Preamble: ‘Member States should determine which of [the criteria mentioned above] apply to determine the scope of rights set out in this Directive where there are references to the role of the victim in the relevant criminal justice system.’41 A notable exception to the definition of rights by reference to national systems is the adoption of a ‘European’ definition of the victim, which is, according to the Directive: i. ii.

a natural person who has suffered harm, including physical, mental or emotional harm or economic loss which was directly caused by a criminal offence; [and] family members of a person whose death was directly caused by a criminal offence and who have suffered harm as a result of that person’s death.42

The Directive also contains a definition of family members,43 but further allows for the limitation and prioritisation of family members by Member States.44 The CJEU has held that the Directive does not apply to legal persons or to the state, even if national law confers on them the status of an injured party in criminal proceedings.45 As regards the content of the rights, the Directive introduces a multi-level system of protection of the victim. According to Article 1(1), its purpose is ‘to ensure that victims of crime receive appropriate information, support and protection and are able to participate in criminal proceedings’. The rights of the victims are divided into three broad categories. The first category involves the provision of information and support to the victim.46 This includes the right of the victim to understand and be understood;47 the right to receive information from the first contact with a competent authority;48 the rights of the victim when making a complaint;49 the right of the victim to receive information about their case;50 the right to interpretation and translation;51 the right to access victim support services;52 and the establishment of minimum rules on support from victim support services.53 Another category of provisions involves the protection of victims and recognition of victims with specific protection needs.54 These include the right to protection, under which Member States must ensure that measures are available to protect victims and their family members from secondary and repeat victimisation,55 and the right to avoid contact between victim and offender,56 both of which could be

40 See

section IV below. 2012/29/EU, Preamble, Recital 20. 42 ibid art 2(1)(a). 43 ibid art 2(1)(b). 44 ibid art 2(2). 45 Case C-603/19, TG, UF, ECLI:EU:C:2020:774. 46 Directive 2012/29/EU, Chapter 2. 47 ibid art 3. 48 ibid art 4. 49 ibid art 5. 50 ibid art 6. 51 ibid art 7. 52 ibid art 8. 53 ibid art 9. 54 ibid Chapter 4. 55 ibid art 18. 56 ibid art 19. 41 Directive

304 The Place of the Victim in Europe’s Area of Criminal Justice seen as overlapping with the provisions of the Directive on the European Protection Order; the right to protection of victims during criminal investigations;57 the right to protection of privacy;58 provisions on the individual assessment of victims to identify specific protection needs;59 and provisions on the right to protection of victims with specific protection needs during criminal proceedings60 and on the right to protection of child victims during criminal proceedings.61 A number of the Directive’s provisions on the right to protection of the victim may have a significant impact on the rights of the defendant in criminal proceedings, and the drafters of the Directive have been careful to state that a number of these rights are without prejudice to the rights of defence and in accordance with rules of judicial discretion.62 The CJEU’s stated approach on the interpretation of the Directive has been to balance, by reference to the ECHR, the interests of the victims against the rights of the defendant.63 The most significant impact on the position of the defendant in criminal proceedings in relation to the victims may arise from the third category of rights set out in the Directive, namely rights relating to participation in criminal proceedings. The Directive grants the victim the right to be heard during criminal proceedings,64 rights in the event of a decision not to prosecute,65 the right to safeguards in the context of restorative justice services,66 a right to legal aid,67 and rights to reimbursement of expenses,68 to the return of property69 and to a decision on compensation from the offender in the course of criminal proceedings.70 The Directive also contains a provision on the rights of victims resident in another Member State.71 However, these rights are largely dependent on national law, with the Directive again attempting to achieve a compromise between the introduction of EU minimum standards and the respect of national diversity in the field. Hence, the Directive provides repeatedly that the procedural rules governing the exercise of a number of key rights, including the right to be heard, the right to legal aid, the right of reimbursement of expenses, the right to return of property and the rights of the victims in the event of a decision not to prosecute, will be 57 ibid art 20. 58 ibid art 21. 59 ibid art 22. 60 ibid art 23. 61 ibid art 24. 62 ibid arts 20 and 23. See also art 18 on the right to protection which is without prejudice to the rights of defence. 63 Case C-38/18, Gambino and Hyka, ECLI:EU:C:2019:628, paras 41 et seq. 64 Directive 2012/29/EU, art 10. 65 ibid art 11. 66 ibid art 12. 67 ibid art 13. 68 ibid art 14. 69 ibid art 15. 70 ibid art 16. The CJEU has held that arts 16 and 18 of the Directive must be interpreted as not precluding national legislation under which, where the victim of a criminal offence has already been examined by a panel of judges of a first-instance court and the composition of that panel is subsequently changed, that victim must, in principle, be examined again by the panel in its new composition, where one of the parties to the proceedings does not consent to that panel basing its decision on the written record of the evidence the victim gave at the first examination. See Gambino and Hyka (n 63). For a commentary, see F Catteau, ‘Les droits procéduraux des personnes poursuivies et des victimes de criminalité devant la Court de Justice de l’Union Européenne. Vers un droit Européen de la procedure pénale?’ (2020) 2–3 Cahiers droit européen 485, 536–39. 71 Directive 2012/29/EU, art 17.

The Place of the Victim in Europe’s Area of Criminal Justice 305 determined by national law.72 Moreover, the Directive grants considerable discretion to Member States as regards the content of certain rights: in relation to the right to be heard, Member States must ‘ensure that victims may be heard during criminal proceedings and may provide evidence’ (emphasis added);73 Member States must ensure the right of the victim to review a decision not to prosecute ‘in accordance with the victim’s role in the relevant criminal justice system’.74 In addition to these limitations and references to national legal systems, a number of rights are not set out in detail in the text of the Directive, but greater detail on their scope is provided in the Preamble. The Preamble to the Directive contains no fewer than 72 recitals, and a number of them are detailed and serve to explain and (as demonstrated in the case of the right to reimbursement of expenses) limit the rights set out in the text of the Directive.75 The use of extensive Preambular provisions has been explained as a means of addressing Member States’ concerns with regard to the perceived lack of legal certainty in the Commission’s original proposal, with the recitals acting as an aid to interpreting the operative articles of the Directive when they are perceived as ambiguous, but also as a means of enabling the Council and the European Parliament to reach agreement on the Directive, with recitals being used to mention issues where the legislators could not agree real obligations in the operative text.76

III. The Place of the Victim in Europe’s Area of Criminal Justice: Constitutional Implications The adoption of measures on victims’ rights at the EU level does not always sit easily with the limits of EU competence to legislate in criminal matters. Questions on the legality of both pre-Lisbon and post-Lisbon victims’ rights instruments arise, in particular as regards the appropriateness of the legal basis used for their adoption. On the one hand, the extent to which measures on the rights of the victim in criminal procedure can be adopted on the basis of EU competence to legislate in criminal matters is not always clear. On the other hand, national legal diversity concerning means of protecting the victim (and the use of civil and not criminal law in this context) raises the question of whether a criminal law legal basis is appropriate and/or sufficient for the EU to legislate in this context. The latter question has arisen prominently with regard to the adoption of the Directive on the European Protection Order. The Preamble to the Directive clarifies

72 ibid arts 10(2), 13, 14, 15 and 11(1) and (2) respectively. 73 ibid art 10(1). 74 ibid art 11(1). 75 According to Recital 47, ‘victims should not be expected to incur expenses in relation to their participation in criminal proceedings. Member States should be required to reimburse only necessary expenses of victims in relation to their participation in criminal proceedings and should not be required to reimburse victims’ legal fees … The right to reimbursement of expenses in criminal proceedings should not arise in a situation where a victim makes a statement on a criminal offence. Expenses should only be covered to the extent that the victim is obliged or requested by the competent authorities to be present and actively participate in the criminal proceedings’. 76 See H Nowell-Smith, ‘Behind the Scenes in the Negotiation of EU Criminal Justice Legislation’ (2012) 3 New Journal of European Criminal Law 381, 384.

306 The Place of the Victim in Europe’s Area of Criminal Justice that the latter ‘applies to protection measures adopted in criminal matters and does not therefore cover protection measures adopted in civil matters’. However, it adds that: For a protection order to be executable in accordance with this Directive, it is not necessary for a criminal offence to have been established by a final decision. Nor is the criminal, administrative or civil nature of the authority adopting a protection measure relevant. This Directive does not oblige Member States to amend their national law to enable them to adopt protection measures in the context of criminal proceedings.77

This flexibility as regards the nature of the authority issuing a European Protection Order and the nature of the protection measure undertaken in the executing state is maintained in the operative part of the Directive. While a protection measure is defined as a decision ‘in criminal matters’ adopted in the issuing Member State,78 a European Protection Order is defined as: [A] decision, taken by a judicial or equivalent authority of a Member State in relation to a protection measure, on the basis of which a judicial or equivalent authority of another Member State takes any appropriate measure or measures under its own national law with a view to continuing the protection of the protected person. (Emphasis added)79

However, the Directive does not require these authorities to be part of Member States’ criminal justice systems, with the Directive not excluding the possibility that such authorities are administrative or civil bodies. According to the Preamble, the Directive takes into account ‘the fact that effective protection can be provided by means of protection orders issued by an authority other than a criminal court’.80 Flexibility is also retained with regard to the nature of the European Protection Order. In executing the European Protection Order, ‘the executing State may apply, in accordance with its national law, criminal, administrative, or civil measures’ (emphasis added).81 The Directive thus allows the transformation of what is a decision in criminal matters in the issuing state into its execution as an administrative or a civil law measure in the executing state. While such flexibility may reflect the considerable diversity in national legal systems in the field,82 as well as the need to reassure Member States that the adoption of the Directive will not alter their domestic criminal justice systems,83 it is questionable whether Article 82(1) TFEU on judicial cooperation in criminal matters is sufficient as a sole legal basis for this instrument. A joint legal basis of Articles 81 (judicial cooperation in civil matters) and 82 (judicial cooperation in criminal matters) TFEU would more accurately reflect the content and the cooperation mechanism set out in the Directive.84

77 Directive 2011/99/EU of the European Parliament and of the Council of 13 December 2011 on the European protection order, Preamble, Recital 10. 78 Directive 2012/29/EU, art 2(2). 79 ibid art 2(1). 80 ibid Preamble, Recital 8. 81 ibid art 9(1). 82 See also ibid Preamble, Recital 20. 83 According to the Preamble to the Directive, the latter ‘does not create obligations to modify national systems for adopting protection measures nor does it create obligations to introduce or amend a criminal law system for executing a European protection order’ (Recital 8). 84 See S van der Aa and J Ouwerkerk, ‘The European Protection Order: No Time to Waste or a Waste of Time?’ (2011) 19 European Journal of Crime, Criminal Law and Criminal Justice 267, 280.

The Place of the Victim in Europe’s Area of Criminal Justice 307 The adoption of the European Protection Order Directive under multiple legal bases could further serve to focus the mind of the EU legislators on the potential overlap of a number of the Directive’s provisions with other EU law instruments which may affect the position of the victim in similar circumstances, including mutual recognition instruments in both the civil and criminal law spheres.85 Legality questions have also arisen with regard to the adoption of EU legislation aiming to harmonise national laws on the rights of the victims of crime. The third pillar Framework Decision on the standing of victims in criminal proceedings was adopted under the general legal basis of Article 31 TEU on common action on judicial cooperation in criminal matters, without specifying further which subparagraph of this provision applies. Article 31 TEU was thus used in a flexible manner in order to translate the political will of Member States in order to be seen to be taking action in favour of victims of crime into legal reality. Yet the link between the Framework Decision and the facilitation of judicial cooperation in criminal matters, which is the main objective of Article 31 TEU, has not been demonstrated and remains questionable. Indeed, approximation under the Framework Decision has been justified as ‘necessary to attain the objective of affording victims of crime a high level of protection, irrespective of the Member State in which they are present’.86 This approach reflects the need to primarily achieve a free movement objective rather than an objective geared towards the facilitation of judicial cooperation in criminal matters. Notwithstanding the introduction of an express legal basis by the Lisbon Treaty conferring upon the EU competence to adopt legislation on the rights of victims under Article 82(2) TFEU, the new Directive on the rights of the victims of crime is not devoid of similar legality shortcomings. Article 82(2) TFEU confers upon the EU competence to establish minimum rules on the rights of the victims of crime ‘to the extent necessary to facilitate mutual recognition of judgments and judicial decisions and police and judicial cooperation in criminal matters having a cross-border dimension’. However, it is questionable whether the Directive on the rights of the victims of crime meets the legality criteria set out by Article 82(2) TFEU. In particular, it has not been demonstrated how the Directive will serve to facilitate mutual recognition or judicial cooperation in criminal matters having a cross-border dimension. In the Explanatory Memorandum to its original draft Directive, the Commission attempted to substantiate a link between the rights of victims of crime and the facilitation of mutual recognition as follows: Mutual recognition can only operate in a spirit of confidence, whereby not only judicial authorities but all those involved in the criminal justice process and others who have a legitimate interest in it can trust in the adequacy of the rules of each Member State and trust that those rules are correctly applied. Where victims of crime are not subject to the same minimum standards throughout the EU, such trust can be reduced due to concerns over the treatment of victims or due to differences in procedural rules. Common minimum rules should thus lead to increased confidence in the criminal justice system of all Member States, which in turn should lead to more efficient judicial cooperation 85 The Preamble to the Directive contains detailed references on the relationship between the various EU law measures which may be of relevance – see Recitals 16, and 33 and 34 for criminal law and civil law measures respectively. 86 Council Framework Decision 2001/220/JHA (n 23) Preamble, Recital 4.

308 The Place of the Victim in Europe’s Area of Criminal Justice in a climate of mutual trust as well as to the promotion of a fundamental rights culture in the European Union. They should also contribute to reducing obstacles to the free movement of citizens since such common minimum rules should apply to all victims of crime.87

However, as I have noted elsewhere in the context of the justification by the Commission of the adoption of EU minimum rules on the rights of the defendant in criminal proceedings,88 the use of mutual trust as an element justifying the adoption of EU measures in the field of criminal procedure is problematic in two respects: first, it fails to provide a direct and clear link between the rights proposed and their necessity for the operation of mutual recognition; and, second, it is based on a concept (of mutual trust) which is too subjective for it to meet the criteria set out by the Court of Justice when ascertaining the legality of EU instruments, namely that the choice of legal basis must be based on objective factors which are amenable to judicial review.89 Compared with EU legislation in the field of the rights of the defendant, where minimum EU rules can be justified on specific human rights grounds and where EU standards can be linked directly to the operation of specific mutual recognition instruments such as the Framework Decision on the European Arrest Warrant,90 the link between EU minimum rules on the victims of crime and the facilitation of mutual recognition and judicial cooperation in criminal matters is much less direct. It is perhaps no coincidence that the Commission’s statement attempting to link the adoption of EU-wide minimum standards on victims of crime with the facilitation of mutual recognition has not been replicated in the finally adopted text of the Directive. However, in this way, the EU legislators have not provided any detailed or specific explanation of the link between the Directive and the criteria set out in its legal basis, namely Article 82(2) TFEU. The political will to legislate on victims’ rights post-Lisbon has resulted in a rather flexible use of the Treaty provisions enabling EU action on the harmonisation of national laws of criminal procedure.

IV. The Impact of EU Law on Victims’ Rights on National Criminal Justice Systems As seen above, one of the key challenges in developing EU criminal law on victims has been how to adopt EU-wide standards in the face of considerable diversity in terms of the legal position of the victim in domestic criminal justice systems. Throughout the development of EU criminal law on victims, the EU institutions have been called upon to address the tension between the perceived need to create an EU level playing field as regards the rights of victims and the need to maintain a degree of flexibility and 87 ‘Proposal for a Directive of the European Parliament and of the Council establishing minimum standards on the rights, support and protection of victims of crime’ COM (2011) 275 final, Brussels, 2–3. 88 V Mitsilegas, ‘Trust-Building Measures in the European Judicial Area in Criminal Matters: Issues of Competence, Legitimacy and Inter-institutional Balance’ in S Carrera and T Balzacq (eds), Security versus Freedom? A Challenge for Europe’s Future (Ashgate, 2006) 279–89. The argument has been developed further in V Mitsilegas, ‘The Limits of Mutual Trust in Europe’s Area of Freedom, Security and Justice: From Automatic Inter-state Cooperation to the Slow Emergence of the Individual’ (2012) 31 Yearbook of European Law 319. 89 See, inter alia, Case C-300/89, Commission v Council [1991] ECR I-2867 (hereinafter ‘Titanium Dioxide’). 90 Mitsilegas, ‘The Limits of Mutual Trust’ (n 88).

The Impact of EU Law on Victims’ Rights on National Criminal Justice Systems 309 breathing space for national systems in the light of the considerable differences between national criminal laws on victims. The challenge of adopting EU-wide standards on the rights of victims while taking into account national legal diversity has emerged in different ways, but forcefully, at all levels of EU legislative action in the field: from establishing victims’ rights via the use of the principle of mutual recognition in criminal matters to legislative efforts to harmonise Member States’ national law on victims’ rights. The evolution of EU harmonisation measures from the largely intergovernmental third pillar to the post-Lisbon, more supranational, reality has not put an end to these challenges.

A. Mutual Recognition One of the ways in which EU law has addressed the need to respect national legal diversity has been via the use of mutual recognition as a method of advancing victims’ rights, with the prima facie advantage of mutual recognition in this context being that, unlike harmonisation instruments, Member States may not be required to introduce immediate and specific changes to their domestic criminal law and procedure as a result of implementing EU law in the field. In the field of victims’ rights, the Directive on the European Protection Order aims to achieve the protection of the victim by putting forward a system of interaction of national legal orders resulting in the recognition and execution of a national protection decision by the authorities of another Member State. Yet, even in this context of mutual recognition, the European Protection Order contains a number of further provisions aimed at managing the high degree of flexibility in national legal orders. The Preamble sets out a general flexibility clause stating that the Directive ‘takes account of the different legal traditions of the Member States as well as the fact that effective protection can be provided by means of protection orders issued by an authority other than a criminal court’. However, it adds at the same time that the Directive ‘does not create obligations to modify national systems for adopting protection measures nor does it create obligations to introduce or amend a criminal law system for executing a European protection order’.91 The tension between guaranteeing the effectiveness of the Directive in ensuring maximum flexibility while respecting national legal diversity and not challenging national sovereignty in criminal matters is evident in the wording of this provision. In addition to this general flexibility provision, the Directive contains a number of provisions aiming to ensure flexibility in terms of how the mutual recognition system established therein will work. In the first place, the Directive aims at ensuring flexibility with regard to the authorities which will be competent to operate the mutual recognition system regarding European Protection Orders. This need for flexibility is confirmed in the Preamble, according to which: [S]ince, in the Member States, different kinds of authorities (civil, criminal or administrative) are competent to adopt and enforce protection measures, it is appropriate to provide a high degree of flexibility in the cooperation mechanism between the Member States under this Directive.92

91 Directive 92 ibid

2011/99/EU, Preamble, Recital 8. Preamble, Recital 20.

310 The Place of the Victim in Europe’s Area of Criminal Justice The text of the Directive attempts to capture national legal diversity by allowing the issuing of a European Protection Order by ‘judicial or equivalent authorit[ies] … in accordance with the national law of the issuing State’ (emphasis added).93 The designation of the judicial or equivalent authorities responsible for issuing and recognising European Protection Orders is left to Member States.94 There are two questions in relation to the determination of the authorities competent to act within the framework of the Directive. The first question is whether the use of non-criminal judicial authorities is compatible with the legal basis of the Directive, which focuses on judicial cooperation in criminal matters.95 The second question is whether the use of ‘equivalent’ authorities is allowed by a legal basis which focuses on judicial cooperation. Not only do the answers to these questions have considerable legality implications, but they also have a considerable impact on the protection of fundamental rights. In the context of the implementation of another mutual recognition measure, the Framework Decision on the European Arrest Warrant, serious doubts have been raised by national courts in relation to the extent to which non-judicial authorities are sufficiently independent to provide appropriate human rights safeguards.96 While the European Protection Order Directive follows the example of other mutual recognition instruments and aims to ensure flexibility by leaving the designation of competent authorities to Member States, national courts have expressed doubts as to whether such designation plays a definitive role regarding the assessment of whether an authority is sufficiently independent to be considered a judicial authority for the purposes of these instruments.97 The discretion given to Member States by the European Protection Order to designate authorities, combined with the potentially extensive scope and diverse nature of these authorities, is likely to prove counterproductive to speedy mutual recognition, as the executing authorities are likely to undertake to themselves assess the independence of the issuing authority, especially in cases where the legal systems of the issuing and the executing Member States are markedly different. More concrete answers are likely to be provided by the Court of Justice, with the definition of ‘judicial or equivalent authority’ for the purposes of the European Protection Order constituting an autonomous concept of EU law. The Court of Justice has already found that the meaning of a ‘court having jurisdiction in particular in criminal matters’ for the purposes of the Framework Decision on the mutual recognition of financial penalties cannot be left to the discretion of each Member State, but constitutes an autonomous concept in EU law.98 The need to accommodate national diversity with regard to the protection of victims is also reflected in efforts to achieve flexibility with regard to the measures of protection which will follow the recognition of a European Protection Order. Thus: [T]he competent authority in the executing State is not required in all cases to take the same protection measure as those which were adopted in the issuing State, and has a degree of discretion to adopt any measure which it deems adequate and appropriate under its national

93 ibid

art 1. art 3. 95 Bucnys v Ministry of Justice, Lithuania [2013] UKSC 71; see Lord Mance at para 23. 96 See Assange v Swedish Prosecution Authority [2012] UKSC 22. 97 In the context of the European Arrest Warrant, see the ruling of Lord Mance in Bucnys (n 95) para 22. 98 Case C-60/12, Baláž ECLI:EU:C:2013:733 (CJEU, 14 November 2013), paras 25–26. 94 ibid

The Impact of EU Law on Victims’ Rights on National Criminal Justice Systems 311 law in a similar case in order to provide continued protection to the protected person in the light of the protection measure adopted in the issuing State as described in the European protection order.99

‘The executing State may apply, in accordance with its national law, criminal, administrative, or civil measures.’100 These and subsequent measures must, ‘to the highest degree possible, correspond to the protection measure adopted in the issuing [Member] State’.101 However, as mentioned above, Member States are not obliged to change their law in order to introduce new protection measures.102 As is recognised in the Preamble: [I]n view of the different legal traditions of the Member States, where no protection measure would be available in the executing State in a case similar to the factual situation described in the European protection order, the competent authority of the executing State should report any breach of the protection measure described in [the Order] of which it is aware to the competent authority of the issuing State.103

The Directive also includes a number of provisions clarifying the applicable law and the respective areas of responsibility between the issuing and the executing states in the aftermath of the recognition of the European Protection Order. The law of the executing state will govern the adoption and enforcement of the Order and the consequences of its breach,104 while the issuing state will remain competent for ‘the renewal, review, modification, revocation and withdrawal of the protection measure’, as well as for ‘the imposition of a custodial measure as a consequence of revocation’.105 The executing authority also has the power to discontinue a European Protection Order in a number of cases,106 including ‘where, according to its national law, the maximum term of duration of the measures adopted in execution of [the Order] has expired’.107 The Directive thus attempts to establish a system of mutual recognition which will ensure continuous protection, while respecting the legal system of the executing Member State to the greatest extent possible.

B. Harmonisation The challenge of ensuring EU-wide protection of victims while at the same time respecting national legal diversity has arisen with greater prominence in EU harmonisation efforts in the field. Both the Framework Decision and its successor Directive on the rights of victims have attempted to strike a balance between Europeanisation and the respect of national diversity on the one hand by including a number of broadly drafted provisions on victims’ rights, while on the other hand leaving considerable discretion

99 Directive

2011/99/EU, Preamble, Recital 20. art 9(1). 101 ibid art 9(2). 102 See ibid Preamble, Recital 8. 103 ibid Preamble, Recital 27. 104 ibid art 11. 105 ibid art 13. 106 ibid art 14. 107 ibid art 14(1)(b). 100 ibid

312 The Place of the Victim in Europe’s Area of Criminal Justice to Member States as regards implementation. In the case of the Framework Decision, the specificities in the legal effects of third pillar measures would mean that its reach in national legal orders could remain limited. The tension between Europeanisation and the respect of national legal diversity, and the impact of Europeanisation on enforcement and legal certainty as regards the Framework Decision on the rights of victims have now been tested before the Court of Justice. The first – and now landmark – ruling of the Court in this context was its judgment in the Pupino case.108 In Pupino, the Court was asked to interpret the broad provisions of the Framework Decision and, in particular, Article 8 on the right to protection in court proceedings, in the light of their applicability to a specific domestic situation. The case arose after a reference by an Italian court asking to what extent the Italian Code of Criminal Procedure could be interpreted, in the light of the Framework Decision, as allowing children allegedly having suffered a number of forms of abuse by their teacher to testify under a special procedure, and not in normal court proceedings, against the defendant. The Italian Code of Criminal Procedure allowed for this possibility for children under 16 only in cases of sexual offences or offences with a sexual background. In a landmark ruling, the Court established that third pillar Framework Decisions, while lacking direct effect, had indirect effect; in other words, the national judge was under the duty to interpret domestic law in conformity with Framework Decisions. Having established the principle of indirect effect and its limits, the Court went on to examine the specific case.109 It confirmed that the achievement of the aims of the Framework Decision on the rights of victims in criminal proceedings ‘require that a national court should be able, in respect of particularly vulnerable victims, to use a special procedure’, such as the one already provided for in Italian law.110 However, in the light of the concerns raised regarding the potential impact of such an interpretation on the rights of the defendant, the Court added two caveats: that, in the light of the Framework Decision, the adopted conditions for giving evidence ‘must … be compatible with the basic legal principles of the Member State’;111 and that the national court must ensure that ‘the application of those measures is not likely to make the criminal proceedings against [the defendant] considered as a whole, unfair within the meaning of Article 6 of the [ECHR], as interpreted by the European Court of Human Rights’.112 The Court’s priority in Pupino appears to have been the clarification of the constitutional position of third pillar measures in EU law by affirming the binding legal effect of Framework Decisions and ensuring their enforcement in national legal orders via the application of the principle of indirect effect.113 However, the impact of the application of the interpretative obligation to the national judge is significant. In Pupino, the Luxembourg Court in reality rewrote the Italian Code of Criminal Procedure. Following the Court’s guidance, the Italian judge had little choice but to allow minors in this

108 Case C-105/03, Maria Pupino [2005] ECR I-5285. 109 ibid paras 50–61. 110 ibid para 56. 111 ibid para 57. The Court referred in particular to art 8(4) of the Framework Decision. 112 Maria Pupino (n 108) para 60. 113 V Mitsilegas, ‘Constitutional Principles of the European Community and European Criminal Law’ (2006) 8 European Journal of Law Reform 301.

The Impact of EU Law on Victims’ Rights on National Criminal Justice Systems 313 case to take advantage of the Code’s protective provisions, although minors were not originally covered by the legislation. This interpretation raises important questions regarding the impact of the application of the principle of indirect effect on the internal coherence of national criminal justice systems, whose balance may be disturbed by piecemeal attempts by national judges to accommodate EU law demands in specific cases. Judges themselves may be faced with difficult balancing exercises, especially in cases where EU law itself – like in the case of the Framework Decision in question – is drafted in broad terms, having to take into account all complex parameters and interests involved in a criminal trial. While Pupino should be seen within this specific constitutional context, where the Court of Justice attempted to ensure the enforceability of third pillar law at a time when Treaty reform no longer appeared imminent, the Court has since developed a substantial body of case law resulting from a number of references for preliminary rulings by national courts seeking clarification of various aspects of the Framework Decision and its application in national law.114 In all these cases, the Court was faced with the challenge of interpreting the provisions of the Framework Decision – a number of which were drafted in a broad, if not aspirational manner – in a way which would achieve the key objectives of the Framework Decision while respecting national legal diversity. The Court has attempted to accommodate national diversity and to address concerns with regard to the potentially negative impact of EU victims’ law on state sovereignty and established criminal policy choices made at the national level in a number of ways. First, the Court emphasised that the Framework Decision does not have an impact on domestic legislative choices with regard to criminalisation and the choice, form and level of penalties imposed under national criminal law.115 It found that this is the case even when upholding national law would result in an outcome which is contrary to the wishes of the victim, as: [I]t must be borne in mind that where a Member State in the exercise of its powers to enforce the law ensures that the criminal law offers protection against acts of domestic violence, the objective is not only to protect the interests of the victim as he or she perceives them but also other more general interests of society.116

The Court has further declined to extend the scope of the Framework Decision and thus influence domestic legislative choices by defining the concept of a victim broadly

114 For an overview of early case law from the perspective of the dialogue between national courts and the Court of Justice in this context, see R Parizot, ‘Les Interactions en Procédure Pénale: La Victime, Vecteur Symbolique de la Circulation du Jurisprudence’ in G Giudicelli-Delage and S Manacorda (eds), Cour de Justice et Justice Pénale en Europe (Société de Législation Comparée, 2010) 177–202. 115 Joined Cases C-483/09 and C-1/10, Gueye and Sanchez [2011] ECR I-8263. According to the Court, ‘the Framework Decision contains no indication that the EU legislature, within the limits of the powers conferred on it by the EU Treaty, intended to harmonise or, at the least, approximate the legislation of Member States in respect of the forms and levels of criminal penalties’ (at para 51). Moreover, ‘Article 8 of the Framework Decision cannot be interpreted in such a way that it restricts the choice by Member States of the criminal penalties they establish in their domestic legal systems’ (at para 68). 116 See ibid para 61. According to the Court, ‘the procedural right to be heard under the first paragraph of Article 3 of the Framework Decision does not confer on victims any rights in respect of the choice of form of penalties to be imposed on the offenders in accordance with the rules of the national criminal law nor in respect of the level of those penalties’ (at para 60).

314 The Place of the Victim in Europe’s Area of Criminal Justice to include legal persons within its scope.117 This does not mean that the Framework Decision precludes Member States from enacting legislation treating legal persons as victims: [S]ince the Framework Decision does not undertake a complete harmonisation of the field in question, a decision that its provisions are also to be applicable where the victim is a legal person is one that Member States are neither prevented by the Framework Decision from taking nor obliged to take.118

On the other hand, the Court has ruled that the Framework Decision ‘contains no indication that the European Union legislature intended to oblige Member States to provide that legal persons are to be liable in criminal law’.119 Last, but not least, the Court of Justice has emphasised on a number of occasions that the Framework Decision grants a considerable degree of discretion to Member States as regards its implementation.120 The tension between Member States’ discretion and the need to ensure the effectiveness of the Framework Decision has been clearly reflected in the case of Katz, where the Court of Justice was asked whether a victim who can act as private prosecutor under national law can also be a witness in criminal proceedings instituted in this context. In a fine balancing act, the Court attempted to find a middle ground by ruling as follows: It must therefore be concluded that the Framework Decision, while requiring Member States, first, to ensure that victims enjoy a high level of protection and have a real and appropriate role in their criminal justice system and, second, to recognise victims’ rights and legitimate interests and ensure that they can be heard and supply evidence, leaves to the national authorities a large measure of discretion with regard to the specific means by which they implement those objectives. However, in order not to deprive the first paragraph of Article 3 of the Framework Decision of much of its practical effect or to infringe the obligations stated in Article 2(1) of the Framework Decision, those provisions imply, in any event, that the victim is to be able to give testimony in the course of the criminal proceedings which can be taken into account as evidence.121

In Katz, the Court was faced with the considerable challenge of interpreting the broadly drafted provisions of the Framework Decision in a manner which would ensure the latter’s effectiveness, while at the same time adjusting and recognising a very specific policy choice by a national criminal justice system. This challenge is compounded by the fact that any answer that the Court would give would have an impact on the balance of power between the parties in the domestic criminal proceedings and ultimately on

117 Case C-467/05, Dell’Orto [2007] ECR I-5557. According to the Court, ‘there is no indication in any other provision of the Framework Decision that the European Union legislature intended to extend the concept of the victim for the purposes of the application of the Framework Decision to legal persons. The converse is in fact the case, as several provisions in the Framework Decision confirm that the legislature’s objective was to limit its scope exclusively to natural persons who are victims of harm resulting from a criminal act’ (at para 55). 118 Case C-205/09, Eredics and Sápi [2010] ECR I-10231, para 29. 119 Case C-79/11, Giovanardi ECLI:EU:C:2012:448 (CJEU, 12 July 2012), para 45. 120 See Gueye (n 115) para 58; Eredics (n 118) para 38. 121 Case C-404/07, Katz v Sós [2008] ECR I-07607, paras 46–47.

The Impact of Victims’ Rights on Justice in Europe 315 the delivery of criminal justice.122 The Framework Decision has now been replaced by a post-Lisbon Directive, which is a significant development both from a substantive and a constitutional perspective. In terms of substance, the Directive contains a more extensive list of provisions on victims’ rights. From a constitutional perspective, the Directive is in principle a more supranational instrument than the Framework Decision and is subject to the full scrutiny of EU institutions. However, a number of questions remain concerning legal certainty and the development of EU standards on the rights of victims while respecting national diversity. First, as per the Directive’s legal basis of Article 82(2) TFEU, EU law can currently only provide minimum standards on victims’ rights. Second, as seen above, the Directive maintains throughout its text – and very prominently as regards the rights of the victims relating to criminal procedure and the trial itself – a high degree of discretion for national authorities.123 It can be said that in this context, the existence of these rights is provided by EU law, while their exercise is largely regulated by national law. This legislative choice means that it is highly unlikely that autonomous EU concepts will be developed in relation to the exercise of victims’ rights in criminal procedure and that the Court of Justice will face similar interpretative challenges to those it has faced when called to interpret the Framework Decision on victims. Third, while the Directive is ‘Lisbonised’, key provisions with regard to victims’ rights in criminal procedure – and, in particular, the right to be heard124 – do not fulfil the requirements which would grant them direct effect. A key enforcement avenue with regard to these rights at the national level is thus lost. Having said that, national judges are still under a duty of consistent interpretation, and domestic criminal law must be interpreted to the extent possible in conformity with the key objectives of the Directive. Reconciling the Directive’s objectives with national legal diversity will thus remain a challenge for national and European courts.

V. The Impact of Victims’ Rights on Justice in Europe Questions on the impact of EU criminal law on victims’ rights on national legal diversity and the internal coherence of the criminal justice systems of Member States cannot be considered independently of the fundamental question of the impact of the proliferation of victims’ rights on the rights of the defendant and, more broadly, of the impact of the strengthening of the position of the victim on criminal justice at the national and EU levels. The strengthening of the position of the victim in the criminal justice process reflects what I have characterised elsewhere as ‘the individualisation of security’, whereby the security needs of the individual take centre stage in justifying the expansion of state power: in addition to protecting the state from a number of perceived security 122 By quoting Pupino, the Court in Katz paid lip service to the need to protect fundamental rights (and, in particular, the right to fair trial) and delegated this task to the national court: ibid paras 48–49. 123 For a criticism of the extensive discretion left to Member States, see R Letschert and C Rijken, ‘Rights of Victims of Crime: Tensions between an Integrated Approach and a Limited Legal Basis for Harmonisation’ (2013) 4 New Journal of European Criminal Law 226. They argue that the procedural autonomy that Member States have with regard to several provisions needs to be monitored (at 247 and 255). 124 See art 10(1) of Directive 2012/29/EU, according to which ‘Member States shall ensure that victims may be heard during criminal proceedings and may provide evidence’ (emphasis added).

316 The Place of the Victim in Europe’s Area of Criminal Justice threats, the individual is to be protected too.125 Conferring rights upon victims is a key part of this process. Garland has called this ‘the return of the victim’, explaining that: [T]he new political imperative is that victims must be protected, their voices must be heard, their memory honoured, their anger expressed, their fears addressed. The rhetoric of penal debate routinely invokes the figure of the victim – typically as a child or a woman or a grieving family member – as a righteous figure whose suffering must be expressed and whose security must henceforth be guaranteed.126

However, taking into account of the interests of the victim in the criminal justice system fundamentally changes the balance of power and interests in the criminal justice process, and ultimately the relationship between the individual and the state. The need to protect the individual as a defendant in criminal proceedings from the power of the state is watered down by the perceived need to protect the interests of another category of individual: the victim. Commentators have noted in this context the juxtaposition of the interests of offenders and victims in a zero-sum game127 and the government rhetoric, in particular in the UK, of ‘rebalancing the criminal justice system in favour of the law-abiding majority and the victim’ (emphasis added).128 In this kind of discourse, the focus on the protection of collective security (of the security of the law-abiding majority) is coupled with the individualisation of security as expressed in the protection of the rights of the victim. In this light, the increased prominence of victims’ interests in the criminal justice system has profound implications for the relationship between the individual and the state on the one hand, and the relationship between various categories of individuals in the criminal justice process on the other. A number of questions need to be answered in this context: what is the criminal process for? What is justice in this context? Whose interests are to be protected? Individualising security via calls to protect victims in the criminal justice system, especially at the pre-trial and trial stages, presents profound challenges to fundamental rights and especially the presumption of innocence. At the same time, the individualisation of security serves as a justification for the increase of state power vis-a-vis the defendant by introducing exceptions to rules of criminal procedure aimed at protecting the defendant and to ensure a balance of power between the prosecution and the defence. Thus, the individualisation of security has profound justice implications: by placing one category of individual (the victim) against another category of individual (the defendant and alleged offender), the prioritisation of victims’ claims may serve to redistribute justice by weakening procedural safeguards in criminal proceedings.129

125 V Mitsilegas, ‘Security versus Justice: The Individualisation of Security and the Erosion of Citizenship and Fundamental Rights’ in S Ugelvik and B Hudson (eds), Justice and Security in the 21st Century. Risks, Rights and the Rule of Law (Routledge, 2012) 199–216. 126 D Garland, The Culture of Control: Crime and Social Order in Contemporary Society (Oxford University Press, 2001) 11. 127 M Matravers, ‘The Victim, the State and Civil Society’ in A Bottoms and JV Roberts (eds), Hearing the Victim: Adversarial Justice, Crime Victims and the State (Willan, 2010) 1–16, 3. 128 M Tonry, ‘“Rebalancing the Criminal Justice System in Favour of the Victim”: The Costly Consequences of Populist Rhetoric’ in Bottoms and Roberts (n 127) 72–103, at 73. 129 Mitsilegas (n 125).

The Impact of Victims’ Rights on Justice in Europe 317 The potential reconfiguration of the relationship between the individual and the state by individualising security via privileging the interests of the victim is apparent in a number of EU policy documents. The protection of the interests of the victim is central in both the Stockholm Programme130 and the EU Internal Security Strategy.131 In its Communication accompanying a package of proposals on the rights of victims, the European Commission outlined its vision on criminal justice focusing on the rights of the victim in greater detail.132 According to the Commission, with this package, the EU ‘will contribute to making crime victims’ needs a central part of the justice systems, alongside catching and punishing the offenders’ (emphasis added).133 The Commission also noted that: One of the European Union’s objectives is to offer its citizens an area of freedom, security and justice in which their freedom of movement is ensured. However, without effective EU-wide application of a minimum level of rights for victims, mutual trust is not possible. This means that judicial systems should have full faith in each other’s standards of fairness and justice, and citizens should have confidence that the same level of minimum rules will be applied when they travel or live abroad … Member States need to raise standards on victims’ rights and the EU must ensure that victims benefit from a level playing field. A certain minimum level of safeguards and standards that are applied in all Member States will facilitate judicial cooperation and increase the quality of justice and also improve people’s confidence in the very notion of ‘justice’. (Emphasis added)134

The Commission thus puts forward a vision of European criminal justice whereby the interests of the victim are central. Minimum standards on victims’ rights are viewed as essential to creating mutual trust not only between judicial authorities, but also between citizens in the EU. As seen above, references to mutual trust have been used by the Commission in order to be able to justify EU competence to legislate in the field under Article 82(2) TFEU. However, the above passage goes beyond the Commission’s statements in the Explanatory Memorandum to the Directive on the rights of victims by focusing specifically on the link between the establishment of EU rules on the rights of victims and confidence in ‘the very notion of justice’. As with the references to mutual trust, this passage is very vague; the link between victims’ rights and the achievement of justice is not substantiated and appears tenuous, to say the least. What is noteworthy in the Commission’s Communication on victims is that it does not attempt to place the development of victims’ rights in the context of criminal justice in Europe within the general framework of the development of legislation on the rights of the defendant at 130 Point 2.3.4 of the Stockholm Programme on victims of crime, including terrorism, reads as follows: ‘Those who are most vulnerable or who find themselves in particularly exposed situations, such as persons subjected to repeated violence in close relationships, victims of gender-based violence, or persons who fall victim to other types of crimes in a Member State of which they are not nationals or residents, are in need of special support and legal protection. Victims of terrorism also need special attention, support and social recognition.’ 131 Council Doc 5842/2/10 REV 2, Brussels, 23 February 2010. The Internal Security Strategy is aimed at ‘protection of all citizens, especially the most vulnerable, with the focus on victims of crime such as trafficking in human beings or gender violence, including victims of terrorism who also need special attention, support and social recognition’. 132 Commission Communication, ‘Strengthening victims’ rights in the EU’ COM (2011) 274, Brussels. 133 ibid 2. 134 ibid 3.

318 The Place of the Victim in Europe’s Area of Criminal Justice the EU level, legislation which has been long pursued by the Commission and achieved after the introduction of a specific legal basis in Article 82(2) TFEU.135 These broad references to the achievement of mutual trust and confidence in the very notion of justice have not survived the finally adopted Directives on victims’ rights. The impact on the balance of powers in the criminal justice system of the current EU legislative framework on victims and, in particular, of the Directive on the rights of victims remains to be seen. The Directive does include a series of provisions relating to victims’ rights and puts forward a general objective that victims must receive appropriate information, support and protection, and be able to participate in criminal proceedings,136 an objective which must guide the implementation and interpretation of the Directive. However, as seen above, Member States have been granted considerable discretion as to how to achieve this objective, with the enforcement of key victims’ rights prescribed by the Directive being left to national law. The Directive thus attempts to achieve a delicate balance between introducing minimum rules on victims’ rights at the EU level and not distorting the balance of powers and the expression of justice thus far settled in the various domestic criminal justice systems of individual Member States. When looking at the interpretation of victims’ rights at the EU level, it is essential not to view victims’ rights in isolation, but to interpret these in accordance with fundamental rights, in particular the rights of the suspect or the defendant. The Directive on the rights of the victim contains a number of references to the need to respect defence rights in this context,137 and consistent Court of Justice case law138 has confirmed this need. The requirement to interpret victims’ rights in conformity with fundamental rights and, in particular, defence and fair trial rights arises even more prominently in the postLisbon, post-Charter era. The Court’s case law on the applicability of the Charter of Fundamental Rights139 calls for a systemic examination of national provisions on the position of the victim in criminal proceedings and their impact on fundamental rights, even if such provisions do not constitute a direct and specific implementation of the standards set out in the EU Directives on victims’ rights.

VI. Conclusion The evolution of legislation on victims’ rights at the EU level reflects a clear political commitment by the EU institutions to be seen to be active in strengthening the position of the victim in the criminal justice process. The EU has legislated on victims notwithstanding the considerable limits of EU competence in the field and notwithstanding 135 See ch 5. 136 Directive 2012/29/EU, art 1(1). 137 According to the Preamble, the rights set out in the Directive are ‘without prejudice to the rights of the offender. The term “offender” refers to a person who has been convicted of a crime. However, for the purposes of this Directive, it also refers to a suspected or accused person before any acknowledgement of guilt or conviction, and it is without prejudice to the presumption of innocence’ (Recital 12). See also arts 18, 20 and 23 of the Directive. 138 Pupino (n 108) para 59; Katz (n 121) para 48. 139 See in particular Case C-617/10, Åklagaren v Hans Åkerberg Fransson ECLU:EU:C:2013:105 (CJEU, 26 February 2013).

Conclusion 319 the considerable diversity in national legal systems with regard to the protection of victims and their place in the criminal justice process. The political imperative to legislate on victims’ rights has thus taken precedence over considerations of legality and legal certainty. As has been noted in relation to the evolution of victims’ rights in the US context: ‘[T]he symbolic strength of the term “victim’s rights” overrides careful scrutiny: Who could be anti-victim?’140 The translation of this political will into legal reality in EU law has led to a situation whereby the general objective of strengthening the position of the victim in criminal justice across the EU is to be achieved either by a system of mutual recognition aimed at providing maximum flexibility to national criminal justice systems, or by the introduction of EU-wide minimum standards on victims’ rights whose implementation depends largely on the specificities of the criminal justice systems of Member States. The ‘Lisbonisation’ of victims’ rights has not fundamentally changed the picture – at least as far as the drafting of EU law in the field is concerned – as regards legal certainty, some of the effects of EU law on national legal orders (particularly direct effect) and the degree of discretion left to Member States. The incomplete implementation of the Directive has been highlighted by the Commission, whose future victims’ strategy focuses primarily on capacity-building and protection at the national level.141 Key pieces of the puzzle of the interaction between EU and national criminal law on victims’ rights will thus continue to be filled by the Court of Justice, which has already been faced with the significant challenge of ensuring the effectiveness of EU law on victims while recognising national specificities and interests in the field of criminal justice. The Court of Justice – and national courts in their duties of ensuring the enforcement of EU law on victims at the domestic level and interpreting national law in conformity with EU law – will continue to face fundamental questions on the extent to which EU law on victims will change the balance of powers and the concept of justice at the national level. In this context, in the post-Lisbon era in particular, the judiciary is required to interpret provisions on victims’ rights in conformity with fundamental rights and especially fair trial and defence rights as enshrined in the Charter. Political discourse on the rights of victims as well as the piecemeal and functional characteristics of EU criminal procedure competence under Article 82(2) TFEU have led to legislation on victims’ rights being developed largely in isolation from legislation on the rights of the defendant. If legislation on the rights of the victim aims to reflect broader concepts of justice at the national and EU levels and their intersection, the need for a more holistic approach, viewing victims’ rights in the light of fundamental rights and taking full account of the position of the suspect and the defendant in criminal proceedings is essential.

140 LN Henderson, ‘The Wrongs of Victim’s Rights’ (1985) 37 Stanford Law Review 937, 952. 141 Commission Communication, ‘EU Strategy on Victims’ Rights (2020–2025)’ COM (2020) 258 final, 24 June 2020.

7 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU I. Introduction EU criminal law and the law of EU citizenship have traditionally evolved in parallel but separate ways. However, recent years have witnessed growing interconnections between these two fields of EU law. On the one hand, aspects of EU citizenship law have emerged in the adoption of EU criminal law instruments. This has particularly been the case regarding the adoption of instruments applying the principle of mutual recognition in criminal matters, including the Framework Decision on the European Arrest Warrant and the Framework Decision on the Transfer of Sentenced Persons. More recently, citizenship considerations have also arisen in the context of the external dimension of EU criminal law, relating to the reception of requests by third states for the extradition of EU citizens based in a Member State other than the one of their nationality. On the other hand, aspects of EU criminal law have become increasingly relevant in the evolution of EU citizenship law, most notably in playing a part in determining the scope of exceptions to citizenship rights in the case law of the Court of Justice. This chapter will examine the interrelationship between EU criminal law and EU citizenship law from these two perspectives, mapping the evolution of EU law in the field and casting light on the impact of the entry into force of the Lisbon Treaty in this regard. It will be argued that the current relationship between EU criminal law and EU citizenship law is rather uneasy, with both fields of law used out of their ordinary context when they interact in EU law. This approach is at odds with the objective of establishing a European area of freedom and justice and leads to a dilution of rights in both EU criminal law and EU citizenship law.

II. Citizenship in EU Criminal Law The first level of interaction between EU criminal law and EU citizenship law arises when citizenship aspects emerge in the adoption of secondary EU criminal law measures. This has been the case in relation to the adoption of two mutual recognition measures, the Framework Decision on the European Arrest Warrant1 and the

1 Framework

Decision 2002/584/JHA of 13 June 2002 on the European Arrest Warrant [2002] OJ L190/1.

Citizenship in EU Criminal Law 321 Framework Decision on the Transfer of Sentenced Persons.2 In the European Arrest Warrant system, citizenship considerations have arisen from the fact that in principle the system of surrender established by EU law would depart from traditional extradition arrangements in allowing the surrender of own nationals, with the Framework Decision tempering the extent of this change by including a provision shielding own nationals and those resident and staying in the executing Member State from surrender.3 The Framework Decision on the Transfer of Sentenced Persons, on the other hand, aims to simplify the transfer of sentenced persons across the EU, irrespective of any citizenship links they may have with the executing state.4 The second level of interaction arises in the external dimension of EU criminal law in the context of extradition requests by third states. The implications of these developments for EU citizenship rights will be examined in turn below.

A. EU Citizenship in the European Arrest Warrant The Court of Justice has had the opportunity to examine limits to automaticity in the recognition and execution of European Arrest Warrants in the context of preliminary references concerning the interpretation of Article 4(6) of the Framework Decision, which may serve to protect own nationals, residents and individuals who are staying in the executing Member State from surrender. The first such case was Kozlowski,5 where the Court was asked to interpret the meaning of ‘residence’ and ‘stay’ under Article 4(6), but also whether the transposition of the Framework Decision making it impermissible to surrender own nationals whilst allowing the surrender of nationals of other Member States was compatible with EU law, in particular non-discrimination and citizenship. The Court began by reaffirming the cooperative objective of the Framework Decision on the basis of mutual recognition6 and answered the first question by putting forward three important findings: that the terms ‘resident’ and ‘staying’ in Article 4(6) of the Framework Decision are concepts that have an autonomous meaning under EU law;7 that Article 4(6) of the Framework Decision has in particular the objective of the

2 Framework Decision 2008/909/JHA of 27 November 2008 on the transfer of custodial sentences (sentenced persons) [2008] OJ L327/27. 3 Framework Decision 2002/584/JHA, art 4(6). For an analysis, see V Mitsilegas, ‘The Constitutional Implications of Mutual Recognition in Criminal Matters in the EU’ (2006) 43 CML Rev 1277. 4 See section II.B below. 5 Case C-66/08, Kozlowski [2008] ECR I-06041. 6 See ibid paras 31 (and the reference to para 28 of Case C-303/05, Advocaten voor de Wereld VZW v Leden van de Ministerraad [2007] ECR I-3633) and 32. 7 Since the objective of the Framework Decision, as indicated in para 31, is to put in place a system of surrender, as between judicial authorities, of convicted persons or suspects for the purpose of enforcing judgments or of criminal proceedings, based on the principle of mutual recognition – a surrender which the executing judicial authority can oppose only on one of the grounds for refusal provided for by the Framework Decision – the terms ‘staying’ and ‘resident’, which determine the scope of Article 4(6), must be defined uniformly, since they concern autonomous concepts of EU law – paragraph 43.

322 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU re-integration of the requested person;8 and that, in assessing their meaning, national authorities must embark on an individual examination of the facts of each case on the basis of a series of objective factors. In particular, the Court found that the terms ‘resident’ and ‘staying’ cover, respectively, the situations in which the person who is the subject of a European Arrest Warrant has either established their actual place of residence in the executing Member State or has acquired, following a stable period of presence in that state, certain connections with that state which are of a similar degree to those resulting from residence.9 It added that: [I]n order to determine whether, in a specific situation, there are connections between the requested person and the executing Member State which lead to the conclusion that that person is covered by the term ‘staying’ within the meaning of Article 4(6) of the Framework Decision, it is necessary to make an overall assessment of various objective factors characterising the situation of that person, which include, in particular, the length, nature and conditions of his presence and the family and economic connections which he has with the executing Member State. (Emphasis added)10

Although the AG opined in detail on the second question referred to by the Oberlandesgericht Stuttgart,11 the Court declined to answer the question in Kozlowski. However, it had to deal with the essence of this question in the subsequent case of Wolzenburg.12 This case concerned the interpretation of the Dutch legislation implementing Article 4(6) of the Framework Decision on the European Arrest Warrant. Unlike the German implementing law examined by the Court in Kozlowski, the Dutch law imposed specific criteria for the implementation of the ground for refusal to execute a European Arrest Warrant set out in Article 4(6): surrender would not take place if the individual involved was a Dutch national or a foreign national in possession of a residence permit of indefinite duration. The case involved a European Arrest Warrant for the surrender to Germany of Mr Wolzenburg, who, although employed in the Netherlands for a number of years, did not meet the conditions for the granting of a residence permit of indefinite duration for the Netherlands on the ground that he had not yet resided in the Netherlands for a continuous period of five years.13 In light of the above, the Rechtbank Amsterdam referred a number of questions to the Luxembourg Court, including whether persons staying in or residents of the executing Member State for the purposes of Article 4(6) of the Framework Decision include nationals of other EU Member States lawfully residing in the executing Member State regardless of the duration of their lawful residence and, if not, how long that residence period should be and under what requirements. The Dutch court also asked whether domestic legislation differentiating between Dutch nationals and nationals of other EU citizens resulted in discrimination under Article 12 EC.

8 Article 4(6) of the Framework Decision ‘has in particular the objective of enabling the executing judicial authority to give particular weight to the possibility of increasing the requested person’s chances of reintegrating into society when the sentence imposed on him expires’ – para 45 (emphasis added). 9 ibid para 46. 10 ibid para 48. 11 Case C-66/08, Kozlowski, View of AG Bot delivered on 28 April 2008, paras 40–112. 12 Case C-123/08, Wolzenburg [2009] ECR I-09621. 13 ibid paras 26–38.

Citizenship in EU Criminal Law 323 The Court addressed these questions by adopting a three-step approach. The first step was to examine the purpose and objectives of the Framework Decision on the European Arrest Warrant as a reflection of the application of the principle of mutual recognition in criminal matters. The second step was to define the concept of residence by evaluating the margin of discretion that Member States have in implementing Article 4(6) of the Framework Decision. And the third step was to assess whether the domestic implementing legislation in question (which differentiated between nationals of the executing Member State and nationals of other EU Member States) is compatible with the principle of non-discrimination as enshrined in the Treaty. As a first step, the Court made a number of observations regarding the system of surrender introduced by the Framework Decision on the European Arrest Warrant and in particular Article 4(6) thereof.14 By reference to the earlier judgment in Kozlowski15 (which in turn referred to the Court’s key ruling in Advocaten voor de Wereld),16 the Court then made extensive reference to the purpose of the Framework Decision on the European Arrest Warrant, which is to replace the multilateral system of extradition between Member States with a system of surrender, as between judicial authorities, of convicted persons or suspects for the purpose of enforcing judgments or of criminal proceedings, that system of surrender being based on the principle of mutual recognition.17 By reference to its ruling in Leymann,18 the Court noted that the principle of mutual recognition means that Member States are in principle obliged to act following receipt of a European Arrest Warrant.19 A narrow definition of optional grounds for refusal to execute a European Arrest Warrant is compatible with this obligation. According to the Court: [A] national legislature which, by virtue of the options afforded it by Article 4 of the Framework Decision, chooses to limit the situations in which its executing judicial authority may refuse to surrender a requested person merely reinforces the system of surrender introduced by that Framework Decision to the advantage of an area of freedom, security and justice.20 … [B]y limiting the situations in which the executing judicial authority may refuse to execute a European arrest warrant, such legislation only facilitates the surrender of requested persons, in accordance with the principle of mutual recognition set out in Article 1(2) of Framework Decision 2002/584, which constitutes the essential rule introduced by that decision. (Emphasis added)21

While accepting in principle that the essence of the Framework Decision on the European Arrest Warrant is the facilitation of surrender, the Court was asked to examine the compatibility with this Framework Decision of national legislation

14 ibid

para 55. (n 11) para 31. 16 Advocaten voor de Wereld (n 6) para 28. 17 ibid para 56. 18 Case C-388 PPU, Leymann and Pustovarov [2008] ECR I-08993, para 51. 19 ibid para 57. 20 ibid para 58. 21 ibid para 59. 15 Kozlowski

324 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU introducing grounds of refusal to surrender which was marked by two special features: it differentiated between nationals of the executing Member State and nationals of other EU Member States; and it introduced in automatic surrender of those EU nationals whose residence in the Netherlands did not fall under the specific residence requirements set out in the Dutch implementing law. In assessing the compatibility of national law with the Framework Decision, the Court’s starting point was to accept that, when implementing Article 4 of the Framework Decision and in particular paragraph 6 thereof, Member States have ‘of necessity’ a certain margin of discretion.22 The re-integration objective of Article 4(6) set out in Kozlowski cannot prevent the Member States, when implementing the Framework Decision, from limiting, in a manner consistent with the essential rule stated in Article 1(2) thereof, the situations in which it is possible to refuse to surrender a person who falls within the scope of Article 4(6).23 The Court justified this departure from Kozlowski and upheld the Dutch limitation of exclusion of a great number of EU nationals from the protective scope of Article 4(6) by accepting the logic of abuse put forward by the Dutch government, which justified the adoption of the Dutch implementing law on the basis of the ‘high degree of inventiveness in the arguments put forward in order to prove that they have a connection to Netherlands society’.24 Developing this approach further, the Court placed the objective of re-integration within the framework of the broader discussion on integration by accepting that the executing Member State is entitled to pursue re-integration objectives only in respect of persons who have demonstrated a certain degree of integration in the society of that Member State.25 Based on this approach, the Court then embarked on an assessment of the integration of the various categories of individuals covered by (and differentiated by) Dutch law for the purposes of implementing Article 4(6) of the Framework Decision on the European Arrest Warrant. The Court upheld the Dutch approach and found it to be compatible with the principle of non-discrimination by accepting a series of presumptions which have been distilled in the paragraph below: In the present case, the single condition based on nationality for its own nationals, on the one hand, and the condition of residence of a continuous period of five years for nationals of other Member States, on the other, may be regarded as being such as to ensure that the requested person is sufficiently integrated in the Member State of execution. By contrast, a Community national who does not hold the nationality of the Member State of execution and has not resided in that State for a continuous period of a given length generally has more connection with his Member State of origin that with the society of the Member State of execution. (Emphasis added)26

The Court’s ruling in Wolzenburg sends mixed and at times contradictory messages with regard to the operation of the system of mutual recognition in criminal matters

22 ibid para 61. 23 ibid para 62. 24 ibid para 65. 25 ibid para 67. 26 ibid para 68. A scheme based on these assumptions was not excessive and not contrary to the anti-discrimination principle in EU law (paras 69–74).

Citizenship in EU Criminal Law 325 and the place of mutual trust therein. The Court based its reasoning on the objective of the Framework Decision on the European Arrest Warrant, and adopted a prima facie expansive approach by highlighting the principle of the Framework Decision – which is the execution of requests to surrender – and consequently privileging a limited construction of the exceptions to this principle, namely grounds to refuse to execute a European Arrest Warrant. Yet this expansive interpretation of recognition – which is linked to the establishment of an Area of Freedom, Security and Justice – is contradicted by the Court’s acceptance that possessing the nationality of the executing Member State can automatically trigger the ground for refusal set out in Article 4(6) of the Framework Decision. The automatic exemption of own nationals from the scope of the Framework Decision challenges one of the main innovations of this instrument (which is to abolish the limits to the surrender of own nationals)27 and sits at odds with the construction of the EU as a borderless Area of Freedom, Security and Justice, where the European Arrest Warrant serves to compensate for the ease with which those wanted to face justice may move from one Member State to another.28 The automaticity embraced by the Court is also at odds with the Area of Freedom, Security and Justice in that it is based upon the presumption that a national of an EU Member State has more connection with their Member State of origin than with another Member State and thus cannot be better re-integrated in another Member State,29 and disregards the approach of the Court in Kozlowski, where an individual assessment of whether the Article 4(6) exception applies on the basis of a number of criteria was put forward.30 The Court’s acceptance of Member States’ margin of discretion in implementing Article 4(6) also contradicts the Court’s ruling in Kozlowski, which emphasised that the terms ‘staying’ and ‘resident’ in Article 4(6) of the Framework Decision are autonomous EU law concepts. In the light of the above observations, the Court’s approach to mutual recognition in the context of the European Arrest Warrant system in Wolzenburg is far from coherent. The Court has in essence accepted that the Article 4(6) ground for refusal can be interpreted restrictively in cases concerning a great number of EU citizens exercising EU law rights in a Member State other than the one of their nationality, but that the same ground for refusal can be interpreted in a maximalist manner granting full protection against surrender to nationals of the executing Member State. In addition to accepting discrimination on grounds of nationality as justified, the Court upheld the system adopted by Dutch law, using the high residence threshold established by the Citizens’

27 See also Wolzenburg, EU:C:2009:183, Opinion of AG Bot delivered on 24 March 2009, para 132, according to whom ‘Member States have surrendered their sovereign power to shield their own nationals from the investigations and penalties of other Member States’ judicial authorities’. The AG based this conclusion, citing the ne bis in idem case law, on the high level of confidence in the Area of Freedom, Security and Justice (paras 133–36). He took the view that ‘Member States cannot, without undermining the effectiveness of the Framework Decision, take decisions in their domestic law which, in one way or another, would have the effect of reintroducing an automatic exception in favour of their nationals’ (para 152). 28 See V Mitsilegas, ‘The Limits of Mutual Trust in Europe’s Area of Freedom, Security and Justice: From Automatic Inter-state Cooperation to the Slow Emergence of the Individual’ (2012) 31 Yearbook of European Law 319. 29 See also in this context Wolzenburg (n 27), Opinion of AG Bot, paras 103–06. 30 See also ibid, Opinion of AG Bot, who argued in favour of a case-by-case assessment (para 63).

326 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU Rights D irective in isolation from the developed legal framework and objectives of EU citizenship law to differentiate between various categories of citizens of the EU.31 It is noteworthy that in assessing the proportionality of the Dutch implementing law, the Court chose to base its ruling on the restrictive approach it had adopted in the citizenship case of Forster, which concerned the granting of rights to EU citizens.32 However, it is submitted that Forster is not the appropriate ruling to be applicable in the case of Wolzenburg, as the latter is not a case concerning the granting of rights to EU citizens, but is one essentially concerning security of residence in another EU Member State according to Article 4(6) of the Framework Decision on the European Arrest Warrant. Framing the case within a security of residence context would trigger the application of the security of residence and protection from expulsion provisions of the Citizens’ Rights Directive, which introduces a very high threshold of threat to the host society, to be assessed on an individual basis, before security of residence is watered down. The Court’s reasoning in Wolzenburg has resulted in the Court – contrary to the Opinion of AG Bot – accepting that an EU citizen who has been resident and employed in a Member State other than the one of their nationality for a number of years is not covered by the protective bar to the execution of a European Arrest Warrant against them. This approach can be explained if Wolzenburg can be seen as an immigration case rather than as a criminal law case, involving the protection of national identity as a state interest. The Court uncritically accepted the sharp distinction put forward by the Dutch government between an inclusionary approach towards own nationals and long-term resident EU citizens and an exclusionary approach towards other EU citizens. In doing so, the Court privileged the interests of the state in maintaining and projecting a national identity over the interests of the affected individuals in the Area of Freedom, Security and Justice: re-integration (the accepted objective of Article 4(6) of the Framework Decision) is subject to mutual recognition when nationals of other EU Member States are concerned, and is made conditional upon the perceived ‘integration’ of EU citizens in the executing Member State. By using immigration law terms and logic in this manner, the concept of mutual trust between Member States or authorities executing European Arrest Warrants is transformed into blind trust in favour of own nationals and blind distrust vis-a-vis nationals of other EU Member States. While the Court’s ruling may be explained as an attempt to address – following its reticence in Kozlowski – concerns expressed in a number of Member States as regards the surrender of own nationals to other EU Member States, the confusion of immigration law with the law relating to citizens of the EU, the acceptance of discrimination between various categories of EU citizens, the undue emphasis on national discretion and the acceptance of automaticity instead of a case-by-case assessment of the applicability of Article 4(6) are backward steps which do not address the

31 For a criticism of this approach, see L Marin, ‘“A Spectre is Haunting Europe”: European Citizenship in the Area of Freedom, Security and Justice’ (2011) 17 European Public Law 705. Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States [2004] OJ L158/77. 32 Case C-158/07, Forster [2008] ECR I-08507.

Citizenship in EU Criminal Law 327 development of the EU into an Area of Freedom, Security and Justice without internal borders.33 The Court subsequently attempted to rebalance its approach to the definition of stay and residence for the purposes of Article 4(6) of the Framework Decision on the European Arrest Warrant in the case of Da Silva Jorge.34 This case concerned the compatibility with EU law of the French implementing law, according to which refusal to execute a European Arrest Warrant was optional and applicable only in relation to French nationals and on condition that the competent French authorities had undertaken to enforce the sentence themselves. The Court reiterated the obligation of Member States as a rule to act upon a European Arrest Warrant,35 but also referred to its ruling in Wolzenburg to affirm that Member States have a margin of discretion in implementing the ground for refusal in Article 4(6) of the Framework Decision and that they may limit the scope of Article 4(6) by making its application ‘subject to the condition that the person requested has lawfully resided for a certain period in that Member State’, where that person is a national of another Member State having a right of residence on the basis of Article 21(1) TFEU.36 However, the Court then continued by referring back to its ruling in Kozlowski, confirming that ‘the terms “resident” and “staying” must be defined uniformly in all the Member States since they concern autonomous concepts of European Union law’.37 While Member States have a margin of discretion, ‘they are not entitled to give those terms a broader meaning than that which derives from a uniform interpretation of that provision in the Member States as a whole’.38 The Court not only attempted to use autonomous concepts to set limits on national discretion here, but continued by introducing a new teleological element in the interpretation of Article 4(6) by stating that, in transposing the latter, ‘Member States are required to comply with Article 18 TFEU’:39 [I]t cannot be accepted that a requested person who, without being a national of the executing Member State, has been staying or been resident there for a certain period of time is not in any circumstances capable of having established connections with that State which could enable him to invoke that ground for optional non-execution.40

It is for the executing judicial authority: [T]o determine whether, in a specific situation, there are connections between the requested person and the executing Member State which lead to the conclusion that that person ‘is staying’ or ‘resident’ within the meaning of Article 4(6) of that framework decision.

In order to do this, the authority must: [M]ake an overall assessment of various objective factors characterising the situation of that person, which include, in particular, the length, nature and conditions of his

33 Mitsilegas

(n 28). C-42/11, Da Silva Jorge, ECLI:EU:C:2012:517 judgment of 5 September 2012. 35 ibid paras 28–29. 36 ibid paras 33–34. 37 ibid para 36. 38 ibid para 37. 39 ibid para 38. 40 ibid para 41, by reference to Kozlowski (n 5) para 37. 34 Case

328 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU presence and the family and economic connections which he has with the executing Member State.41

However, these principles were not followed by the French legislator in the implementation of the Framework Decision. The Court found that: [I]f Member States transpose Article 4(6) of Framework Decision 2002/584 into their domestic law, they cannot … limit ground[s] for optional non-execution solely to their own nationals, by excluding automatically and absolutely the nationals of other Member States who are staying or resident in the territory of the Member State of execution irrespective of their connections with that Member State.

This would be to undermine the principle that there should be no discrimination on the grounds of nationality42 In this manner, the Court has laid down the minimum ground rules for the definition of residence and stay as autonomous concepts for the purposes of the execution of European Arrest Warrants, consisting at least of an individual assessment of the degree of connection of an EU national with the executing Member State. However, Da Silva Jorge does not negate the influence that domestic integration agendas may have on the development of the EU as an area of criminal justice.

B. EU Citizenship in the EU System on Transfer of Prisoners The Framework Decision on the transfer of sentenced persons aims to go beyond existing public international law instruments in the field by enhancing automaticity in interstate cooperation.43 This step forward is justified on the basis of the existence of ‘special mutual confidence’ among EU Member States’ legal systems, which enables mutual recognition.44 This elevated mutual trust justifies automaticity to such an extent that: [N]otwithstanding the need to provide the sentenced person with adequate safeguards, his or her involvement in the proceedings should no longer be dominant by requiring in all cases his or her consent to the forwarding of a judgment to another Member State for the purpose of its recognition and enforcement of the sentence imposed. (Emphasis added)45

Hence, while in theory the objective of the Framework Decision includes the facilitation of the social rehabilitation of the sentenced person,46 in practice the 41 Da Silva Jorge (n 34) para 43, by reference to Kozlowski (n 5) paras 48 and 49, and Wolzenburg (n 27) para 76. 42 Da Silva Jorge (n 34) para 50. See also the Opinion by AG Mengozzi, delivered on 20 March 2012. According to the AG, the line of argument put forward by certain governments to the effect that, in such circumstances, nationals are not in a situation comparable to that of nationals of other Member States is untenable (para 50). 43 Council Framework Decision 2008/909/JHA of 27 November 2008 on the application of the principle of mutual recognition to judgments in criminal matters imposing custodial sentences or measures involving deprivation of liberty for the purpose of their enforcement in the European Union, Preamble, Recital 4. 44 ibid Preamble, Recital 5. 45 ibid. 46 See ibid art 3(1), according to which its purpose is ‘to establish the rules under which a Member State, with a view to facilitating the social rehabilitation of the sentenced person, is to recognise a judgment and enforce the sentence’.

Citizenship in EU Criminal Law 329 ramework Decision introduces a system of maximum automaticity with little F consideration for the position of the affected individual. Automaticity in the Framework Decision is introduced at four levels. The first three levels correspond largely to the automaticity elements analysed in the context of the Framework Decision on the European Arrest Warrant. First, cooperation is based on speed and a minimum of formality based on a pro-forma document annexed to the Framework Decision.47 Second, the verification of the existence of dual criminality has been abolished for a list of offence categories.48 While in the case of the European Arrest Warrant the abolition of the verification of dual criminality led to legality concerns due to the obligation of the executing Member State to deploy its law enforcement powers for conduct which is not a criminal offence under its legal system, the same abolition in the Framework Decision on the transfer of sentenced persons leads to an equally complex challenge for the executing Member State, which is required to keep an individual in prison for conduct which does not constitute an offence under its law. This is why Member States are given the opportunity not to apply this provision.49 Third, the Framework Decision contains limited grounds for refusal (here, unlike the Framework Decision on the European Arrest Warrant, these grounds are only optional) and non-compliance with fundamental rights does not constitute such a ground.50 The Framework Decision introduces an additional element of automaticity: it removes the need for consent of the sentenced person in a number of cases, including where the judgment is forwarded ‘to the Member State of nationality in which the sentenced person lives’ and where the judgment is forwarded ‘to the Member State to which the sentenced person will be deported once he or she is released from the enforcement of the sentence on the basis of an expulsion or deportation order included in the judgment or in a judicial or administrative decision or any other measure consequential to the judgment’.51 The Framework Decision on the transfer of sentenced persons is an instrument designed with the interests of the state firmly in mind and with very little consideration for the position of the affected individuals. The stated social rehabilitation aims are subordinated to the enforcement interests of the state.52 The latter are part of a particularly vulnerable category of population. Unlike the Framework Decision on

47 ibid arts 12 and 15. 48 ibid art 7(1). 49 ibid art 7(4). For a discussion, see V Mitsilegas, ‘The Third Wave of Third Pillar Law: Which Direction for EU Criminal Justice?’ (2009) 34 European Law Review 523. 50 Framework Decision 2008/909/JHA, art 9. See also art 3(4) of the Framework Decision, which is drafted in a similar manner to art 1(3) of the Framework Decision on the European Arrest Warrant. 51 Framework Decision 2008/909/JHA, art,6(2)(a) and 6(2)(b) respectively. The other case involves transfer ‘to the Member State to which the sentenced person has fled or otherwise returned in view of the criminal proceedings pending against him or her in the issuing State or following the conviction in that issuing State’ (art 6(2)(c)). 52 V Mitsilegas, EU Criminal Law after Lisbon (Hart Publishing, 2016) ch 8. See also A Martufi, ‘Assessing the Resilience of “Social Rehabilitation” as a Rationale for Transfer: A Commentary on the Aims of Framework Decision 2008/909/JHA’ (2018) 9 New Journal of European Criminal Law 43; and P Faraldo-Cabana, ‘One Step Forward, Two Steps Back? Social Rehabilitation of Foreign Offenders under Framework Decisions 2008/909/JHA and 2008/947/JHA’ (2019) 10 New Journal of European Criminal Law 151.

330 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU the European Arrest Warrant (which targets individuals wanted to face justice), this Framework Decision deals with the unwanted individuals who Member States wish to remove from their territory. The removal of the requirement of consent in this context introduces maximum automaticity, which is reinforced in practice by the implementation of the Framework Decision in Member States.53 Automaticity is based on a double presumption: that the Member State of nationality in which the sentenced person lives is the Member State where the re-integration of this person will be best achieved; and that fundamental rights breaches – in particular, breaches of Article 3 ECHR or Article 4 of the Charter – will never arise in the Member State of nationality. The system introduced also disregards any consequences of an enforced transfer for the right to private and family life of the sentenced person. It also sits at odds with the provisions of the Citizens’ Rights Directive on security of residence and expulsion of EU citizens, in that it essentially ensures that the imprisonment of an EU citizen has the same effects as their expulsion, although the imposition of a custodial sentence does not in itself constitute a ground for expulsion under EU law and the threat posed to the host society must be individually assessed.54 The automatic transfer of a sentenced person to their state of nationality sits at odds with the requirement of individual assessment put forward by EU citizenship law, with the requirement of an individualised assessment of each request for transfer being essential towards achieving the stated social rehabilitation objectives and a meaningful protection of EU citizens.55 Automaticity based on the above presumptions also serves to shield the Framework Decision from an examination of whether the system it introduces is compatible with the objective of establishing an Area of Freedom, Security and Justice. While the Framework Decision is justified partly on the grounds of ensuring the interests of the affected individuals – namely, their re-integration – it is difficult to see how this objective is met by a system which removes the need for consent and does not give affected individuals any decisive say on the execution of the judgment ordering their transfer. If the objective of re-integration is not met, it is hard to see which objective is met by the Framework Decision beyond cutting costs with regard to prison maintenance and operation in Member States. However, this objective in itself is not sufficient to justify the adoption of EU law under an Area of Freedom, Security and Justice legal basis. The enforced transfer of persons who are already serving a sentence in one Member State which does not contribute to their re-integration does not address freedom, security or justice in an area without internal frontiers.56

53 European Commission, ‘Report from the Commission to the European Parliament and the Council on the implementation by the Member States of the Framework Decisions 2008/909/JHA, 2008/947/JHA and 2009/829/JHA on the mutual recognition of judicial decisions on custodial sentences or measures involving deprivation of liberty, on probation decisions and alternative sanctions and on supervision measures as an alternative to provisional detention’ COM (2014) 57 final, Brussels, 5 February 2014, para 4.1, p 8. 54 See art 28 and 33(1) of Directive 2004/38/EC ([2004] OJ L158/77, 30 April). 55 On the importance of an individualised assessment, see the Opinion of AG Bobek in Case C-919/19, Generálna prokuratura Slovenskej republiky v XY ECLI:EU:C:2021:650 (delivered on 3 June 2021). 56 Mitsilegas (n 28).

Citizenship in EU Criminal Law 331

C. EU Citizenship in the External Dimension of EU Criminal Law: Extradition Requests by Third States The relationship between EU citizenship and the external dimension of EU criminal law has been tested in a series of cases involving extradition requests from third states to EU Member States.57 Initially, these requests covered a wide range of legal situations: extradition requests for the purpose of prosecution in cases where the third country in question had not concluded an extradition agreement with the EU (this was the case for Russia in Petruhhin);58 extradition requests for prosecution by countries which had concluded an extradition agreement with the EU (namely the US case Pisciotti);59 and extradition requests for the purposes of execution of the sentence by countries with no extradition agreement with the EU (again a case involving Russia – Raugevicius).60 In all three cases, the CJEU was essentially asked to position the fight against impunity within the constitutional question of the extent to which cooperation is possible while upholding EU law. In response, and notwithstanding the nuances in these rulings, the CJEU has elevated the fight against impunity in the context of international cooperation and its effectiveness as a key objective of EU law subject to two conditions: that cooperation complies with EU values and that it respects, to some extent, EU citizenship rights. In terms of the need to respect EU values, the CJEU has explicitly used its internal Aranyosi test developed in the European Arrest Warrant as the external benchmark of Member State action in the field of extradition. This is an important reminder that international cooperation cannot happen at the expense of the protection of fundamental rights and cannot undermine the EU’s own standards and values.61 The CJEU added a second layer of scrutiny and examined the extent to which EU citizenship could act as a further protection against extradition requests from third countries. It noted that the EU is to contribute to the protection of its citizens in its relations with the wider world,62 questioning the extent to which such protection extends to extradition requests against EU citizens located in Member States other than the state of nationality. The development of bilateral international cooperation arrangements between Member States and third countries aimed at fighting impunity must be seen here within the broader obligations and values of the EU as a whole, both in terms of the relationship between national law and EU law, and in terms of the requirement of the EU to uphold its fundamental principles on the global stage. The evolution of the CJEU case law thus far has presented a nuanced protection against extradition on citizenship grounds. The Court set a promising initial benchmark in Petruhhin, where it focused on the need to protect free movement and invoked the need to give priority to internal EU cooperation mechanisms over international ones.

57 On this topic, see S Saluzzo, ‘Impunity and EU or Member States’ Extradition Agreements with Third Countries’ in S Montaldo and L Marin (eds), The Fight against Impunity in EU Law (Hart Publishing, 2020) 299–316. 58 Case C-182/15, Petruhhin, ECLI:EU:C:2016:630. 59 C-191/16, Pisciotti, ECLI:EU:C:2018:222. 60 Case C-247/17, Raugevicius, ECLI:EU:C:2018:898. 61 Petruhhin (n 58) para 44 – see the reference to art 3(5) TFEU. 62 ibid.

332 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU It accepted that preventing the risk of impunity is a legitimate objective of EU law.63 However, measures which restrict a fundamental freedom such as the one set out in Article 21 TFEU can be justified by objective considerations only if the interests which they are intended to secure cannot be attained by less restrictive means.64 If the state of nationality has jurisdiction pursuant to its national law to prosecute that person for offences committed outside its territory,65 it will be granted the opportunity to issue a European Arrest Warrant, which takes precedence over the international extradition request.66 In other words, as Costa has noted, the EU citizenship exception gives rise to protection against extradition, but only if the offence can be prosecuted in the EU.67 In this way, the CJEU has attempted to ensure that impunity does not occur while trying to uphold citizenship rights by establishing not a duty, but merely an opportunity for the country of nationality to issue a European Arrest Warrant via the evocation of the principle of sincere cooperation.68 The protection offered by the Court to EU citizens is thus derivative, depending on action by the state of nationality.69 With this caveat, Petruhhin has been an important ruling in setting potential limits to the uncritical fight against impunity in the context of international cooperation in criminal matters, with EU fundamental rights benchmarks and citizenship rights setting limits to such cooperation. The extent of these limits has been tested in the follow-up case of Pisciotti.70 Pisciotti differed from Petruhhin in two main respects: it involved an EU national who was in transit from an EU Member State (an Italian national in transit at Frankfurt Airport); and it involved a situation where the EU had in fact signed an extradition agreement with the third country concerned (the US). The CJEU found that this agreement, as well as national law, including constitutional law governing bilateral extradition relations with third countries (which may prohibit the extradition of own nationals to third countries), must be applied in accordance with EU law, including primary EU law.71 It then referred back to Petrunhin regarding the requirement of approaching the need to prevent impunity in the international sphere without disproportionately restricting the free movement of EU citizens.72 However, the CJEU’s conceptualisation of the protective function of EU citizenship in the context of international cooperation was rather limited. The CJEU did not place Member States under the duty to treat EU citizens in the same way as their own citizens in cases of extradition requests by third countries (which could mean a prohibition of extradition if this is the case for own nationals and an

63 ibid para 37 and the reference to Case C 129/14 PPU, Spasic, ECLI:EU:C:2014:586. For further details, see ch 3. 64 ibid para 38. 65 ibid para 50. 66 ibid para 48. 67 MJ Costa, ‘The Emerging EU Extradition Law: Petruhhin and Beyond’ (2017) 8 New Journal of European Criminal Law 192. 68 Petruhhin (n 58) para 42. 69 Costa (n 67) 198. 70 Pisciotti (n 59). 71 ibid paras 39–43. 72 ibid paras 44–48.

Citizenship in EU Criminal Law 333 obligation to assume prosecution at the national level). This approach would both give meaning to EU citizenship rights and ensure the avoidance of impunity. Rather, the Court chose to further develop its approach to Petruhhin, whereby essentially citizenship rights are taken into account by giving precedence to the enforcement will of the country of nationality of the requested person. In Pisciotti, this derivative protection found its expression in the CJEU giving precedence to a European Arrest Warrant in relation to an extradition request from the US, notwithstanding the nuanced wording of the EU–US Agreement on extradition in this regard.73 The only question for Germany in this context was whether to adopt an action which was less prejudicial to free movement and surrender the EU citizen to his EU state of nationality (Italy) rather than to the US.74 Thus, the only way forward in this case would be for Germany to inform Italy and, should the latter decide to issue a European Arrest Warrant, to execute the warrant provided that the Member State has jurisdiction, pursuant to its national law, to prosecute the person for offences committed outside its territory.75 In this case, the Italian authorities chose not to issue a European Arrest Warrant in respect of Mr Pisciotti.76 The Pisciotti ruling was rightly criticised for failing to uphold a protection based on EU citizenship. As Coutts has eloquently noted, in Pisciotti the relationship shifts from one of an EU citizen, deriving protection from the EU legal order, to a one of a national citizen, over whom the state claims a privileged relationship of authority before and above the claims of other third states.77 Indeed, such protection may essentially be offered on the grounds of nationality and not of a broader European understanding of EU citizenship within Europe’s of Freedom, Security and Justice – a European approach which has been weakened further in Pisciotti by the failure of the CJEU to refer expressly to the requirement for EU fundamental rights standards in order to form the benchmark for external action on extradition for the EU and its Member States. The CJEU’s restrictive approach in Pisciotti may be explained by the facts of the case, namely that it involved an EU citizen in transit via another EU Member State. The CJEU’s response was slightly different in the subsequent case of Raugevicius, which involved a permanent resident EU citizen.78 Mr Raugevicius was a dual Russian-Lithuanian national, resident in Finland and subject to a Russian extradition request to enforce a sentence. The CJEU reiterated its statements on the limits to the fight against impunity posed by free movement79 and applied this reasoning to extradition requests for the enforcement of sentences.80 However, unlike in Pisciotti, here the Court projected its internal case law on citizenship protection in intra-EU European Arrest Warrant cases into the external field. By reference to the internal case of Wolzenburg, the CJEU found that, in view of the aim of preventing the risk of impunity, Finnish nationals and

73 ibid

para 53. para 50. 75 ibid para 51. 76 ibid para 55. 77 S Coutts, ‘From Union Citizens to National Subjects: Pisciotti’ (2019) 56 CML Rev 536. 78 Raugevicius (n 60) 533. 79 ibid paras 28–32. 80 ibid para 34. 74 ibid

334 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU nationals of other Member States who reside permanently in Finland and demonstrate a certain degree of integration into that state are in a comparable situation.81 The CJEU found that Articles 18 and 21 TFEU require that nationals of other Member States who reside permanently in Finland and whose extradition is requested by a third country for the purpose of enforcing a custodial sentence should benefit from the provision preventing extradition from being applied to Finnish nationals and may, under the same conditions as Finnish nationals, serve their sentence on Finnish territory.82 In contrast, if a citizen may not be regarded as residing permanently in the Member State which has received the extradition request, the issue of their extradition is to be settled on the basis of the applicable national or international law.83 The Court constructed citizenship protection here in light of permanent residence under national law. However, this protection is further underpinned by the requirement to comply with EU benchmarks: the Court reiterated that, in the absence of EU law on extradition with Russia, Member States are still required to exercise the power to adopt domestic provisions in accordance with EU law.84 Citing Petruhhin, the Court confirmed the obligation of a Member State intending to extradite a national from another Member State to a third country not to infringe Charter rights, especially Article 19.85 In terms of their impact on the conceptualisation of the fight against impunity in EU law, this sequence of cases paints a complex and nuanced picture.86 First of all, the Court confirmed that the fight against impunity in the context of international cooperation in criminal matters and, in particular, in the context of extradition arrangements between EU Member States and third countries is a legitimate objective of EU law. It can thus be seen that the effectiveness of international cooperation is elevated as a distinct objective in EU law.87 Second, it can be seen that the fight against impunity on the international stage is far from unqualified. EU law sets important parameters and limits to international cooperation. The first set of limits involves full compliance with internal EU fundamental rights standards – as also reiterated by the CJEU in two out of its three rulings in the field. The challenge for the EU when emerging as a global actor is to uphold and promote its values worldwide, and these values can be seriously challenged in the context of international cooperation in criminal matters with third states whose benchmarks and standards vary significantly from EU norms. The significance of rulings such as Petruhhin and Raugevicius is not only the express reminder by the Court that internal EU benchmarks apply externally, but also that these standards govern action by EU Member States in their bilateral relations with third states, even in the absence of EU rules on extradition with the third countries concerned. This can certainly be said for cases involving extradition requests by third countries involving citizens of

81 ibid para 46. 82 ibid para 47. 83 ibid para 48. 84 ibid para 45. 85 ibid para 49; Petruhhin (n 58) para 60. 86 V Mitsilegas, ‘Conceptualising Impunity in the Law of the European Union’ in Montaldo and Marin (n 57) 13–45. 87 Coutts ((n 77) 536) notes that impunity reflects a more abstract principle here that justice be done more generally.

Citizenship in EU Criminal Law 335 other EU Member States, but it is submitted that this also applies in cases involving extradition requests by third countries involving own nationals of EU Member States. This is an area where, in view of EU action in the field, Member States are bound by EU law in their external action.88 While fundamental rights here provide a truly European benchmark for conceptualising the fight against impunity and setting its parameters in international cooperation, the same cannot be said in terms of the development of protection against extradition on the grounds of citizenship of the EU. The CJEU’s choice of dealing with these cases from a citizenship perspective has been of great significance in bringing these cases within the scope of EU law in order to ensure that EU law protection is achieved. As Nic Shuibhne has eloquently noted, the Court’s primary concern is to keep the business of EU citizens within the territory of the EU as much as possible, with the purpose of protecting the EU citizen from the uncertain consequences of exposure to ‘outside’.89 However, in the evolution of the case law of the Court, protection against an uncritical fight against impunity privileging the interests of the non-EU requesting state has been based not so much on a European concept of citizenship and rights, but rather on a derivative model, which has degenerated in cases like Pisciotti from a model of protection based on citizenship to a model of protection based on nationality. This approach leaves EU citizens at the mercy of the choices of their country of nationality, which may or may not see a strong need to protect that individual concerned on the basis of the various links arising in the specific case. It potentially creates significant disparity in the treatment of EU citizens within the Area of Freedom, Security and Justice. The case for a reconsideration on the basis of a European model of protection based more firmly on equality and non-discrimination appears to be due. These concerns have been affirmed in more recent case law of the CJEU – with the Court shying away from imposing on EU Member States direct obligations to protect EU citizens. In Generalstaatsanwaltschaft Berlin, the Court extended the scope of protection to EU citizens who moved the centre of their interests to the host Member State at a time when they did not have EU citizenship,90 and in Ruska Federacija, it confirmed that the Petruhhin protection also covers European Economic Area (EEA) nationals.91 In the latter case, the Court further stressed the requirement for the host EU Member State to refuse extradition if the latter would be contrary to the Charter, in particular in cases where the EEA national in question has been granted asylum by the home state for reasons which are based on the criminal proceedings which have generated the extradition request by a third state to the host state.92 However, the Court declined to develop a clear obligation on the host Member State to refuse the extradition of an EU citizen to a third country. There is no obligation to refuse to extradite and no obligation for the host

88 I have developed this point in V Mitsilegas, ‘Transatlantic Counter-terrorism Cooperation after Lisbon’ (2010) 3 Eucrim 111. 89 N Nic Shuibhne, ‘“The Territory of the Union” in EU Citizenship Law: Charting a Route from Parallel to Integrated Narratives’ (2019) 38 Yearbook of European Law 267. 90 Case C-398/19, Generalstaatsanwaltschaft Berlin (Extradition vers l’Ukraine), ECLI:EU:C:2020:1032, para 34. 91 Case C-897/19 PPU, Ruska Federacija, EU:C:2020:262, para 54. 92 ibid paras 64–68.

336 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU state itself to conduct a criminal prosecution of that person for offences committed in a third state where its national law empowers that state to prosecute that EU citizen for certain offences committed in a third state.93 An obligation to refuse extradition to a third country does not arise even in cases where the national law of the host state provides for extraterritorial jurisdiction for the offences in question. The CJEU is reluctant to establish such an obligation on state sovereignty grounds: if there were such an obligation, the consequence would be that that Member State would be deprived of the opportunity to decide itself on the appropriateness of conducting a prosecution of that citizen on the basis of national law – such an obligation would go beyond the limits that EU law may impose.94 Sovereignty concerns are linked to concerns that impunity is avoided in the Court’s reasoning.95 In attempting to clarify the obligations of the host state in its relations with the home state, the CJEU provided further guidance on the information to be provided by the host to the home state,96 but stated that neither the requested Member State nor the Member State of which the requested person is a national can be obliged, under EU law, to make an application to the third state that is requesting extradition for the transmission of the criminal investigation file.97 Moreover, the communication process between the two EU Member States does not stop extradition to a third country: provided that the authorities of the requested Member State have duly informed the authorities of the Member State of which the requested person is a national, those authorities may continue the extradition procedure and, where appropriate, carry out the extradition of that person where a European Arrest Warrant has not been issued by the Member State of which that person is a national within a reasonable time.98 There is thus no further substantial protection offered to EU citizens by the CJEU, with the limits of protection against extradition offered by the host EU Member State brought clearly to the fore. In this manner, the ruling affirms earlier criticism on the limits of protection on the basis of EU citizenship.

III. EU Criminal Law in EU Citizenship EU criminal law considerations have emerged in recent attempts by the Court of Justice to determine the scope of derogations to the protection afforded by the Citizens’ Rights Directive. The Court has delivered two landmark rulings post-Lisbon in the field: Tsakouridis, which involved the impact on citizenship rights of conduct which would be punishable under secondary EU criminal law (the third pillar Framework Decision on drug trafficking); and PI, which involved the impact on citizenship rights of conduct

93 Generalstaatsanwaltschaft Berlin (n 90) para 64. 94 ibid para 65. 95 See also in this context S Giudici, ‘Generalstaatsanwaltschaft Berlin: A Further Development of Extradition Rules of Union Citizens to Third Countries’ in European Papers, vol.6, 2021, European Forum, Insight of 11 June 2021, pp.211–218,. 96 Generalstaatsanwaltschaft Berlin (n 90) paras 43, 48. 97 ibid para 49. 98 ibid para 53.

EU Criminal Law in EU Citizenship 337 which was enumerated in the Treaty legal basis for securitised criminalisation under Article 83(1) TFEU (sexual offences). The evolving interpretation by the Court of the impact of EU criminal law on citizenship rights will be examined in this section.

A. The Impact of Secondary EU Criminal Law on EU Citizenship: Tsakouridis The CJEU first considered the impact of EU criminal law on the meaning of ‘imperative grounds of public security’ in the case of Tsakouridis.99 Mr Tsakouridis was born a Greek national in Germany in 1978, where he acquired an unlimited residence permit in 2001. Between March and November 2004, he ran a pancake stall in Rhodes, where he returned in October 2005. A few months later, he was arrested in Greece on the basis of an international arrest warrant issued by a German court. He had already been convicted in Germany more than once for crimes of assault and possession of an illegal object. In August 2008, he acquired another conviction of six years and six months for dealing in narcotics as part of an organised group. Under German law, a term of imprisonment of at least five years for an intentional offence was the threshold for triggering an expulsion on the basis of ‘imperative grounds of public security’ as set out in Article 28(3) of the Citizens’ Rights Directive.100 Consequently, the national authorities ordered the expulsion of Mr Tsakouridis. He successfully brought an action against that decision.101 However, on appeal, the national court decided to request a preliminary ruling and ask whether the concept of public security covered only irrefutable threats to the external or internal security of the Member State specifically linked to the existence and function of the state, the survival of its population, its foreign relations and the peaceful coexistence of nations. In other words, what was at stake was whether the personal conduct of Mr Tsakouridis represented a sufficiently serious threat to one of the core interests of German society that could justify his expulsion on imperative public security grounds. The court further inquired about the consequences of repeated absences from the host state to the enhanced protection offered to an EU citizen after 10 years of residence in the host state. The questions of the referring court were addressed in detail by AG Bot.102 The AG devoted a large part of his Opinion to an analysis on what constitutes an imperative ground of public security. From the outset, he made two remarks: first, that the length of stay in the territory of the host Member State is a decisive factor for determining the conditions of an expulsion measure, as it is indicatory of the level of integration in that

99 Case C-145/09, Land Baden-Württemberg v Tsakouridis, ECLI:EU:C:2010:708 judgment of 23 November 2010. 100 Paragraph 6(5) of the Gesetz über die allgemeine Freizügigkeit von Unionsbürgern (FreizügG/EU). See para 10 of the judgment. Directive 2004/58/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States (hereinafter the ‘Citizens’ Rights Directive’). 101 For an overview of the arguments presented by the Administrative Court, see Tsakouridis (n 99) paras 18–20. 102 ibid, Opinion of AG Bot, delivered on 8 June 2010, EU:C:2010:322.

338 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU state’s society;103 and, secondly, that the principle that a criminal sanction must function as a means of achieving the rehabilitation of the convicted person is a general principle of EU law, which is also applicable in the context of the Area of Freedom, Security and Justice.104 The AG examined the distinction between the concepts of public security and public policy by pointing out that no judgment of the CJEU contains a definition of public security and that it is merely stated that it includes both internal and external security.105 By invoking a series of judgments by the CJEU as well as the wording of the EU Citizens’ Rights Directive as such, he opined that a clear-cut distinction of the two concepts and a definition with exhaustive content is difficult and even artificial, since their common objective is the protection of the fundamental interests of society.106 ‘Member States are free to determine public policy and public security requirements in accordance with their national needs’, and therefore the EU legislator and jurisprudence have deliberately left Member States with a certain margin of discretion.107 As regards drug trafficking in particular, he pointed out that it could pose a direct threat to the physical safety of the population in cases, which occur very often, where drug traffickers are organised into armed gangs that commit urban violence.108 Therefore, in his view, public security should not be confined to including only ‘the security of the Member State and its institutions’, but also ‘all the measures designed to combat serious threats to the values essential to the protection of its citizens’.109 Consequently, this would inevitably bring under the scope of public security certain grounds that are also covered by the scope of public policy.110 However, this would not, according to the AG, reduce the safeguards prescribed to limit the adoption of expulsion decisions against EU citizens. National authorities would still need to prove that the public security grounds are of imperative character.111 In the assessment of the proportionality of an expulsion order, the justification must be of superior level and have regard to the extreme seriousness of the conduct alleged.112 National authorities should explain with precision ‘in what way [an expulsion] decision does not prejudice the offender’s rehabilitation’. Overall, a balance between the interests of the individual and the EU must be found. This is because even if a person is expelled from a Member State and prohibited from returning, they will still be able to exercise their freedom of movement in the other Member States. ‘It is therefore in the general interests [of the EU] that the conditions of his release should be such as to dissuade him from committing crimes and, in any event not risk pushing him back into offending.’113 In addition, according to the AG, a number of criteria need to be taken into 103 ibid paras 42–45. 104 ibid paras 46–50. 105 See Case C-367/89, Richardt and Les Accessoires Scientifiques SNC [1991] ECR I-4621, para 22; Case C-83/94, Leifer and Others [1995] ECR I-3231, para 26; and Case C-285/98, Kreil v Bundesrepublik Deutschland [2000] ECR I-69, para 17. 106 Tsakouridis (n 99) para 68 of the Opinion. 107 ibid paras 69–71. 108 ibid para 72. 109 ibid para 77. 110 ibid para 78. 111 ibid para 80. 112 ibid para 91. 113 ibid para 95.

EU Criminal Law in EU Citizenship 339 consideration, such as the classification of the offence and the penalty framework, the involvement in the criminal activity and the specific sanction in comparison with the maximum sentence for the crime, the personal circumstances of the person concerned, such as the family ties and the exercise of economic activity in the host state, as well as ‘the effects produced or the information provided, regarding the degree of reintegration or the risk of re-offending, by the aid, advice and surveillance measures which accompanied his conditional release’.114 While the Court of Justice in its ruling did not fully follow the line of argument of the AG, it reached a similar conclusion and adopted a wide interpretation of the concept of ‘imperative grounds of public security’. Rather than exploring the correlation between public policy and public security more generally, it focused on the extent to which drug trafficking could be covered by the concept of ‘imperative grounds of public security’. Therefore, the concept of public security was interpreted in an autonomous way without any express association with the notion of public policy.115 In this regard, although a literal interpretation of Article 28(3) could perhaps lead to confining the application of the provision only to particularly serious conduct which threatens state security and puts the survival of the population in jeopardy,116 the Court adhered to a wide interpretation of the notion – just like the AG – by stating that the fight against crime in connection with dealing in narcotics as part of an organised group is not necessarily excluded from the concept of public security. In order to support this claim, the Court took into account the existence of an EU criminal law instrument, namely Framework Decision 2004/757/JHA, which lays down minimum rules regarding the constituent elements of criminal acts and penalties in the area of illicit drug trafficking.117 In particular, the Court pointed out that Recital 1 of the Framework Decision includes security among the public interests threatened by the crime.118 The second factor highlighted by the Court was the special characteristics of this criminal activity, in particular the negative consequences of drug addiction for the individual, its extraordinary economic and operational resources, and its transnational links. In the light of the above, it concluded that dealing ‘in narcotics as part of an organised criminal group could reach a level of intensity that might directly threaten the calm and physical security of the population as a whole or a large part of it’, thus making it a threat that could lead to an expulsion on imperative public security grounds.119

114 ibid para 96. 115 G Anagnostaras, ‘Case Comment – Enhanced Protection of EU Nationals against Expulsion and the Concept of Internal Public Security: Comment on the PI Case’ (2012) 37 European Law Review 632. 116 Kostakopoulou and Ferreira term this interpretation a restrictionist approach, in contrast to the Court’s view, which is regarded as the counter-restrictionist approach. See D Kostakopoulou and N Ferreira, ‘Testing Liberal Norms: The Public Policy and Public Security Derogations and the Cracks in European Union Citizenship’ (Legal Studies Research Paper No 2013–18, University of Warwick, School of Law) 10–11. 117 Council Framework Decision 2004/757/JHA of 25 October 2004 laying down minimum provisions on the constituent elements of the criminal acts and penalties in the field of illicit drug trafficking [2004] OJ L335/8. 118 In particular, Recital 1 of the Framework Decision states that illicit drug trafficking poses a threat to health, safety and the quality of life of citizens of the EU, and to the legal economy, stability and security of the Member States. 119 Tsakouridis (n 99) para 47.

340 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU This expansive interpretation adopted by the Court essentially blurs the distinction between the second and third paragraphs of Article 28 and leaves leeway to Member States to apply the public security concept in criminal offences that are also covered by the public policy ground, thus potentially lowering the enhanced level of protection provided by Article 28(3).120 It appears that the underlying rationale behind the Court’s approach is that when assessing expulsion decisions, national authorities should not give precedence to determining precisely the classification of the threat, whether it is a public policy or a public security one, as these concepts cannot easily be distinguished and their meaning at a national level can vary significantly. Instead, the focus must be placed on the ‘exceptional circumstances’ surrounding the criminal conduct and the ‘high level of seriousness’ of the threat.121 The importance attached to the exceptional nature of the threat could also be interpreted as meaning that an overlap between the concepts of public policy and public security cannot occur on a common basis and would depend on the impact of the personal conduct in question on the calm and physical security of at least a part of the general population.122 Regrettably, apart from examining the case of Mr Tsakouridis, the Court did not clarify what type of conduct would pose such exceptional security threats that could justify an expulsion of permanent residents.123 However, it noted that an individual assessment of each case is necessary on the basis of the possible penalties and the sentences imposed, the degree of involvement in the criminal activity and, if appropriate, the risk of reoffending. Echoing the arguments of AG Bot, the Court stated that the personal conduct of the EU citizen should be balanced against the risk of compromising the social rehabilitation of the EU citizen in the host state in which they have become genuinely integrated.124

B. The Impact of Primary EU Criminal Law on EU Citizenship: Article 83(1) TFEU and PI Less than two years after the Tsakouridis judgment, another German court sought an interpretation of Article 28(3) by the CJEU, this time with regard to criminal offences concerning the sexual exploitation of a minor. The case involved Mr I, an Italian national who had resided in Germany since 1987. In 2006, he was convicted and sentenced to seven-and-a-half years’ imprisonment for sexually abusing his 14-year-old stepdaughter from 1990 until 2001. In 2008, the German authorities adopted an expulsion order, which was unsuccessfully challenged. On appeal, the national court decided to stay the proceedings and refer a single question to the CJEU. Its wording was almost identical to the first question in Tsakouridis, as discussed above, and was rephrased as meaning whether the crimes committed by Mr I were covered by Article 28(3).

120 Anagnostaras (n 115) 633; Kostakopoulou and Ferreira (n 116) 10. In fact, the Court admitted that dealing in narcotics was indeed covered by both the concepts of public policy and public security. See Tsakouridis (n 99) paras 54–56. 121 See Tsakouridis (n 99) paras 40–41. 122 Anagnostaras (n 115) 633. 123 ibid. 124 Tsakouridis (n 99) paras 48–50.

EU Criminal Law in EU Citizenship 341 AG Bot delivered his Opinion on 6 March 2012.125 The AG took the view that the crimes in question, though particularly serious and repulsive in character, posed a threat to public policy, but could not give rise to ‘imperative grounds of public security’. In line with his views in Tsakouridis, the AG further elaborated his views on the distinction between the concepts of public security and public policy. In this regard, he explained that criminal law rules are in essence public policy rules, whereby each Member State defines the conduct it prohibits and sanctions.126 In this context, an infringement of these rules will signify the imposition of a penalty, the level of which corresponds to the disturbance caused to public policy.127 By contrast, public security covers a narrower category of criminal law which is determined first by the criminal conduct as such that is of particularly serious nature and second by its effects, which go beyond the individual harm caused to the victim.128 Therefore, the AG distinguished the nature of the act from the severity of the punishment; it is the nature of the crime in question that is of primary importance in asserting whether the offender poses a threat to public security, rather than the penalty imposed or the risk of reoffending.129 As regards the crimes of Mr I, he recalled the definition provided by the Court in Tsakouridis that a threat to public security should be a ‘diffuse form of crime [that] could reach a level of intensity that might directly threaten the calm and physical security of the population as a whole or a large part of it’.130 Given the particularities of the case where the criminal offences took place exclusively in a family context, he held that Mr I did not pose a threat to public security, despite the moral contempt attached to his crimes. Any other interpretation would signify that the objective seriousness of the offence as determined by the penalty imposed may justify an expulsion decision on imperative grounds of public security.131 Notwithstanding this finding, the AG took the view that Mr I could not benefit from the protection enshrined in Article 28(3) of the Directive. Drawing from the CJEU’s ruling in the Kol case,132 he stated that expulsion from the host Member State can have harmful effects only to those EU citizens who are genuinely integrated into the host Member State.133 In this regard, the Directive provides only for a ‘presumption of integration’, which is rebuttable.134 This is because in the AG’s view, the level of integration of an individual is conditional not only upon territorial and time factors, but also upon qualitative elements. In the case of Mr I, he found that such integration had not taken place, since he started committing his criminal acts three years after

125 Case C-348/09, PI v Oberbürgermeisterin der Stadt Remscheid, Opinion of AG Bot, delivered on 6 March 2012. 126 ibid para 36 of the Opinion. 127 ibid para 37. 128 ibid para 38. 129 ibid para 39. 130 ibid para 42. 131 ibid paras 43–45. 132 Case C-285/95, Kol v Land Berlin [1997] ECR I-3069. Kol involved a Turkish worker who had obtained a residence permit using fraudulent papers and subsequently obtained employment on the basis of this permit. The Court stated that he could neither derive any rights nor have any legitimate expectations. 133 PI (n 125) para 53 of the Opinion. 134 ibid para 56.

342 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU he obtained his residence permit and continued throughout the years and within the 10-year period required by the Directive.135 The commission of such crimes within this timeframe proved his complete lack of willingness to truly integrate into German society.136 While the first part of the AG’s Opinion provides valuable remarks on the relationship between the notions of public policy and public security, his innovative line of thinking as regards the rebuttable character of the presumption of integration is questionable and has attracted much criticism.137 In essence, the AG suggested that in order for an EU citizen to enjoy the protection offered by the Directive, certain actions proving true integration need to be undertaken by the individual concerned.138 Inability or unwillingness to conform to these requirements is ranked higher than the length of residence and could result in the disqualification and exclusion of any enhanced protection as set out in both Articles 28(2) and 28(3), thus depriving these articles of their effet utile.139 Thus, the AG seems to have introduced an exception from this status of enhanced protection – one that is related specifically to the commission of a crime.140 However, these proclamations are at odds with the spirit and philosophy of the Directive, which seeks to establish a meaningful status of permanent residence for EU citizens. Although the Preamble to the Directive refers to integration into society as the main cause behind the recognition of a status of permanent residence,141 there is no indication in the instrument that the presumption of integration can be rebutted.142 In its judgment, the Grand Chamber did not follow the approach of the AG either in his distinction between public policy and public security or in his views regarding the dependence of true integration upon whether an EU citizen is law-abiding or not.143 After recalling its findings in Tsakouridis, it emphasised that EU law does not impose on Member States a uniform scale of values as regards the assessment of a conduct as contrary to public security.144 However, while the Court recognised that Member States enjoy the discretion to determine the meaning of public security and

135 In this regard, Kostakopoulou notes that ‘the perception of the risk posed by the criminal conduct of an EU citizen is flowing backwards in order to unsettle an actual fact, namely, residence exceeding 10 years. PI’s past presence did not merely create a risk but was transformed into a real harm which had escaped the authorities’ attention’. See D Kostakopoulou, ‘When EU Citizens Become Foreigners’ (2014) 20 European Law Journal 459. 136 PI (n 125) paras 59–60 of the Opinion. 137 Anagnostaras (n 115) 3–8; D Kochenov and B Pirker, ‘Deporting the EU Citizens within the European Union: A Counter-intuitive Trend in Case C-348/09, PI v Oberbürgermeisterin der Stadt Remscheid’ (2013) 19 Columbia Journal of European Law 384; Kostakopoulou and Ferreira (n 116) 13. 138 Kochenov and Pirker (n 137) 384. 139 D Kochenov, ‘AG Bot in PI (Case C-348/09): Committing a Crime Disqualifies EU Citizens from Permanent residence’ European Law Blog (13 March 2012), europeanlawblog.eu/?p=281; Kochenov and Pirker (n 137) 385. 140 Anagnostaras (n 115) 367. 141 Recital 24 of the Citizens’ Rights Directive. 142 Kochenov and Pirker (n 137) 385. 143 PI (n 125). 144 ibid para 21.

EU Criminal Law in EU Citizenship 343 public policy in accordance with their needs and their own appreciation of values, it stressed that they must do so within the limits of EU law and ‘under the control of the institutions of the European Union’.145 In order to determine whether the criminal offences of Mr I could give rise to imperative public security considerations, the Grand Chamber again took into account the legislative developments at EU level. First, it referred to the EU competence in adopting legislation in criminal matters and, in particular, in Article 83(1) TFEU, which includes the sexual exploitation of children among the crimes of a particularly serious nature and cross-border dimension where the EU legislature may intervene.146 Second, it made reference to Directive 2011/93 as the result of exercising this competence,147 which states that sexual abuse and the sexual exploitation of children constitute grave violations of fundamental rights and provide a set of minimum maximum penalties that correspond to the seriousness of the offences in question.148 According to the Court, these references implied that the sexual exploitation of children as well as all the criminal offences stated in Article 83(1) TFEU may constitute a serious threat to the calm and physical security of the population, and may thus fall within the concept of ‘imperative grounds of public security’ so long as the way in which these acts were committed carries particularly serious characteristics. Whether or not this is the case for a specific individual, this is for the referring court ultimately to determine after an individual assessment.149 The Court thus introduced another criterion for assessing the existence of a public security ground: it is not only the exceptional nature of the threat posed by a certain criminal conduct, but also the seriousness of the criminal offence as such.150 The gravity of certain offences is specifically evidenced by the EU competence to adopt minimum rules and the existence of secondary legislation as a form of exercise of this competence. Such serious offences may constitute particularly grave threats to one of the fundamental interests of society, which in turn may directly threaten ‘the calm and physical security of the population’.151 Having provided a rather expansive interpretation of the threat posed by serious criminal offences, or at least those enlisted in Article 83(1), the Court cautiously noted that the finding that a criminal offence poses such a threat should not necessarily lead to an expulsion of the EU citizen in question. It made clear that the particular circumstances of a person’s life must be balanced against the legitimate security considerations of the state. A number of factors to be assessed by national authorities were highlighted in this regard; the personal conduct of the individual must represent a ‘genuine,

145 ibid para 23. See in this regard Case 36/75, Rutili v Ministre de l’intérieur [1975] ECR 1219, paras 26–27; and Case C-50/06, Commission v The Netherlands [2007] ECR I-4383. 146 PI (n 125) para 25. 147 Directive 2011/92/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA [2011] OJ L35/1, 17 December. 148 PI (n 125) paras 26–27. 149 ibid para 28. 150 Anagnostaras (n 115) 634. 151 PI (n 125) para 28.

344 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU present threat affecting one of the fundamental interests of society’, which implies that a propensity to act in the same way in the future must exist.152 According to Article 33(2) of the Directive, such a propensity needs to be verified as still existing when the expulsion order is enforced more than two years after it was issued.153 In addition, the factors listed in Article 28(1) of the Directive, namely the length of stay in the host Member State, their age, state of health, family ties, economic situation, social and cultural integration in the host state, and existence and extent of links with the state of origin must also be assessed.154 The judgment in PI not only confirmed the shift in the focus from the public policy/ public security divide to the exceptional character of the threat posed by the criminal conduct, but also significantly widened the scope of the public security derogation.155 While in Tsakouridis the Court seemed to imply that a potential overlap between the two concepts would be a rare occurrence, since the calm and physical security of the whole population or at least part of it would need to be under threat, in PI it was suggested that even cases involving specific individuals without such far-reaching repercussions could be considered as threats giving rise to imperative public security considerations as long as the manner in which the offence was committed involves particularly serious characteristics, which would be determined by the national authorities.156 It is noteworthy in this regard that the reference to the ‘calm and physical security of the population as a whole or at least large part of it’ was substituted by a mere reference to the ‘calm and physical security of the population’.157 Consequently, the Grand Chamber seems to understand the family context as part of a broader social sphere that the state has to duty to protect,158 thus adding an ‘everyday dimension’ to the public security derogation, which further blurs the distinction between the notions of public security and public policy.159 On the one hand, this wide interpretation by the Court, which encompasses large parts of the public policy notion, would satisfy Member States as it gives them leeway to expand their scope of manoeuvre and introduce additional limits to the free movement of persons in compliance with the judgment. In this framework, the judgment creates an interesting paradox, as at the same time the Grand Chamber carefully called for a strict interpretation of public policy and public security requirements at the national level.160 On the other hand, the content of Article 28(3) is reformed in a way that seems to be in contrast with the wording and rationale of the Directive, which was specifically designed

152 ibid paras 29–30. The concept of ‘propensity to act in the same in the future’ is drawn from Case 30/77, Bouchereau [1977] ECR 1999. For an analysis of the different meaning between PI and Bouchereau, see L Azoulai and S Coutts, ‘Restricting Union Citizens’ Residence Rights on Grounds of Public Security: Where Union Citizenship and the Area of Freedom, Security and Justice Meet: Case C-348/09, PI v Oberbürgermeisterin der Stadt Remscheid, judgment of the Court of Justice (Grand Chamber) of 22 May 2012’ (2013) 50 CML Rev 557. 153 PI (n 125) para 31; Directive 2004/38/EC, art 33(2). 154 PI (n 125) para 32. 155 Kostakopoulou and Ferreira (n 116) 12. 156 Anagnostaras (n 115) 634. 157 Azoulai and Coutts (n 152) 559–60. 158 ibid 560. Azoulai and Coutts refer to the Court’s approach as the socialisation of the concept of public security. 159 Kostakopoulou and Ferreira (n 116) 12. 160 Anagnostaras (n 115) 634.

EU Criminal Law in EU Citizenship 345 in order to make expulsions for EU citizens more difficult, depending on their level of integration in the society of the host Member State based on the length of residence, and thus promote the EU citizenship status.161 As Azoulai and Coutts have pointed out, the judgment could be seen as complementing the rights enshrined in the Directive with correlative obligations.162 However, the fact that Article 28(2) makes reference to both public policy and public security grounds, while Article 28(3) merely refers to ‘imperative grounds of public security’ clearly calls for a distinct interpretation of the concept of public security. A distinction between the notions is corroborated by the Commission Report on the implementation of the Directive, where it is highlighted that the competent national authorities must not extend the concept of public security to instruments that should be covered by public policy.163 Elsewhere, the Commission stressed the importance of clearly identifying the protected interests of society and of distinguishing between public policy and public security by noting that the former concept is generally to be interpreted along the lines of preventing the disturbance of the social order, while the latter intends to preserve the integrity of the territory of a Member State and its institutions.164 In this context, by putting aside the distinction between the two concepts, the Court allowed Member States to interpret the Directive in a manner that waters down the high level of protection offered to EU citizens against expulsions and more generally undermines the effectiveness of the Directive.165 As Acosta and Martire have noted, the Court’s approach seems to suggest that: ‘Rather than treating long-term EU citizens as quasi-nationals, the approach is to consider them … “eternal guests” whose integration can always be questioned.’166 The emphasis of the Grand Chamber on the role of Article 83(1) TFEU seems to suggest the existence of an EU list of particularly grave offences, which may raise public security concerns and potentially lead to the expulsion of EU citizens. In relation to these crimes, there is no requirement to ‘affect the calm and physical security of the general population as a whole or at least of a large part of it’. The inclusion of a crime in Article 83(1) TFEU seems to satisfy the Court that the crime is sufficiently serious, so an EU citizen may be expelled on the basis of imperative public security grounds ‘if the manner in which it was committed discloses particularly serious characteristics’.167 161 Kostakopoulou and Ferreira (n 116) 13. 162 Azoulai and Coutts (n 152) 569. 163 Commission, ‘Report to the European Parliament and the Council on the application of Directive 2004/38 on the rights of citizens of the Union and their family members to move and reside freely within the territory of the Member States’ COM (2008) 840 final, 10 December 2008. 164 Commission, ‘Communication from the Commission to the European Parliament and the Council on guidance for better transposition and application of Directive 2004/38/EC on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States’ COM (2009) 313 final, 2 July 2009, 10. 165 Kostakopoulou (n 135) 458. Some commentators have regarded the Court’s approach as an ultra vires action and unacceptable judicial activism, and the interpretation of the EU Citizens Directive as contra legem. See Kochenov and Pirker (n 137) 372. 166 D Acosta Arcarazo and J Martire, ‘Trapped in the Lobby: Europe’s Revolving Doors and the Others as Xenos’ (2014) 39 European Law Review 374. 167 Anagnostaras (n 115) 635. In his view, the line of argumentation of the Court seems rather circular in the sense that by default, a particularly serious criminal activity consists of particularly serious characteristics. The Court could have provided further clarifications as to what kind of particularly serious characteristics a serious offence should carry in order raise imperative public security concerns, but it merely left the matter for the national authorities to determine, thus further obscuring the matter.

346 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU In this context, Article 83(1) is transferred from its traditional context of judicial cooperation in criminal matters to the EU citizenship framework and acquires additional functions that are unrelated to the purpose it serves and were certainly not intended when the Lisbon Treaty was drafted.168 First, it provides guidance to national authorities by indicating criminal conduct of a serious nature that could thus be covered by the concept of ‘imperative public security grounds’. Second, rather than being used for controlling national definitions of fundamental interests as mentioned by the Court, it seems to affirm enforcement choices made at the national level, with some commentators even arguing that it serves to define a set of EU values.169 The Court has made clear that all listed crimes on the basis of which the EU legislature may intervene in accordance with Article 83(1) TFEU could imperil public security in an imperative manner and therefore could result in an expulsion order after considering the set of factors provided by the Court.170 In this manner, the Court has used Article 83(1) TFEU out of context: Article 83(1) TFEU serves as a legal basis circumscribing the competence of the EU to adopt legislation on criminal offences and sanctions, and not as a legal basis for interpreting exceptions to EU free movement and citizenship rights. In any case, EU intervention under Article 83(1) TFEU takes the form of a Directive, leaving Member States with a level of discretion as to how specifically the criminalisation objectives of EU law adopted under this legal basis are implemented. Thus, the use of Article 83(1) TFEU by the Court in PI has a dual transformational effect: in terms of EU citizenship, it serves to dilute the protection offered by EU law; and in terms of EU criminal law, by elevating the enumeration of the conduct listed in Article 83(1) to a ground justifying exceptions to rights granted under EU law, it affirms an uncritical securitised vision of EU criminal law and transforms Article 83(1) TFEU into symbolic criminal law.171

IV. Conclusion: Towards a Paradigm Change in Citizenship and EU Criminal Law The development of EU law in recent years on the relationship between EU criminal law and EU citizenship, in particular via the case law of the Court of Justice, has resulted in a paradigmatic change in terms of both the effect and significance of EU criminal law provisions and in terms of the perception and content of citizenship rights. EU citizenship law has been distorted and has thus undermined the objectives and effectiveness of EU criminal law, and EU criminal law has been used to undermine longstanding protections under EU citizenship law. In terms of the place of citizenship rights

168 Mancano views this development as enhancing the legitimacy of EU criminal law. See L Mancano, ‘Criminal Conduct and Lack of Integration into the Society under EU Citizenship: This Marriage is Not to Be Performed’ (2015) 6 New Journal of European Criminal Law 53. 169 Azoulai and Coutts (n 152) 564. 170 PI (n 125) para 28. 171 On art 83(1) TFEU as a reflection of ‘securitised criminalisation’, see ch 2.

Conclusion: Towards a Paradigm Change in Citizenship and EU Criminal Law 347 in the development of EU criminal law, both the legislator and the Court of Justice have demonstrated remarkable – and, it has been argued, undue – deference on the choices of EU Member States as to who is deemed to be sufficiently integrated into their territory to be able to remain. The irony here is that this approach is counterproductive to the stated aims of the EU criminal law instruments in question: discriminating between own nationals and citizens of other EU Member States is contrary to a key aim of the European Arrest Warrant system, namely to ensure justice across Europe’s Area of Freedom, Security and Justice regardless of the nationality of the individual affected by the surrender procedure; on the other hand, the removal of the need for consent in the transfer of sentenced persons, even if these individuals are EU citizens with strong integration links to the Member State which wishes to transfer them, is at odds with the stated aims of the instrument to re-integrate and rehabilitate. In both cases, the approach taken by the EU legislature and judiciary undermines key protections under EU citizenship law. The limits of protection offered by EU citizenship are also clear in the case law on the external dimension of EU criminal law in cases involving extradition requests from third states. A combination of sovereignty and uncritical anti-impunity considerations have led to the development of a low threshold of protection of EU citizens, with enforcement interests of third states prioritised, and with the link of protection from extradition within the EU centred around nationality and not citizenship of the EU. Similar deference to Member States’ security perceptions can also be discerned at the level of the use of EU criminal law in the case law on derogations from the EU citizenship Directive. This trend has also been discernible with regard to the role of the use of domestic criminal law and its enforcement in limiting citizenship rights.172 In terms of the impact of EU criminal law on citizenship rights, the Court of Justice seems to accept that criminalisation at the EU level – either by secondary law or by the Treaty itself – is a sufficient ground to justify domestic choices to restrict citizenship rights. National enforcement choices and security perceptions are legitimised by reference to the TEU and, in particular, Article 83(1) TFEU. In this manner, as Nic Shuibhne has noted in relation to PI, ‘the Court converted an exceptional protection against expulsion into a route towards it’.173 This approach not only transforms EU citizenship by altering fundamental presumptions of integration, but also signifies a fundamental change as regards the place of EU criminal law in the EU constitutional order. Post-PI, Article 83(1) TFEU can be seen as not only a conferral provision – namely a provision which serves to determine the extent of EU competence to adopt minimum rules on the definition of criminal offences and the imposition of criminal sanctions – but also, much more broadly, as a provision which treats the conduct enumerated therein

172 See in this context in particular the Court’s ruling in Onuekwere v Secretary of State for the Home Department, which involved the impact of imprisonment on citizenship rights: Case C-378/12, Onuekwere v Secretary of State for the Home Department, EU:C:2014:13, judgment of 16 January 2014; for a comment, see S Coutts, ‘Union Citizenship as Probationary Citizenship: Onuekwere’ (2015) 52 CML Rev 531. 173 N Nic Shuibhne, ‘Limits Rising, Duties Ascending: The Changing Legal Shape of Union Citizenship’ (2015) 52 CML Rev 889, 925.

348 The Uneasy Relationship between EU Criminal Law and Citizenship of the EU as a security issue and thus justifies Member State choices to curtail long-established fundamental rights and freedoms at the EU level. The combination of the two strands of law and policy leads to a vicious circle: by limiting citizenship rights and facilitating expulsion following PI, transfer to another Member States without consent under the Framework Decision on the transfer of prisoners is allowed. This twin-track approach disregards the objectives and internal coherence of both EU criminal law and EU citizenship law and poses significant challenges to the position of the citizen in Europe’s area of criminal justice.

8 Bodies, Offices and Agencies VALSAMIS MITSILEGAS AND FABIO GIUFFRIDA*

I. Introduction European integration in criminal matters has been promoted significantly in recent years by the establishment of a number of EU bodies and organs with responsibilities in the field of criminal law. Some of these bodies (like Europol and Eurojust) have been established by EU legislation under the previous third pillar. Others have been set up in the framework of the then first pillar, either with a hybrid status (OLAF) or with functions not directly relating to criminal law (the European Border and Coast Guard Agency, also known as Frontex). Others, like IntCen and the EU Counter-Terrorism Coordinator, fell mainly under the previous second pillar (the CFSP), but have a much shakier legal basis. Finally, some have been created after the Lisbon Treaty abolished the pillar structure (eu-LISA and the EPPO). This chapter will place the development of these bodies in context and will look in detail at their legal framework and impact on the development of EU powers in criminal matters. In doing so, it will focus extensively on the extent to which EU criminal law bodies challenge state sovereignty in criminal matters. In this context, the tensions between visions of these bodies as centralised EU agencies on the one hand and looser, intergovernmental forms of cooperation on the other are particularly relevant. An examination of the powers of these bodies will be coupled with an analysis of their various accountability mechanisms, as well as of the complex picture of inter-agency cooperation in criminal matters in the EU.1 In doing so, * This chapter was co-authored by Valsamis Mitsilegas and Fabio Giuffrida, except for section II.C, which was co-authored by Valsamis Mitsilegas and Niovi Vavoula, and section V.B.iii.b, which was authored by Valsamis Mitsilegas only. The opinions expressed in this chapter by Fabio Giuffrida are the personal opinions of the author and do not reflect those of the European Commission. 1 There have been various attempts in pinning down the concept of ‘accountability’ in the EU – see in particular C Harlow, Accountability in the European Union (Oxford University Press, 2002); and D Curtin and A Nollkaemper, ‘Conceptualizing Accountability in International and European Law’ (2005) 36 Netherlands Yearbook of International Law 3. With regard to EU agencies, see M Busuioc, European Agencies: Law and Practices of Accountability (Oxford University Press, 2013). Various categorisations of accountability have been put forward, including legal accountability, political accountability, administrative accountability, parliamentary accountability and financial accountability. For the purposes of this chapter, legal accountability will be treated separately under ‘judicial control’ and the term ‘accountability’ will encompass all the other aspects, including democratic control and scrutiny.

350 Bodies, Offices and Agencies the chapter will assess the impact of EU bodies on the development of EU criminal law and the position of the individual in this framework.

II. Europol A. Background The establishment and the gradual enhancement of the European Union Agency for Law Enforcement Cooperation (Europol)2 are emblematic of the development of EU criminal law through the creation of EU structures in the field. In the 1990s, the debate surrounding the role, powers and future of the agency epitomised the tension between a centralising approach viewing Europol as a central, EU police force overseeing national police forces on the one hand, and a more ‘intergovernmental’ approach viewing Europol as a body responsible for the cooperation and coordination between national police forces, with little (if any) ‘operational’ or coercive powers. The former view, supportive of a centralised European police force replacing looser mechanisms of police cooperation in Europe (such as TREVI),3 was strongly put forward in the late 1980s and early 1990s by the then German Chancellor Helmut Kohl, who repeatedly argued in favour of the establishment of a ‘European FBI’.4 This view was put forward forcefully during the negotiations, which led to the adoption of the Maastricht Treaty. Under the headline ‘fight against international drug trafficking and organised crime’, Annex 1 to the Presidency Conclusions emanating from the Luxembourg European Council of 28 and 29 June 1991 called for: Treaty commitment to full establishment of a Central European Criminal Investigation Office (‘Europol’) for these areas by 31.12.1993 at the latest … Gradual development of Europol functions: first of all relay station for exchange of information and experience (up to 31.12.1992), then in the second phase powers to act also within the Member States would be granted. (Emphasis added)5 2 Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L135, 24 May 2016, 53 (hereinafter the ‘Europol Regulation’). 3 TREVI was formally established following a resolution adopted by the EC Ministers of Justice and Home Affairs in 1976. It was not based on any formal Treaty provisions and operated outside the formal Community law framework. It initially consisted of two working groups (on terrorism and public order issues), but expanded in the 1980s to cover organised crime. TREVI – which ceased to exist following the entry into force of the Maastricht Treaty which envisaged more permanent forms of cooperation within the EU framework – has been instrumental in the groundwork for the establishment of Europol. See V Mitsilegas, J Monar and W Rees, The European Union and Internal Security (Palgrave Macmillan, 2003) 23–25; see also J Benyon, ‘The Politics of Police Co-operation in the European Union’ (1996) 24(4) International Journal of the Sociology of Law 353, 362–63. A degree of police cooperation was also achieved by the Schengen Agreement and Convention. On the Schengen framework on police cooperation, see C Fijnaut, ‘The Schengen Treaties and European Police Co-operation’ (1993) 1(1) European Journal of Crime, Criminal Law and Criminal Justice 37; M Daman, ‘Cross-border Hot Pursuit in the EU’ (2008) 16(2) European Journal of Crime, Criminal Law and Criminal Justice 171. 4 For the German proposals, set in the context of the overall German position towards EU policing, see C Fijnaut, ‘The “Communitization” of Police Cooperation in Western Europe’ in HG Schermers (ed), Free Movement of Persons in Europe: Legal Problems and Experiences (Kluwer Academic Publishers, 1993) 75–92. 5 Available at https://ec.europa.eu/commission/presscorner/detail/en/DOC_91_2.

Europol 351 This centralising approach was met with resistance by a number of Member States, including the UK, Denmark, the Netherlands and France.6 National differences on the nature of police cooperation in Europe, in particular with regard to the question of how many and what kind of powers should be given to a new EU body in the field and the closely linked question of the degree of erosion of national sovereignty in the field, gave rise to extensive debate in the negotiations of both the Maastricht Treaty and the Europol Convention itself. The main issues of contention were: the mandate of Europol (which offences would fall within its remit and, in particular, whether terrorism would fall within its remit); its powers (and whether it should have ‘operational’, or ‘coercive’, powers); and its accountability and judicial control (in particular, the role of the Court of Justice in this context).7 The compromise reached in the Maastricht Treaty has been a reference in Article K1 of the then third pillar to ‘the organisation of a Union-wide system of exchanging information within a European Police Office (Europol)’.8 The Maastricht Treaty provided for a legal basis for the negotiations of the Europol Convention, which was eventually signed in 1995.9 However, the Convention only entered into force in 1998, due to the fact that the form of the adopted instrument was a third pillar Convention, requiring ratification by all the (then 15) Member States prior to its entry into force.10 Europol started operations in The Hague in 1999,11 although EU mechanisms of police cooperation were already established prior to the signature of the Europol Convention: a European Drugs Unit (EDU) was set up by Ministerial Agreement in 1993 and was further formalised by a 1995 Joint Action.12 The EDU acted as a precursor to Europol and was envisaged as a ‘non-operational’ team where liaison officers sent by Member States would exchange and analyse information with regard to drug trafficking, trafficking in radioactive and nuclear substances, crimes involving ‘clandestine migration networks’ and illicit vehicle trafficking.13 The Europol Convention had since its signature been amended by a series of legal acts – mostly in the form of Protocols requiring the same ratification process as the 6 For various reactions, see D Bigo, Polices en Réseaux. L’Expérience Européenne (Presses de Sciences Po, 1996), in particular at 210–12; M Anderson et al, Policing the European Union (Clarendon Press, 1995) 81–82; JD Occhipinti, The Politics of EU Police Cooperation.:Toward a European FBI? (Lynne Rienner, 2003) ch 3; and Fijnaut (n 4) 88–91. 7 See Anderson et al (n 6), in particular at 64–67 and 207–09; Bigo (n 6) 208–48; Occhipinti (n 6) 57–59. 8 It has been argued that the name ‘European Police Office’ is both neutral and flexible in allowing the further extension of Europol’s remit (see Anderson et al (n 6) 64, who also point out (at 63) that the Treaty was accompanied by a Political Declaration where Member States expressed their commitment towards exploring ways of, inter alia, coordinating national investigation and search operations, creating new databases and providing a central analytical facility for the planning of criminal investigations). On the flexibility of the ‘Europol’ name, see also M den Boer and W Brüggeman, ‘Shifting Gear: Europol in the Contemporary Policing Era’ (2007) 23 Politique européenne 77, 79. 9 [1995] OJ C316, 27 November, 2. 10 On Conventions as a third pillar legislative instrument, see ch 1. 11 See S Peers, EU Justice and Home Affairs Law, vol II, 4th edn (Oxford University Press, 2016) 325ff; see also House of Lords Select Committee on the European Union, Europol’s Role in Fighting Crime, 5th Report, session 2002–03, HL Paper 43. 12 Joint Action 95/73/JHA, OJ L62, 20 March 1995, 1. For details on the EDU, see FR Monaco, ‘Europol: The Culmination of the European Union’s International Police Cooperation Efforts’ (1995) 19(1) Fordham International Law Journal 247, 277ff. 13 Article 2 of the Joint Action. Its competence was extended in 1996 to cover human trafficking: [1996] OJ L342, 31 December, 4. It has been noted that the EDU’s first and only coordinator was Jürgen Storbeck, who has continued to serve as Director of Europol – Occhipinti (n 6) 51.

352 Bodies, Offices and Agencies ‘mother’ Convention – which clarified and extended Europol’s mandate and tasks. Such legislation included a Protocol on the interpretation of the Europol Convention by way of preliminary rulings by the ECJ;14 Protocols on privileges and immunities;15 a Protocol16 and a number of Council Decisions17 extending Europol’s competence to deal with a number of offences; a Decision designating Europol as the Central Office for combating Euro counterfeiting;18 a Protocol on JITs and the initiation of criminal investigations;19 and a wide-ranging Protocol introducing a number of changes in Europol’s operations (the so-called ‘Danish’ Protocol).20 These measures were supplemented by a series of acts implementing the Europol Convention, some of which referred specifically to Europol’s external action.21 All in all, this presented a mosaic of legal provisions, which incrementally expanded Europol’s mandate and entered into force at different times.22 The completion of the amendments to the Europol Convention and the fact that the last of the Protocols only entered into force in 2007 has not stopped further discussions on the future of Europol which were also prominent in the negotiations leading up to the EU Constitutional Treaty.23 Discussions, which continued notwithstanding the ‘freezing’ of the Constitutional Treaty, focused on two main issues: the change in the legal basis of Europol (with calls to replace the Europol Convention with a more flexible third pillar instrument such as a Decision), and the change in Europol’s mandate and powers (in particular, the question of whether Europol should become more ‘operational’). The 2006 Austrian EU presidency prioritised the debate by organising a High Level Conference on the Future of Europol and by commissioning a ‘Friends of the Presidency’ Working Group to discuss the issue. Both initiatives proposed sweeping changes to the Europol framework. The High Level Conference called for making Europol ‘operational’ and for ways to be found ‘to enable Europol to exchange information also with countries that do not have the same data protection standards as those that are applicable within the European Union’.24 The ‘Friends of the Presidency’ Report went further, in particular as regards the issue of information collection and exchange.25

14 [1996] OJ C299, 9 October, 2. 15 [1997] OJ C221, 19 July, 2; and amending Protocol of 28 November 2002 [2002] OJ C312, 16 December, 2. 16 Protocol of 30 November 2000 amending Article 2 and the Annex to the Europol Convention – extending Europol’s mandate to cover money laundering offences – [2000] OJ C358, 13 December, 1. 17 Human trafficking ([1999] OJ C26, 30 January, 21); terrorism ([1999] OJ C26, 30 January, 22); forgery of money and means of payment ([1999] OJ C149, 28 May, 16); and a Council Decision authorising Europol to deal with the forms of serious crime listed in the Annex of the Europol Convention ([2001] OJ C362, 18 December, 1). 18 [2005] OJ L185, 16 July, 35. 19 [2002] OJ C312, 16 December, 2 (the same as the amending immunities Protocol). 20 [2004] OJ C2, 6 January, 3. 21 For details, see below. 22 See den Boer and Brüggeman (n 8) 80–81. 23 See the Final Report of Working Group X on ‘Freedom, Security and Justice’, CONV 426/02, WG X 14, Brussels, 2 December 2002, 18; see also art III-276 of the Constitutional Treaty. 24 Chairman’s Summary of the High Level Conference on the Future of Europol (23 and 24 February 2006), Council Doc 7868/06, Brussels, 29 March 2006, 3. 25 Austrian Presidency of the European Union, Future of Europol. Options Paper reflecting the outcome of the discussion on the future of Europol held during the Austrian Presidency, May 2006, Council Doc 9184/1/06 REV 1, Brussels, 19 May 2006. See also V Mitsilegas, ‘Databases in the Area of Freedom, Security and Justice’ in C Stefanou and H Xanthaki (eds), Towards a European Criminal Record (Cambridge University Press, 2008) 311–35.

Europol 353 Taking note of this Report, the Justice and Home Affairs Council at the end of the Austrian EU presidency adopted a series of conclusions sketching out a number of options on the future of Europol.26 These were followed by further conclusions at the end of 2006, whereby the Council agreed that the Europol Convention should be replaced by a Council Decision.27 A few days later, the Commission tabled a draft Decision to this effect.28 Negotiations began under the German EU presidency in the first half of 2007. These proceeded relatively quickly for such a complex instrument, but the ‘urgent’ aim of reaching agreement by the end of the German presidency was not achieved.29 Member States gradually reached ‘general approaches’ on parts of the proposal on a chapter-by-chapter basis, and proclaimed the aim to reach political agreement by June 2008 at the latest.30 This deadline was of political significance at the time, as it would pre-empt the prospective entry into force of the Lisbon Treaty (then expected in January 2009 prior to the Irish ‘no’ vote), which would grant the European Parliament co-decision powers with regard to legislation relating to Europol. With this in mind, the European Parliament in its Opinion on the Commission’s proposal under the consultation procedure amended the proposal to allow the revision of the Europol Decision within a period of six months following the entry into force of the Lisbon Treaty.31 However, this amendment was not taken up by Member States, which reached ‘political agreement’ – notwithstanding a number of difficult issues in negotiations32 – on the text at the Luxembourg April 2008 Justice and Home Affairs Council.33 Formally adopted in April 2009,34 the Europol Council Decision entered into force on 1 January 201035 and was then supplemented by four Council Decisions.36 26 Justice and Home Affairs Council of 1–2 June 2006, Doc 9409/06 (Presse 144), 22–23. 27 Justice and Home Affairs Council of 4–5 December 2006, Doc 15801/06 (Presse 341), 20–21. After the entry into force of the Amsterdam Treaty, the Council had been granted the power, acting unanimously on the initiative of any Member State or the Commission, to adopt decisions for the purposes of enhancing judicial and police cooperation, yet excluding any approximation of the laws and regulations of the Member States (art 34(2)(c) TEU). 28 ‘Proposal for a Council Decision establishing the European Police Office (EUROPOL)’ COM (2006) 817 final, Brussels, 20 December 2006. See also Mitsilegas (n 25). 29 See also D Kietz and V Perthes (eds), The Potential of the Council Presidency: An Analysis of Germany’s Chairmanship of the EU, 2007, SWP Research Paper 1, January 2008, Berlin, https://www.swp-berlin.org/en/ publication/the-potential-of-the-eu-council-presidency. 30 See the Conclusions of the Justice and Home Affairs Council of 12–13 June 2007, Council Doc 10267/07 (Presse 125), where it was stated that the Europol Decision would be finalised by 30 June 2008 at the latest (at 10). 31 T6-0015/2008, 17 January 2008. 32 In this context, see the evidence of the Home Office Minister of State Tony McNulty to the House of Commons Select Committee on European Scrutiny, 16 January 2008, HC 247-i (25 February 2008), Q8 in particular. 33 Conclusions of Justice and Home Affairs Council of 18 April 2008, Council Doc 8397/08 (Presse 96), 13. 34 Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol) [2009] OJ L121, 15 May (hereinafter the ‘Europol Council Decision’) 37. See A de Moor and G Vermeulen, ‘The Europol Council Decision: Transforming Europol into an Agency of the European Union’ (2010) 47(4) CML Rev 1089; E Disley et al, ‘Evaluation of the Implementation of the Europol Council Decision and of Europol’s Activities’, Report for Europol Management Board, Rand Europe, 2012, https://www.europol.europa.eu/publications-documents/ evaluation-of-implementation-of-europol-council-decision-and-of-europol%E2%80%99s-activities-2. 35 Article 64(2) of the Europol Council Decision. 36 Council Decision 2009/934/JHA of 30 November 2009 adopting the implementing rules governing Europol’s relations with partners, including the exchange of personal data and classified information [2009] OJ L325, 11 December, 6; Council Decision 2009/935/JHA of 30 November 2009 determining the list of

354 Bodies, Offices and Agencies Along with the change in the legal instrument of Europol from a Convention to a Decision, which the Commission had justified as ‘relatively easy to adapt to changing circumstances because it does not require ratification’,37 the Europol Council Decision introduced a number of changes in the organisation’s mandate and powers.38 These included the partial ‘communautarisation’ of Europol by inter alia funding it from the EU budget (and not by Member States)39 and by establishing it as an ‘entity of the European Union’,40 the broadening of its mandate to cover a wide range of forms of criminality,41 and the extension of Europol’s powers with regard to data collection and processing.42 In line with the Stockholm Programme’s emphasis on the enhancement of European law enforcement cooperation,43 the entry into force of the Lisbon Treaty triggered new debates on the reinforcement of Europol, which gained momentum after the escalation of terrorist attacks in Europe in mid-2010s. In accordance with Article 88 TFEU, which replicates almost verbatim the wording of Article III-276 of the Constitutional Treaty, the European Parliament and the Council should determine Europol’s structure, operation, field of action and tasks by means of regulations adopted in accordance with the ordinary legislative procedure.44 The Commission tabled the proposal for a new Regulation on Europol in April 201345 in order to achieve the following aims:46 (i) aligning Europol with the requirements of the Lisbon Treaty, especially with regard to its accountability to the European and national parliaments; (ii) enhancing the agency’s role in the exchange of information according to the goals of Stockholm Programme;47 (iii) reinforcing Europol’s support to national authorities by also merging the agency with the European Union Agency for Law Enforcement Training (CEPOL) and enabling it to develop EU centres of specialised expertise for combating certain types of crime;48 third states and organisations with which Europol shall conclude agreements [2009] OJ L325, 11 December, 12; Council Decision 2009/936/JHA of 30 November 2009 adopting the implementing rules for Europol analysis work files [2009] OJ L325, 11 December, 14; Council Decision 2009/968/JHA of 30 November 2009 adopting the rules on the confidentiality of Europol information [2009] OJ L332, 17 December, 17. 37 ‘Proposal for a Council Decision establishing the European Police Office (EUROPOL)’ (n 28) 2. See de Moor and Vermeulen (n 34) 1092–97. 38 For an overview, see Disley et al (n 34) 5. 39 Europol Council Decision, art 42. 40 ibid Recital 3. The Commission’s proposals talked about establishing Europol as an ‘agency of the Union’. This wording has not been replicated in the agreed text, with the body of the Decision merely referring to the establishment of a ‘European Police Office’ (art 1). Although Europol has formally become an ‘agency’ only following the 2016 Regulation, its website claims that it ‘has been an EU agency since 2010’ (https://www. europol.europa.eu/about-europol/governance-accountability), ie, since the entry into force of the Europol Council Decision (1 January 2010). See also Disley et al ((n 34) 39) on the ‘symbolic value of being an entity of the European Union’; Busuioc (n 1) 21–22. 41 Europol Council Decision, art 4. 42 ibid arts 22ff. 43 The Stockholm Programme. An open and secure Europe serving and protecting citizens [2010] OJ C115, 4 May, 1 at 20ff. 44 TFEU, art 88(2). 45 ‘Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA’ COM (2013) 173 final, Brussels, 27 March 2013. 46 ibid 6. 47 ‘Europol should become a hub for information exchange between the law enforcement authorities of the Member States’ (The Stockholm Programme (n 43) 20). 48 For a few remarks on CEPOL, see section VI below on other bodies and agencies.

Europol 355 (iv) ensuring a better data protection regime; and (v) improving the governance of the agency, in line with the Common Approach on EU decentralised agencies adopted by the Council, the Parliament and the Commission in 2012.49 Acting on an equal footing with the Council within the ordinary legislative procedure, the European Parliament suggested several amendments to the text.50 In addition to the almost unanimous rejection of the merger of Europol and CEPOL,51 which was dropped during the negotiations, the European Parliament’s approach was inspired by a strong commitment to ensuring the highest protection possible to the fundamental rights of individuals and enhancing the agency’s overall accountability.52 The Member States agreed with the suggested establishment of the Joint Parliamentary Scrutiny Group,53 but did not endorse a number of the other amendments by the European Parliament.54 They also watered down some provisions of the original Commission’s proposal which aimed to loosen the Member States’ control on Europol’s functioning and composition.55 The Parliament and the Council finally adopted the Regulation in May 2016.

B. The Europol Regulation i. Overview The Regulation became applicable on 1 May 2017 and repeals and replaces the previous Council Decisions.56 Denmark does not take part in it,57 in accordance with Protocol 22 to the Lisbon Treaty. However, in February 2017, the Council added Denmark to the 49 For the Common Approach, see Council Doc 11450/12, Brussels, 18 June 2012. 50 In its position at first reading, the Parliament tabled more than 220 amendments to the Commission’s proposal (see ‘European Parliament legislative resolution of 25 February 2014 on the proposal for a regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA (COM(2013)0173 – C7-0094/2013 – 2013/0091(COD))’, P7_TA(2014)0121). For an overview of the negotiations, see S Peers, ‘The Reform of Europol: Modern EU Agency, or Intergovernmental Dinosaur?’ EU Law Analysis (18 June 2014) http://eulawanalysis.blogspot.com/2014/06/the-reform-of-europol-modern-eu-agency.html. 51 However, at least one political group of the European Parliament (ALDE) was of the view that the merger of the two agencies would be ‘a good occasion to save money’ (Outcome of the European Parliament’s first reading (Strasbourg, 24 to 27 February 2014), Council Doc 6745/1/14, Brussels, 20 March 2014, 4). According to the Common Approach on EU decentralised agencies, the merger of agencies should be considered when ‘their respective tasks are overlapping, where synergies can be contemplated or when agencies would be more efficient if inserted in a bigger structure’ – (Council Doc 11450/12 (n 49) 5). 52 The European Parliament, inter alia, suggested that the request of access to personal data should be free of charge (amendments 165 and 234 of the European Parliament, ‘European Parliament legislative resolution of 25 February 2014’ (n 50), 78), but this amendment was not taken up by the Member States and the Regulation now provides that the interested person shall not incur ‘excessive costs’ (art 36(3) of the Europol Regulation) when they exercise their right to access. 53 See section II.B.viii below. 54 For instance, the final text has not endorsed the European Parliament’s amendment to carry out a Data Protection impact assessment ‘prior to any set of processing of personal data’ (amendment 130 of the European Parliament, ‘European Parliament legislative resolution of 25 February 2014’ (n 50) 60–61). 55 See section II.B.ii below on the different views of EU institutions on the appointment of the Executive Director of Europol. 56 Respectively arts 77 and 75 of the Europol Regulation. 57 Recital 74 of the Europol Regulation. On Denmark’s opt-out from EU policies concerning the AFSJ, see ch 1.

356 Bodies, Offices and Agencies list of third states and organisations with which Europol should conclude agreements,58 and an Agreement was later signed in April 2017, that is, a few days before the Regulation took effect.59 The Agreement aims to ensure that the non-participation of Denmark in the Regulation does not impair a smooth coordination – and especially the flow of information – between this country and Europol. The Agreement also provides that up to eight Danish-speaking Europol staff will be assigned on a 24/7 basis to the task of processing Danish requests.60 In short, Denmark retains ‘a unique status’ which allows for ‘much closer ties with Europol without amounting to full membership’.61 In the Brexit negotiations, it was debated whether this Agreement could represent a valuable precedent to regulate the future UK’s relations with Europol, after the UK’s procedure of exiting the EU was completed. However, as acknowledged in the joint declaration of the Danish Prime Minister and the Presidents of the Commission and the European Council, the Agreement is ‘Denmark-specific’,62 since Denmark is still an EU Member State, which applies the EU regime on data protection, and is subject both to the jurisdiction of the Court of Justice and to the competence of the European Data Protection Supervisor (EDPS).63 The outcome of the EU–UK negotiations as regards the future status of the UK vis-a-vis the EU will thus determine whether a bespoke agreement similar to the Danish one would be feasible.64 Like Ireland,65 the UK was bound by the Europol Regulation as long as it was part of the EU,66 although it initially decided not to opt into this instrument. The UK government indicated its wish to take part in the Regulation, in accordance with Article 4 of

58 Council Implementing Decision (EU) 2017/290 of 17 February 2017 amending Decision 2009/935/JHA as regards the list of third states and organisations with which Europol shall conclude agreements [2017] OJ L42, 18 February, 17. In accordance with art 23(2) of the Europol Council Decision, Europol could conclude agreements with third states that had been included in an ad hoc list prepared by the Europol Management Board and adopted by the Council (art 26(1)(a) of the Europol Council Decision). Listing Denmark – which is an EU Member State – among the ‘third countries’ is at least contentious, yet the C ouncil adopted a strict interpretation of the latter notion, regarding Denmark ‘as a third country with respect to Europol’ (Council Implementing Decision (EU) 2017/290). See the summary and conclusions of the European Scrutiny Committee of the House of Commons, 22 February 2017, https://publications.parliament. uk/pa/cm201617/cmselect/cmeuleg/71-xxx/7119.htm, para 16. 59 ‘Agreement on Operational and Strategic Cooperation between the Kingdom of Denmark and the European Police Office’, 29 April 2017. 60 ibid art 10(6). 61 Statement of Dimitris Avramopoulos (Commissioner for Migration, Home Affairs and Citizenship) and Julian King (Commissioner for the Security Union), 29 April 2017, https://ec.europa.eu/commission/ presscorner/detail/en/STATEMENT_17_1169. 62 Declaration by the President of the European Commission, Jean-Claude Juncker, the President of the European Council, Donald Tusk and the Prime Minister of Denmark, Lars Løkke Rasmussen, Brussels, 15 December 2016, https://ec.europa.eu/commission/presscorner/detail/en/IP_16_4398. 63 For further remarks on the role of the Court of Justice and the data protection regime in the scenario where the UK leaves the EU and wishes to join Europol, or at least have a bespoke agreement with it, see House of Lords European Union Committee, Brexit: Future UK-EU Security and Police Cooperation, 7th Report, session 2016–17, HL Paper 77, 17–21. 64 S Carrera et al, ‘Criminal Justice and Police Cooperation between the EU and the UK after Brexit: Towards a Principled and Trust-Based Partnership’, Report of a CEPS & QMUL Task Force, 2018, https://www.ceps.eu/ ceps-publications/criminal-justice-and-police-cooperation-between-eu-and-uk-after-brexit-towards, 103–06. 65 Recital 72 of the Europol Regulation. 66 Despite the opt-out from a number of instruments concerning EU criminal law, the UK had already re-opted in to the Europol Council Decision in 2014 (Council Doc 15398/14, Brussels, 27 November 2014). For more on this, see ch 12.

Europol 357 Protocol 21 to the Lisbon Treaty, only in December 2016.67 The Commission formally confirmed the participation of the UK in March 2017.68 The UK has been instrumental in exporting parts of its model of intelligence-led policing into Europol and its absence as a full member from the organisation would be felt not only within Europol, but also in terms of the UK security landscape.69 Moreover, the UK is one of the highest contributors to EU security cooperation as regards contributions to Europol and its databases.70

ii. Europol’s Organisation and Structure Europol has legal personality and enjoys legal and contractual capacity in each Member State.71 Its main organs are the Management Board and the Executive Director.72 A striking ‘intergovernmental’ feature of Europol is that its Management Board is composed of one representative per Member State (each having one vote). Reflecting a trend towards the ‘communautarisation’ of the agency, the Europol Council Decision had partially mitigated this legacy of the Europol Convention: like that Decision, the Europol Regulation also provides that one representative of the Commission, with voting right, sits on the Management Board.73 In line with the Common Approach on EU decentralised agencies, the Commission’s proposal for a Europol Regulation suggested doubling the number of the representatives of the Commission,74 but this met with resistance from both the European Parliament and the Council. The Commission’s proposal also provided that the Management Board could establish, if appropriate, an Executive Board,75 with the aim of streamlining the agency’s decisionmaking process and allowing the Management Board to focus on strategic rather than administrative matters.76 The rules on the Executive Board were not endorsed by the

67 The European Union Committee of the House of Lords supported the opt-in to the Europol Regulation not only because of its practical consequences for security issues, but also because of its political salience in the framework of the ongoing Brexit negotiations: ‘the UK’s forthcoming exit from the EU means there is now an additional, strategic value in remaining a full member of Europol and its Management Board during a period when the modalities of the UK’s future partnership with the EU on police and security matters are under negotiation’ (House of Lords European Union Committee (n 63) 17). See also Carrera et al (n 64) 93–97. 68 [2017] OJ L59, 7 March, 39. 69 See in this context the warning of Rob Wainwright, former Director of Europol, on the adverse security consequences of Brexit for the UK: ‘Brexit Would Bring Serious Security Consequences – Europol Head’, https://www.reuters.com/article/uk-britain-eu-europol-idUKKCN0XG16B?edition-redirect=uk. 70 ‘The UK uses Europol more than almost any other country’ (HM Government, ‘The UK’s Cooperation with the EU on Justice and Home Affairs, and on Foreign Policy and Security Issues’, background note, 2016, https://www.gov.uk/government/publications/the-uks-cooperation-with-the-eu-on-justice-home-affairsforeign-policy-and-security-issues-background-note, 4). See V Mitsilegas, ‘European Criminal Law after Brexit’ (2017) 28(2) Criminal Law Forum 219, 240. 71 Article 62 of the Europol Regulation (paras 1 and 2 respectively). 72 ibid art 9. 73 ibid art 10(1), which replicates the wording of art 37(1) of the Europol Council Decision. Pursuant to art 28(4) of the Europol Convention, the Commission could only be invited – without having voting rights – at the discretion of the Management Board. 74 Article 13(1) of the Commission’s proposal for a Regulation on Europol. See point 10 of the Common Approach on EU decentralised agencies, n 49 above, 7. 75 See Arts 12(e), 21 and 22 of the Commission’s proposal for a Regulation on Europol, which take on board the suggestions in Council Doc 11450/12 (n 49) 7. 76 See Disley et al (n 34) 139–40.

358 Bodies, Offices and Agencies Council and the European Parliament, since they would arguably downscale the agency’s intergovernmental nature and loosen the control of Member States on its functioning. Nonetheless, the Regulation is a step forward in the direction of (partially) enhancing the ‘communautarisation’ of Europol, since it introduces the rule that the Management Board takes most – but not all – of its decisions by a majority of its members.77 The Board is responsible for a wide range of matters concerning the functioning of Europol, such as the adoption of the (annual and multi-annual) working programmes, the annual budget, the annual activity report, the internal anti-fraud strategy and the like.78 As already envisaged by the Europol Council Decision, it also proposes to the Council a shortlist of candidates for the posts of Executive Director and Deputy Executive Directors,79 who are eventually appointed by the Council.80 This was a sticking point during the negotiations of the Regulation, as the Commission called for the appointment of the Executive Director to be made by the Management Board from a list of candidates proposed by the Commission itself.81 The option upon which the European Parliament and the Council eventually agreed instead reflects the still predominant intergovernmental nature of the agency.82 The Director – who is appointed for a oncerenewable four-year term83 – is Europol’s legal representative, manages Europol and is responsible for the day-to-day administration of the agency.84 The relationship between Europol and Member States takes place in two ways: via the Europol national units and via the liaison officers posted at Europol. The role of national units was central in the Europol Convention, its opening Article specifying that Europol liaises ‘with a single national unit in each Member State’.85 The centrality of the national unit was also stressed in Article 4 of the Convention, which stated that the national unit is ‘the only liaison body between Europol and the competent national authorities’ (emphasis added).86 This could be seen as a safeguard for national sovereignty, limiting Europol’s involvement in domestic police systems. However, this centrality of the national unit had been seriously undermined by the 2003 ‘Danish’ Protocol.87 The latter amended the Europol Convention by adding that Member States ‘may allow direct contacts between designated competent authorities and Europol’ (emphasis added).88 This provision significantly altered the relationship between Europol and the national 77 Article 15(1) of the Europol Regulation. Under the Europol Convention, most of the decisions of the Management Board had to be taken by unanimity, whereas art 37(8) of the Europol Council Decision lowered the quorum to two thirds. 78 Respectively art 11(1)(a), (b), (c) and (e) of the Europol Regulation. The most sensitive decisions, such as the working programmes and the budget, shall be adopted with a majority of two-thirds of the members of the Board. 79 ibid art 11(1)(j). 80 ibid arts 54 and 55. 81 Article 56(2) of the Commission’s proposal for a Regulation on Europol. 82 Already under art 29 of the Europol Convention, the Council – acting by unanimity – was entrusted with the appointment of the Executive Director. The Management Board was required to give a mere opinion to the Council. 83 Article 54(3)–(6) of the Europol Regulation. Europol’s Directors thus far have been Jürgen Storbeck, Max-Peter Ratzel (both from Germany), Rob Wainwright (the UK) and Catherine de Bolle (Belgium). 84 ibid art 16(4) and (1) respectively. The Director’s responsibilities are listed in art 16(5). 85 Art 1(2) of the Europol Convention. 86 ibid art 4(2). 87 See n 20 above. 88 Amended art 4(2) of the Europol Convention. See also art 8(2) of the Europol Council Decision.

Europol 359 law enforcement systems, as it allowed a system of decentralised cooperation between Europol and the national authorities. This scenario where national units have a primary role, while direct contacts between Europol and national authorities are exceptional, has not changed following the Europol Council Decision and the Regulation. Whereas in the proposal for a Regulation on Europol, the Commission had suggested streamlining the direct interactions between the agency and national authorities,89 the final text does not depart from the status quo. The national unit is still defined as the ‘liaison body’ between Europol and domestic competent authorities,90 while Member States may allow direct contacts ‘subject to conditions determined by the Member States, including prior involvement of the national unit’.91 The attempt to broaden Europol’s interlocutors in Member States relates to calls to increase the flow of information from the national level to Europol and vice versa. This aspect of cooperation between national units and Europol is perceived to be central to the effectiveness of Europol, and the involvement of a greater number of national authorities may be deemed as a step towards maximising such cooperation. One of the main tasks of national units as outlined in the Regulation is to supply Europol with the information necessary for the agency to fulfil its objectives.92 However, the identical provision of the Europol Council Decision had been largely disregarded in practice, since police authorities are often reported to be reluctant to share their data with Europol.93 This is arguably the problem par excellence of police (and judicial) cooperation in the EU, and national authorities are often urged to share their information with EU agencies on a more regular basis. It is worth noting that the Regulation also tasks the national units with raising ‘awareness of Europol’s activities’,94 with the aim of increasing the knowledge of Europol among national authorities and, as a (potential) consequence, the amount of information shared by them with the agency.95 However, the Regulation, like the Europol Council Decision, provides that Member States cannot be obliged to supply information if that would: (i) be contrary to the essential interests of the security of the state concerned; (ii) jeopardise the success of ongoing investigations or the safety of a person; or (iii) disclose information relating to organisations or specific intelligence activities in the field of national security.96 89 ‘Europol may directly cooperate with competent authorities of the Member States in respect of individual investigations. In that case, Europol shall inform the National Unit without delay and provide a copy of any information exchanged in the course of direct contacts between Europol and the respective competent authorities’ (art 7(4) of the Commission’s proposal for a Regulation on Europol, emphasis added). 90 Article 7(2) of the Europol Regulation. 91 ibid art 7(5). 92 ibid art 7(6)(a). 93 See M Fletcher, R Lööf and B Gilmore, EU Criminal Law and Justice (Edward Elgar, 2008) 91; M G roenleer, The Autonomy of the European Union Agencies: A Comparative Study of Institutional Development (Eburon, 2009) 296ff; de Moor and Vermeulen (n 34) 1099; Disley et al (n 34) 47–65; Busuioc (n 1) 146–50; S Gless, ‘Europol’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on EU Criminal Law (Edward Elgar, 2016) 457–79, at 459; C Cocq and F Galli, ‘The Evolving Role of Europol in the Fight against Serious Crime: Current Challenges and Future Prospects’ in S Hufnagel and C McCartney (eds), Trust in International Police and Justice Cooperation (Hart Publishing, 2017) 125–48. 94 Article 7(6)(c) of the Europol Regulation. 95 See also Disley et al (n 34) 55–56. 96 Article 7(7) of the Europol Regulation. See art 8(5) of the Europol Council Decision.

360 Bodies, Offices and Agencies In order to improve the exchange of information between the agency and the Member States, the proposal of the Commission for a Europol Regulation did not envisage any similar provision; the suggested removal of this rule from the Europol Regulation was one of the main concerns that justified the initial non-participation of the UK in the Regulation.97 With the aim of maximising the cooperation between the agency and national authorities, the Regulation also calls on the heads of the Europol national units (HENUs) to meet ‘on a regular basis’, in particular ‘to discuss and resolve problems that occur in the context of their operational cooperation with Europol’.98 This role of the HENUs was first introduced by the Danish Protocol. The other side of Europol’s relationship with national authorities is the secondment of national liaison officers to Europol (Europol Liaison Officers (ELOs)) – each national unit must send at least one such officer to The Hague.99 In a noteworthy provision, stressing – at least on paper – the centrality of Member States and replicating the words of the Europol Convention, the Regulation states that liaison officers, who constitute the national liaison bureaux at Europol,100 are instructed by their national units ‘to represent the interests of the latter within Europol in accordance with the national law of the designating Member State and the provisions applicable to the administration of Europol’ (emphasis added).101 Liaison officers have the task of assisting in the exchange of information between their Member States and Europol, as well as between their Member States and the liaison officers of other Member States, third countries and international organisations.102 The presence of liaison officers at The Hague not only represents a socialisation process of police officers from the different Member States towards a framework of European policing,103 but may also constitute in practice a considerable pool of information exchange and analysis on the basis of informal relations.104

iii. Europol’s Objectives and Mandate It is noteworthy that, in the Europol Regulation, Europol’s objective is inextricably linked to its mandate (namely the offences for which it is competent to act). Article 3(1) of the Regulation reads as follows: Europol shall support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting 97 House of Commons European Scrutiny Committee, Europol: Opt-in Debate, 21st Report, session 2016–17, HC 71-xix, 9–12. 98 Article 7(9) of the Europol Regulation. 99 ibid art 8(1). See also the Act of the Europol Management Board concerning the rights and obligations of liaison officers [1999] OJ C26, 30 January, 86, later replaced by the Decision of the Management Board of Europol concerning the rights and obligations of liaison officers seconded to Europol, 2009, https://www. europol.europa.eu/publications-documents/public-decision-of-management-board-of-europol-concerningrights-and-obligations-of-liaison-officers-seconded-to-europol. 100 Article 8(2) of the Europol Regulation. 101 ibid. 102 ibid art 8(3) and (4) respectively. 103 See also Groenleer (n 93) 293–94. 104 On informality in the work of Europol but also its relationship with other EU bodies, see D Bigo et al, The Field of the EU Internal Security Agencies (L’Harmattan/Centre d’études sur les conflits, 2007), in particular at 29.

Europol 361 two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy, as listed in Annex I.

Article 3(2) extends Europol’s remit to relating criminal offences, ie, offences committed in order to facilitate or perpetrate – or procure the means of perpetrating – acts in respect of which Europol is competent, as well as to ensure the impunity of persons committing those same acts. The determination of Europol’s mandate has been a gradual process of extension and lies at the heart of the discussion on what Europol should really be about. In addition to the involvement of two or more Member States, the Convention originally mentioned ‘terrorism, unlawful drug trafficking and other serious forms of international crime’ and required the existence of ‘factual indications that an organized criminal structure [was] involved’ (emphasis added)105 (notwithstanding the fact that the legal definition of organised crime in EU law was not conducive to legal certainty).106 The Danish Protocol loosened the last criterion, extending Europol’s mandate to those instances where there were merely ‘reasonable grounds to believe’107 that an organised criminal structure was involved. The Europol Council Decision also deleted the requirement of ‘factual indications or reasonable grounds’ and stated that Europol was competent for ‘organised crime, terrorism and other forms of serious crime listed in the Annex’ and affecting two or more Member States.108 However, the most significant change was the extension of Europol’s competence from serious cross-border organised crime to serious cross-border crime. This means that indications that organised crime was involved were no longer necessary to trigger Europol’s competence.109 During the negotiations of the Council Decision, the Commission suggested deleting the reference to cross-border crime. This caused concerns in the Member States, which approached this proposal as signifying a shift of focus for Europol from crossborder crime to purely domestic criminal investigations.110 Such concerns resulted in the retention of the wording of the Europol Convention with regard to the requirement for offences to constitute cross-border serious crime in order to fall within Europol’s mandate. As mentioned above, the Europol Regulation keeps this requirement, but has moved ‘organised crime’ from the text of the Regulation to the Annex, which lists the forms of crime falling within the competence of Europol. The Annex to the Regulation is largely similar to that attached to the previous Council Decision and only a handful of offences have been added.111 Although the definitions of some forms of crime listed in 105 Article 2(1) of the Europol Convention. 106 See ch 2, section IX A. See also the remarks immediately below in the text. 107 Amended art 2(1) of the Europol Convention. 108 The Annex to the Council Decision aligned the list of offences for which Europol was competent with the list of offences for which dual criminality had been abolished under the European Arrest Warrant (see ch 4). 109 See also de Moor and Vermeulen (n 34) 1097. 110 Tony McNulty, Minister of State for the Home Office, to Lord Grenfell, Chairman of the House of Lords European Union Committee, 7 November 2007, noting that the re-insertion of the criterion of cross-border crime requiring a common approach was introduced by the UK to ‘prevent any possibility of Europol becoming involved in purely national criminal investigations’. 111 Namely, aggravated theft, insider dealing and financial market manipulation, ship-source pollution, sexual abuse and sexual exploitation (including child abuse material and solicitation of children for sexual purposes), genocide, crimes against humanity and war crimes.

362 Bodies, Offices and Agencies the Annex have been harmonised at the European level, they still vary from country to country. This could represent an obstacle for the effective functioning of Europol since ‘the mandate of Europol is interpreted in different ways throughout the EU’.112 The definition of ‘organised crime’ is a case in point. Joint Action 98/733/JHA first dealt with the crime of participating in a criminal organisation113 and was later repealed by Council Framework Decision 2008/841/JHA.114 Yet, none of these instruments managed to introduce a satisfactory degree of harmonisation across the Member States.115 Whereas practitioners are reported to appreciate ‘vague definitions that provide different options’,116 the lack of a clear definition could create some ‘uncertainty over [the] competence [of Europol] to be involved in investigations’ (emphasis added).117 In the past, another debated subject was the inclusion of fraud in Europol’s mandate, which raised the issue of the reach of Europol into the domestic administrative systems. This was addressed by a Declaration attached to the Danish Protocol limiting Europol’s competence in the field.118 This also inevitably raised the issue of overlap between Europol and OLAF, whose primary purpose is the investigation of fraud against the EU budget.119 The issue of overlap, and a certain competition between the two bodies, could already be discerned when Europol was designated as the Central Office for combating euro counterfeiting.120

iv. Europol’s Tasks a. Overview The tasks of Europol are outlined in Article 4 of the Regulation. Unlike the Convention and the Council Decision, the Regulation does not distinguish among ‘principal’, ‘additional’ and further supporting actions of the agency.121 Nonetheless, the numerous tasks listed in Article 4 can be divided into three broad categories for the sake of the analysis: information-related tasks; operational tasks; and tasks relating to training, knowledge and expertise. 112 De Moor and Vermeulen (n 34) 1098. 113 [1998] OJ L351, 29 December, 1. 114 [2008] OJ L300, 11 November, 42. 115 See V Mitsilegas, ‘The Council Framework Decision on the Fight against Organised Crime: What Can Be Done to Strengthen EU Legislation in the Field?’, Note for the European Parliament, 2011; S Hufnagel, ‘Organized Crime’ in Mitsilegas, Bergström and Konstadinides (n 93) 355–75; ‘Report from the Commission to the European Parliament and the Council based on Article 10 of Council Framework Decision 2008/841/JHA of 24 October 2008 on the fight against organised crime’ COM (2016) 448 final, Brussels, 7 July 2016, 10. 116 Hufnagel (n 115) 363. 117 ibid. With regard to other forms of crime, see also Disley et al (n 34) 71: ‘there was extensive discussion (lasting months) as to whether Europol was competent to work on the riots which surrounded the G8 and G20 meetings, due to different definitions of terrorism and extremism’ (emphasis added). This problem arises with regard to Eurojust’s competence as well (see section III.B.iii below). 118 [2004] OJ C2, 6 January, 2. 119 On OLAF, see section IV below. On the challenges surrounding the relationship between Europol and OLAF under the previous legal regime of Europol, see C Fijnaut, ‘Police Co-operation and the Area of Freedom, Security and Justice’ in N Walker (ed), Europe’s Area of Freedom, Security and Justice (Oxford University Press, 2004), 241–82 at 264–65; de Moor and Vermeulen (n 34) 1111. 120 See art 4(4) of the Europol Regulation. On the tensions between Europol and OLAF in this context, see House of Lords Select Committee on the European Union (n 11) paras 27–29. 121 See art 5 of the Europol Council Decision and art 3 of the Europol Convention.

Europol 363 1. Information-Related Tasks: Information Exchange and Analysis The first of Europol’s tasks mentioned in Article 4 is to ‘collect, store, process, analyse and exchange information, including criminal intelligence’ (emphasis added).122 Information-related tasks are central to the existence of Europol, which has been defined as an ‘enormous data processing agency rather than a law enforcing police office’.123 The range of data processed by Europol has increased over time. In particular, a provision of the Europol Council Decision substantially extended Europol’s powers by allowing the agency – within some limits – to deal with information provided by private parties and persons, including private parties established in third states.124 The agency has a primary role in facilitating the information exchange among national authorities, and between them and other relevant actors – including Europol itself. The following tasks should be mentioned in this context: (i) ‘support Member States’ cross-border information exchange activities, operations and investigations, as well as JITs’;125 (ii) ‘cooperate with the Union bodies established on the basis of Title V of the TFEU [ie, the Title concerning the AFSJ] and with OLAF, in particular through exchanges of information and by providing them with analytical support in the areas that fall within their competence’;126 (iii) ‘provide information and support to EU crisis management structures and missions established on the basis of the TEU, within the scope of Europol’s objectives’;127 and (iv) ‘provide information and analytical support to Member States in connection with major international events’,128 such as sporting events. Europol is also responsible for the management of the Secure Information Exchange Network Application (SIENA), an online platform that aims to facilitate the exchange of information among Member States, EU bodies (including Europol), third countries and international organisations.129 Empirical research has demonstrated that national authorities highly value the exchange of information through SIENA,130 not least because they are also allowed to exchange data concerning offences falling beyond the mandate of Europol.131 However, this flow of information on crimes in respect of which Europol is not competent is not subject to the application of the agency’s regime on data protection.132

122 Article 4(1)(a) of the Europol Regulation. 123 Gless (n 93) 465. 124 Article 25 of the Europol Council Decision and arts 26 and 27 of the Europol Regulation. See sections II.B.v, II.B.vi and II.B.ix below. 125 Article 4(1)(h) of the Europol Regulation. 126 ibid art 4(1)(j). 127 ibid art 4(1)(k). 128 ibid art 4(1)(e). 129 Recital 24 of the Europol Regulation. See Disley et al (n 34) 78. 130 Disley et al (n 34) 36. 131 ibid 61. With the entry into force of the Europol Council Decision, the liaison officers had been tasked with assisting ‘in the exchange of information from their national units with the liaison officers of other Member States. Such bilateral exchanges may also cover crimes outwith the competence of Europol, as far as allowed by national law’ (art 9(3)(d) of the Europol Council Decision, emphasis added). This provision has now become art 8(4) of the Europol Regulation. 132 E Guild et al, ‘Implementation of the EU Charter of Fundamental Rights and its Impact on EU Home Affairs Agencies. Frontex, Europol and the European Asylum Support Office’, Study for the Civil Liberties, Justice and Home Affairs (LIBE) Committee of the European Parliament, 2011, 70.

364 Bodies, Offices and Agencies The core of Europol’s mission lies not only in the facilitation of the information exchange, but also and especially in the analysis of such information. Europol is tasked with preparing ‘threat assessments, strategic and operational analyses and general situation reports’.133 The concept of ‘analysis’ encompasses two different sets of activities, which will be examined below:134 –– strategic analysis, meaning ‘all methods and techniques by which information is collected, stored, processed and assessed with the aim of supporting and developing a criminal policy that contributes to the efficient and effective prevention of, and the fight against, crime’ (emphasis added);135 –– operational analysis, meaning ‘all methods and techniques by which information is collected, stored, processed and assessed with the aim of supporting criminal investigations’ (emphasis added).136 Europol’s operational analysis can help to discover relevant information to be used for the purpose of (ongoing) national investigations and prosecutions, such as the precise location of people, goods or companies. It can also lead to the discovery and establishment of links among existing cases, of which Member States – via the national units – should be notified without undue delay.137 2. Operational Support This category includes different tasks relating to Europol’s support to national investigations beyond operational analysis. Europol can request national authorities both to initiate a criminal investigation and to set up a joint investigation team (JIT), in which Europol can also participate. These two tasks are addressed further below.138 In addition, Europol should also: [C]oordinate, organise and implement investigative and operational actions to support and strengthen actions by the competent authorities of the Member States, that are carried out: (i) jointly with the competent authorities of the Member States; or (ii) in the context of JITs in accordance with Article 5 and, where appropriate, in liaison with Eurojust. (Emphasis added)139

This provision replicates to a large extent the wording of Article 88(2)(b) TFEU and was not included in the Europol Council Decision. However, rather than authorising Europol to perform a radically new task, the Regulation seems to have ratified the existing state of affairs. Europol had indeed already shown its commitment to the coordination of national investigations through operational tasks before the entry into force of the Regulation, especially in cases of terrorism, immigration and cybercrime. The practical consequences of Europol’s operational support are fleshed out in the document setting out the agency’s strategy for the period 2016–20: Europol will be prepared to swiftly adjust its response as required by MS [Member States] and work more closely with front-line investigators, providing on-the-spot, real-time information 133 Article 4(1)(f) of the Europol Regulation. 134 See section II.B.v below. 135 Article 2(b) of the Europol Regulation. 136 ibid art 2(c). 137 ibid art 4(1)(b). 138 The two mentioned tasks are not listed in ibid art 4, but rather in arts 5 (JITs) and 6 (request for the initiation of a criminal investigation). 139 ibid art 4(1)(c).

Europol 365 exchange and expertise. … Europol’s response could include short- and longer-term deployments of Europol experts (e.g. through EU mobile investigation support teams …), forming a situation centre to coordinate a response to major security events and crises, creating a task force or support the formation of multinational teams to intensify efforts and achieve immediate operational results in areas demanding attention. (Emphasis added)140

The division of tasks is clear: within the framework of domestic investigations concerning cross-border crimes (or JITs), national authorities remain competent for the adoption of coercive measures – which Europol is forbidden to carry out141 – but they can rely on the agency’s support and coordination. 3. Tasks Relating to Training, Knowledge and Expertise Many of the Europol’s tasks that previous legal instruments labelled as ‘additional’ or of further support to national authorities can be included in this residual category. Europol is ideally placed to collect knowledge concerning cross-border criminality and the best ways to curb it, so that the agency should also engage with the adequate collection and diffusion of this knowledge, as well as with the training of national authorities. For some areas of crime, Europol seems ever better equipped than domestic bodies. As mentioned above, Europol has been designated as the Central Office for combating euro counterfeiting.142 Even before the entry into force of the Regulation, Europol had set up specialised units to deal with migrant smuggling (the European Migrant Smuggling Centre (EMSC) set up in February 2016), terrorism (the European Counter Terrorism Centre (ECTC) set up in January 2016), and cybercrime (the European Cybercrime Centre (EC3) set up in 2013).143 In June 2020, it launched the European Financial and Economic Crime Centre (EFECC).144 Because of the agency’s remarkable commitment to fight cybercrime, the European Parliament had even suggested amending the Commission’s proposal for a Europol Regulation to bestow upon Europol the right to initiate an investigation on its own initiative if a malicious attack on the network and information system of two or more Member States or EU bodies was suspected. The Council rejected this amendment since it would be at odds with Europol’s current powers. Some of tasks falling within the category in question are to: (i) ‘develop, share and promote specialist knowledge of crime prevention methods, investigative procedures and technical and forensic methods, and provide advice to Member States’ (emphasis added);145 (ii) ‘provide specialised training and assist Member States in organising 140 ‘Europol Strategy 2016–2020’, https://www.europol.europa.eu/publications-documents/europol-strategy2016-2020, 16. 141 Article 88(3) TFEU; art 4(5) of the Europol Regulation. 142 Article 4(4) of the Europol Regulation. See Groenleer (n 93) 287. 143 Further information on these specialised Europol units can be found on Europol’s website. As for cybercrime, see also B Hayes et al, ‘The Law Enforcement Challenges of Cybercrime: Are We Really Playing Catch-up?’, Study for the LIBE Committee of the European Parliament, 2015, 33–35; Gless (n 93) 472–73. On the ECTC and EC3, see also S Gless and T Wahl, ‘A Comparison of the Evolution and Pace of Police and Judicial Cooperation in Criminal Matters: A Race between Europol and Eurojust?’ in C Brière and A Weyembergh (eds), The Needed Balances in EU Criminal Law: Past, Present and Future (Hart Publishing, 2018) 339–54 at 343. 144 See more on Europol’s website at https://www.europol.europa.eu/newsroom/news/europol-launcheseuropean-financial-and-economic-crime-centre. 145 Article 4(1)(g) of the Europol Regulation.

366 Bodies, Offices and Agencies training, including with the provision of financial support’ (emphasis added);146 and (iii) ‘develop Union centres of specialised expertise for combating certain types of crime falling within the scope of Europol’s objectives, in particular the European Cybercrime Centre’ (emphasis added).147 Finally, Europol aims to facilitate the collection and sharing of knowledge concerning cross-border criminality through the development and maintenance of a secure online platform: the Europol Platform for Experts (EPE). This is an environment where best practices, documentation, innovation, knowledge and non-personal data on crime can be shared.148 b. Initiation of Investigations The task of Europol to ask the competent authorities of Member States to initiate, conduct or coordinate investigations was first introduced by the 2002 Protocol to the Europol Convention and is now enshrined in Article 6 of the Regulation. Member States are not obliged to comply with Europol’s requests – to be transmitted via the national units149 – but should at least give reasons for their refusal without undue delay, preferably within one month of receipt of the request.150 However, they are not bound by this obligation when providing those reasons would jeopardise the success of an ongoing investigation or the safety of an individual, or would be contrary to the essential interests of the security of the state.151 The Commission’s proposal for a Europol Regulation intended to reduce the margin of discretion of national authorities, providing that national units had to ‘inform Europol without delay of the initiation of the investigation’ (emphasis added).152 This stance, albeit not endorsed by either the Parliament or the Council, contributed to the initial non-participation of the UK in the Regulation: [T]he [UK] Government considered that the provisions on the initiation of a criminal investigation if requested by Europol were ‘much more specific, possibly creating the presumption that Member States will comply’ and would place ‘a stronger responsibility on Member States to give a reason, by imposing a time limit’. The Government made clear that ‘Member States should take their own decisions on operational actions’.153

At the other end of the spectrum, the European Parliament instead suggested an amendment to reduce Europol’s discretion in the field by requiring it to justify the request to initiate an investigation.154 The amendment was not approved by the Council, but shows the EU institutions’ different approach to the matter: the Commission primarily aimed to strengthen the effective functioning of the agency, whereas the Parliament 146 ibid art 4(1)(i). 147 ibid art 4(1)(l). As for Europol’s role vis-a-vis cybercrime, see also art 4(1)(m) and Recital 8 of the Europol Regulation. 148 See https://www.europol.europa.eu/activities-services/services-support/information-exchange/europolplatform-for-experts. See also Disley et al (n 34) 100. 149 Article 6(1) of the Europol Regulation. 150 ibid art 6(3). 151 ibid. 152 Article 6(3) of the Commission’s proposal for a Regulation on Europol. 153 House of Commons European Scrutiny Committee (n 97) 10. 154 Amendment 11 of the European Parliament, ‘European Parliament legislative resolution of 25 February 2014’ (n 50), 12.

Europol 367 was more concerned with delimiting the powers of Europol and enhancing its overall accountability. Article 6 of the Europol Regulation largely mirrors the provision in the Eurojust Decision granting Eurojust the power to ask national authorities to begin investigations.155 National authorities can be requested to initiate investigations by both Europol and Eurojust. This duplication of tasks between the two EU bodies may lead to increased pressure for the initiation of investigations at the national level. It also signifies that the boundaries between police and prosecutorial/judicial functions at the EU level are blurred. c. JITs and Europol Participation Another amendment to the Europol Convention introduced by the 2002 Protocol concerned the participation of the agency in JITS, now addressed in Article 5 of the Regulation. The establishment of such teams was regulated by the 2000 Convention on Mutual Legal Assistance (hereinafter the ‘MLA Convention’)156 and later by a Framework Decision on Joint Investigation Teams (hereinafter the ‘JIT Framework Decision’).157 These instruments enable Member States to set up JITs ‘for a specific purpose and a limited period, which may be extended by mutual consent, to carry out criminal investigations in one or more of the Member States setting up the team’.158 The setting up of such teams would be by ‘mutual agreement’ between the participating Member States,159 with the Council subsequently adopting a Recommendation on such a model agreement.160 The main advantages of JITs can be summarised as follows: [R]equests for mutual legal assistance are no longer necessary. Instead, if investigative action is required in a state that is party to the JIT, a team member from that country can instigate such an action directly, exactly as they would have done in their home country. Furthermore, team members can freely exchange all the information acquired.161

JITs have turned out to be a very useful instrument of cooperation that has been highly appreciated by practitioners,162 albeit still underused.163 To promote this tool, a JITS 155 See section III.B.iii below. 156 [2000] OJ C197, 12 July, 1, art 13. 157 [2002] OJ L162, 20 June, 1. The Framework Decision largely replicates the text of the MLA Convention and was deemed necessary at the time because of the delay in the entry into force of the latter (largely due to the ratification requirements for this type of EU law instrument). 158 Article 13(1) of the MLA Convention; art 1(1) of the JIT Framework Decision. 159 ibid. 160 [2003] OJ C121, 23 May 2003, 1. Since then, the ‘Model Agreement for setting up a joint investigation team’ has been updated twice: in 2010 ([2010] OJ C70, 19 March, 1) and in early 2017 ([2017] OJ C18, 19 January, 1). The latter revision of the Model Agreement was prompted, inter alia, by the adoption of the Europol Regulation, which requires that such an agreement shall determine the conditions relating to the participation of Europol staff in JITs (art 5(1) of the Europol Regulation). 161 T Spapens, ‘Joint Investigation Teams in the European Union: Article 13 JITS and the Alternatives’ (2011) 19(3) European Journal of Crime, Criminal Law, and Criminal Justice 239, 249. See also A Klip, European Criminal Law: An Integrative Approach, 3rd edn (Intersentia, 2016) 496–98. 162 ‘Final report on the 6th round of mutual evaluations on “The practical implementation and operation of the Council Decision 2002/187/JHA of 28 February 2002 setting up Eurojust with a view to reinforcing the fight against serious crime and of the Council Decision 2008/976/JHA on the European Judicial Network in criminal matters”’, Council Doc 14536/2/14 REV 2, Brussels, 2 December 2014, 16 and 50–52. See also Disley et al (n 34) 72–73. 163 See S Hufnagel, Policing Cooperation across Borders: Comparative Perspectives on Law Enforcement within the EU and Australia (Ashgate, 2013) 214–30. Calls for more JITs – and in more areas of crime – can be found

368 Bodies, Offices and Agencies Network was established in 2005.164 This is composed of experts located in each Member State, who meet annually, whereas Eurojust hosts the Secretariat of the Network. JITs represent a significant inroad into state sovereignty in relation to policing by allowing officers from various Member States to operate in the territory of another Member State.165 The establishment of JITs raises a number of practical and legal issues in terms of trust, liability and applicable law.166 Neither the MLA Convention nor the JIT Framework Decision contains detailed rules regarding the participation of EU bodies such as Europol in JITs. Article 5 of the Europol Regulation now provides a legal basis for the participation of the agency officials in JITs, and further details can be found in the 2017 model agreement for setting up a JIT put forward by the Council167 and in the 2017 JITs Practical Guide, developed by the JITs Network Secretariat in cooperation with Eurojust, Europol and OLAF.168 The participation of Europol in JITs is allowed insofar as these teams are investigating criminal offences falling within Europol’s mandate.169 Europol officials may assist in all activities and exchanges of information with all members of the JIT and may provide the latter with the necessary information processed by Europol itself.170 Under certain conditions laid down in the Regulation, information obtained by Europol officials may be subsequently processed by the agency, with the consent and under the responsibility of the Member State which provided the information.171 Europol may also propose the setting up of a JIT and assist national authorities in the procedures thereof.172 The 2002 Protocol and the Europol Council Decision expressly laid down the prohibition for Europol officials to take any coercive measure in the framework of JITs, whereas Article 5 of the Regulation does not restate such prohibition. This silence notwithstanding, it ought to be recalled that the Europol Regulation – replicating the Treaty’s wording – lays down a general and all-encompassing prohibition for the agency

in several EU documents, such as the Stockholm Programme (n 43), 20; and the ‘EU Action Plan against Wildlife Trafficking’ COM (2016) 87 final, Brussels, 26 February 2016, 12. 164 See ‘Joint Investigation Teams – Proposal for designation of national experts’, Council Doc 11037/05, Brussels, 8 July 2005. 165 This goes further than the limited provisions of hot pursuit in the Schengen Convention – see in particular art 40 of the Convention. 166 On various aspects of JITs, see also M Plachta, ‘Joint Investigation Teams: A New Form of International Cooperation in Criminal Matters’ (2005) 13(2) European Journal of Crime, Criminal Law, and Criminal Justice 284; C Rijken and G Vermeulen (eds), Joint Investigation Teams in the European Union: From Theory to Practice (TMC Asser Press, 2006); L Block, ‘EU Joint Investigation Teams: Political Ambitions and Police Practices’ in S Hufnagel, C Harfield and S Bronitt (eds), Cross-border Law Enforcement: Regional Law Enforcement Cooperation – European, Australian and Asia-Pacific Perspectives (Routledge, 2012) 87–108. 167 ‘Model Agreement for setting up a joint investigation team’ (n 160). 168 ‘Joint Investigation Teams Practical Guide’, Council Doc 6128/1/17, Brussels, 14 February 2017 (hereinafter the ‘JITs Practical Guide’), which enhances and replaces the previous ‘Joint Investigation Teams Manual’ (Council Doc 15790/1/11, Brussels, 4 November 2011). 169 Article 5(1) of the Europol Regulation. 170 ibid art 5(2) and (3). See also JITs ‘Model Agreement’ (n 160) 6–7. 171 Article 5(4) of the Europol Regulation. 172 ibid arts 4(1)(d) and 5(5). The 2017 JITs Practical Guide highlights the Europol’s added value in supporting JITs by mentioning the contribution that the agency can provide in the setting-up and operational phases of a JIT, as well as at the conclusion of the team’s activities (‘JITs Practical Guide’ (n 168) 23–24; see also Disley et al (n 34) 72–76).

Europol 369 to apply coercive measures in carrying out its tasks,173 including tasks performed within JITs. The above overview of both the establishment of EU JITs and the legal framework underlying Europol’s participation therein demonstrates the potential for a significant expansion of police powers via two main features: extraterritoriality and informality. Police officers from Member States, and Europol officials to some extent, are allowed to operate ‘extraterritorially’ in the territory of another Member State. This arrangement leads to a spatial expansion of the reach of police powers in the EU. Such powers may increase, in particular in the light of the minimalist EU legal framework regulating JITs, a framework which leaves a wide range of issues to be determined by further implementing agreements between the authorities concerned.174 Moreover, with regard to Europol, the wording of some provisions of the Regulation has been drafted in broad terms – in particular, the provision stipulating that Europol may ‘assist in all activities’ of a JIT.175 While Europol officials are precluded from taking ‘coercive’ measures, it is not clear whether this will stop them in practice from assuming operational tasks on the ground as members of a JIT.176 In this context, the dividing line between ‘assisting’ and ‘operating’ can become rather blurred. It is worth mentioning that Europol officials do not benefit from immunities while they are participating in JITs:177 this should strengthen Europol’s (legal) accountability when the activities of the agency come closer to the European citizens and can – directly or indirectly – infringe upon their fundamental rights.178 As for informality, it has been noted that the informal exchange of information has been a major factor behind the establishment of JITs, in the light of the long delays in formal cooperation in criminal matters.179 For Europol, this is significant because its participating officials may liaise and exchange information on the ground with officers from a number of EU Member States, with very little in the way of legislation covering such interaction. Moreover, information gathered within the framework of a JIT may be processed by Europol. This may serve as a major boost to Europol’s work in its attempt to gather more information from Member States.

v. Europol’s Analysis: Databases and Strategic Intelligence Analysis lies at the core of Europol’s mission, be it operational or strategic. This section offers an overview of this fundamental task of the agency, first looking at the information system developed and maintained by Europol and then addressing the prominent role attached to the Europol’s strategic activities in shaping EU criminal policy. 173 Article 4(5) of the Europol Regulation, which mirrors the principles enshrined in art 88(3) TFEU. Moreover, the prohibition of taking coercive measures is laid down in the JITs ‘Model Agreement’ (n 160) 6. 174 On this point, see also C Rijken, ‘Joint Investigation Teams: Principles, Practice, and Problems. Lessons Learnt from the First Efforts to Establish a JIT’ (2006) 2(2) Utrecht Law Review 99, 102. 175 Article 5(2) of the Europol Regulation. See B de Buck, ‘Joint Investigation Teams: The Participation of Europol Officials’ (2007) 8(2) ERA Forum 253, 259; Groenleer (n 93) 280; Guild et al (n 132) 29. 176 This issue arises especially when Europol officials are authorised to be present during the activities of the JIT. 177 Recital 16 of the Europol Regulation. 178 On the impact of Europol’s activities on human rights in the framework of JITS, see Guild et al (n 132) 65–69. 179 Rijken (n 174) 117.

370 Bodies, Offices and Agencies a. Information System Central to the work of Europol is the maintenance of a computerised information system. The Regulation has brought about an important change in that respect. The Europol Convention and the Europol Council Decision listed the different components of this system, that is, the Europol Information System (EIS), the analysis work files (AWFs) – within the framework of which ‘focal points’ or ‘target groups’180 had been created – and the index function.181 Each of these components had different rules and objectives. That state of affairs raised risks of overlap and duplication on the one hand, and of ineffective fragmentation of information on the other.182 The Regulation has therefore re-designed the Europol’s processing architecture: the old pre-defined databases or systems are not mentioned in the Regulation, whereas a new ‘privacy by design approach’183 has been adopted. This approach ‘would allow Europol to link and make analyses of relevant data, reduce delays in identifying trends and patterns and reduce multiple storage of data’ (emphasis added).184 As explained in the Europol Strategy for 2016–20: The new legal framework of Europol is expected to remove emphasis from specific information and communications technology … systems and databases and introduce a new integrated data management … concept …. In concrete, the rules for information processing will be related to the data itself – rather than the systems or databases used to store it. As a consequence, Europol, in close consultation with MS [Member States], will have the opportunity to use this flexibility to modernise its system’s architecture and information-management strategy to ensure the best ways to manage criminal information and enhance the analytical capabilities of Europol based on MS operational requirements. The integration of data will ensure that links across crime areas will be more easily identified and, therefore, analytical support will be of increased value. (Emphasis added)185

In sum, once information is shared with Europol, the agency should be in a position to process and analyse it without the restrictions linked to the AWFs, analysis projects, target groups and/or EISs: interoperability – ie, ‘the possibility to analyse one data set with another without additional procedural burden’186 – should be the new guiding principle. A simplification of the previous structure is an important step forward, which can help to easily cross-check information within Europol’s databases. This is highly beneficial for an effective fight against cross-border crimes, yet can raise concerns about the level of protection of human rights potentially affected by Europol’s activities. 180 See more in V Mitsilegas and F Giuffrida, ‘The Role of EU Agencies in Fighting Transnational Environmental Crime: New Challenges for Eurojust and Europol’ (2017) 1(1) Brill Research Perspectives in Transnational Crime, 1, 75–76. 181 Articles 11–13 (EIS), 14 and 16 (AWFs), and 15 (index function) of the Europol Council Decision. See previously art 6(1) of the Europol Convention. In the literature, see Disley et al (n 34) 78; Klip (n 161) 490–92. 182 The perceived lack of flexibility resulting from data stored in different databases is discussed in Disley et al (n 34) 80–84. 183 Explanatory Memorandum to the Commission’s proposal for a Regulation on Europol, 8. Article 33 of the Europol Regulation, entitled ‘Data Protection by Design’, states that ‘Europol shall implement appropriate technical and organisational measures and procedures in such a way that the data processing will comply with this Regulation and protect the rights of the data subjects concerned’. 184 Explanatory Memorandum to the Commission’s proposal for a Regulation on Europol, 8. 185 ‘Europol Strategy 2016–20’ (n 140) 12. 186 D Drewer and V Miladinova, ‘The Big Data Challenge: Impact and Opportunity of Large Quantities of Information under the Europol Regulation’ (2017) 33(3) Computer Law & Security Review 298, 305. On the interoperability of information systems throughout the EU, see ch 9.

Europol 371 b. Strategic Intelligence and Analysis: Europol and the Policy Cycle Previously listed among the ‘additional’ tasks of Europol,187 the task of providing strategic intelligence has become increasingly important over the years. It has been argued that the logic of intelligence-led policing seems to be ‘pervasive’ in the case of Europol.188 This argument is based on the increasing emphasis by Europol on the production of threat assessments ‘to assess future threats and the groups of populations from which they are likely to emanate’ (emphasis added).189 This trend was prevalent in The Hague Programme, which called on Europol with effect from 1 January 2006 to replace its crime situation reports by annual threat assessments.190 As has been noted, the replacement of the traditional organised crime reports by threat assessments codifies a practice of making ‘anticipatory analytical reports’ on crime phenomena.191 In 2008, Europol itself claimed that: [T]he various threat assessments produced by the organisation, on the basis of information and intelligence sent by the Member States, constitute the cornerstone of a European intelligence-led policing system for the fight against organised crime. Europol’s analytical input sets in motion the execution of the European Criminal Intelligence Model (ECIM). Based on the experience of the National Criminal Intelligence Model (NIM) currently used in the UK, the ECIM is a four-step cyclical process which starts by an assessment of the threat at European level from which political priorities in internal security are drawn. By anticipating better the criminal developments, the intelligence-led policing approach enables the political level to decide about the priorities while the operational level use resources more effectively. (Emphasis added)192

The Europol Regulation expressly mentions the preparation of threat assessments, together with strategic analyses and general situation reports, among the tasks of Europol.193 The most well-known Europol’s threat assessments are the Serious and Organised Crime Threat Assessments (SOCTAs) and the Internet Organised Crime Threat Assessments (IOCTAs). The methodology and reliability of Europol’s threat assessments have been subject to strong criticism in the literature;194 some authors have even argued that the oversimplification of Europol’s reports and their perceived detachment from reality could lead to a loss of credibility of the agency in the eyes of national police authorities.195

187 Article 3(2)(2) of the Europol Convention and art 5(3)(b) of the Europol Council Decision. 188 Bigo et al (n 104) 39. 189 ibid. 190 [2005] OJ C53, 3 March, 1, point 2.3. 191 M den Boer, ‘New Dimensions in EU Police Co-operation: The Hague Milestones for What They are Worth’ in J W de Zwaan and F Goudappel (eds), Freedom, Security and Justice in the European Union (TMC Asser Press, 2006) 221–32 at 226. 192 Europol, submission to the House of Lords Select Committee to the European Union, Inquiry into Europol, The Hague, 28 April 2008, File no 3100–174, para 1.1. 193 Article 4(1)(f) of the Europol Regulation; see also art 4(3). 194 See PC van Duyne and T vander Beken, ‘The Incantations of EU Organised Crime Policy’ (2009) 51(2) Crime, Law and Social Change 261, 273ff; and A Scherrer, J Jeandesboz and EP Guittet, ‘Developing an EU Internal Security Strategy, Fighting Terrorism and Organised Crime’, Study for the LIBE Committee of the European Parliament, 2011, 21–23. 195 J Sheptycki, H Ben Jaffel and D Bigo, ‘International Organised Crime in the European Union’, Study for the LIBE Committee of the European Parliament, 2011, 8.

372 Bodies, Offices and Agencies Nevertheless, Europol’s threat assessments set in motion a four-step cyclical process at the European level: the ‘Policy Cycle’ (previously the ECIM).196 The Policy Cycle is adopted ‘in order to tackle the most important criminal threats in a coherent and methodological manner through optimum cooperation between the relevant services of the Member States, EU Institutions and EU Agencies, as well as relevant third countries and organisations’.197 A first, limited Policy Cycle covered the years between 2011 and 2013 and was followed by fully fledged cycles for the periods 2014–17, 2018–21 and 2022–25.198 The first step of the cycle is the Europol SOCTA, which identifies the main criminal threats in Europe. On the basis of this threat assessment, the Council sets the EU priorities in the fight against serious and organised crime.199 For each of them, multi-annual strategic plans are then elaborated. In this framework, a European Multidisciplinary Platform Against Criminal Threats (EMPACT) project and an operational action plan are implemented;200 on the basis of these, national authorities take actions on the ground with the support and the coordination of Europol. This can lead to more effective reaction against the crimes that have been identified as priorities. At the end of the cycle, the activities carried out are evaluated, with a view to the further setting of new priorities for the next cycle. In the Policy Cycle, the Standing Committee on Internal Security (COSI) plays a relevant coordinating and monitoring role. Following the recommendations of the Working Group on Freedom, Security and Justice at the Convention on the Future of Europe,201 and mirroring the Constitutional Treaty, the Lisbon Treaty established this committee to ensure that ‘operational cooperation on internal security is promoted and strengthened within the Union’.202 Representatives of the EU bodies, offices and agencies

196 On the ECIM, see H Brady, ‘Europol and the European Criminal Intelligence Model: A Non-state Response to Organized Crime’ (2008) 2(1) Policing 103, 106–07. On the evolution from the ECIM to the Policy Cycle and for a description of the latter, see A Gruszczak, ‘The EU Criminal Intelligence Model’ in JB Banach-Gutierrez and C Harding (eds), EU Criminal Law and Policy: Values, Principles and Methods (Routledge, 2017) 149–67. The Policy Cycle is also referred to as ‘EMPACT Policy Cycle’. As explained immediately below in the text, EMPACT stands for ‘European Multidisciplinary Platform Against Criminal Threats’. 197 Council conclusions on the creation and implementation of a EU policy cycle for organised and serious international crime, Justice and Home Affairs Council meeting, Brussels, 8–9 November 2010. 198 Council conclusions on setting the EU’s priorities for the fight against serious and organised crime between 2014 and 2017, Justice and Home Affairs Council meeting, Brussels, 6–7 June 2013; Council conclusions on setting the EU’s priorities for the fight against organised and serious international crime between 2018 and 2021, Justice and Home Affairs Council meeting, Brussels, 18 May 2017; Council conclusions setting the EU’s priorities for the fight against serious and organised crime for EMPACT 2022–2025, Council Doc 8665/21, Brussels, 12 May 2021. 199 Comparing the key threats identified by Europol in the 2013 and 2017 SOCTAs with the priorities set by the Council for the two Policy Cycles, it emerges that the latter has almost entirely aligned its position to that of Europol. In the 2022–25 Policy Cycle, the priorities are: high-risk criminal networks; cyber-attacks; trafficking in human beings; child sexual exploitation; migrant smuggling; drug trafficking (notably production, trafficking and distribution of cannabis, cocaine, heroin, synthetic drugs and new psychoactive substances); fraud, economic and financial crimes (notably online fraud schemes, excise fraud, missing trader intra-community fraud); organised property crime; environmental crime; and firearms trafficking. Document fraud is instead identified as a cross-cutting threat (see Council Doc 8665/21 (n 198)). 200 EU crime priorities are often called ‘EMPACT priorities’ (see https://www.europol.europa.eu/empact). 201 Final Report of Working Group X (n 23) above. The Report contained a specific part on ‘strengthening operational collaboration’. 202 Article 71 TFEU.

Europol 373 concerned (including Europol) may be involved in the proceedings of the Committee, which aims to facilitate coordination of the action of Member States’ competent authorities.203 In the EU Policy Cycle, COSI is responsible – among other things – for the final evaluation of the activities carried out.204 In sum, the importance of Europol’s strategic tasks has increased over the years. The agency has now a prominent role in shaping EU and domestic criminal policies, thanks to the SOCTA and its impact on the choices made by the Member States within the Policy Cycle.205 Since national law enforcement agencies and European bodies (eg, Eurojust) have to cope with several forms of criminality, the decisions adopted in the Policy Cycle lead to the prioritisation of the crimes to tackle and therefore can affect the allocation of resources at the national and European levels. For instance, the first of the six criteria that Eurojust should take into account in the assessment of whether to fund a JIT is whether the crime that the JIT will investigate falls within the Policy Cycle’s priorities.206

vi. Data Processing and Data Protection a. Overview For an agency dealing with information concerning crimes and individuals, the respect of the right to the protection of personal data – enshrined in Article 8 of the Charter and Article 16(1) TFEU207 – is crucial. In the Regulation, two chapters are expressly devoted to the processing of information (Chapter IV) and data protection safeguards (Chapter VI), whereas all provisions (except one) of Chapter V, which concerns Europol’s relations with partners, deal with the transfer and exchange of personal data with such partners. In addition, three out of the four Articles in Chapter VII (remedies and liability) relate to data protection issues. This set of rules represents an autonomous regime of data protection, which applies to the work of Europol as lex specialis, due to the specificity of personal data processing

203 ibid. The emphasis is thus placed quite heavily on both operational cooperation – which is not defined – and the creation of an EU steering body coordinating action of national authorities (see also art 74 TFEU on administrative cooperation between national authorities). The setting-up of this Committee is based on the previous ‘Art 36 Committee’ (now Coordinating Committee in the area of police and judicial cooperation in criminal matters (CATS)), which was provided for by art 36 TEU and consisted of senior officials by Member States. However, unlike the art 36 Committee, COSI does not have legislative tasks (see C Ladenburger, ‘Police and Criminal Law in the Treaty of Lisbon: A New Dimension for the Community Method’ (2008) 4(1) European Constitutional Law Review 20, 33). In fact, the tasks and powers of COSI are not precisely defined, something that raises questions of both transparency and accountability, but also of the transfer of sovereignty by Member States to the EU in the field of operational action. 204 On COSI, see also A Jonsson Cornell, ‘EU Police Cooperation Post-Lisbon’ in M Bergström and A Jonsson Cornell (eds), European Police and Criminal Law Co-operation (Hart Publishing, 2014) 147–61 at 154–56. 205 cf also art 4(2) of the Europol Regulation. 206 Eurojust Single Programming Document 2020–2022, 10 December 2019, https://www.eurojust.europa. eu/eurojust-single-programming-document-2020-2022, 70. On the funding of JITs by Eurojust, see section III below. 207 See Recital 76, which also recalls art 7 of the Charter (respect for private and family life), usually interpreted as encompassing the right to privacy.

374 Bodies, Offices and Agencies in the law enforcement context.208 The legislator has chosen not to apply Directive (EU) 2016/680 to Europol, which concerns the protection of natural persons with regard to the processing of personal data for the purposes of the prevention, investigation, detection or prosecution of criminal offences.209 Article 2(3)(b) of the Directive excludes the processing of personal data by the EU institutions, bodies, offices and agencies from the scope of application of the Directive. It is an open question as to whether the specificity of the law enforcement context can be regarded as a sufficient justification for the EU regime of data protection not to apply to Europol, especially since the Lisbon Treaty and the Europol Regulation have enhanced the nature of Europol as a truly European agency. In any case, the rules laid down in the Europol Regulation are in principle consistent with Directive (EU) 2016/680 – as required by Recital 40 of the Europol Regulation – as well as with Regulation (EC) No 45/2001 (now repealed by Regulation (EU) 2018/1725),210 the 1981 Council of Europe data protection Convention,211 and the Council of Europe Recommendation No R(87) 15 concerning the use of personal data in the police sector.212 In addition, the Charter also applies and the case law of the Court of Justice – which has developed a number of relevant principles aimed at protecting the individual’s right to privacy – is to be taken into account. The following paragraph focuses primarily on the rules on data processing and data protection, whereas those concerning the exchange of information with Europol’s partners are addressed further below. b. Main Rules and Monitoring Mechanisms The overarching principle is engraved in Recital 39 of the Regulation, which reads as follows: ‘Any information which has clearly been obtained in obvious violation of human rights shall not be processed.’213 Moreover, Europol may carry out processing activities only ‘in so far as necessary for the achievement’214 of its objectives. Chapter IV of the Regulation sets out some basic rules for the processing of information within Europol, concerning: –– the sources of information that Europol can process, namely Member States, EU bodies, third countries, international organisations, private parties and private 208 See also Declaration 21 attached to the Treaty of Lisbon: ‘The Conference acknowledges that specific rules on the protection of personal data and the free movement of such data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 of the [TFEU] may prove necessary because of the specific nature of these fields’ (Declaration on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation). 209 [2016] OJ L119, 4 May, 89. 210 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC [2018] OJ L295, 21 November, 39. 211 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS No 108, Strasbourg, 28 January 1981. 212 Recommendation No R (87) 15 of the Committee of Ministers to member states regulating the use of personal data in the police sector, 17 September 1987. 213 This is restated in art 23(9) of the Europol Regulation, which concerns the agency’s relations with its partners. 214 ibid art 18.

Europol 375

–– ––

––

––

persons in accordance with the rules and procedures provided for in the Regulation itself;215 however, Europol may also retrieve and process information – including personal data – both from publicly available sources216 and, if permitted by specific legal instruments, from EU, international and national information systems;217 the purposes of information processing activities, such as strategic and operational analyses or cross-checking with the aim of identifying links among cases;218 the obligation for the entity that shares its information with Europol to determine the purpose for which that information is to be processed by the agency (‘purpose limitation’);219 the access to information stored by the agency: Europol staff ‘duly empowered by the Executive Director’220 can access information processed by Europol ‘to the extent required for the performance of their duties’.221 In addition, only Member States have the right to access and search all information provided to Europol for the purposes of cross-checking or strategic analysis.222 Eurojust and OLAF, as well as Member States when information provided for operational analysis is concerned, can only have indirect access on the basis of a hit/no-hit system:223 in other words, the purpose of their access is simply to verify whether their information matches with information processed at Europol. In case of a hit, ‘Europol shall initiate the procedure by which the information that generated the hit may be shared’;224 the obligation of Europol to notify a Member State, without delay, of any information concerning it.225

However, much more numerous are the provisions of Chapter VI, which regard the data protection safeguards.226 These include, inter alia, rules on general data protection principles,227 procedures for the assessment of reliability of the source and accuracy of information228 and for the processing of special categories of personal data,229 time limits for the storage and deletion of data,230 measures for the security of processing,231 data protection by design,232 right of access of individuals to their personal data and

215 ibid art 17(1). 216 For some positive views on information that Europol can retrieve from publicly available sources, see Drewer and Miladinova (n 186) 303–304. 217 Article 17(2) and (3) of the Europol Regulation respectively. 218 ibid art 18. 219 ibid art 19(1). 220 ibid art 20(4). 221 ibid. 222 ibid art 20(1). 223 ibid arts 20(2) (Member States) and 21 (Eurojust and OLAF). 224 ibid arts 20(2) and 21(1). 225 ibid art 22. 226 ibid arts 28–46. 227 ibid art 28, which largely resembles art 4(1) of Directive (EU) 2016/680. 228 ibid art 29. 229 ibid art 30. The processing of special categories of personal data is likewise addressed in art 10 of Directive (EU) 2016/680. 230 ibid art 31. 231 ibid art 32, which replicates the principles laid down in Art 29 of Directive (EU) 2016/680. 232 ibid art 33. See n 183 above.

376 Bodies, Offices and Agencies right to rectification, erasure and restriction,233 an obligation of prior consultation of the EDPS in specific cases,234 and responsibility in data protection matters.235 Such a responsibility for the quality of personal data lies with the Member States for the information that they provide to Europol, and with Europol in respect of data communicated to it by third parties or that result from analyses conducted by it.236 This twofold system of data protection (shared between Europol and Member States)237 is also adopted in the design of data protection monitoring mechanisms. Each Member State must designate a national supervisory authority, the task of which is to monitor independently, in accordance with its respective national law, the permissibility of the transfer, the retrieval and any communication to Europol of personal data by the Member State concerned, as well as monitoring the activities of the Europol national unit in that Member State and of the liaison officers.238 In addition to national supervisory authorities, the Europol Convention and the Europol Council Decision also regulated the role of the Europol Joint Supervisory Body (JSB), which was composed of members of the national supervisory authorities239 and had the tasks of ensuring that the rights of the individuals were not violated and monitoring the transmission of data originating by Europol.240 The Regulation has suppressed the JSB and enhanced the European side of the Europol data protection regime, which is now composed of the Data Protection Officer (DPO) and the EDPS. The DPO is a member of Europol’s staff who acts ‘independently’ in the performance of their duties, despite being appointed by the Management Board.241 The DPO ensures the internal application of the Regulation to the activities of Europol concerning the processing of data,242 and therefore has access to all the data processed by the agency and all its premises.243 The DPO, inter alia, informs the Executive Director of any possible breach of the provisions of the Regulation concerning the processing of data, and requires them to resolve the issue within a specified timeframe. If the Director fails to solve the problem, the DPO informs the Management Board, which intervenes within the time specified. If the Board does not deal with the issue in a satisfactory way, the matter is referred to the EDPS.244 The EDPS monitors and ensures the application of the Regulation provisions relating to the protection of individuals’ rights concerned by the processing of personal data by Europol.245 They also advise such individuals, as well as Europol, on matters concerning

233 ibid arts 36 and 37. See arts 14–17 of Directive (EU) 2016/680. 234 Article 39 of the Europol Regulation. A similar obligation of prior consultation is provided for by art 28 of Directive (EU) 2016/680. 235 Article 38 of the Europol Regulation. 236 ibid art 38(2). 237 See also ibid art 38(4) and (5). For some examples of the tensions arising from the respective responsibilities of Europol and the Member States, see Guild et al (n 132) 70. 238 Article 42(1) and (3) of the Europol Regulation. 239 Article 24(1) of the Europol Convention and art 34(1) of the Europol Council Decision. 240 ibid. 241 Article 41(1) of the Europol Regulation. 242 For the list of the DPO’s tasks, see ibid art 41(6). 243 ibid art 41(8). 244 ibid art 41(9). 245 ibid art 43(1).

Europol 377 personal data.246 The Regulation enhances the relations between the EDPS and national supervisory authorities by establishing, and listing the competences of, a Cooperation Board, which is composed of a representative of the EDPS and of the national supervisory authorities of each Member State.247 The Regulation therefore lays down several rules on data protection, offering a wide range of guarantees to individuals. Together with the abolition of the JSB, the recognition of a central role to the EDPS is noteworthy: it shows a clear shift towards a more independent, European supervision of rights relating to data processing. The enhancement of Europol’s data protection regime was necessary not only because of the developments in EU data protection law and standards, but also – if not especially – because the powers of Europol in the field of the collection, analysis and exchange of personal data have been substantially increased. Ironically, the constant expansion of such powers has been achieved despite some sustained criticism of Europol’s efficiency and added value, criticism that at times focuses on the very design of Europol, it being the outcome of a political compromise.248

vii. Judicial Control One of the thorniest issues in the negotiations of the Europol Convention was the subjection of Europol to the judicial control of the Court of Justice. With multiple changes in the drafts, and Member States such as the UK strongly opposed to the involvement of the Court, the finally adopted text contained very little on the issue.249 The Europol Convention merely included a provision on the ‘settlement of disputes’ providing that disputes between Member States on the interpretation or application of the Europol Convention would initially be discussed at the Council with the aim of finding a settlement and, if this was not possible within six months, parties to the dispute had to decide among themselves on the modalities of settlement.250 There followed a Protocol amending the Europol Convention to allow the interpretation, by way of preliminary rulings, of the Convention by the Court of Justice.251 However, the adoption of the Protocol did not mean that the Court’s jurisdiction extended automatically to all Member States: in a technique similar to the one followed with regard to the Court’s jurisdiction in the third pillar in Amsterdam, Member States were asked to make a Declaration by which they accepted its jurisdiction to give preliminary rulings on the interpretation of the Europol Convention.252

246 ibid. 247 Among the other tasks, the Cooperation Board discusses the general policy and strategy of data protection supervision of Europol and promotes awareness of data protection rights (art 45(3)(a) and (g)). 248 See, inter alia, the criticism in B Müller-Witte, ‘The Effect of International Terrorism on EU Intelligence Co-operation’ (2008) 46(1) Journal of Common Market Studies 49, 54ff. The author asks whether Europol is ‘flawed by design’ (at 54). 249 On the background, see in particular Anderson et al (n 6) 207–09; Occhipinti (n 6) 57–58; E Denza, The Intergovernmental Pillars of the European Union (Oxford University Press, 2002) 314–15. 250 Article 40(1) and (2) of the Europol Convention. By a Declaration attached to the Convention, a number of Member States agreed to submit such disputes to the Court of Justice. 251 [1996] OJ C299, 9 October, 1. 252 Article 2 of the Protocol.

378 Bodies, Offices and Agencies The already limited judicial control of Europol acts253 was thus further limited and was made subject to the political will of the Member States.254 Subsequently, the Europol Council Decision provided that ‘judicial control over Europol will be exercised in accordance with Article 35 of the Treaty on European Union’.255 This reference did not introduce any major change to the previous scenario. However, under former Article 35(7) TEU, the Court had an enhanced role in dispute settlement compared to the provisions on the matter in the Europol Convention, which were therefore deleted from the Decision.256 Pursuant to Article 35 TEU, Member States also retained the option not to accept the Court’s jurisdiction on preliminary rulings, as was the case with the UK. The Europol Regulation eventually aligned Europol’s legal framework with the developments brought about by the Lisbon Treaty. First, since the Court has now full jurisdiction regarding preliminary rulings concerning the AFSJ,257 there was no need to mention the issue in the Regulation. Second, the CJEU has jurisdiction pursuant to any arbitration clause in a contract concluded by Europol, as well as in disputes relating to compensation for damage in the case of non-contractual liability of the agency.258 The CJEU can also rule, in accordance with Article 263 TFEU, on the decisions of Europol confirming the refusal of the agency to grant total or partial access to a document.259 Third, the CJEU is expected to play a more relevant role than it did in the past in the field of data protection. Europol can be brought before the Court by an individual who has suffered damage as result of an unlawful data processing operation and who claims their right to receive compensation in accordance with Article 340 TFEU.260 They can also bring an action before national courts against the Member State in which the event that gave rise to the damage occurred.261 If the question of who should bear the ultimate responsibility for the compensation to be awarded to the individual is a controversial one, the dispute between Europol and the concerned Member State should be referred to the Management Board, which decides by a majority of two-thirds of its members.262 This decision can then be challenged before the CJEU in accordance with Article 263 TFEU.263 The decision of the EDPS on a complaint lodged pursuant to the Europol Regulation is also subject to the judicial review of the CJEU, in accordance with Article 48 of the 253 See also the extensive privileges and immunities enjoyed by the Europol Directors, members and employees – art 41 of the Europol Convention and the Protocol on the privileges and immunities of the European Union ([1997] OJ C221, 19 July, 2), as amended ([2002] OJ C312, 16 December, 1). 254 The first Europol Director, Jürgen Storbeck, reportedly advocated limited judicial control of Europol, on the basis of the argument that there is only place for judicial control of Europol in the European context if Europol is able to independently instigate investigations; see T Schalken and M Pronk, ‘On Joint Investigation Teams, Europol and Supervision of Their Joint Actions’ (2002) 10(1) European Journal of Crime, Criminal Law and Criminal Justice 70, 74. 255 Recital 21 of the Europol Convention. 256 On previous the art 35 TEU, see Peers (n 11) 20–21. 257 Article 267 TFEU. 258 Article 49(2) and (4) of the Europol Regulation respectively. 259 ibid art 65(3). 260 ibid art 50(1). See art 56 of Directive (EU) 2016/680. 261 Article 50(1) of the Europol Regulation. 262 ibid art 50(2). 263 ibid.

Europol 379 Europol Regulation.264 This is a significant improvement when compared to the previous state of affairs, in which Europol decisions on the right of access could not reach the Luxembourg Court, but the JSB at best.265 Finally, the EDPS can refer a matter to the Court of Justice under the conditions provided for in the TFEU.266 In conclusion, the Regulation enhances the judicial control on Europol’s activities, especially when potential violations of the rules on data protection occur. However, most of the acts and decisions through which Europol accomplishes its mission still escape the scrutiny of the Court of Justice, such as the requests to initiate a criminal investigation or to set up a JIT, as well as all other acts adopted by Europol in its supporting and coordinating activities. The principles developed by the case law of the CJEU on OLAF seem applicable in this context.267 In essence, Europol cannot adopt coercive measures, with the consequence that Europol’s requests and acts do ‘not bring about a distinct change in the [individual’s] legal position’,268 and therefore cannot be subject to the action for annulment in accordance with Article 263 TFEU. National measures instigated by Europol cannot be reviewed by the Court of Justice either, since the Treaties expressly exclude its jurisdiction to rule ‘on the validity or proportionality of operations carried out by the police or other law-enforcement services of a Member State’.269 The final word on the legality of police activities carried out by national authorities upon the request of Europol therefore lies with national courts. In the literature, some concerns have been raised about the compliance of this scenario with fundamental human rights and EU constitutional principles.270

viii. Accountability, Parliamentary Scrutiny and Transparency The history of Europol, and therefore of its accountability, is marked by a progressive – yet not complete – relinquishment of intergovernmental features. Europol was partially ‘communautarised’ with the 2009 Council Decision, which introduced relevant rules that the Regulation replicates and that concern, among other things, the funding of Europol by the EU budget (and no longer by Member States),271 the application of the Staff Regulations of Officials of the European Union to Europol staff,272 and the application of the Protocol annexed to the Treaties on the privileges and immunities of the EU to Europol and its staff.273

264 For instance, Europol’s decisions denying or restricting the right of access to personal data can be appealed before the EDPS (ibid art 36(7)). 265 Guild et al (n 132) 72. 266 Article 43(3)(h)of the Europol Regulation. 267 For more on this, see section IV.B below. 268 Case T-193/04, Tillack v Commission, judgment of 4 October 2006, EU:T:2006:292, para 68. For more on this, see section IV.B below. 269 Article 276 TFEU. 270 See, among others, Guild et al (n 132) 83–84. 271 Articles 42(1) of the Europol Council Decision and art 57(3) of the Europol Regulation. 272 Article 57 of the Europol Council Decision and art 53 of the Europol Regulation. 273 Article 51 of the Europol Council Decision and art 63(1) of the Europol Regulation. As mentioned, when Europol officials participate in a JIT, they do not benefit from immunities (Recital 16 of the Europol Regulation).

380 Bodies, Offices and Agencies As mentioned above, the Europol Council Decision mitigated the intergovernmental nature of the Europol Management Board, which, since 2010, has consisted of one representative per Member State and a representative of the Commission.274 The Management Board is responsible for a wide range of decisions concerning the functioning of Europol and has a role in budgetary matters, as well as in the appointment and dismissal of the Executive Director and Deputy Executive Directors.275 The Director is accountable to the Management Board276 and could be invited by the Council and the European Parliament to report on the performance of their duties.277 The Management Board is thus vested with considerable powers, but the Regulation lays down very few rules on its accountability, which is achieved primarily by adopting and submitting annual activity reports on Europol’s activities – to be made public – to the European Parliament, the Council, the Commission, the Court of Auditors and the national parliaments.278 The Executive Director should also present the annual report to the European Parliament and the Council.279 Prior to the Europol Regulation, the annual reports had to be sent only to the Council, which should forward them to the European Parliament.280 Whereas this form of ‘soft’ accountability for the Management Board has now been extended to involve other EU institutions and national parliaments, the Council is still responsible for the appointment of the Executive Director, to be chosen from a shortlist of candidates proposed by the Management Board.281 In turn, this shortlist is drawn up by a selection committee set up by the Management Board and composed of members designated by Member States and a representative of the Commission.282 Likewise, the Director – whose term of office is of four years, which is renewable once283 – can be removed only pursuant to a decision of the Council acting on a proposal from the Management Board.284 The European Parliament is sidelined in these procedures. It is only provided that, before appointment, the candidate selected by the Council may be invited to appear before the competent committee of the Parliament, which gives a non-binding opinion.285 As for the removal from office of the Director, the European Parliament should only be informed about the decision of the Council.286 Nevertheless, the democratic accountability of Europol has been enhanced by the Regulation, which was mandated by the Treaty to lay down the procedures for the scrutiny of Europol’s activities by the European Parliament, together with

274 Article 10(1) of the Europol Regulation, which replicates art 37(1) of the Europol Council Decision. 275 See art 11 of the Europol Regulation. 276 ibid art 16(1). 277 ibid Recital 60. 278 Article 11(1)(c). As for the accountability of the Management Board, see also art 50(2). 279 ibid Recital 60. 280 Article 37(10)(c) of the Europol Council Decision. 281 Article 54(2) of the Europol Regulation. 282 ibid. 283 ibid art 54(3). The Council grants the extension, acting on a proposal from the Management Board (art 54(4)). 284 ibid art 54(7). The non-renewal of the Director is however ‘the more likely alternative to sanctioning’ (Busuioc (n 1) 107). 285 Article 54(2) of the Europol Regulation. 286 ibid art 54(7).

Europol 381 national parliaments.287 A specialised Joint Parliamentary Scrutiny Group (JPSG) was established in April 2017 and is competent to carry out the scrutiny on Europol’s activities.288 The JPSG should politically monitor Europol’s activities in fulfilling its mission, ‘including as regards the impact of those activities on the fundamental rights and freedoms of natural persons’.289 To this end, the Management Board should consult the JPSG in relation to the multi-annual programming of Europol290 and can invite a representative designated by the JPSG to its meetings as a non-voting observer.291 Furthermore, Europol should transmit to the JPSG a number of documents concerning its activities, such as threat assessments and other strategic analyses and reports, as well as the annual reports drafted by the Management Board. However, the JPSG can request access to other relevant documents necessary for the fulfilment of its tasks.292 The JPSG may draw up summary conclusions and submit them to the national parliaments and the European Parliament, which should then forward these conclusions – ‘for information purposes’293 – to the Council, the Commission and Europol. The Regulation also provides that the European Parliament – but not the national parliaments – should have access to the information processed by or through Europol, pursuant to the procedures and rules laid down in the Regulation and in ad hoc working arrangements concluded between Europol and the European Parliament.294 These provisions mark a substantial difference between the Regulation and the previous Europol’s legal framework, where the supervision of the European Parliament on Europol’s activities was extremely limited.295 National parliaments instead played a 287 Article 88(2) TFEU. Europol staff and EU officials supported the European Parliament’s involvement in the activities of Europol, insofar as it does not concern the operational activities (see Disley et al (n 34) 141–43). 288 Annex I to the Conclusions of the Conference of Speakers of EU Parliaments of 23–25 April in Bratislava as pertaining to the Europol JPSG. The rules of procedure of the JPSG were adopted in 2018; see www.europarl.europa.eu/doceo/document/LIBE-DT-618214_EN.pdf?redirect. See more in Gless and Wahl (n 143) 352–53. 289 Article 51(2) of the Europol Regulation. 290 ibid art 51(2)(c). 291 ibid art 14(4). 292 ibid art 51(4). 293 ibid art 51(5). 294 ibid art 52. This provision also recalls the Interinstitutional Agreement of 12 March 2014 between the European Parliament and the Council concerning the forwarding to and the handling by the European Parliament of classified information held by the Council on matters other than those in the area of the common foreign and security policy ([2014] OJ C95, 1 April, 1). Article 3(4) of this Agreement lays down the so-called ‘principle of originator control’: ‘The Council may grant the European Parliament access to classified information which originates in other Union institutions, bodies, offices or agencies, or in Member States, third States or international organisations only with the prior written consent of the originator’ (emphasis added). As a matter of fact, most of the data processed and held by Europol ‘originate’ from Member States, third countries or other public or private entities. Therefore, it is eventually up to them to decide whether the European Parliament can have access to information stored at Europol. For more on this, see V Abazi, ‘The Future of Europol’s Parliamentary Oversight: A Great Leap Forward?’ (2014) 15(6) German Law Journal 1121; M Schinina, ‘What Balance between Eurojust and Europol from a Parliamentary Angle?’ (2020) 11(2) New Journal of European Criminal Law 123, 132. 295 On Europol’s initial ‘little to no supranational accountability’, see M Busuioc, D Curtin and M Groenleer, ‘Agency Growth between Autonomy and Accountability: The European Police Office as a “Living Institution”’ (2011) 18(6) Journal of European Public Policy 848, 854–56. See also S Puntscher Riekmann, ‘Security, Freedom and Accountability: Europol and Frontex’ in E Guild and F Geyer (eds), Security versus Justice? Policy and Judicial Cooperation in the European Union (Routledge, 2008), 19–34 at 23–26; de Moor and Vermeulen (n 34) 1116–18.

382 Bodies, Offices and Agencies considerable role in the adoption of the Convention and its amendments in the form of Protocols via the national ratification process: they had the essentially negative power to block any amendments to the Europol Convention.296 With the change in the legal basis from a Convention to a Decision (which did not require ratification in the Member States), the position of national parliaments seemed to be weakened, before being enhanced again with the Lisbon Treaty and the Regulation.297 The potential of the JPSG is noteworthy: ‘Appropriate parliamentary control may enhance the transparency of a sector which has inherent characteristics of secrecy. It may also enhance the confidence people have in the European Union.’298 However, it is uncertain whether the JPSG will carry out its monitoring and supervising tasks in a truly effective way, especially bearing in mind that it is supposed to meet in principle twice a year and is composed by up to four members of each national parliament and up to sixteen members of the European Parliament (that is, more than 120 persons).299 Further concerns about Europol’s democratic accountability relate to the position of the European Parliament: except for its budgetary powers in relation to Europol and for minor rights it has been given by the Regulation, the European Parliament has a limited role in the development of internal rules concerning the functioning of Europol, the adoption of a number of which is instead delegated to the Management Board.300 Nevertheless, at least the main rules concerning the processing of data and data protection have been laid down in the Regulation, which the European Parliament and the Council negotiated and concluded on an equal footing. Other two forms of accountability of Europol come via transparency, in particular access to documents, and via the administrative inquiries of the European Ombudsman to which Europol can be subject.301 While the latter was introduced by the Regulation, a right to access to Europol documents was first introduced by the 2003 ‘Danish’ Protocol, which demonstrated a remarkable shift towards the application of the (then) first pillar principles to Europol. The Europol Regulation now refers to Regulation (EC) No 1049/2001, which has been repealed by Regulation (EU) 2018/1725, and calls upon 296 S Peers, ‘Governance and the Third Pillar: The Accountability of Europol’ in D Curtin and RA Wessel (eds), Good Governance and the European Union. Reflections on Concepts, Institutions and Substance (Intersentia, 2005) 253–76 at 259. 297 For the different roles of the European Parliament and the national parliaments in the oversight of Europol throughout the years, see Abazi (n 294) 1129–32. 298 Meijers Committee, ‘Note on the interparliamentary scrutiny of Europol’, CM 1702, 1–6 at 3. See also I Cooper, ‘A New Form of Democratic Oversight in the EU: The Joint Parliamentary Scrutiny Group for Europol’ (2018) 10(3) Perspectives on Federalism 185. 299 Annex I to the Conclusions of the Conference of Speakers of EU Parliaments of 23–25 April in Bratislava (n 288). See D Fromage, ‘The New Joint Parliamentary Scrutiny Group for Europol: Old Wine in New Bottles?’ TARN (The Academic Research Network Blog on EU Agencies & Institutional Innovation) (17 June 2017), https://tarn.maastrichtuniversity.nl/the-new-joint-parliamentary-scrutiny-group-for-europolold-wine-in-new-bottles; C Brière, ‘Cooperation of Europol and Eurojust with External Partners in the Fight against Crime: What are the Challenges Ahead?’, DCU Brexit Institute, Working Paper 1, 2018, https://papers. ssrn.com/sol3/papers.cfm?abstract_id=3102394, 22–24; Schinina (n 294) 132. Likewise, the Meijers Committee (n 298) had suggested setting up ‘a small group of parliamentarians (from both the European and the national levels) that would be able to act effectively and rapidly’. 300 See art 11 of the Europol Regulation for the list of decisions the adoption of which is bestowed upon the Management Board. 301 ibid art 69. For some remarks on the accountability of EU agencies to the Ombudsman, see Busuioc (n 1) 221–45.

Europol 383 the Management Board to adopt the detailed rules for access to Europol documents.302 Furthermore, pursuant to an amendment put forward by the European Parliament during the negotiations of the Regulation, the agency should publish on its website a list of the Management Board members, summaries of the outcome of the Management Board meetings,303 and a list of adequacy decisions, agreements and administrative arrangements relating to the transfer of personal data to third countries and international organisations.304

ix. Relations with Partners Article 23 of the Regulation sets out the common rules for Europol’s relations with the partners and is followed by four provisions laying down in detail the requirements that should be met in order for Europol to exchange personal data with EU bodies,305 third countries and international organisations,306 private parties307 and private persons.308 The principles governing such exchanges of personal data can be summarised as follows: 1.

Information cannot be processed if it has ‘clearly’ been obtained in ‘obvious’ violation of human rights.309 2. Europol may receive and process personal data from the entities mentioned above ‘in so far as necessary and proportionate for the legitimate performance of its tasks’310 and subject to the conditions provided for in Articles 23–27 of the Regulation. 3. Europol may transfer personal data to its partners, in accordance with the Regulation, if necessary for preventing and combating crimes for which Europol is competent and ‘if the recipient gives an undertaking that the data will be processed only for the purpose for which they were transferred’;311 if the data have been provided by a Member State, the latter should also give its consent – which can be withdrawn at any time – unless it ‘has granted its prior authorisation to such onward transfer’;312 similarly, if a partner of Europol intends to transfer data held by Europol, the agency should give its prior explicit authorisation.313 4. Europol should record all transfers of personal data and the grounds thereof.314 Once these conditions are met, Europol can directly transfer personal data to another EU body,315 a broad category encompassing institutions, bodies, missions, offices and

302 ibid

art 65(1) and (2) respectively. art 65(4). 304 ibid art 25(3). 305 ibid art 24. 306 ibid art 25. 307 ibid art 26. 308 ibid art 27. 309 ibid art 23(9). This overarching principle is also enshrined in Recital 39. 310 ibid art 23(5). 311 ibid art 23(6). 312 ibid. 313 ibid art 23(7). 314 ibid art 23(8). 315 ibid art 24. 303 ibid

384 Bodies, Offices and Agencies agencies set up by or on the basis of the TEU and the TFEU.316 Over the years, Europol has concluded a number of agreements with EU bodies, including Eurojust, OLAF, CEPOL, the European Border and Coast Guard Agency (Frontex), the European Union Intellectual Property Office (EUIPO, previously known as Office for the Harmonisation in the Internal Market (OHIM)), the Commission and the European Central Bank.317 The relations of Europol with other EU bodies raise the issue of the extent of cooperation between bodies established for different purposes, including the exchange of data between these bodies as well as the risks of overlap and reluctance to cooperate.318 As for Europol’s relations with third countries and international organisations, prior to the entry into force of the Lisbon Treaty, Europol could sign international agreements with its partners.319 It had therefore concluded 16 ‘operational’ agreements with third countries – allowing for the exchange of both strategic and personal data – and four ‘strategic’ agreements – pursuant to which only strategic information can be exchanged. Strategic agreements were notably concluded with Russia and China.320 The operational agreements with Canada and Australia are also worth mentioning, as well as those with the US, which raised some concerns in terms of data protection.321 The strong Europol’s commitment to reinforce its role as a global actor in international policing led the agency to also sign an agreement with the World Customs Organization and the United Nations Office on Drugs and Crime (UNODC), as well as Interpol. More recently, Europol has been awarded observer status in the Egmont Group of Financial Intelligence Units.322 However, in the aftermath of the Lisbon Treaty, the power to conclude international agreements sits only with the Council, in accordance with the procedure set out in Article 218 TFEU. At most, Europol can adopt working arrangements with its partners, but these arrangements do not allow the exchange of personal data and do not even bind the EU and the Member States.323 If it complies with the general requirements listed above, Europol could therefore exchange information, including personal data, with third countries and international organisations on the basis of such Council’s agreements, which should adduce ‘adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals’.324 However, three further options are available. First, Europol can exchange information with international partners pursuant to previously signed

316 ibid art 2(d). 317 The text of these agreements, as well as a list of all Europol’s partners, are available on Europol’s website. 318 See section VII below on inter-agency cooperation. 319 Europol’s international dimension has been examined in depth by F Coman-Kund, European Union Agencies as Global Actors: A Legal Study of the European Aviation Safety Agency, Frontex and Europol (Routledge, 2018), especially at 274–328. 320 The agreement with China was signed in April 2017, a couple of weeks before the entry into force of the Europol Regulation. 321 See, among others, Guild et al (n 132) 73–74. 322 See more on the Europol website (at https://www.europol.europa.eu/newsroom/news/increasedcooperation-between-egmont-group-and-europol). Europol financially supports FIU.net, the network of EU financial intelligence units located in each Member State (https://www.europol.europa.eu/about-europol/ financial-intelligence-units-fiu-net). 323 Article 23(4) of the Europol Regulation. 324 ibid art 25(1)(b).

Europol 385 operational agreements,325 which remain valid for the time being.326 Second, information with third countries or international organisations can also be exchanged if the Commission has adopted an ‘adequacy decision’, ie, if that country or organisation is deemed to ensure an adequate level of protection of individuals with regard to the processing of personal data.327 In this context, the principles laid down in the Schrems case by the CJEU should be adequately considered in the evaluation of the third country’s regime of data protection: ‘the term “adequate level of protection” must be understood as requiring the third country in fact to ensure … a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union’ (emphasis added).328 Finally, the Director can authorise the transfer of personal data to third countries and international organisations on a case-by-case basis for the exceptional – but admittedly broadly phrased – reasons listed in the Regulation.329 As far as private parties (ie, legal entities) and private (ie, natural) persons are concerned, Europol may exchange information, including personal data, with them, in accordance with the ‘stringent conditions’330 provided for in Articles 26 and 27. Two main principles inspire the provisions at hand. First, personal data from private person and bodies are processable as far as they are received via a national unit or via a contact point or a competent authority of a third country which is subject to an adequacy decision of the Commission or with which an (operational) agreement has been signed (either by Europol or by the Council).331 Second, Europol should not contact private parties and persons to retrieve information.332 A relevant difference between these two categories of Europol’s partners exists: in exceptional circumstances and on a case-bycase basis, Europol can only transfer personal data to private parties (even if established outside the EU), but never to private persons.333 However, at present, the exchange of data with private partners seems unsatisfactory.334 In sum, calls to enhance Europol’s efficiency, along with an increased emphasis in the EU on intelligence-led policing and inter-agency cooperation, have created a legal framework that allows Europol to substantially expand its analytical capacity, in particular by establishing channels of cooperation with a wide range of public and private authorities both within and outside the EU. However, this expansion of Europol’s powers

325 ibid art 25(1)(c). 326 ibid art 25(4). 327 ibid art 26(1)(a). 328 Case C-362/14, Schrems, judgment of 6 October 2015, EU:C:2015:650, para 73. See also Opinion 1/15 of the Court on the agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data (PNR), delivered on 27 July 2017, EU:C:2016:656, para 134; Case C-311/18, Facebook Ireland and Schrems, judgment of 16 July 2020, EU:C:2020:559 (hereinafter ‘Schrems II’). 329 See art 25(5) of the Europol Regulation. 330 ibid Recital 23. 331 ibid arts 26(1) and 27(1). 332 ibid arts 26(9) and 27(4). 333 See especially ibid art 26(5) and (6) on the transfer of personal data to private parties. Article 27(5) instead states that ‘Europol may not transfer personal data to private persons’. 334 ‘Europol today faces a number of serious constraints – notably as regards the direct exchange of personal data with private parties – which hinders it from effectively supporting Member States in combating terrorism and crime’ (Commission, ‘Communication on the EU Security Union Strategy’ COM (2020) 605 final, Brussels, 24 July 2020, 21). See also the Council conclusions on Europol’s cooperation with Private Parties, Council Doc 14745/19, Brussels, 2 December 2019.

386 Bodies, Offices and Agencies poses some challenges for the protection of fundamental rights in the EU, in particular privacy. While the Regulation tries to strike a balance between the different interests at stake, it remains to be seen whether it will manage to achieve such a delicate balance.

C. The Future of Europol: The Revised Regulation On 9 December 2020, the Commission presented a proposal for a Regulation amending the Europol Regulation, with a view to enhancing Europol’s mandate.335 The proposal – which is accompanied by a two-part Impact Assessment, but is not based on a previous evaluation of the Europol Regulation336 – encompasses a wide-ranging revision of Europol’s tasks. At the time of writing, negotiations on the text are ongoing. First, the proposal aims to enable Europol to cooperate effectively with private parties – an open-ended category that may include NGOs as well as financial institutions – in countering criminal offences committed in abuse of the cross-border services of private parties. The proposal aims to establish the agency as a central point of contact in case of multi-jurisdictional or non-attributable datasets. Europol will be enabled to: (a) receive personal data directly from private parties on a more regular basis; (b) inform such private parties of missing information; and (c) ask Member States to request private parties to share further information. In addition, Europol can provide its infrastructure for the exchange of data between national authorities and private parties and can support Member States in preventing the large-scale dissemination of terrorist content or violent extremism. These changes would constitute a considerable paradigm shift for the agency, which is in line with the emergence of the trend in past years to establish direct channels of communication between law enforcement and private parties and foster a public/private partnership. Applying this approach to Europol requires detailed rules on the duties of Europol, Member States and the private sector, eg, when the private parties may refuse to cooperate, as well as provisions on independent authorisation of transfers and remedies for individuals. Whereas certain safeguards are included in the proposal – eg, the requirement for ‘absolute’ or ‘strict’ necessity when information is shared with private parties337 – additional safeguards are mentioned in the Impact Assessment accompanying the proposal,338 but are not explicitly stated in the main text, 335 ‘Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation’ COM (2020) 796 final, Brussels, 9 December 2020 (hereinafter ‘Commission’s proposal for a revised Europol Regulation’). This section draws upon V Mitsilegas and N Vavoula, ‘Strengthening Europol’s Mandate: A Legal Assessment of the Commission’s Proposal to Amend the Europol Regulation’, Study for the LIBE Committee of the European Parliament, 2021. 336 Article 68(1) of the Europol Regulation provides that: ‘By 1 May 2022 … the Commission shall ensure that an evaluation assessing, in particular, the impact, effectiveness and efficiency of Europol and of its working practices is carried out. The evaluation may, in particular, address the possible need to modify the structure, operation, field of action and tasks of Europol.’ 337 See the proposed new wording of art 26(5) and (6) of the Europol Regulation (art 1(12) of the Commission’s proposal for a revised Europol Regulation). 338 See Commission, ‘Staff Working Document – Impact Assessment Report accompanying the document Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/79, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of c riminal

Europol 387 which does not provide for the involvement of the EDPS before the agency makes such transfers either. The proposal also aims to enable Europol to process large and complex datasets following the admonishment of the agency by the EDPS on 17 September 2020.339 To face the ‘big data challenge’, Europol would be enabled to conduct ‘pre-analyses’ of large and complex datasets received and identify whether these concern individuals whose personal data may be processed by Europol in line with Annex II to the Europol Regulation.340 The prior processing would be limited to a maximum period of one year, which can be extended following authorisation by the EDPS. Another objective of the proposal is to strengthen Europol’s role in the fields of research and innovation. Europol will process personal data for research and innovation matters for the development of tools, including the use of Artificial Intelligence for law enforcement.341 When developing new technologies, extensive processing of large quantities of personal data may be required, for example, to create and test algorithms or for encryption. Therefore, the potential impact of such processing for research and innovation purposes on the principle of non-discrimination and the rights to respect for private life and protection of personal data should be adequately guaranteed. The proposal would also enable Europol to enter data into the Schengen Information System342 and to request the competent authorities of the Member States to initiate, conduct or coordinate an investigation of a crime that affects a common interest covered by an EU policy, regardless of the cross-border nature of that crime.343 In the negotiations that followed the presentation of the Commission’s proposal, this new Europol power to request the initiation of investigations by national authorities has been met with great scepticism by the Member States, to the extent that at the time of writing, it does not appear that this reform will take place. A large majority of Member States have considered that no further obligation to act at the request of Europol should be imposed on the Member States, as that would be disproportionate, because it arguably encroaches upon national sovereignty.344 Furthermore, the Commission’s proposal aim to strengthen Europol’s cooperation with the European Public Prosecutor’s Office (EPPO) by aligning the Europol Regulation with the Regulation that established the EPPO,345 as well as with third countries, and by enabling the Executive Director to authorise not only transfers, but also ‘categories of transfers’ of personal data to third countries or international organisations

investigations, and Europol’s role on research and innovation Part 1/2’ SWD (2020) 543 final, Brussels, 9 December 2020, 47. 339 EDPS Decision of 17 September 2020 on the own initiative inquiry on Europol’s big data challenge. 340 Proposed art 18(5)a of the Europol Regulation (art 1(5) of the Commission’s proposal for a revised Europol Regulation). 341 Proposed art 33a of the Europol Regulation (art 1(19) of the Commission’s proposal for a revised Europol Regulation). 342 Proposed art 4(1)(r) of the Europol Regulation (art 1(2) of the Commission’s proposal for a revised Europol Regulation). 343 See the proposed new wording of art 6(1) of the Europol Regulation (art 1(3) of the Commission’s proposal for a revised Europol Regulation). 344 Mitsilegas and Vavoula (n 335) 60. 345 Proposed art 20a of the Europol Regulation (art 1(8) of the Commission’s proposal for a revised Europol Regulation). On the EPPO, see section V below.

388 Bodies, Offices and Agencies in specific situations and on a case-by-case basis.346 While the latter is a seemingly minor change in Europol’s legal framework, this reform may pose significant legal challenges if it ended up broadening the remit of Europol’s transfers of data – notably because it is not entirely clear what is meant by ‘categories of transfers’ – from criminal investigations on specific suspects to surveillance activities in general, thus changing Europol’s powers. Finally, in addition to some provisions that would strengthen the data protection framework applicable to Europol, the Commission’s proposal aims to enhance the agency’s political accountability and parliamentary scrutiny by enabling the JPSG to receive annual information concerning the proposed new Europol’s powers (eg, information regarding the number of cases in which Europol issued follow-up requests to private parties, issued alerts in the Schengen Information System, or processed personal data outside the categories of data subjects listed in Annex II, as well as information about the number of pilot projects in which Europol processed personal data to train, test and validate algorithms for the development of tools, including Artificial Intelligencebased tools, for law enforcement).347 While this is certainly a welcome addition, the proposal does not address the above-mentioned concerns relating to the structure and functioning of the JPSG, the political scrutiny of which is therefore likely to remain overall limited. The Commission’s proposal entails considerable paradigm shifts in the way in which Europol operates and in its relationship with the Member States and third parties. These reforms have been proposed before an evaluation of the Europol Regulation was conducted, which hinders a proper and in-depth assessment of Europol’s work. The proposal aims to ensure that the agency can continue to play its key role in the fast-evolving field of law enforcement, strengthening its ties with traditional and new partners, and entrusting it with powers that are sufficiently flexible and up to date to face new challenges and threats, yet this makes the strict compliance of the new Europol legal framework with the EU acquis on fundamental rights and data protection all the more important.

D. Final Remarks Europol’s identity and mission have partially changed over the years, and may continue to change in the future. Established as an intergovernmental body, Europol has progressively acquired the status of an EU agency. Despite the improvements brought about by the Regulation – and despite the known definition of Europol as ‘perhaps the most controlled police agency in Europe’348 – Europol seems to inevitably owe more allegiance

346 See the proposed new wording of art 25(5) of the Europol Regulation (art 1(11) of the Commission’s proposal for a revised Europol Regulation). 347 Proposed art 51(3)(f), (g), (h) and (i) (art 1(37) of the Commission’s proposal for a revised Europol Regulation). 348 Fijnaut (n 119) 255.

Europol 389 to Member States than EU institutions; some gaps still exist with regard to the judicial review of its acts and its democratic accountability at the EU level. Practitioners increasingly appreciate Europol’s contribution to the fight against crossborder crime,349 and the Commission presented a proposal to strengthen its mandate in December 2020.350 Information-related tasks, namely (operational and strategic) analysis and facilitation of exchange of information, still represent the core of Europol’s activities, yet the agency has recently been given more ‘operational’ powers. Although Europol is not entitled to adopt coercive measures, the opportunities for its staff to work much closer to, and if necessary on the ground with, national authorities are now much more frequent than in the past. Coupled with an increasing number of strategic tasks, the enhanced role of Europol suggests that the traditional boundaries between ‘operational’ and ‘non-operational’ powers have become rather blurred: ‘gathering and processing information, as Europol does, generates “knowledge” and produces “evidence”, which by their very essence are no different from a traditional house search conducted by a police unit using its operational power’.351 As some authors have argued, Europol’s ‘tools and activities are of great importance for operational measures in Member States. Not only can its staff take part in national and joint investigations, but, more importantly, if Europol does its job correctly, the information collected and analysed will set off operational measures in Member States’.352 Europol’s success depends to a large extent on the willingness of national authorities to share information with the agency. The more domestic bodies resort to Europol, the more the latter is in a position to carry out its operational and strategic tasks and collect useful information in view of further sharing relevant knowledge. Somehow paradoxically: ‘Europol cannot oblige member states to cooperate and it relies entirely on member states’ willingness to participate. At the same time, however, Europol’s ability to bring about results is tightly related to member states’ input and participation.’353 In its more than 20-year history, Europol has often struggled with the reluctance of national authorities that were and are sometimes not very keen to share their data. This has also been due to a scarce knowledge of Europol’s work – to which the not always transparent functioning of the agency may have contributed, especially during the early stages of its activities. Europol’s activities have also triggered some criticism as regards their effectiveness, especially because of the fragmentation of information stored in its databases. The Europol Regulation envisages a new system of data processing inspired by a ‘privacy by design’ approach, which aims to overcome the obstacles emerged over the years and to ensure an adequate protection of the fundamental rights potentially affected by data processing. For an agency that almost by definition works in secrecy, human rights have always been a thorny issue. As far as the internal functioning of the agency is concerned,

349 See S Hufnagel, Policing Global Regions: The Legal Context of Transnational Law Enforcement Cooperation (Routledge, 2021). 350 See section II.C above. 351 Gless (n 93) 464. 352 Jonsson Cornell (n 204) 154. See also Mitsilegas and Giuffrida (n 180). 353 Busuioc (n 1) 148. See also Groenleer (n 93) 298.

390 Bodies, Offices and Agencies the 2016 Directive on the protection of personal data in criminal matters does not apply. It ought to be noted that while the claimed specificity of law enforcement context may not be sufficient to leave aside existing EU legislation on data protection, the Europol Regulation nonetheless provides for several rules on the matter. In addition, the Charter will apply to Europol’s activities and the extensive CJEU case law should also be taken into account.354 The adequate protection of human rights connected with data processing activities is also a key issue in the agreements of Europol with its partners. Europol is committed to liaising with many state and non-state actors, although the post-Lisbon legal regime prevents the agency from concluding international agreements with potential partners. In terms of data protection, due attention should be paid in this context to the principles laid down by the CJEU in Schrems, which require an ‘essentially equivalent’ level of protection of fundamental rights in third states. Furthermore, due to its privileged position as the ‘EU criminal information hub’,355 Europol has become a central actor in EU criminal policy. In its threat assessments on serious and organised crime (SOCTAs), it singles out the most relevant criminal threats affecting the EU, which the Council usually rubber-stamps and identifies as ‘crime priorities’ in the EU Policy Cycles. This crucial function of Europol has developed outside a clear constitutional framework since the Treaties do not envisage such a strong policy-making role for the agency.356 Europol’s strategic tasks – as well as its more traditional ones (support to and coordination of national police authorities in the fight against cross-border criminality) – bring to the fore the issue of the agency’s relations with other EU bodies, such as the Council, COSI, the Commission, and especially other agencies and offices. Relations with the latter are regulated in a way that should boost inter-agency cooperation, although they seem at times more inclined towards competition than synergy. In particular, Eurojust and Europol – thought to be ‘sister agencies’357 – have not always experienced a smooth process of collaboration, even though recent years have seen some improvements in this respect.358 The partial overlap of their missions brings with it the inherent risk of triggering conflicts between them and inefficiently duplicating tasks and functions.359

354 See for instance Joined Cases C-293/12 and C-594/12, Digital Rights Ireland, judgment of 8 April 2014, EU:C:2014:238; Opinion 1/15 of the Court on the EU-Canada PNR (n 328). 355 ‘Europol Strategy 2020+’, https://www.europol.europa.eu/europol-strategy-2020, 4. 356 See M Busuioc and D Curtin, ‘The EU Internal Security Strategy, the EU Policy Cycle and the Role of (AFSJ) Agencies: Promise, Perils and Pre-requisites’, Study for the LIBE Committee of the European Parliament, 2011, 7. See also Scherrer, Jeandesboz and Guittet (n 194) 88. The expertise of Europol on strategic matters can also expand beyond the EU borders, since the agency can contribute to the evaluation of states that are candidates for accession to the EU by providing strategic analyses and threat assessments at the request of the Council or the Commission (Recital 7). 357 A Weyembergh, I Armada and C Brière, ‘The Inter-agency Cooperation and Future Architecture of the EU Criminal Justice and Law Enforcement Area’, Study for the LIBE Committee of the European Parliament, 2014, 11. 358 For more on this, see sections III and VII below. 359 For instance, Eurojust is increasingly committed to carrying out strategic activities concerning terrorism, namely a field where Europol has been playing its strategic role since the times of the Europol Convention. See more in section III.B.iii.c below.

Eurojust 391

III. Eurojust A. Background The establishment of Europol was coupled with calls to apply this model of promoting European integration in the sphere of police cooperation in the EU via an agency to the field of judicial cooperation in criminal matters. In this context, ideas for the establishment of an EU ‘judicial’ body in criminal matters were put forward – its name, Eurojust, appears to be a clear analogy to the use of the term ‘Europol’.360 A body like Eurojust was envisaged as a ‘counterpart’ to Europol, although views on the precise relationship between the two bodies were far from uniform: one view envisaged Eurojust’s role as a judicial back-up to Europol’s activities;361 another perceived Eurojust action as necessary to legitimise police action at the national and EU levels;362 and a third view went further, arguing that Eurojust should take over the judicial supervision of Europol.363 In any case, the establishment of Europol provided an important precedent for the establishment of greater cooperation and coordination, and the development of EU structures operating in the field of judicial cooperation in criminal matters. While rules on Eurojust are currently provided for by Regulation (EU) 2018/1727 (hereinafter the ‘Eurojust Regulation’),364 the first major attempt to coordinate EU action in the field dates back to 1998, when a Joint Action establishing the European Judicial Network (EJN) was adopted.365 Far from being a centralised EU body, the network consists of national contact points – members of the national judicial authorities responsible for judicial cooperation in criminal matters – which provide legal and practical information to local judicial authorities in other countries to prepare effective judicial cooperation requests. The function of contact points is to be: [A]ctive intermediaries with the task of facilitating judicial cooperation between Member States, particularly in actions to combat forms of serious crime. They shall be available to enable local judicial authorities and other competent authorities in their own Member State, contact points in the other Member States and local judicial and other competent authorities in the other Member States to establish the most appropriate direct contacts. (Emphasis added)366 360 For a detailed analysis of the background to the establishment of Eurojust, with a specific focus on the role of the different EU institutions in its development, see M Mangenot, ‘Jeux Européens et Innovation Institutionnelle: Les Logiques de Création d’Eurojust’ (2006) 62 Cultures et conflits 43. 361 Commission, ‘Communication on the Establishment of Eurojust’ COM (2000) 746 final, Brussels, 22 November 2000, 10. 362 H Labayle, ‘Three Principles of Reflection’ in Notre Europe, Protecting European Citizens against International Crime (Notre Europe, 2000), 12–22 at 20. 363 See the written evidence of Joachim Vogel to the House of Lords European Union Committee, Judicial Cooperation in the EU: The Role of Eurojust, 23rd Report, session 2003–04, HL Paper 138, 105–06. 364 Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA [2018] OJ L295, 21 November, 138. 365 [1998] OJ L191, 7 July, 4. The Joint Action was subsequently repealed by Council Decision 2008/976/JHA of 16 December 2008 on the European Judicial Network [2008] OJ L348, 24 December, 130 (hereinafter the ‘EJN Council Decision’). On the background to the EJN and, later, to Eurojust, see H Nilsson, ‘Eurojust: The Beginning or the End of the European Public Prosecutor?’, paper presented to the third Eurojustice conference in Santander, Spain, 24–27 October 2000 (typescript with the author). See also G Vermeulen, ‘A European Judicial Network linked to Europol? In Search of a Model for Structuring Trans-national Criminal Investigations in the EU’ (1997) 4(4) Maastricht Journal of European and Comparative Law 346. 366 Article 4(1) of the EJN Council Decision.

392 Bodies, Offices and Agencies National authorities usually consult the contact points to be instructed on how, and to whom, requests for mutual legal assistance or mutual recognition should be sent. Notwithstanding the establishment of the EJN, the idea of the creation of an EU-wide body still remained. This was in view of various factors which were perceived as impeding effective judicial cooperation, such as the lack of trust between national authorities, problems in the implementation of the relevant Conventions and in language and translation, processing delays, lack of training and resources, and problems in legal harmonisation regarding criminal offences, especially organised crime. These problems were already highlighted in 1997 and led to the proposal for the establishment of a Judicial Cooperation Unit.367 The role of the Council Secretariat in pushing for the development of such a unit (and eventually Eurojust) has been central, with Council officials reportedly promoting the creation of such a unit at various crucial stages of the formation of the EU Justice and Home Affairs strategy by the European Council or the various EU presidencies.368 The development of Eurojust in that period must be viewed in the context of the ongoing debate regarding the nature and extent of European integration in criminal matters across the EU. In the second half of the 1990s, the Commission on the one hand advocated a largely harmonised, almost uniform model of EU criminal justice by commissioning the corpus juris project and floating ideas about the establishment of a European Public Prosecutor (EPP) on the other hand. At the same time, a number of Member States appeared reluctant to go that far; on the contrary, they stressed the intergovernmental character of the third pillar and put forward alternatives to harmonisation in criminal law, in particular mutual recognition. The role of this tension in discussions on Eurojust has been demonstrated eloquently by Hans Nilsson, one of the Council Secretariat officials who have been instrumental in the establishment of this body, who stated: It is in the crossroads between these two ‘ideologies’/tendencies that Eurojust is situated. In fact, it is highly likely that Eurojust would never had seen the day had it not been for the fact that its very idea has something that could satisfy both ‘camps’ – for one it is the beginning, for the other it is the end.369

Indeed, the tension between these two ‘camps’ has been a prevailing feature in both the negotiations and finally agreed content of the legislation establishing Eurojust. The debate on Eurojust involved both its eventual powers and role (where tensions between the intergovernmental and more supranational ‘camps’ could be discerned), but also its very existence and relationship with other proposals which were on the table in the 1990s – in particular, proposals on the establishment of the EPP (with Eurojust being perceived by some as an intergovernmental ‘Trojan Horse’ aiming at annulling in practice more integrationist proposals such as the EPP). Eurojust seemed to have won this latter ‘battle’ at the EU constitutional level at the time – the Nice Treaty included a specific legal basis for Eurojust370 and nothing on the EPP.371 However, as will be seen below, the EPP resurfaced (ironically, perhaps, ‘from Eurojust’) under the Lisbon Treaty. 367 For a detailed analysis, see Nilsson (n 365). 368 For a detailed background and a fascinating name-dropping exercise, see Mangenot (n 360). 369 Nilsson (n 365) para 3. 370 See the amended version of previous art 31 TEU. 371 On the background to the Commission reactions to the Nice developments, see Mangenot (n 360). Mangenot also cites an article in Les Échos asserting that Eurojust has been included in the Nice Treaty, as if it

Eurojust 393 The momentum towards the establishment of Eurojust in the late 1990s was reflected in the Tampere European Council Conclusions: To reinforce the fight against serious organised crime, the European Council has agreed that a unit (EUROJUST) should be set up composed of national prosecutors, magistrates, or police officers of equivalent competence, detached from each Member State according to its legal system. EUROJUST should have the task of facilitating the proper co-ordination of national prosecuting authorities and of supporting criminal investigations in organised crime cases, notably based on Europol’s analysis, as well as of cooperating closely with the European Judicial Network, in particular in order to simplify the execution of letters rogatory. The European Council requests the Council to adopt the necessary legal instrument by the end of 2001.372

This impetus by the Tampere European Council (which defined the mission of Eurojust in rather general terms),373 along with different views on the nature of Eurojust and perhaps a desire by certain Member States to assume ownership of the idea,374 resulted in not one but two legislative proposals for the establishment of Eurojust: one from Germany375 and one from the four EU presidencies which would have to negotiate Eurojust until the final deadline of the end of 2001 (Portugal, France, Sweden and Belgium, or the ‘four presidencies’).376 These initiatives were characterised by marked differences regarding the unit’s nature and powers, as well as data protection issues.377 The ‘four presidencies’ proposal already contained a number of compromise provisions resulting from earlier consultations regarding the role of Eurojust.378 During the course of negotiations, three major issues of controversy arose, all inextricably linked to the nature and powers of Eurojust, and all reflecting the various models put forward with regard to the unit’s development.379 The first controversial issue concerned the offences falling within the remit of Eurojust. The Tampere Conclusions referred to the role of Eurojust in reinforcing the fight against ‘serious organised crime’, without further specification. In negotiations, a number of views were put forward regarding the delimitation of Eurojust’s mandate in this context. In its Communication ‘on the establishment of Eurojust’, the Commission opted for the inclusion within its remit of ‘all major criminal offences’ in respect of which judicial legal assistance might be required. The Commission justified this approach in view of the general Tampere mandate and of the fact that the establishment of a list of offences, rather than a general reference to serious crime, would require a new Council decision if it were to be amended.380 A general mandate was also supported by Member States such has ‘slid in the bed prepared for the EPP’ (‘comme s’il c’était glissé dans le lit prepare pour le parquet européen’) (at 57). 372 European Council’s Conclusions, Tampere, 1999, para 46. 373 On this point, see S Brammertz, ‘Eurojust: Parquet Européen de la Première Génération?’ in G de Kerchove and A Weyembergh (eds), Vers un Espace Judiciaire Pénal Européen (Éditions de l’Université de Bruxelles, 2000) 105–18. 374 Mangenot ((n 360) 51) argues that Germany had tabled its own proposal before the planned proposal by the four presidencies in order to claim ‘paternity’ of the proposal. Hans Nilsson ((n 365) para 19) also refers to Germany as claiming ‘maternity rights’. 375 [2000] OJ C206, 19 July, 1. 376 [2000] OJ C243, 24 August, 15. 377 Nilsson (n 365). 378 Mangenot (n 360) 52. 379 See Mitsilegas, Monar and Rees (n 3) 119–21. 380 Commission (n 361) 2–3.

394 Bodies, Offices and Agencies as the UK, arguing that competence expressed in general terms would be in the interests of flexibility.381 Different views advocated the adoption of a list of offences forming Eurojust’s mandate, with some support for aligning Eurojust’s mandate with that of Europol (thus transplanting the offences mentioned in the Europol Convention into the eventual Eurojust instrument).382 This view largely reflects the perception of Eurojust as a ‘counterpart’ to Europol. Another controversial issue regarding Eurojust’s mandate concerned the inclusion within Eurojust’s mandate of fraud against the Community budget.383 Inclusion of fraud in Eurojust’s mandate could have significant repercussions regarding its nature and relationship with other EU structures (in particular, OLAF and – if established – the EPP). A further controversial issue involved the status and powers of Eurojust and its members. Regarding status, the prevailing view was to grant the unit a separate legal personality.384 The situation was less clear-cut regarding the unit’s powers. The Commission noted that the existing consensus at the time of its Communication centred on a common denominator that was so low that the tasks in question could also be carried out by the EJN.385 However, the exact delimitation of such tasks was controversial, in view of the differences between Member States. A further issue of controversy concerned the status and position of Eurojust members. Certain Member States were not in favour of replicating the Europol model, but emphasising the ‘Union’ character of Eurojust members. However, this approach would clash with more ‘intergovernmentally minded’ Member States wishing to retain a national dimension into Eurojust,386 arguably in order to dispel the potential development of Eurojust from a more ‘intergovernmental’ coordinating body into a centralised Euro-unit reminiscent of the EPP. For that reason, the role, status and powers of national members have been central, existential issues to the development of Eurojust. A further issue of controversy in negotiations was the relationship of Eurojust with other EU institutions and bodies. An overlap could arise with the activities of the EJN, as both bodies would have as their general task the enhancement of judicial cooperation in criminal matters. However, it was believed that no major problems would arise as, while Eurojust was envisaged to operate on an independent, EU-wide basis, the EJN would operate within a national context and was limited to bilateral cooperation.387 Queries have also been raised regarding the extent of the involvement of the Commission (including OLAF) in the work of Eurojust. There has been pressure to associate the Commission with the latter’s work in full,388 but the precise involvement of the 381 See letter from Bob Ainsworth, then Parliamentary Under Secretary of State, Home Office, to Lord Brabazon of Tara, then Chairman of the House of Lords Select Committee on the European Union, 29 November 2001, in House of Lords Select Committee on the European Union, Correspondence with Ministers, 18th Report, session 2001–02, HL Paper 99, 61. 382 The Commission (n 361) stated that if a list were to be accepted, it should contain the offences in the Europol Convention and the Annex, with particular emphasis on cross-border organised crime. 383 Nilsson (n 365) argues in this respect that competence should not be restricted either to specific offences or to serious crime, otherwise offences such as financial fraud would fall outside of the mandate of Eurojust. 384 For arguments advocating a separate legal personality, see Commission (n 361) 6; and Nilsson (n 365). 385 Commission (n 361) 3. 386 On this clash, see the remarks of Daniel Flore, a Belgian official involved in the Eurojust negotiations, in Mangenot (n 360) 52. 387 See Nilsson (n 365). 388 ibid.

Eurojust 395 Commission in Eurojust has been the subject of lengthy negotiations.389 Moreover, the potential involvement of Eurojust in fraud cases raised the issue of its relationship and potential overlap with OLAF. Last but not least, a number of issues arose with regard to the relationship between Eurojust and Europol. A major issue in negotiations was the ability of Europol to transfer analysed data to Eurojust (and vice versa), and the ability of Eurojust to protect such data in an equivalent manner to that of Europol. Issues relating to the dissemination and use of data were also controversial.390 With negotiations ongoing, the momentum towards the establishment of Eurojust was sustained by the adoption by the Council of a Decision establishing a Provisional Judicial Cooperation Unit (or Pro-Eurojust),391 aimed at being a precursor to Eurojust, located in Brussels and supported by the infrastructure of the Council.392 According to the Pro-Eurojust Decision, the objectives of the Provisional Unit were to improve cooperation and stimulate coordination between national authorities with regard to the investigation and prosecution of serious crime;393 however, there was little in terms of formal legal standards regarding its work (including standards on data protection) in the Pro-Eurojust Decision.394 The establishment of this unit has been characterised as an example of ‘institutional mimetism’, as it is strongly reminiscent of the establishment of the EDU which preceded Europol.395 The unit was competent for ‘serious crime’ in general and its tasks involved the improvement of cooperation between national authorities regarding investigations and prosecutions and the improvement of their coordination. It started work in March 2001 and consisted of a roundtable of 15 prosecutors based in the Council Secretariat.396 The events of 9/11 accelerated negotiations, with agreement reached at the end of the Belgian presidency in December 2001 and the Eurojust Decision finally being adopted in 2002.397 The Decision established Eurojust as ‘a body of the Union’ with legal personality.398 The first Annual Reports revealed that Eurojust’s workload steadily grew year after year, with 2007 witnessing ‘the historic crossing of the threshold of 1,000 cases handled by Eurojust in a single year’.399 However, Eurojust encountered a number of obstacles to its efficient functioning and the years 2006 and 2007 witnessed a momentum towards an increase of Eurojust’s powers.

389 See House of Lords Select Committee on the European Union (n 381) 62. 390 On the relationship between Europol and Eurojust, see Nilsson (n 365); and Commission (n 361) 10. 391 [2000] OJ L324, 21 December, 2. 392 Article 1. 393 Article 2(1). 394 The lack of such standards was also highlighted by the European Parliament Committee on Citizens’ Freedoms and Rights, Justice and Home Affairs (Doc A5–0317/2000 final, 30 October 2000, Rapporteur: E Gebhardt). 395 Mangenot (n 360) 59. 396 Personal communication, DG JHA, Brussels, 5 December 2000. For further details, see Mangenot (n 360) 60. 397 Council Decision 2002/187/JHA of 28 February 2002 setting up Eurojust with a view to reinforcing the fight against serious crime [2002] OJ L63, 6 March, 1. For further remarks on Eurojust under the 2002 Council Decision, see, eg, C van den Wyngaert, ‘Eurojust and the European Public Prosecutor in the Corpus Juris Model: Water and Fire?’ in N Walker (ed), Europe’s Area of Freedom, Security and Justice (Oxford University Press, 2004) 201–40; H Xanthaki, ‘Eurojust: Fulfilled or Empty Promises in EU Criminal Law?’ (2006) 8(2–3) European Journal of Law Reform 175. 398 Council Decision 2002/187/JHA, art 1. 399 2007 Annual Report, 8. All Eurojust Annual Reports are available on Eurojust’s website.

396 Bodies, Offices and Agencies Contributing to this momentum had been the organisation of two seminars, one by the Austrian EU presidency in 2006400 and another by the Portuguese EU presidency in 2007,401 where – in a process reminiscent of the method applied in the Convention on the future of Europe, aiming to give legitimacy to future action – the future of Eurojust was extensively discussed by Eurojust members, representatives of governments and EU institutions, and practitioners and experts from Member States. The second seminar coincided with the publication of a Commission Communication ‘on the role of Eurojust and the European Judicial Network in the fight against organised crime and terrorism in the European Union’.402 These initiatives, all of which focused one way or another on the issue of Eurojust’s powers,403 maintained a momentum culminating into action by Member State governments.404 The Justice and Home Affairs Council of 6–7 December 2007 adopted specific conclusions on Eurojust,405 which were followed shortly afterwards by a draft Council Decision tabled by no fewer than 14 Member States under their third pillar right of initiative, which aimed at amending the Eurojust Decision.406 It is noteworthy that the exercise of the right of initiative under the previous third pillar by Member States pre-empted a proposal on Eurojust by the European Commission, which might have been more ambitious with regard to the powers of Eurojust and the establishment of an EPP.407 Although a number of the elements of the proposal were particularly controversial, the Justice and Home Affairs Council reached a ‘general approach’ on the proposal in July 2008.408 The text, which amended but did not replace the 2002 Eurojust Decision, was eventually published in June 2009,409 20 days after the publication in the Official Journal of the Europol Decision.410 The reason for this delay was the decision by Member States to align the mandate of Eurojust in terms of the offences for which it 400 See the report of the seminar: ‘A Seminar with 2020 Vision: The Future of Eurojust and the European Judicial Network’, Vienna, 25–26 September 2006, Council Doc 14123/06, Brussels, 19 October 2006. 401 See the general report on the seminar: ‘Eurojust: Navigating the Way Forward’, Lisbon, 29 and 30 October 2007, Council Doc 15542/07, Brussels, 21 November 2007. 402 See COM (2007) 644 final, Brussels, 23 October 2007. 403 This issue was also highlighted in Eurojust’s initial contribution to the Commission’s 2007 Communication – see Council Doc 13079/07, Brussels, 20 September 2007. 404 See also the press article by the Justice Ministers of France, Portugal, Spain, Italy, Slovenia and Germany, published in September 2007 and calling, inter alia, for the strengthening of Eurojust, in particular in the context of transnational criminal investigations and the work of JITs: see ‘Maintenant, il faut un vrai espace judiciaire européen’ Le Figaro (15 September 2007). 405 Council Doc 15966/07 (Presse 275), Brussels, 21 December 2007, 25–27. 406 Council Doc 5037/08, Brussels, 7 January 2008. 407 In this context, see ‘EU States Muscle in on Bloc’s Judicial Body’, 6 May 2008, https://euobserver.com/ justice/26082. According to this article, the Commission stated that it would no longer table a legislative proposal on Eurojust as the planning had been overtaken by the submission of the Member States’ initiative. 408 Justice and Home Affairs Council of 24–25 July 2008, Council Doc 11653/08 (Presse 205), Brussels, 29 July 2008, 20. 409 Council Decision 2009/426/JHA on the strengthening of Eurojust and amending Decision 2002/187/JHA setting up Eurojust with a view to reinforcing the fight against serious crime [2009] OJ L138, 4 June 2009, 14. A consolidated text of the 2002 Decision, as amended by Council Decision 2003/659/JHA (OJ L245, 29 September 2003, 44 – this Decision only concerned budgetary issues) and Council Decision 2009/426/JHA, was published – for information purposes only – in Council Doc 5347/3/09, Brussels, 15 July 2009. This text will be referred to as the ‘Eurojust Council Decision’ (or simply ‘Eurojust Decision’). The original Decision and that of 2009 will accordingly be referred to as the ‘2002 (Eurojust Council) Decision’ and the ‘2009 (Eurojust Council) Decision’. 410 See Council Doc 17131/08, Brussels, 20 December 2008.

Eurojust 397 had competence with that of Europol. The new Eurojust Decision introduced a number of significant changes to the earlier text, in particular as regards the clarification and to some extent the expansion of the powers of Eurojust members.411 According to the Preamble to the text, a further enhancement of Eurojust’s operational effectiveness was needed412 and the time had come for Eurojust to become ‘more operational’.413

B. The Eurojust Regulation i. Background A few months after the adoption of the 2009 Eurojust Council Decision, the Lisbon Treaty entered into force. Article 85 TFEU mandates the Council and the European Parliament to adopt, in accordance with the ordinary legislative procedure, regulations that determine Eurojust’s structure, operation, field of action and tasks.414 While Eurojust has developed mainly as a coordination agency aiming to bring together national authorities in order to facilitate cooperation in cross-border cases,415 the Lisbon Treaty has created the possibility of a reconfiguration of the role of Eurojust vis-a-vis national authorities. The Treaty calls for the adoption of secondary legislation that may include, among Eurojust’s tasks, the initiation of criminal investigations and the resolution of conflicts of jurisdiction.416 Granting Eurojust binding powers to initiate criminal investigations – as well as granting express powers in resolving conflicts of jurisdiction – would amount to a significant increase of Eurojust’s powers and a qualitative change in its role.417 However, in order to assuage the concerns of Member States about potential loss of sovereignty in the field, Declaration 27 annexed to the Lisbon Treaty requires that regulations on Eurojust take into account national rules and practices relating to the initiation of criminal investigations. Likewise, Article 85(2) TFEU clarifies that formal acts of judicial procedure are carried out by the competent national officials. Yet, developments throughout the 2010s showed that the Commission prioritised and threw its weight behind the establishment of the EPPO,418 at the expense of a radical reform or increase of the powers of Eurojust. Due to their similar composition and complementary missions, the two bodies were once more linked in the EU political agenda.

411 See more in, eg, I Wieczorek, ‘Understanding JHA Agencies in Context: Where Does Eurojust Lie in the Constitutional Architecture of the Area of Freedom Security and Justice?’ in M Fletcher, E Herlin-Karnell and C Matera (eds), The European Union as an Area of Freedom Security and Justice (Routledge, 2016) 441–58. 412 Recital 2 of the 2009 Eurojust Council Decision. 413 ibid Recital 3. 414 Article 85(1) TFEU. 415 See more below. See also M Labayle and H G Nilsson, ‘The Role and Organisation of Eurojust: Added Value for Judicial Cooperation in Criminal Matters’ in J Monar (ed), The Institutional Dimension of the European Union’s Area of Freedom, Security and Justice (Peter Lang, 2010) 195–216. 416 Article 85(1)(a) and (c) TFEU. 417 For an analysis of art 85 TFEU, see A Weyembergh, ‘Coordination and Initiation of Investigations and Prosecutions through Eurojust’ (2013) 14(2) ERA Forum 177; M Coninsx, ‘Eurojust’ in Mitsilegas, Bergström and Konstadinides (n 93) 441–56, at 451ff. 418 The Treaty of Lisbon provided, for the first time in EU history, a legal basis in EU primary law for the establishment of the EPPO (art 86 TFEU). For more on this, see section V below.

398 Bodies, Offices and Agencies On 17 July 2013 – and shortly after the celebration of Eurojust’s tenth birthday – the Commission released a new proposal for a Regulation on Eurojust.419 The proposal was presented as part of a package also including the proposal for a Regulation on the EPPO420 and a Communication on reinforcing the role of OLAF.421 The overall objective of the Commission’s proposal was to modernise the legal framework of the agency and streamline its functioning and structure in line with the Lisbon Treaty and the 2012 Common Approach on EU Decentralised Agencies, insofar as the nature of Eurojust allows it.422 However, after 18 months, the legislative procedure was stalled for about two years and the negotiations only resumed in May 2017, when those on the EPPO Regulation were almost over. The Eurojust Regulation was eventually agreed in the second half of 2018 and has applied as of December 2019. With the entry into force of the Regulation, Eurojust has formally become an EU agency (the European Union Agency for Criminal Justice Cooperation), while the previous Council Decision labelled it a ‘unit’.423 The UK and Ireland decided to opt in after the Regulation was approved,424 while Denmark, which does not take part in it, concluded an agreement with Eurojust to ensure that operational cooperation will continue.425 Denmark can still have a representative at Eurojust who can participate in the meetings of the agency’s management body (the College) without the right to vote. The agreement also lays down a number of rules concerning the exchange of data between Denmark and Eurojust. The agreement with Eurojust, like that with Europol, builds on the specific status of Denmark: albeit a ‘third state’ vis-a-vis these agencies, it is a Member State of the EU, applies EU legal instruments on data protection and is subject to the CJEU’s jurisdiction. Denmark also contributes to the budget of Eurojust (as well as in that of Europol) and its agreements with the two agencies are conditional upon its continued membership of the Schengen Area.426 In the light of the above, it seems unlikely that the provisions of such agreements can be replicated in potential future agreements between the UK and the two EU agencies.

ii. Structure Reflecting to some extent the vision of Eurojust as the ‘judicial counterpart’ of Europol, the seat of Eurojust is located in The Hague.427 Each Member State has its representative 419 ‘Proposal for a Regulation of the European Parliament and of the Council on the European Agency for Criminal Justice Cooperation (Eurojust)’ COM (2013) 535 final, Brussels, 17 July 2013 (hereinafter ‘Commission’s proposal for a Regulation on Eurojust’). 420 ‘Proposal for a Regulation of the European Parliament and of the Council on the establishment of the European Public Prosecutor’s Office’ COM (2013) 534 final, Brussels, 17 July 2013. 421 Commission, ‘Improving OLAF’s governance and reinforcing procedural safeguards in investigations: a step-by-step approach to accompany the establishment of the European Public Prosecutor’s Office’ COM (2013) 533 final, Brussels, 17 July 2013. 422 Commission’s proposal for a Regulation on Eurojust, Explanatory Memorandum, 3. 423 Article 1 of the Eurojust Council Decision. 424 Commission Decision of 11 July 2019 on the participation of the United Kingdom of Great Britain and Northern Ireland in Regulation (EU) 2018/1727 of the European Parliament and of the Council on the European Union Agency for Criminal Justice Cooperation (Eurojust) [2019] OJ L187, 12 July, 50. 425 ‘Agreement on Criminal Justice Cooperation between Eurojust and the Kingdom of Denmark’, which was adopted in late April 2019 (Council Doc 8599/19, Brussels, 24 April 2019). 426 Article 29(1) of the Eurojust-Denmark Agreement; art 27(1) of the Europol-Denmark Agreement. 427 See Decision 2004/97/EC on the location of the seats of certain offices and agencies of the Union [2004] OJ L29, 3 February, 15. According to its then President, ‘Eurojust was sent to work in The Hague because

Eurojust 399 at Eurojust, the so-called ‘national desk’,428 which is composed of the national member and, in principle, one deputy and one assistant.429 Seconded by the Member States in accordance with their legal systems, the national members, like their deputies, have the status of prosecutors, judges or representatives of a judicial authority with competences equivalent to those of prosecutors or judges under their national law.430 Unlike the previous Decisions, the Regulation standardises the term of office for national members, which is now five years (renewable once).431 All the national members form the College,432 which then elects – from among the national members – the President and the two Vice-Presidents of Eurojust.433 The first President of Eurojust was Mike Kennedy from the UK, who was succeeded by José Luís Lopes da Mota from Portugal, Aled Williams from the UK, Michèle Coninsx from Belgium and Ladislav Hamran from the Slovak Republic. Compared to the previous Decisions, the Eurojust Regulation has modified the rules on the election of the Eurojust’s President to strengthen the agency’s independence from the Council. While in the past the election of the Eurojust’s President had to be submitted to the Council, which approved it acting by qualified majority,434 the Regulation does not re-introduce such a rule. This represents a noteworthy difference between Eurojust and Europol, as the Executive Director of the latter is to be appointed by the Council, which can also remove them from office.435 The President of Eurojust can instead be dismissed only by a decision of the College adopted on the basis of a two-thirds majority of its members.436 The difference in the appointment and removal regime of the agencies’ heads is arguably due to the fact that the status of prosecutors (or even judges) of Eurojust staff calls for more independence from political organs than that of police officers who make up Europol. The Eurojust Regulation, unlike the previous Decisions, also provides that a representative from the Commission takes part in the College meetings, in the same way as a representative from the Commission participates in the Europol Management Board. However, the Eurojust Regulation limits such participation only to those (parts of the) meetings ‘when the College exercises its management functions’ (emphasis added).437 In addition to its core operational tasks, which are discussed below, the Eurojust College also has management functions, such as adopting the budget and a document containing annual and multi-annual programming.438 Over the years, concerns have

Europol was already there’ – Mike Kennedy, oral evidence to the House of Commons Home Affairs Committee for its inquiry on EU Justice and Home Affairs, reproduced in Justice and Home Affairs Issues at European Union Level, 3rd Report, session 2006–07, vol 2, HC 76-II, Q210. 428 Recitals 21 and 22 and arts 11(7) and 12(2)(b) of the Eurojust Regulation. 429 ibid art 7(2). 430 ibid art 7(4). 431 ibid art 7(5). 432 ibid art 10(1)(a). 433 ibid art 11(1). At the time of writing, the German and Slovenian national members are Eurojust’s Vice-Presidents. 434 Article 28(2) of the Eurojust Council Decision. 435 Article 54(2) and (7) of the Europol Regulation. For more on this, see section II.b.ii above. 436 Article 11(6) of the Eurojust Regulation. 437 ibid art 10(1)(b). Article 11(1) of the Eurojust Council Decision only provided that the Commission should be ‘fully associated with the work of Eurojust’. 438 Respectively, arts 61(2) and 15(1) of the Eurojust Regulation.

400 Bodies, Offices and Agencies emerged about the excessively numerous administrative tasks of the College, which prevented it from focusing on its operational functions. In order to strengthen such functions and reduce the ‘administrative workload of national members’,439 the Regulation has established an Executive Board. Composed of the President, the Vice-Presidents, two members of the College designated in accordance with a rotation system and a representative from the Commission,440 the Board is now responsible for taking most of the administrative decisions concerning Eurojust. The participation of the Commission’s representative is in line with the ‘Lisbonisation’ of the agency that the Eurojust Regulation brings about and is meant to enhance its ‘European dimension’.441 Finally, in each Member State, a Eurojust National Coordination System (ENCS)442 should be set up and is to be composed of: national correspondents for Eurojust that Member States are required to designate (one or more per each Member State),443 national correspondents for issues relating to the competence of the EPPO, a national correspondent for Eurojust for terrorism matters,444 a national correspondent for the EJN and up to three other contact points of the EJN, and national members or contact points of the JITs Network and of other networks mentioned in the Eurojust Regulation.445 These persons retain their position and status under national law and facilitate, within their Member State, the carrying out of the Eurojust’s tasks.446 It may be discerned from the above that the Regulation reflects the tensions between the various visions for Eurojust’s role and contains a number of compromise provisions aiming to reconcile competing views and the conflict between a largely ‘intergovernmental’ model on the one hand and a more centralised model on the other.

iii. Eurojust’s Mandate and Powers a. The Eurojust Regulation The Regulation lists the types of crime which fall within the mandate of Eurojust in Annex I,447 which replicates verbatim Annex I to the Europol Regulation (terrorism, 439 ibid Recital 9. 440 ibid art 16(4). 441 ibid Recital 9. 442 ibid art 20. 443 ibid art 20(1). 444 Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and cooperation concerning terrorist offences ([2005] OJ L253, 29 September, 22) made it mandatory for Member States to designate Eurojust national correspondents for terrorism matters (art 2(2)). The Decision has been partially amended by Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA [2017] OJ L88, 31 March, 6. 445 Article 20(3) of the Eurojust Regulation. The Regulation mentions the networks set up by Council Decision 2002/494/JHA of 13 June 2002 setting up a European network of contact points in respect of persons responsible for genocide, crimes against humanity and war crimes ([2002] OJ L167, 26 June, 1), Council Decision 2007/845/JHA of 6 December 2007 concerning cooperation between Asset Recovery Offices of the Member States in the field of tracing and identification of proceeds from, or other property related to, crime ([2007] OJ L332, 18 December, 103), and Council Decision 2008/852/JHA of 24 October 2008 on a contactpoint network against corruption ([2008] OJ L301, 12 November, 38). Article 20(3) provides that, where applicable, any other relevant judicial authority may also be part of the Eurojust national coordination system. 446 Article 20(4) and (7) of the Eurojust Regulation. 447 ibid art 3(1).

Eurojust 401 organised crime, drug trafficking, money-laundering activities etc). Eurojust’s competence also covers offences that are ‘related’448 to those listed in Annex I and may extend to offences other than those of Annex I, where requested by a competent authority of a Member State and ‘in accordance with its tasks’.449 In principle, the Regulation – in accordance with Article 85(1) TFEU – limits Eurojust’s activities to serious crime that concerns two or more Member States.450 However, this comes with two caveats. First, the Regulation aims to set clear boundaries between the competence of Eurojust and that of the EPPO. In essence, Eurojust is not competent with regard to cross-border crimes affecting the EU budget if the EPPO exercises its competence, unless the case involves some of the Member States that currently do not participate in the EPPO and they, or the EPPO, require Eurojust’s intervention.451 Second, Eurojust may also exercise its powers when one of the serious crimes listed in Annex I ‘requires prosecution on common bases’452 – an expression that includes cases involving one Member State and a third country, or even a single Member State if the crime has repercussions at an EU level.453 In the latter case, Eurojust’s support may be sought not only by a competent authority of that Member State but also by the Commission, even though the competent national authorities may oppose the intervention by Eurojust requested by the Commission.454 This provision clearly reflects the delicate balancing exercise which took place in order to ensure the establishment of an EU body in the field, while at the same time reassuring Member States that their sovereignty in the field of criminal justice would remain intact to the greatest extent possible. This delicate exercise also underlines the Regulation’s provisions on the tasks of Eurojust. The provision on Eurojust’s operational functions contains a much longer list than the Eurojust Council Decision,455 yet it does not bestow any new power upon the agency. The core of Eurojust’s activities is still represented by the assistance to national authorities to ensure the coordination of their investigations and prosecutions and improve their cooperation.456 The extent and legal framework of Eurojust’s coordination function are not always clear, and Eurojust’s powers in this context have been at the heart of the debate over what degree of EU centralisation should exist in judicial cooperation in criminal matters. Along the lines of the previous Council Decisions, the Regulation restates that Eurojust can act either through its national members or as a College – the latter will kick in, inter alia, when a case involves investigations or prosecutions ‘which have repercussions at Union level or which might affect Member States other than those directly concerned’.457 448 ibid art 3(4). Similarly to the Europol Regulation, the notion of ‘related’ offences covers criminal offences committed in order to procure the means of committing the crimes listed in Annex I, facilitate or commit those crimes, or ensure the impunity of the persons who committed them. 449 ibid art 3(3). 450 ibid art 2(1). 451 See section V.B.vi below. As per Annex I to the Eurojust Regulation, crimes against the financial interests of the EU fall within the offences over which Eurojust is competent. 452 Article 2(1) of the Eurojust Regulation. 453 ibid Recital 11, and art 3(5) and (6). 454 ibid art 3(6). 455 ibid art 4. cf Art 3(1) of the Eurojust Council Decision. 456 Article 4(1)(b) and (c) of the Eurojust Regulation. 457 ibid art 5(2)(a)(ii).

402 Bodies, Offices and Agencies This can be seen as an attempt to distinguish between bilateral or simpler cases (involving a Eurojust national member and their Member State of origin) and multilateral or more complex cases (involving more than two Member States) – it is particularly in the latter scenario where the question of Eurojust’s powers and the degree of its influence in domestic criminal justice systems come into play. While the Eurojust Decision contained two separate provisions on the tasks of Eurojust acting through its national members and Eurojust acting as a College, the Regulation lists them in a single provision (Article 4) and clarifies that, in principle, Eurojust acts through one or more national members.458 In particular, Eurojust may ask the competent authorities of the Member States concerned – giving its reasons459 – to: (i) undertake an investigation or prosecution of specific acts; (ii) accept that one of them may be in a better position to undertake an investigation or to prosecute specific acts; (iii) coordinate between the competent authorities of the Member States concerned; (iv) set up a JIT in keeping with the relevant cooperation instruments; (v) provide Eurojust with any information that is necessary for it to carry out its tasks; (vi) take special investigative measures; (vii) take any other measure justified for the investigation or prosecution.460 This provision is key in determining the extent of Eurojust’s powers with regard to domestic criminal justice systems. It is noteworthy that Eurojust can ask Member State authorities to undertake an investigation or prosecution of specific acts; however, it cannot compel these authorities to do so (thus addressing – at least in the short term – concerns that Eurojust would have mandatory powers to initiate investigations and prosecutions in Member States following the model of the EPP). The option offered by the Lisbon Treaty for Eurojust to initiate criminal investigations has not been taken up.461 Unlike the EPPO and like Europol, Eurojust was and remains a body that supports national authorities, but does not exercise direct and coercive powers in criminal matters. The Regulation obliges national authorities to respond without undue delay to Eurojust’s requests, but also allows them to refuse to comply with these requests if this would harm essential national security interests or would jeopardise either the success of an ongoing investigation or the safety of an individual.462 The Eurojust Decision provided for a similar rule,463 but it has been found that ‘Eurojust has never received any notifications in cases where national competent authorities have decided not to comply with a formal request of Eurojust’.464 This may be due to the fact that Eurojust does not always 458 ibid art 5(1). As mentioned, Eurojust will act as a College when the case has a strong transnational component. 459 ibid art 4(2). 460 ibid. 461 Article 85(1)(a) TFEU. 462 Article 4(6) of the Eurojust Regulation. 463 cf art 8 of the Eurojust Council Decision. 464 ‘Final report on the 6th round of mutual evaluations on “The practical implementation and operation of the Council Decision 2002/187/JHA of 28 February 2002 setting up Eurojust with a view to reinforcing the fight against serious crime and of the Council Decision 2008/976/JHA on the European Judicial Network in

Eurojust 403 make use of its formal powers. On the contrary, informality seems the preferred avenue of both national authorities and Eurojust members,465 although this raises concerns in terms of legal certainty.466 Another key provision in determining the relationship between Eurojust and domestic competent authorities – which also highlights the prosecutorial nature of Eurojust – concerns the issue of concurrent jurisdictions. An extensive analysis of the issue can be found in Chapter 3. Here it suffices to say that Eurojust can ask national authorities to accept that one of them may be in a better position to undertake an investigation or to prosecute specific acts – again, this is not a mandatory power.467 In addition, where two or more Member States cannot agree on which of them should undertake an investigation or prosecution after a request from Eurojust, the agency should issue ‘a written opinion’ on the case.468 The Council Decision specified that such opinion was not binding. In the proposal for a Eurojust Regulation, the Commission tried to change this, but the Council did not agree. The Preamble to the Regulation now restates that Eurojust’s written opinions ‘are not binding on Member States’ (emphasis added).469 Once again, although the Lisbon Treaty would allow Eurojust to settle conflicts of jurisdiction,470 the Regulation has not enhanced the agency’s role in that respect. However, Eurojust can still be called upon to act as a ‘broker’ between Member States in cases of disagreement as to which jurisdiction should prosecute. At present, there are no clear rules with regard to conflicts of jurisdiction at the EU level. Eurojust has produced – and recently revised – (non-legally binding) guidelines on determining which jurisdiction is best placed to prosecute,471 and a number of the (previous) third pillar instruments contain clauses on conflicts of jurisdiction. However, the lack of clarity with regard to the criteria and the interests they serve raises serious concerns with regard to the possibility of prosecutorial ‘forum shopping’ – is the jurisdiction which is best placed to prosecute the one where a conviction is more criminal matters”’, Council Doc 14536/2/14 REV 2, Brussels, 2 December 2014 (hereinafter ‘GENVAL final report’), 44. GENVAL is the Council Working Party on General Matters including Evaluation, which decided to devote its sixth round of mutual evaluation to the implementation of the Eurojust Council Decision and the EJN Council Decision. The round of evaluation, which was carried out by means of a questionnaire and visits of small groups of experts in each EU country, began in May 2012 and ended two years later, with the final report being published in December 2014. 465 GENVAL final report (n 464) 43–44. According to the report, some national members even ‘found the distinction between “formal” and “informal” artificial, especially practitioners from smaller Member States. An essential part of the daily business is replies to requests received by phone or e-mail’ (at 43). For further remarks on informality within Eurojust, see P Jeney, ‘The Future of Eurojust’, Study for the LIBE Committee of the European Parliament, 2012, 58–59 and 94–95. 466 One of the recommendations of the GENVAL final report is therefore ‘to reflect on how to render more transparent the real workload of national members and national desks’ (GENVAL final report (n 464) 44, emphasis added). See also M Wade, ‘Judicial Control: The CJEU and the Future of Eurojust’ (2013) 14(2) ERA Forum 201, 203–04. 467 For further remarks on the role of Eurojust in conflicts of jurisdiction, see C Deboyser, ‘Eurojust’s Role in the Matter of Choice of Forum’ and H-H Herrnfeld, ‘Mechanisms for Settling Conflicts of Jurisdiction’, both in M Luchtman (ed), Choice of Forum in Cooperation against EU Financial Crime: Freedom, Security, and Justice and the Protection of Specific EU Interests (Eleven International Publishing, 2013) 101–08 and 185–210 respectively; I Patrone, ‘Conflicts of Jurisdiction and Judicial Cooperation Instruments: Eurojust’s Role’ (2013) 14(2) ERA Forum 215. 468 Article 4(4) of the Eurojust Regulation. 469 ibid Recital 14. 470 Article 85(1)(c) TFEU. 471 For further details, see ch 3.

404 Bodies, Offices and Agencies easily obtained? Concerns relating to the proliferation of prosecutorial power at the expense of the defendant are coupled with issues of sovereignty and legitimacy. Should Member States be ordered not to prosecute behaviours which may lead to a criminal conviction in their jurisdiction? It is one thing for Member States to be bound by an EU body/instrument to initiate prosecutions, but quite another for these states to be prevented or prohibited from initiating prosecutions for conduct that may be a serious criminal offence under their law. Sovereignty concerns are clearly reflected in not granting Eurojust legally binding powers to decide which jurisdiction should prosecute. However, the informality of discussions under the auspices of Eurojust does not sit easily with legal certainty in the field.472 A coordination function in cases of concurrent jurisdictions is also envisaged for Eurojust in cases concerning EAWs. The EAW FD allows the executing authorities in Member States to seek the advice of Eurojust when they have to make a decision in cases of multiple requests.473 It also obliges national authorities to inform Eurojust of cases where they cannot observe the time limits for the execution of an EAW provided for therein, giving reasons for the delay.474 Details of such notifications can be found in the Eurojust Annual Reports. Due to its nature as a central European body committed to enhancing cooperation and coordination among national authorities, Eurojust is in an ideal position to ‘monitor’ the functioning of judicial cooperation instruments.475 Refraining from granting Eurojust a binding say over the initiation of investigations and prosecutions in Member States has been one way of addressing the willingness of Member States to keep their criminal justice systems ‘immune’ from mandatory EU intervention by Eurojust. In the 2002 Eurojust Council Decision, another way of preserving state sovereignty was to define to a large extent the powers of Eurojust members on the basis of national law. One means of reliance on national law has been the distinction mentioned above between Eurojust acting as a College and acting via its national members. It has been rightly argued that this ‘hybrid’ solution created a certain flexibility towards the future development of Eurojust, while at the same time addressing the concerns of reluctant Member States.476 However, the emphasis on national law also contributed to the lack of clarity. The determination of the powers of Eurojust national members by reference to the domestic law of their state of origin had resulted in considerable discrepancies with regard to the way in which Member States had actually defined these powers. A number of Member States had not implemented the Eurojust Decision in their domestic legal order. For instance, implementation had not been 472 See also Jeney (n 465) 74–76. A Framework Decision on the prevention and settlement of conflicts of jurisdiction was adopted at the end of 2009 ([2009] OJ L328, 15 December, 42). This Framework Decision does not contain any binding rule since it merely establishes channels of information exchange and consultation between national competent authorities. Pursuant to art 12 of the Framework Decision, in cases where there is no consensus among these authorities, the matter must be referred to Eurojust. Recital 9 adds that national authorities should ‘consider’, inter alia, the Eurojust’s Guidelines on determining which jurisdiction is best placed to prosecute. 473 [2002] OJ L190, 18 July, 1, art 16(2). 474 ibid art 17(5). 475 J Monar, ‘Eurojust’s Present and Future Role at the Frontline of European Union Criminal Justice Cooperation’ (2013) 14(2) ERA Forum 187, 193–94. 476 See D Flore and S de Biolley, ‘Des Organes Jurisdictionnels en Matière Pénale pour l’Union Européenne’ (2003) 5 Cahiers de droit européen 597, 623.

Eurojust 405 deemed necessary in the UK. It has been stated some years ago that the powers of the UK national member (a Crown Prosecutor in the UK) were retained while at Eurojust; however, this would mean that these powers vis-a-vis the domestic legal order might change in the future if the UK chose to appoint a national member from an agency other than the Crown Prosecution Service.477 This approach raised two issues: the issue of legal certainty at both the domestic and EU levels with regard to the extent of the powers of the national member; and the issue of whether in this example the UK member acted as a Crown Prosecutor under English domestic law or as a Eurojust national member – and if the latter, at which stage EU law would kick in. While it might be politically convenient – and pragmatically flexible – for Member States to send national members to Eurojust without detailed legal provisions covering their mandate, this resulted in a lack of certainty with regard to Eurojust’s powers. This lack of certainty was compounded by the substantial differences in Member States’ conferral of powers to their national members, which is to some extent the outcome of the diversity of domestic criminal justice and constitutional systems. An issue which has arisen has been that the territorial mandate of prosecutors or magistrates could be limited on a prefectural or regional basis, raising the issue of how these limitations were going to be reconciled with Eurojust powers to cover the whole national territory.478 A much-cited example has been that of Germany, where tensions between the competence of the Länder and those of the federal level in relation to criminal justice have appeared in the context of the powers of the German national member for Eurojust. The 2009 Eurojust Council Decision aimed to reduce discrepancies among the Member States, yet some shortcomings remained, not least because the Decision had to be implemented at the national level.479 The direct applicability of the Regulation should improve the status quo. The Regulation requires that national members have access to, or at least should be able to obtain the information contained in, a number of national databases such as criminal records, registers of arrested persons, investigations and DNA registers.480 Moreover, Article 8 of the Regulation lists, along the lines of the 2009 Eurojust Decision, the powers that national members should have:481 • ‘ordinary’ powers to facilitate mutual legal assistance and judicial cooperation, in particular those to: (a) facilitate or otherwise support the issuing or execution of any request for mutual legal assistance or mutual recognition; (b) directly contact and exchange information with any competent national authority, any other competent EU body, office or agency, and any international authority; and (c) participate in JITs, including in setting them up (Article 8(1) of the Eurojust Regulation); 477 House of Lords European Union Committee (n 363) para 37. 478 Interview, DG JHA, Brussels, 5 December 2000 – see Mitsilegas, Monar and Rees (n 3). 479 The GENVAL evaluation reported that the powers of the national members still varied ‘considerably from one desk to another’ (GENVAL final report (n 464) 28). 480 Article 9 of the Eurojust Regulation. 481 ibid art 8. Articles 9b, 9c and 9d of the Eurojust Council Decision distinguished among ‘ordinary powers’, ‘powers exercised in agreement with a competent national authority’ and ‘powers exercised in urgent cases’. Such classification captures the different powers that national members can exercise, even though it has not been replicated in the Regulation.

406 Bodies, Offices and Agencies • powers to be exercised in agreement with a competent national authority, namely: (a) issue or execute any request for mutual legal assistance or mutual recognition; and (b) order, request or execute investigative measures, as provided for in the Directive on the European Investigations Order (Article 8(3)); • powers to be exercised in urgent cases: when the case is urgent and it is not possible to identify or contact the competent national authority in a timely manner, national members can exercise motu proprio the powers mentioned in Article 8(3) above, which could, in principle, only be exercised with the previous agreement of domestic authorities (Article 8(4)). The Eurojust Council Decision provided for some leeway with respect to the last two categories of powers. The Regulation has taken a similar approach. National members may only submit a proposal to the competent national authority to carry out the measures referred to in Article 8(3) and (4) where the exercise of those powers by the national members themselves would be in conflict either with national constitutional rules or with fundamental aspects of a Member State’s national criminal justice system.482 The similar ‘safeguard clause’483 of the Eurojust Council Decision turned out to be ‘largely used’484 in practice. One may therefore wonder whether the same will happen with respect to the analogous Regulation provision, which the Commission had originally suggested should be removed, or whether Member States will in the future be open to accept a stronger role of Eurojust in cross-border investigations and prosecutions. In sum, the Regulation further approximates the powers of national members and should thus be seen as a continuation of the developments launched by the 2009 Decision. The clarification of the powers of national members can contribute towards enhancing the effectiveness of Eurojust: since the setting up of the agency, it has been argued that the discrepancies between national members have considerably impeded its work.485 Finally, it is worth mentioning that Eurojust is now allowed to exercise its powers not only upon the request of national authorities (or the EPPO), but also ‘on its own initiative’.486 Introduced by the Regulation, such a possibility could further enhance the effectiveness of Eurojust’s activities as the agency could ‘take a more proactive role in coordinating cases’ (emphasis added),487 for instance, ‘involving Member States that might not initially have been included in the case and discovering links between cases based on the information it receives from Europol, [OLAF], the EPPO and national authorities’.488 482 Article 8(5) of the Eurojust Council Decision. 483 Coninsx (n 417) 445. 484 GENVAL final report (n 464) 29. 485 N Thwaites, ‘Eurojust: Autre Brique dans l’Édifice de la Coopération Judiciaire en Matière Pénale ou Solide Mortier?’ (2003) 1 Revue de science criminelle et de droit pénal comparé 45, 51–52. See also A Suominen, ‘The Past, Present and the Future of Eurojust’ (2008) 15(2) Maastricht Journal of European and Comparative Law 217, 226. 486 Article 2(3) of the Eurojust Regulation. 487 ibid Recital 12. 488 ibid. The proactive role of Eurojust also seems to be enhanced by the provision according to which the agency, in carrying out its tasks, should take into account not only information provided by other EU bodies, but also ‘any information collected by Eurojust itself ’ (art 2(2)(a)).

Eurojust 407 b. Eurojust in Practice: Coordination Meetings, Coordination Centres and Exchange of Information Two further aspects of the activities of Eurojust, albeit almost neglected by the Eurojust Regulation, ought to be mentioned here in order to provide a better understanding of the role of the agency. First, practitioners highly value Eurojust’s support as the agency also funds JITs,489 the costs of which should therefore not be (entirely) borne by national authorities. Second, the ‘coordination meetings’ represent the essence of Eurojust’s operational functions.490 These meetings, which usually take place at the premises of Eurojust and benefit from the agency’s logistical and financial support, gather both national authorities from different Member States dealing with the same case and representatives from the concerned Eurojust’s national desks. The coordination meetings are an ideal platform for competent national authorities to exchange views on ongoing investigations and their potential coordination. OLAF, third states and Europol can participate in these meetings. Europol usually carries out previous analysis on the case and, on this basis, national authorities can become aware of the transnational dimension of the crimes under investigation and the potential links between suspects. As an outcome of the coordination meetings, the competent national authorities can decide to carry out, contemporarily and in a previously agreed day (the ‘action day’), measures such as arrests, seizures, searches and the like. In these cases, a ‘coordination centre’ is usually set up at Eurojust: representatives of the involved desks take part in it, with the aim of monitoring the activities on the ground, facilitating communication between national authorities and resolving possible legal issues raised by the ongoing actions. Once the day is over, the concerned domestic authorities agree on the further steps to be taken in the investigations.491 Coordination meetings and coordination centres represent the clearest example of Eurojust’s added value,492 yet sometimes they are not even necessary to allow the agency to achieve its mission. Some issues faced by domestic prosecutors can indeed be easily solved within Eurojust in an informal way. The message is that these informal avenues of cooperation,493 which practitioners appreciate, at the same time make the work of Eurojust not always transparent. Finally, the success of Eurojust – like that of Europol – largely depends on the willingness of national authorities to share information with the agency. The previous Eurojust Decision’s rules on the exchange of information were not applied in a satisfactory way.494 Article 21(1) of the Regulation provides that the competent domestic authorities ‘shall exchange’ with Eurojust all information necessary for the performance of its tasks. However, to assuage Member States’ concerns, the Regulation keeps the 489 For further remarks on Eurojust’s role with regard to JITS, see M Helmberg, ‘Eurojust and Joint Investigation Teams: How Eurojust Can Support JITs’ (2007) 8 ERA Forum 245. 490 In the Regulation, coordination meetings are mentioned only in art 4(3)(a): ‘Eurojust may … supply logistical support, including translation, interpretation and the organisation of coordination meetings.’ See Coninsx (n 417) 449; Gless and Wahl (n 143) 346. 491 For further remarks on Eurojust’s coordination centres, see S Petit Leclair, ‘Justice et Sécurité en Europe : Eurojust ou la Création d’un Parquet Européen’ (2012) 20 Cahiers de la sécurité 38, 42. 492 GENVAL final report (n 464) 45. 493 See also Jeney (n 465) 94–95; GENVAL final report (n 464) 43–44. 494 GENVAL final report (n 464) 17 and 33–35.

408 Bodies, Offices and Agencies wording of the analogous provision of the Eurojust Council Decision, so that such transmission of information to Eurojust ‘shall only be interpreted as a request for the assistance of Eurojust in the case concerned if so specified by a competent authority’ (emphasis added).495 c. Strategic Activities In addition to the operational tasks, Eurojust also plays a strategic role.496 Since an effective fight against transnational crime should be based on adequate knowledge of such criminality and of the European instruments to tackle it, Eurojust is committed to provide and share as much strategic knowledge as possible. For instance, the agency contributed to the ‘Handbook on how to issue and execute a European Arrest Warrant’497 and to the JITs Practical Guide. Eurojust also organises strategic or tactical meetings in order to allow national authorities to discuss some key issues in the field of judicial cooperation. These meetings are also intended ‘to promote Eurojust, demonstrating its added value to national authorities and therewith attracting more case referrals’.498 Finally, the Commission and the Member States can seek Eurojust’s opinion on draft instruments concerning police and judicial cooperation in criminal matters.499

iv. Data Protection The work of Eurojust involves the collection, processing and exchange of a wide range of personal data. Eurojust is required to establish a case management system (CMS), which is composed of temporary work files and of an index which contain personal and non-personal data.500 As in the case of Europol, the relevant data protection framework is provided for in the Eurojust Regulation itself,501 which lays down a number of provisions to regulate issues such as data processing, time limits for data storage, data security and access to personal data. Most of the rules and principles discussed above with regard to Europol also apply to Eurojust as they follow from the – now legally formalised – status of Eurojust and Europol as EU agencies. The Directive on data protection in the law enforcement sector (Directive (EU) 2016/680) does not apply as such to Eurojust, although the Eurojust Regulation has to be consistent with that Directive.502 The supervision of personal data processing is no longer entrusted to the JSB, but to the EDPS,503 the decisions of which concerning operational personal data are subject to the

495 Article 21(2) of the Eurojust Regulation. 496 See also Groenleer (n 93) 317ff (claiming that ‘[w]hile Eurojust still plays a primarily operational role, it has been developing a more strategic approach’ (at 318)); Coninsx (n 417) 446; Mitsilegas and Giuffrida (n 180) 77–81. 497 [2017] OJ C335, 6 October, 1. 498 Groenleer (n 93) 318. 499 Article 68 of the Eurojust Regulation. 500 ibid art 23(1). 501 ibid arts 26–46. 502 ibid Recital 28. 503 ibid arts 40–44.

Eurojust 409 CJEU’s jurisdiction.504 Finally, the Eurojust Regulation calls for the appointment of a DPO, who is a member of Eurojust staff and is responsible for ensuring compliance with the data protection provisions of the Eurojust Regulation.505

v. Judicial Control The Eurojust Regulation contains no express provisions with regard to the judicial control or interpretation of Eurojust acts, with the exception of the rule on Eurojust’s liability for unauthorised or incorrect processing of data.506 This gap – which was also to be found in the Eurojust Decision and might be explained by Member States’ sovereignty concerns as well as the framing of Eurojust as a ‘judicial’ body – has resulted in litigation before the Court of Justice prior to the entry into force of the Lisbon Treaty. In the case of Spain v Eurojust,507 the Spanish government sought the annulment of various points in seven calls for applications for the recruitment of temporary staff issued by Eurojust relating to matters of linguistic competence (in particular the emphasis of the calls on knowledge of English and French). Spain brought the action under a first pillar legal basis – then Article 230 of the EC Treaty508 – which gave the Court the competence to reviewing the ‘legality of acts adopted jointly by the European Parliament and the Council, of acts of the Council, of the Commission and of the ECB, other than recommendations and opinions, and of acts of the European Parliament intended to produce legal effects vis-a-vis third parties’. The Court dismissed the action as inadmissible. It stated that the acts contested therein were not included in the list of acts the legality of which the Court could review under the previous Article 230 EC, with the Court’s jurisdiction on judicial cooperation in criminal matters defined in the then third pillar, namely in Article 35 EU.509 The Lisbon Treaty bridged this gap. Article 263 TFEU provides that the Court of Justice ‘shall review the legality of … acts of bodies, offices or agencies of the Union intended to produce legal effects vis-à-vis third parties’. In principle, therefore, Eurojust acts could be reviewed by the CJEU. Nonetheless, since the agency does not exercise coercive powers (eg, it cannot initiate an investigation), Eurojust acts can hardly be considered as producing direct legal effects vis-a-vis third parties; hence, the case law of the Court of Justice on Article 263 TFEU would shield them from judicial scrutiny at the EU level.510 This may be contentious since Eurojust’s contribution to national investigations can trigger the adoption of decisions – formally by national competent authorities – that infringe upon individuals’ rights and freedoms (eg, the choice of forum).

504 ibid art 44. 505 ibid arts 36(1) and 38. 506 ibid art 46. 507 Case C-160/03, Spain v Eurojust, judgment of 15 March 2005, EU:C:2005:168. 508 ibid para 35. 509 ibid paras 37 and 38. 510 See section II.B.vii above for similar remarks on the jurisdiction of the CJEU over Europol acts. In accordance with Recital 15 of the Eurojust Regulation, when national members exercise the powers discussed above in the text (eg, issue and execute requests for mutual legal assistance), ‘those powers are to be exercised in accordance with national law’, with the consequence that it is for national courts to review the measures carried out by national members in those circumstances.

410 Bodies, Offices and Agencies In other words, although ‘it may be formally true to ascribe a decision to a national authority, it is a fallacy – at least in many cases – to deem it that authority’s decision alone’.511

vi. Accountability and Scrutiny In order to address these issues, it is important to focus on the organisational structure of Eurojust. In this context, the centrality of the Eurojust College is noteworthy, yet it has been downsized after the entry into force of the Regulation, which has ‘Lisbonised’ the agency. As noted above, the College consists of the national Eurojust representatives and one representative of the Commission, when the College exercises its management functions. Unlike Europol, where the Management Board consisting of representatives of Member States (and of the Commission) plays a central role in organisational matters and decision-making, Eurojust is run by its national expert members (mostly judges or prosecutors) who (perhaps as a reflection of their ‘judicial’ status) enjoy a large degree of independence.512 By establishing the Executive Board, the Regulation tried to reduce the administrative burden of the College in order for the latter to focus on operational issues. Yet the management tasks of the College are still essential for the functioning of the agency. As mentioned above, it elects the President of Eurojust from among the national members – the President exercises their duties ‘on behalf of the College’.513 The College also appoints Eurojust’s Administrative Director, who ‘shall be accountable to the College’.514 While the previous Eurojust Decision mentioned that the Eurojust DPO was ‘under the direct authority of the College’515 and Eurojust staff had to carry out their tasks ‘under the authority of the College’,516 these provisions are not included in the Regulation. The Regulation instead reaffirms the College’s obligation to annually forward to the Commission a budget estimate, and ultimately to adopt the budget.517 The Eurojust budget does not cover the salaries of national members, deputies and assistants, which, in another example of Eurojust’s ‘intergovernmental’ features, are funded by Member States.518 The budgetary involvement was perhaps the strongest role of the EU institutions with regard to the control and accountability of Eurojust before the entry into force of the Regulation. With the Regulation, the Commission has been given the right to participate in the College meetings when the College exercises its management functions, as well as in the Executive Board. The Commission may even request Eurojust to intervene in cases that concern one Member State only, but have repercussions at the EU level, although national competent authorities may oppose the execution of this request by Eurojust.519 511 Wade (n 466) 202. See also Jeney (n 465) 100 and 122–24. 512 Not many provisions regarding the control of the College exist in the Eurojust Regulation – an example is art 5(5), which establishes that Eurojust’s Rules of Procedure must be adopted by the College and approved by the Council. 513 Article 11(2) of the Eurojust Regulation. 514 ibid art 17(6). 515 Art 17(1) of the Eurojust Council Decision. 516 ibid art 30(3). 517 Article 61 of the Eurojust Regulation. 518 ibid art 7(9). 519 ibid art 3(4).

Eurojust 411 The role of the European Parliament and national parliaments vis-a-vis the agency has also been strengthened: they receive, like the Council, the programming document adopted by the College and the Eurojust annual report, as well as the results of studies and strategic projects elaborated or commissioned by Eurojust and working arrangements concluded with third parties.520 Upon their election, the President of Eurojust should make a statement before the competent committee(s) of the European Parliament and answer questions put by its members.521 Furthermore, they shall appear once a year for the joint evaluation of the activities of Eurojust by the European Parliament and national parliaments within the framework of an interparliamentary committee meeting, to discuss Eurojust’s current activities and present the annual report or other key Eurojust documents.522 However, such form of accountability does not extend to Eurojust’s operational functions, but is limited to the management of the agency and its strategic role: when the President of Eurojust appears before the European Parliament and/or national parliaments, their statements and ensuing discussions should not refer directly or indirectly to concrete actions taken in relation to specific operational cases.523 While the Europol Regulation requires the establishment of a JPSG, the E urojust Regulation does not provide for anything similar. The nuances in the wording of the Treaty indeed unveil a different regime of democratic accountability for the two agencies:524 the European Parliament and national parliaments will be involved in the evaluation of Eurojust’s work – thus implying an ex post and not necessarily joinedup scrutiny (Article 85(1) TFEU). On the other hand, the European Parliament together with national parliaments will be involved in the scrutiny of Europol’s activities (Article 88(2) TFEU): the wording here implies a more joined-up control of Europol between the European Parliament and national parliaments, and a potentially more day-to-day scrutiny of Europol’s activities. Overall, the limited avenues for transparency and information regarding the work of Eurojust are evident, as are the intergovernmental elements in its organisational and accountability structures (although these are much less prominent than in the past), and also demonstrate an increased independence of Eurojust as an organisation, based in particular on the fact that its members come primarily from the judiciary.

vii. Eurojust’s Relations with its Partners The relations between Eurojust and its partners play an important part in Eurojust’s activities. Eurojust should ‘cooperate and consult with’ the EJN, ‘cooperate closely with the EPPO’ and ‘cooperate with Union institutions, bodies, offices and agencies’.525 The relations with OLAF, Europol and the EJN are discussed in following sections, while those with the EPPO will be analysed in section V.

520 ibid

art 67(1) and (4). art 67(2). 522 ibid art 67(3). 523 ibid art 67(2) and (3). 524 See Schinina (n 294). 525 Article 4(d), (e) and (h) of the Eurojust Regulation. 521 ibid

412 Bodies, Offices and Agencies As for the agency’s relations with third countries, these are regulated in a very similar way to the Europol Regulation as they are inspired by the post-Lisbon EU legal framework for cooperation with third countries. Eurojust may therefore establish and maintain cooperation with the authorities of these countries as well as international organisations (such as Interpol).526 Eurojust may conclude working arrangements with them, although such arrangements cannot form the basis for allowing the exchange of personal data. As is the case with Europol, Eurojust has to comply with some requirements in order to share personal data with third countries (necessity of the transfer, prior authorisation of the Member State that transmitted the information to Eurojust etc).527 Subject to these requirements, these exchanges can only take place if the Commission has adopted an adequacy decision with regard to the level of data protection in that third country, or appropriate safeguards have at least been provided in the absence of an adequacy decision.528 The exchange of personal data is also allowed on the basis of either a cooperation agreement that was concluded by Eurojust before the Regulation took effect or an international agreement concluded between the EU and that third country in accordance with Article 218 TFEU.529 Like Europol, in the pre-Lisbon era, Eurojust could conclude agreements with third countries which allowed the exchange of personal data,530 while this power now lies with the Council. Finally, cooperation with third countries and international organisations can also lead to the secondment of liaison magistrates to Eurojust,531 as well as the posting of a liaison magistrate on behalf of Eurojust to third countries.532 As far as EU bodies and institutions are concerned – and leaving aside the EJN, OLAF, Europol and the EPPO for the moment – Eurojust ‘shall establish and maintain cooperative relations with the European Judicial Training Network’,533 while the European Border and Coast Guard Agency (Frontex) ‘shall contribute to Eurojust’s work’.534 Eurojust can conclude working arrangements with other EU bodies, but, as mentioned above, the exchange of personal data cannot be regulated by these arrangements.535

526 ibid art 52(1). For an overview of Eurojust’s relations with third countries, see B Škrlec, ‘Eurojust and External Dimension of EU Judicial Cooperation’ (2019) 3 Eucrim 188. 527 Article 56(1) of the Eurojust Regulation. 528 ibid art 56(2)(a). The exchange of personal data may also take place outside the legal framework outlined in the text if the case is urgent and the transfer is necessary for the prevention of an immediate and serious threat to the public security of a Member State or of a third country, or to the essential interests of a Member State (art 56(4); see the similar rule in art 25(5) of the Europol Regulation). 529 Article 56(2)(b) and (c) of the Eurojust Regulation. 530 At the time of writing, Eurojust has signed more than 10 agreements with third countries and MoUs with, inter alia, Interpol, UNODC and the Iber-American network of international legal cooperation (Iber-RED). For further information, see https://www.eurojust.europa.eu/states-and-partners/third-countries. 531 Presently, Eurojust hosts liaison prosecutors for Albania, Georgia, Norway, Switzerland, the US, Montenegro, Ukraine, the Republic of North Macedonia, Serbia and the UK (https://www.eurojust.europa. eu/states-and-partners/third-countries/liaison-prosecutors). 532 Article 53 of the Eurojust Regulation. 533 ibid art 51(1). Eurojust signed an MoU with the European Judicial Training Network in 2008. 534 ibid art 51(3). An MoU between Eurojust and Frontex was signed in 2013. 535 The exchange of operational personal data between Eurojust and EU institutions, bodies, offices and agencies is regulated by art 55.

Eurojust 413 a. Relations with OLAF In its 2004 Report on Eurojust, the House of Lords European Union Committee noted that ‘the picture on the relationship between OLAF and Eurojust is far from rosy’,536 concluding that (at least back in 2004) ‘the current state of affairs in the relationship between OLAF and Eurojust is regrettable’,537 with cooperation being ‘hampered by suspicion and antagonism, to the detriment of effective action against fraud’.538 Ten years later, in spite of some improvements, the final report of the Council Working Party on General Matters including Evaluation (GENVAL) on the implementation of the Eurojust Council Decision and a study for the European Parliament on inter-agency cooperation did not draw substantively different conclusions.539 This rather bleak picture of the relationship between the two bodies can partly be explained if placed in the context of the inter-institutional competition within the EU.540 Eurojust – already perceived by some as a threat to centralised or unified models of prosecution in the EU, having been introduced to stave off calls for a EPP – may be seen to also represent a threat to existing EU anti-fraud structures such as OLAF. As will be seen below, OLAF is responsible for cooperating with national authorities towards the investigation and prosecution of fraud against the EU budget; however, this task also appears to be within the remit of Eurojust. Overlap (and the proliferation of bodies in the not unlimited EU criminal justice space) may generate competition instead of cooperation between the various bodies. These elements were reflected in evidence of both bodies to the House of Lords Committee back in 2004, with the then President of Eurojust Mike Kennedy noting that initially Eurojust had been faced with ‘quite a hostile situation’, with OLAF acknowledging the potential overlap and pointing out that Eurojust was still in a start-up phase.541 This climate of mistrust was prevalent notwithstanding the signature in 2003 of a Memorandum of Understanding (MoU) between Eurojust and OLAF. The MoU called on both parties to inform each other immediately and spontaneously of the existence of case of mutual interest, and exchange any necessary information and provide mutual assistance in this context.542 This was followed up by a Heads of Agreement, signed in December 2005 – this provided practical guidance and served as a declaration of intent towards a more formal agreement.543 The MoU was later replaced by a Practical Agreement on arrangements of cooperation between Eurojust and OLAF signed in 2008. This includes rules concerning, inter alia, the setting up – within the two bodies – of ad hoc 536 House of Lords European Union Committee (n 363) para 63. 537 ibid para 68. 538 ibid. 539 See GENVAL final report (n 464) 48, where it is stated that the ‘operational cooperation between Eurojust and Olaf is regrettably still limited’ (emphasis added); Weyembergh, Armada and Brière (n 357) 38–42. For similar remarks, see also Jeney (n 465) 85–88; V Covolo, L’Émergence d’un Droit Pénal en Réseau. Analyse Critique du Système Européen de Lutte Antifraude (Nomos, 2015) 402–16 (especially at 414–16, where the author discusses the ‘antagonisme latent’ between the two bodies). 540 For the position of Eurojust within the framework of such competition, see also A Mégie, ‘L’Institutionnalisation d’un Pouvoir Judiciaire Européen Incertain en Quête de Légitimité : L’Unité de Coopération Eurojust’ (2007) 23 Politique européenne, 57. 541 House of Lords European Union Committee (n 363) paras 64 and 65. 542 It also contained, inter alia, provisions on participation in JITs, communication with other partners and information collection. 543 Eurojust Annual Report 2006, 18.

414 Bodies, Offices and Agencies teams which should meet regularly, as well as the exchange of case summaries with a view to identifying appropriate cases for collaboration and of case-related information, including personal data.544 In 2018, Eurojust and OLAF issued a leaflet to clarify their complementary roles and encourage national competent authorities to consider involving both of them if appropriate.545 Finally, in July 2019, Eurojust and OLAF agreed to step up their cooperation, eg, by early contacts to form JITs, as well as by increasing the number of coordination meetings between Eurojust national members and investigators from OLAF,546 even though the 2008 Agreement has not been formally amended. The Regulation has partially enhanced the relationship between the two bodies. It keeps the previous rule in accordance with which OLAF may contribute to Eurojust’s coordination work regarding the protection of the EU’s financial interests, but has removed the clause pursuant to which OLAF could contribute to Eurojust’s work ‘where the competent national authorities concerned do not oppose such participation’.547 A limited step forward was also taken by the 2013 Regulation on OLAF investigations.548 Article 13 of this Regulation confirms that the two bodies can conclude arrangements concerning the exchange of operational, strategic or technical information, including personal data and classified information, and also adds a specific obligation for OLAF to inform Eurojust: Where this may support and strengthen coordination and cooperation between national investigating and prosecuting authorities, or where [OLAF] has forwarded to the competent authorities of the Member States information giving grounds for suspecting the existence of fraud, corruption or any other illegal activity affecting the financial interests of the Union in the form of serious crime, it shall transmit relevant information to Eurojust, within the mandate of Eurojust. (Emphasis added)549

The issue of the coordination between Eurojust and OLAF looks even more delicate in the light of the trilateral relationship among the two bodies and the EPPO, as will be discussed further below.550 b. Relations with Europol The relationship between Eurojust and Europol appears to be closer and more effective than that between Eurojust and OLAF.551 A number of initiatives have been taken 544 Respectively, points 3, 5 and 6 of the Practical Agreement between Eurojust and OLAF. See A Marletta, ‘Interinstitutional Relationship of European Bodies in the Fight against Crimes Affecting the EU’s Financial Interests. Past Experience and Future Models’ (2016) 3 Eucrim 141, 142. 545 ‘How Can OLAF Cooperate with Eurojust? – How Can Eurojust Cooperate with OLAF?’, 2018, https:// www.eurojust.europa.eu/how-can-olaf-cooperate-eurojust-how-can-eurojust-cooperate-olaf. 546 ‘Winning the Fight against Fraud – Joint Eurojust/OLAF News Item’, 12 July 2019, https://ec.europa.eu/ anti-fraud/media-corner/news/12-07-2019/winning-fight-against-fraud_en. 547 Article 26(4) of the Eurojust Council Decision. 548 Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 [2013] OJ L248, 18 September, 1. See Weyembergh, Armada and Brière (n 357) 40. 549 Article 13(1), second indent of Regulation (EU, Euratom) 883/2013. 550 See section V.B.vi below. 551 See Jeney (n 465) 83–85; GENVAL final report (n 464) 48. For an extensive analysis of the relations between the two agencies, see Weyembergh, Armada and Brière (n 357) 11–26.

Eurojust 415 over the years to strengthen their cooperation. Following the relevant requirements of the Eurojust Decision, a first agreement between the two bodies was signed in 2003. While this agreement was not ambitious enough for Eurojust, it was seen by it as ‘an important first step’.552 One of the thorny issues of negotiations at the time was access by Eurojust to Europol’s AWFs, with Europol noting that the interests of other ‘stakeholders’ had to be taken into account in this context.553 After the entry into force of the Protocol of 27 November 2003 amending the Europol Convention, which allowed Europol to invite experts of third states or bodies to be associated with the activities of an analysis group,554 the issue was addressed in a more satisfactory way. According to the Eurojust 2007 Annual Report, for instance, Eurojust signed six Arrangements with Europol on 7 June 2007 and appointed national members and cases analysts who could be associated – in their capacity as experts from Eurojust – on the subject of judicial cooperation. This move – which was promoted by Member State governments555 – represented a considerable strengthening of cooperation between the two bodies, but it could also have considerable implications both for data protection and for Eurojust’s recommendations and decisions on whether, and in which jurisdiction, particular conduct should be investigated or prosecuted. Moreover, it contributed to blurring the boundaries between Eurojust’s perceived ‘judicial’ nature and its involvement with police and intelligence work. Finally, the issue of Eurojust’s access to Europol’s AWFs was formalised in 2010, when a new Agreement between the two agencies entered into force.556 As of 2016, Eurojust had participated in 25 Europol’s files.557 As mentioned above, the implementation of the Europol Regulation should lead to replacing the AWFs with a more flexible system of data processing, to which Eurojust may have access within the limits described above.558 The 2010 Agreement still regulates the relations between the two agencies. Recently, they have also concluded the 2018 ‘Memorandum of Understanding on the joint establishment of rules and conditions for financial support to joint investigation teams activities between Europol and Eurojust’. In the light of the Europol Regulation’s provision on funding of JITs,559 the MoU aims to coordinate the activities of the two agencies with respect to the financial support to JITs, also with a view to avoiding double funding.560 In addition to the issues of the exchange of information and financial support to JITs, the potential overlap between the two bodies is also worth mentioning. This was largely ignored in the discussion of the instruments aimed at replacing the Europol

552 House of Lords European Union Committee (n 363) para 69. 553 ibid para 72. 554 See section II.B.v above. 555 See also the Conclusions of the Justice and Home Affairs Council of 5–6 June 2008, calling, inter alia, for the formalisation of Eurojust’s participation in Analysis Work Files (Council Doc 9956/08, Presse 46, Brussels, 18 June 2008, 20). 556 See especially art 11 of the Agreement. 557 Eurojust Annual Report 2016, 41. 558 See section II.B.ix above. 559 Article 61(4) of the Europol Regulation. 560 On double funding and further issues connected to the participation of Eurojust and Europol in the setting-up and financing of JITs, see A Weyembergh, I Armada and C Brière, ‘The Cooperation between Police and Justice at the EU Level: The Representative Example of Joint Investigation Teams’ in Brière and Weyembergh (n 143) 355–82.

416 Bodies, Offices and Agencies Convention by a Decision on the one hand, and amending the Eurojust Decision on the other. While the membership, institutional arrangements and databases of the two bodies are distinct, there is an overlap regarding their tasks as both of them are dealing with aspects of the investigation of criminal offences. Diversity in domestic criminal justice systems may serve to retain the current complexity, with investigation falling within the realm of the judiciary in some Member States and within the realm of the police in others. Intensified cooperation between Europol and Eurojust may serve to boost the chances for the investigation and prosecution of crime. At present, this efficiency logic, along with a logic of boosting the powers of both bodies, seems to have prevailed. A more systematic examination of the relationship between the two bodies in the context of the development of an EU criminal justice system is therefore needed to avoid unnecessary duplications. c. Relations with the EJN The Eurojust Regulation deals with the relationship between Eurojust and the EJN in Article 48, which states that they ‘shall maintain privileged relations with each other, based on consultation and complementarity’561 and lays down further rules on their cooperation.562 Moreover, as seen above, the national correspondent for the EJN and up to three other contact points of the EJN are part of the Eurojust national coordination system.563 Questions of overlap appear very prominently as regards the relationship between the two bodies – especially when Eurojust is asked to deal with bilateral or relatively straightforward cases which could also be dealt with by the EJN. The question in particular has been whether there is added value in having two EU bodies dealing with the same type of judicial cooperation caseload.564 Rather than dismantling the EJN or changing the mandate of Eurojust to focus on more complex cases, the political choice has been to make the EJN Secretariat form part of the Eurojust Secretariat,565 leading to charges that Eurojust has effectively ‘bought up’ the EJN.566 This seems to give a certain degree of EJN oversight to the President of Eurojust,567 but the legal basis for such oversight is unclear. In 2014, Eurojust and the EJN issued a Joint Task Force Paper with the aim of guiding national authorities in the choice between Eurojust and the EJN when the support of European bodies is needed in cross-border cases,568 since there is ‘a general 561 Article 48(1) of the Eurojust Regulation. Article 10(1) of the Council Decision on the EJN is phrased in the same way. 562 For more on this, see Jeney (n 465) 88–89. 563 See section III.B.ii above. 564 The House of Lords European Union Committee ((n 363) para 81) proposed that the EJN should deal with bilateral cases, whereas Eurojust should deal with complex, multilateral cases. 565 Eurojust Annual Report 2007, 55. See also art 48(2) of the Eurojust Regulation. 566 See A Mégie, ‘Mapping the Actors of European Judicial Cooperation’ in Bigo et al (n 104) 85. 567 See also the oral evidence of the then Eurojust President, Mike Kennedy, to the House of Commons Home Affairs Committee (n 427) Q210. 568 ‘Assistance in International Cooperation in Criminal Matters for Practitioners – European Judicial Network and Eurojust – What can we do for you?’, Council Doc 11233/14, Brussels, 27 June 2014. This document was updated in 2018 and the revised version is available at https://www.eurojust.europa.eu/jointpaper-assistance-international-cooperation-criminal-matters-practitioners-european-judicial. On the same

Eurojust 417 nderstanding that it is important only to address one entity in order not to create u confusion and duplication of work’.569 As the GENVAl final report notes: The basic guidelines are well-known: e.g. that Eurojust should be contacted of operational work in complex or very urgent cases, requiring coordination of investigations and prosecutions, the EJN being a network of Contact Points and hence having a more flexible structure with the aim of facilitating direct contacts between practitioners when dealing with less complex cases (e.g. information on competent authorities in Member States, etc.). (Emphasis added)570

The report concludes that the Joint Task Force Paper should be further distributed and should serve as a basis for the development of national guidelines.571

C. Final Remarks The 2018 Regulation has eventually recognised Eurojust as an EU ‘agency’ and aligned this body with the EU post-Lisbon legal framework, eg, by providing for the Commission’s participation in (non-operational) College meetings and on the Executive Board, the competence of the EDPS on data protection matters, and a more relevant monitoring role of the European Parliament and national parliaments. The Regulation ensures more clarity on the agency’s mandate and should help to overcome some of the previous obstacles to the effective functioning of Eurojust, especially the lack of homogeneous powers of national members.572 Eurojust has also been given the power to act on its own initiative. Nonetheless, the extent to which the reform on Eurojust corresponds to the potential of Article 85 TFEU is fairly limited. As was pointed out with regard to the Commission’s proposal, which was not significantly different from the text eventually adopted, the Regulation ‘does not constitute a revolution’573 and ‘does not fully exploit the possibilities offered’.574 In particular, the Regulation retains the status quo and does not implement the clauses of Article 85(1) TFEU that would allow for binding decisions from Eurojust vis-a-vis national authorities. In order to explain this reluctance to grant binding powers to Eurojust, some have referred to the ‘it is not the right moment’ argument, according to which it is too early to entrust binding decision-making functions to Eurojust.575 webpage, two further documents concerning the relations between Eurojust and the EJN can be found: Council conclusions on the synergies between Eurojust and the networks established by the Council in the area of judicial cooperation in criminal matters, Council Doc 9643/19, Brussels, 27 May 2019; and the joint report by Eurojust and the EJN, ‘Assessment of allocation of cases to Eurojust and to the European Judicial Network’, 5 November 2019. 569 GENVAL final report (n 464) 42. 570 ibid 40. See also Weyembergh, Armada and Brière (n 357) 26–30. 571 GENVAL final report (n 464) 43. 572 See also A Weyembergh, ‘An Overall Analysis of the Proposal for a Regulation on Eurojust’ (2013) 4 Eucrim 127, at 127. 573 Council Doc 17188/1/13, Brussels, 4 December 13, 6 (this quote is taken from the contribution of Lotte Knudsen, then Director in DG Justice, European Commission, as reported in the Council document). 574 ibid 8 (this quote is taken from the contribution of Michèle Coninsx, then President of Eurojust, as reported in the same Council document). 575 Weyembergh (n 417) 181.

418 Bodies, Offices and Agencies Although Eurojust also plays a strategic role – which is less relevant than that of Europol in shaping and steering EU criminal policy – it remains a body devoted to facilitating the cooperation among national authorities dealing with cross-border cases. Due to its very nature of a ‘service body’,576 the applicability of Article 263 TFEU to its acts and decisions is limited. The current case law on individuals’ locus standi before the CJEU, coupled with the lack of formally binding powers of Eurojust, is likely to exclude the scrutiny of the Court in most if not all cases where Eurojust intervenes to support national investigations and prosecutions. In spite of the non-mandatory character of Eurojust’s requests to national authorities to initiate investigations and prosecution, the agency’s impact on state sovereignty and the relationship between the EU and the national level in judicial cooperation in criminal matters should not be underestimated. The detailed – and now directly applicable – provisions on the powers of national members of Eurojust represent a step forward in the direction of transforming this relation and increasing the impact of EU structures on domestic criminal justice systems. However, the insertion of exceptions to these powers based on the need to preserve domestic constitutional and criminal justice systems reflects Member States’ unease with this prospect. On the other hand, Eurojust’s support is increasingly valued by national authorities,577 especially when the agency acts in an informal way. However, particularly when Eurojust’s decisions touch upon – albeit indirectly – individuals’ rights and liberties (eg, choice of forum), more transparency should be sought, as recommended, inter alia, by the GENVAL final report. Furthermore, while Eurojust’s caseload has been growing year on year, the nature of the cases referred to the agency may not have proven to be what was originally expected (namely, mainly multilateral cases for Eurojust, with the bilateral cases left primarily for the EJN). Between 2012 and 2016, for instance, the number of bilateral cases dealt with by Eurojust has represented around 80 per cent of the agency’s workload.578 Risks of overlap are inherent in the very existence of two entities entrusted with complementary functions. The same goes for the relations between Eurojust and OLAF, which have at times been marked by tensions and competitions. The cooperation with Europol has likewise been difficult, especially at the beginning of Eurojust’s activities, but recent years have witnessed noteworthy improvements. Notwithstanding their different membership, there is an increasing synergy, if not convergence in the tasks of Europol and Eurojust, leading to a considerable strengthening of the investigatory branch in EU criminal law. The investigative dimension is emphasised in the provisions of the Eurojust Regulation concerning data processing – which include the processing of sensitive personal data such as DNA data – and Eurojust’s participation in JITs. On the one hand, this blurs the boundaries between Eurojust’s perceived ‘judicial’ nature and its involvement with police and intelligence work; on the other hand, it confirms that the model of Eurojust as a ‘judicial’ authority overseeing the police of Europol has not been adopted. 576 Wade (n 466) 201. 577 See Jeney (n 465) 60; GENVAL final report (n 464) 16; House of Lords European Union Committee (n 63) 22–24. 578 See Eurojust Annual Report 2016, 10.

OLAF 419 Further elements of complexity arise from the establishment of the EPPO, which should have been set up ‘from Eurojust’.579 The two entities have different missions and powers: the EPPO investigates and prosecutes crimes affecting the EU’s financial interests, whereas Eurojust coordinates national prosecutors and judicial authorities that cope with cross-border crimes. Despite their differences, they will have to cooperate and support each other in numerous situations, as will be discussed below, and at the same time should try to avoid the duplication of efforts and tasks.

IV. OLAF A. Background and Legislative Framework An area of criminality which attracted the attention of Community institutions early on has been fraud against the financial interests of the Community. The need to protect the Community’s finances resulted in calls for increased intervention of Community law into the sphere of domestic criminal law.580 At the institutional level, in 1987, the Commission already decided to establish an anti-fraud unit based within its auspices (UCLAF)581 – UCLAF became operational in 1988,582 one year prior to the ECJ Greek Maize judgment.583 It operated in the 1990s within the context of a growing emphasis at the EU level on the adoption of criminal law against fraud, in an effort in particular to boost the external dimension of the fight against fraud, namely by providing an incentive for Member States to prosecute fraud against the Community’s financial interests in their jurisdiction.584 However, it was allegations with regard to the management of Community funds internally which led to the reform of the Community anti-fraud institutional framework. Such allegations led in the late 1990s to a major political crisis in the EU, culminating in the fall of the Santer Commission in 1999.585 One of the responses to this crisis was internal institutional reform, with the Task Force for Coordination of Fraud Prevention (which had in the meantime succeeded UCLAF) being

579 Article 86(1) TFEU. 580 For more on this, see ch 2. 581 UCLAF stands for ‘Unité de coordination de la lutte anti-fraude’. 582 On the establishment and role of UCLAF, see JAE Vervaele, ‘Towards an Independent European Agency to Fight Fraud and Corruption in the EU?’ (1999) 7(3) European Journal of Crime, Criminal Law and Criminal Justice 331; V Pujas, ‘The European Anti-Fraud Office (OLAF): A European Policy to Fight against Economic and Financial Fraud?’ (2003) 10(5) Journal of European Public Policy 778, 779–82; and H Xanthaki, ‘Genesis: UCLAF and the Transition to OLAF’ in C Stefanou, S White and H Xanthaki, OLAF at the Crossroads: Action against EU Fraud (Hart Publishing, 2011) 1–14. 583 On the Greek Maize judgment, which introduced the principle of assimilation in a case involving alleged fraud against Community funds, see the chapter on harmonisation and competence. 584 See in particular the 1995 fraud Convention and its Protocols, and the subsequent Commission corpus juris proposals – see ch 2. 585 See P Craig, ‘The Fall and Renewal of the Commission: Accountability, Contract and Administrative Organisation’ (2000) 6(2) European Law Journal 98; A Tomkins, ‘Responsibility and Resignation in the European Commission’ (1999) 62(5) Modern Law Review 744; and D Georgakakis, ‘La Démission de la Commission Européenne: Scandale et Tournant Institutionnel (octobre 1998 – mars 1999)’ (2000) 38–39 Cultures et conflits, https://journals.openedition.org/conflits/814.

420 Bodies, Offices and Agencies replaced by a new unit, OLAF;586 as one author noted, the latter is thus ‘the fruit of exceptional circumstances in the aftermath of a scandal’ and ‘reflects the necessity of restoring credibility’.587 OLAF588 was established by a Commission Decision in April 1999.589 Amended three times between 2013 and 2015,590 the Decision confirms that OLAF’s tasks would include the conduct of both external and internal administrative investigation,591 with OLAF exercising the Commission’s powers to carry out external investigations.592 It also confirms the independence of OLAF’s investigative function.593 The Decision also calls for the establishment of a ‘supervisory committee’ responsible for monitoring such investigative function594 – the latter will also have a role in the appointment of OLAF’s Director-General, who will be nominated by the Commission after consulting the European Parliament and the Council.595 This rather short instrument was complemented in 1999 by a Regulation fleshing out rules concerning OLAF’s investigations,596 which was replaced and repealed by Regulation (EU, Euratom) 883/2013.597 Slightly amended in 2016 and further revised by Regulation (EU, Euratom) 2020/2223,598 the Regulation was adopted with the aim of improving the effectiveness of OLAF activities599 and

586 For a brief chronology, see the Report by the French National Assembly – Assemblée Nationale, Rapport d’information déposé par la Délégation de l’Assemblée Nationale pour l’Union européenne sur l’Office européen de lutte anti-fraude (OLAF), No 1533, 8 April 2004, 9–10. See also JFH Inghelram, Legal and Institutional Aspects of the European Anti-Fraud Office (OLAF): An Analysis with a Look Forward to a European Public Prosecutor’s Office (Europa Law Publishing, 2011) 47–56. 587 Pujas (n 582) 792. 588 OLAF stands for ‘Office lutte anti-fraude’. 589 [1999] OJ L136, 31 May, 20. 590 Commission Decision 2013/478/EU of 27 September 2013 ([2013] OJ L257, 28 September, 19); Commission Decision (EU) 2015/512 of 25 March 2015 ([2015] OJ L81, 26 March, 4); Commission Decision (EU) 2015/2418 of 18 December 2015 ([2015] OJ L133, 19 December, 148). 591 The Court of Justice resisted attempts to limit the powers of OLAF with regard to Community bodies by annulling Decisions of the European Central Bank and the Management Committee of the European Investment Bank, aiming to exclude to a great extent these bodies from OLAF’s remit. See Case C-11/00, Commission v European Central Bank, judgment of 10 July 2003, EU:C:2003:395; and Case C-15/00, Commission v European Investment Bank, judgment of 10 July 2003, EU:C:2003:396. 592 Article 2(1) of Commission Decision (n 589). For such powers, see Council Regulation (EC, Euratom) No 2988/95 of 18 December 1995 on the protection of the European Communities’ financial interests ([1995] OJ L312, 23 December, 1); and especially Council Regulation (Euratom, EC) No 2185/96 concerning on-thespot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities ([1996] OJ L292, 15 November, 2). On the fragmentation of legal bases upon which OLAF carries out its investigations, see M Simonato, ‘OLAF Investigations in a Multi-level System: Legal Obstacles to Effective Enforcement’ (2016) 3 Eucrim 136, 137–38. 593 Article 3 of Commission Decision (n 589). 594 ibid art 4. 595 ibid art 5(2). See also art 17(2) of Regulation (EU, Euratom) 883/2013. 596 Regulation (EC) No 1073/1999 concerning investigations conducted by OLAF [1999] OJ L136, 31 May, 1. 597 For a detailed analysis of the functioning of OLAF in the aftermath of the new Regulation, see Covolo (n 539). 598 See Regulation (EU, Euratom) 2016/2030 [2016] OJ L317, 23 November, 1; and Regulation (EU, Euratom) 2020/2223 of 23 December 2020 [2020] OJ L437, 28 December, 49. The adoption of the latter Regulation, which is further discussed in section IV.C below, was prompted by the need to align OLAF’s legal framework with that of the EPPO. Further references to Regulation (EU, Euratom) 883/2013 should therefore be understood as referring to Regulation (EU, Euratom) 883/2013 as amended by Regulation (EU, Euratom) 2020/2223. 599 See Recital 4 of Regulation (EU, Euratom) 883/2013.

OLAF 421 ensuring a better balance between its independence and accountability, including a stronger protection of human rights.600 The objective of OLAF is to step up the fight against fraud, corruption and any other illegal activity affecting the EU’s financial interests.601 The Office pursues its mission by providing the Member States with assistance ‘in organising close and regular cooperation between their competent authorities in order to coordinate their action aimed at protecting the financial interests of the Union against fraud’.602 However, on the different plane of administrative law, this power of OLAF resembles the main task of Eurojust and Europol. Like the two agencies, OLAF also plays a strategic role by contributing to the ‘design and development of methods of preventing and combating fraud, corruption and any other illegal activity affecting’603 the EU budget. To this end, OLAF should foster the sharing of operational experience and best practices in the field of the protection of the EU’s financial interests (PIF).604 However, it is through its investigations that OLAF mostly contributes to the fight against fraud and other illegal conducts affecting the EU budget. Regulation 883/2013 contains the rules applicable to OLAF’s external and internal investigations.605 Internal investigations are conducted within EU institutions, bodies, offices and agencies.606 Within the framework of external investigations, OLAF can instead carry out ‘on-thespot checks and inspections in Member States and, in accordance with cooperation and mutual assistance agreements and any other legal instrument in force, in third countries and on the premises of international organisations’.607 Especially when OLAF undertakes external investigations in the Member States, it faces the same problem as Eurojust and Europol: its success largely depends on the collaboration of national authorities, which should give the ‘necessary assistance to enable the staff of the Office to fulfil their tasks … effectively and without undue delay’.608 The Regulation also includes specific rules on the opening609 and the procedure of investigations,610 and emphasises the need for confidentiality.611 Central to the conduct of investigations are also the provisions calling for the forwarding of information by OLAF to the competent (including judicial) authorities of Member States,612 and the

600 House of Commons European Scrutiny Committee, Twenty-Eighth Report of Session 2010–12, HC 428-xxvi, 2011, 41. 601 Article 1(1) of Regulation (EU, Euratom) 883/2013. 602 ibid art 1(2). In addition, OLAF can also ‘join national administrative investigations that may be opened on OLAF’s request’ (Simonato (n 592) 137). For further remarks on the powers and role of OLAF, see L Kuhl, ‘Le Renforcement des Dispositifs Existants et la Lutte Contre la Fraude au Budget de l’Union’ in P Ghaleh Marzban (ed), Quelles Perspectives pour un Ministère Public Européen? Protéger les Intérêts Financiers et Fondamentaux de l’Union (Dalloz, 2010) 99–112. 603 Article 1(2) of Regulation (EU, Euratom) 883/2013. 604 ibid. PIF stands for ‘protection des intérêts financiers’. 605 ibid arts 3 and 4 respectively. 606 ibid art 4(1). 607 ibid art 3(1). 608 ibid art 7(3). See also Recital 10: ‘The operational efficiency of the Office depends greatly on cooperation with the Member States.’ 609 ibid art 5. 610 ibid art 7. 611 ibid art 10. 612 ibid art 12.

422 Bodies, Offices and Agencies provision stating that OLAF will draw up a report on completion of its investigations.613 These provisions raise a number of questions concerning the relationship of OLAF’s activities with the domestic criminal procedure systems of Member States, in particular as regards the use of the OLAF investigation report as evidence in domestic criminal proceedings.614 The use of ‘EU’-produced evidence in domestic criminal proceedings is far from straightforward and has led to concerns regarding the maintenance of state sovereignty in criminal matters.615 In terms of data protection, unlike the Europol and Eurojust Regulations, Regulation 883/2013 does not lay down specific rules to be followed: due to the nature of OLAF as a Commission department, the ordinary EU rules apply, namely those laid down in Regulation (EU) 2018/1725, which has repealed Regulation 45/2001 on the protection of individuals with regard to the processing of personal data by the EU institutions.616 As far as accountability is concerned, Regulation 883/2013 contains a number of express provisions that vary in terms in detail, with the overarching principle being that OLAF – its peculiar status notwithstanding – enjoys (full) ‘independence’ from the Commission.617 The Director-General of OLAF618 – who directs the conduct of OLAF’s investigations619 and must neither seek nor take instructions from any government or EU body in their investigative capacity620 – must report regularly to the European 613 ibid art 11. 614 Article 11(2) of Regulation (EU, Euratom) 883/2013 states that the reports ‘shall constitute admissible evidence: (a) in judicial proceedings of a non-criminal nature before national courts and in administrative proceedings in the Member States; (b) in criminal proceedings of the Member State in which their use proves necessary in the same way and under the same conditions as administrative reports drawn up by national administrative inspectors and shall be subject to the same evaluation rules as those applicable to administrative reports drawn up by national administrative inspectors and shall have the same evidentiary value as such reports; (c) in judicial proceedings before the CJEU and in administrative proceedings in the institutions, bodies, offices and agencies’. This provision was worded in a different way before Regulation (EU, Euratom) 2020/2223 amended Regulation (EU, Euratom) 883/2013, yet the rule on the admissibility of OLAF reports in national criminal proceedings has not changed in substance. On the application of the previous version of art 11(2) in some Member States and the issues it raised, see F Giuffrida and K Ligeti (eds), ‘Admissibility of OLAF Final Reports as Evidence in Criminal Proceedings’, University of Luxembourg, 2019, https://orbilu. uni.lu/handle/10993/40141. See also section IV.C below. 615 There have been reports of the reluctance of national courts accepting evidence collected by OLAF – see House of Lords European Union Committee, Strengthening OLAF, the European Anti-Fraud Office, 24th Report, session 2003–04, HL Paper 139, para 54; K Ligeti, ‘The Protection of the Procedural Rights of Persons Concerned by OLAF Administrative Investigations and the Admissibility of OLAF Final Reports as Criminal Evidence’, Report for the European Parliament’s Committee on Budgetary Control, 2017, 25–28. Issues relating to the admissibility of evidence have led to the centralising proposals in the corpus juris – for a discussion, see W Hetzer, ‘National Criminal Prosecution and European Tendering of Evidence. Perspectives of the European Anti-Fraud Office (OLAF)’ (2004) 12(2) European Journal of Crime, Criminal Law and Criminal Justice 166. 616 Recital 35 of Regulation 883/2013, which refers to Regulation 45/2001. 617 See Recitals 3, 17, 18, 20, 37, 41, 42, 48 and 49 of Regulation 883/2013. 618 The first Director of OLAF was Franz-Hermann Brüner from Germany. Appointed in 2000, his term was renewed in 2006. However, Regulation (EU, Euratom) 883/2013 provides that the term of office of the DirectorGeneral is seven years, which is not renewable (art 17(1); see also the revised version of art 5 of the 1999 Commission Decision establishing OLAF, as amended by art 1(5) of the Commission Decision 2013/478/EU). Between 2011 and 2017, OLAF was led by Giovanni Kessler (Italy), who has since been replaced by Ville Itälä (Finland). 619 Article 7(1) of Regulation (EU, Euratom) 883/2013. 620 ibid art 17(3).

OLAF 423 Parliament, the Council, the Commission and the Court of Auditors on the findings of investigations carried out by OLAF, as well as on the action taken and the problems encountered.621 Financing of OLAF is – although under a specific budget line – part of the general Commission budget.622 Regulation 883/2013 has partially enhanced OLAF’s accountability vis-a-vis the public and the EU institutions. As for OLAF’s accountability, the Director-General is required to adopt guidelines on OLAF’s investigations which must be available on the OLAF website.623 With regard to EU institutions, the European Parliament, the Council and the Commission should meet the Director-General once a year for an ‘exchange of views at [the] political level’,624 although this does not interfere with the conduct of ongoing investigations.625 The discussion should instead focus on the policy of OLAF concerning methods of preventing and combating fraud, corruption and any other illegal activity affecting the EU budget. Representatives of the Court of Auditors, the EPPO, Eurojust and/or Europol ‘may be invited to attend on an ad hoc basis upon request of the European Parliament, of the Council, of the Commission, of the Director-General or of the Supervisory Committee’, while the Supervisory Committee ‘shall’ participate in the exchange of views and the European Chief Prosecutor ‘shall’ be invited to attend it.626 The Supervisory Committee monitors OLAF’s investigative function in order to ‘reinforce the Office’s independence’.627 The Committee is composed of five ‘independent members’ appointed by the common accord of the European Parliament, the Council and the Commission for a non-renewable term of five years.628 In accordance with the previous OLAF Regulation, their term of office was for three years, which was renewable once:629 the change introduced by Regulation 883/2013 therefore goes in the direction of striking a balance between independence and accountability.630 To this end, the Supervisory Committee shall be granted access to all the information and documents it considers necessary, including reports and recommendations on closed investigations and cases dismissed, ‘without however interfering with the conduct of investigations in progress and with due regard to the requirements of confidentiality and data protection’.631

621 ibid art 17(4). OLAF is also accountable under a number of Treaty provisions aiming at ensuring the accountability of the Commission to other EU institutions, such as the European Parliament and the European Court of Auditors; see, for instance, the Commission annual reports to the European Parliament and the Council on the fight against fraud, produced under art 325(5) TFEU. 622 Article 18 of Regulation (EU, Euratom) 883/2013. 623 ibid Recital 18 and art 17(8). See ‘Guidelines on Investigation Procedures for OLAF Staff ’, 1 October 2013, https://ec.europa.eu/anti-fraud/sites/antifraud/files/docs/body/gip_18092013_en.pdf. 624 ibid art 16(1). 625 ibid art 16(3). 626 ibid art 16(1). 627 ibid art 15(1). 628 ibid art 15(2) and (3). 629 Article 11(2) and (3) of Regulation (EC) 1073/1999. 630 House of Commons European Scrutiny Committee (n 600) 41. 631 Article 15(1) of Regulation (EU, Euratom) 883/2013.

424 Bodies, Offices and Agencies Members of the Supervisory Committee have included judges, prosecutors, former MEPs, academics and civil servants.632 In carrying out their duties, members must neither seek nor take instructions from any government or any institution, body, office or agency.633 The Committee’s main task is to deliver opinions to the Director-General concerning OLAF’s activities, without interfering with the conduct of investigations in progress.634 Regularly informed by the OLAF Director-General,635 the Committee also adopts at least one annual activity report – ‘covering in particular the assessment of the Office’s independence, the application of procedural guarantees and the duration of investigations’636 – which is submitted to the European Parliament, the Council, the Commission and the Court of Auditors.637 This legislative framework has led to the conclusion that OLAF’s status is ‘hybrid and ambiguous’.638 OLAF was set up in response to grave allegations of financial irregularities within the Commission in order partly to investigate any such irregularities independently – yet it is not an independent agency, but remains a department of the Commission itself, under the Commission’s control. For example, OLAF does not have locus standi before the CJEU and actions against its acts are brought against the Commission.639 The paradox – and potential conflict of interest – with regard to OLAF’s role in internal investigations is glaring: the office set out to ‘clean up’ the financial affairs of the Commission is in essence – with some added safeguards of independence – the Commission itself. This paradox may account for what is deemed to be the ‘increased politicisation’ of OLAF investigations.640 It has also led to difficult situations with regard to ensuring meaningful accountability of OLAF towards other EU institutions, in particular the European Parliament. These difficulties were recognised by the Commission itself in its 2003 evaluation of OLAF. Discussing the parliamentary oversight of OLAF, the Commission noted that: [T]his situation is likely to generate expectations that will be tricky for the Office to solve as, particularly in the context of the discharge or parliamentary questions, it must both help the Commission to fulfil its obligations and satisfy Parliament’s wish for facts allowing it to exert

632 The Supervisory Committee is currently chaired by former MEP Jan Mulder. Previous chairpersons were: Tuomas Pöysti (Auditor General of Finland), Johan Denolf (Belgian Chief Commissioner), Diemut Theato (former MEP), Peter Strömberg (Director of the Swedish Supervisory Board of Public Accountants), Luis López Sanz-Aranguez (Public Prosecutor at Supreme Court in Spain), Rosalind Wright (Chairman of the UK Fraud Advisory Panel), Raymond Kendall (honorary Interpol Secretary-General) and Professor Mireille Delmas-Marty, who led the corpus juris project. 633 Article 15(7) of Regulation (EU, Euratom) 883/2013. 634 ibid art 15(1). 635 ibid art 17(5), which states that the Director must keep the Committee periodically informed of the Office’s activities, the implementation of its investigative function and the action taken by way of follow-up to investigations. 636 ibid art 15(9). 637 ibid. 638 Report by the French National Assembly (n 586) 10. On OLAF’s hybrid status, see also House of Lords European Union Committee (n 615) para 29. 639 See JFH Inghelram, ‘Judicial Review of Investigative Acts of the European Anti-Fraud Office (OLAF): A Search for a Balance’ (2012) 49(2) CML Rev 601, 603. The lack of an autonomous legal personality prevents OLAF from qualifying as a proper EU agency (M Chamon, EU Agencies. Legal and Political Limits to the Transformation of the EU Administration (Oxford University Press, 2016) 14–15). 640 ‘Une politisation croissante’ – Report by the French National Assembly (n 586) 21.

OLAF 425 its financial management audit task, while complying with the legal framework for its investigations that place restrictions on its communication activities. For the Commission, the situation with regard to the current investigations can prove delicate, because of the Office’s independence, as it must answer questions from Parliament even though the Office’s independent status means that the Commission does not always have the requisite information, and at the same time it must abide by the principle of confidentiality of investigations.641

This ambiguous status of OLAF, coupled with its considerable investigative powers, has led to broader concerns regarding the impact of its action on fundamental rights.642 Such concerns were expressed strongly by the Court of Auditors in its special Report on OLAF (2005), where it expressly stated that ‘there is no independent guarantee of the legality of investigative procedures in progress or that the fundamental rights of persons under investigation are safeguarded’ (emphasis added), adding that ‘[f]or want of a clear codification of investigative procedures, the situation is prone to litigation’.643 The lack of clear investigatory procedures and structured supervision of OLAF investigations was also highlighted by the OLAF Supervisory Committee in 2007.644 These concerns have been partially addressed by Regulation 883/2013. Article 9 lists the procedural guarantees of the persons concerned by OLAF (internal and external) investigations. Among other things, OLAF must seek evidence ‘for and against the person concerned’ and in any case must conduct the investigations ‘objectively and impartially and in accordance with the principle of the presumption of innocence’.645 The Regulation also provides that – once the investigations of the Office are over – the interested person ‘shall be given the opportunity to comment on facts’646 concerning them on the basis of a ‘summary of the facts’ that will be sent to them in due course.647 However, this does not imply that the interested person has the right to access the OLAF file and the documents included therein, as acknowledged by the Court of Justice in the International Management Group case:648 [T]he legislative framework applicable to OLAF precludes, in principle, a right to access OLAF’s file on the part of the persons concerned. It is only if the authorities to whom the final report is addressed intend to adopt acts which adversely affect the persons concerned that those authorities must, in accordance with the procedural rules which apply to them,

641 Commission, ‘Evaluation of the Activities of the European Anti-Fraud Office (OLAF)’ COM (2003) 154 final, Brussels, 2 April 2003, 41. In the same document, the Commission claims that it had initially proposed the establishment of an external body and notes that OLAF’s current status can be explained by the circumstances surrounding its establishment, with the aim being ‘to find a good way of increasing the effectiveness and credibility of the fight against fraud, corruption and other illegal activities as quickly as possible’ (at 31). 642 In this context, see S Gless and HE Zeitler, ‘Fair Trial Rights and the European Community’s Fight against Fraud’ (2001) 7(2) European Law Journal 219; and W Hetzer, ‘Fight against Fraud and Protection of Fundamental Rights in the European Union’ (2006) 14(1) European Journal of Crime, Criminal Law and Criminal Justice 20. See also the Tillack saga in section IV.B below. 643 European Court of Auditors, ‘Special Report No 1/2005 concerning the management of the European Anti-Fraud Office (OLAF), together with the Commission’s replies’ [2005] OJ C202, 18 August, point IX at 3. 644 OLAF Supervisory Committee, Activity Report of OLAF Supervisory Committee December 2005– May 2007, 17 October 2007. 645 Article 9(1) of Regulation (EU, Euratom) 883/2013. 646 ibid art 9(4). 647 ibid. 648 Case T-110/15, International Management Group v Commission, judgment of 26 May 2016, EU:T:2016:322.

426 Bodies, Offices and Agencies provide access to OLAF’s final report in order to enable those persons to exercise their rights of defence. (Emphasis added)649

Yet, as the Supervisory Committee pointed out in 2013, the list of procedural guarantees was not coupled with a sufficient system of redress mechanism for the cases where OLAF is believed to violate human rights during the investigations.650 As section IV.B below explains, the CJEU adopts a restrictive interpretation of Article 263 TFEU in relation to OLAF activities, whereas the Supervisory Committee can only point out breaches of fundamental rights in OLAF investigations, but its powers are limited. As the Court of Auditors already noted in 2005: The discharge of the mandate of the Supervisory Committee is delicate on several counts. The Committee is required to be the guarantor of both the Office’s independence and the rights of persons under investigation. The legislation gives it no decision-taking power to do this. By restricting its pronouncements to issues of principle, it is laying down a doctrine which has no real effects on investigations. Finally, as the Committee cannot intervene during the course of investigations, it in no way constitutes a mechanism to monitor the legality of investigations while they are in progress. (Emphasis added)651

The other paths available to seeking redress – such as complaints to the EDPS or the European Ombudsman – are likewise considered insufficient.652 The same goes for the internal ‘legality check’, which is aimed at evaluating the legality, necessity and proportionality of OLAF activities before and after they are carried out.653 In 2013, the Supervisory Committee therefore called for the establishment of a ‘transparent and stable internal procedure for dealing with individual complaints’.654 In 2014, the Commission proposed the establishment of a ‘Controller of procedural guarantees’,655 but, although endorsed by the Court of Auditors, this proposal was opposed by Member States.656

649 ibid para 36. For further remarks on the limited right of access to OLAF case files, see Ligeti (n 615) 16–18. See also Covolo (n 539) 423–510. 650 See ‘Opinion No 2/2013 of the Supervisory Committee of OLAF on establishing an internal OLAF procedure for complaints’. 651 European Court of Auditors (n 643) para 67. See also ‘Opinion No 2/2013 of the Supervisory Committee of OLAF’ (n 650) 4. 652 See ‘Opinion No 2/2013 of the Supervisory Committee of OLAF’ (n 650) 3–4. 653 See arts 12 and 20 of the ‘Guidelines on Investigation Procedures for OLAF Staff ’ (n 623). For more on this, see M Scholten and M Simonato, ‘EU Report’ in M Luchtman and JAE Vervaele (eds), ‘Investigatory Powers and Procedural Safeguards: Improving OLAF’s Legislative Framework through a Comparison with Other EU Law Enforcement Authorities (ECN/ESMA/ECB)’, Utrecht University, April 2017, https://dspace. library.uu.nl/handle/1874/352061, 27–28. 654 ‘Opinion No 2/2013 of the Supervisory Committee of OLAF’ (n 650) 2. 655 ‘Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 883/2013 as regards the establishment of a Controller of procedural guarantees’ COM (2014) 340 final, Brussels, 11 June 2014. 656 See, respectively, European Court of Auditors, ‘Opinion No 6/2014 concerning a proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 883/2013 as regards the establishment of a Controller of procedural guarantees’, Council Doc 16042/14, Brussels, 26 November 2014, and Council Doc 14075/14, Brussels, 27 October 2014. The added value of this proposal had been questioned by Ligeti (n 615) 23–24, since it introduces ‘an additional layer of non-binding control’ (at 24).

OLAF 427 The Controller was eventually established by Regulation 2020/2223, which amended Regulation 883/2013.657 Appointed by the Commission and administratively attached to the Supervisory Committee, the Controller handles complaints regarding OLAF’s compliance with the procedural guarantees referred to in Article 9 of Regulation 883/2013, as well as on the grounds of an infringement of the rules applicable to its investigations, in particular infringements of procedural requirements and fundamental rights. The Controller should examine the complaints – which do not have suspensive effect on ongoing investigations by OLAF – in a swift and adversarial way, and issue recommendations in response to them, suggesting solutions to the issues raised by the complainants where necessary.658 This development in the legal framework of OLAF shows that increasing attention is being paid to fundamental rights and their protection in the context of OLAF’s investigations, despite the limits to their fully fledged judicial review at the EU level, as will be explained in the following section.

B. The Judicial Control of OLAF: The Tillack Saga and Beyond OLAF’s hybrid status, along with its extensive investigative powers, may have significant implications for the position of individuals under investigation. This is particularly the case in the light of the inevitable politicisation of cases involving alleged irregularities within the European Commission, where OLAF’s zeal to pursue the matter, along with its extended avenues of communication with national investigative authorities, may lead to the unleashing of a wide range of powers against individuals who happen to be involved in these cases. The issue of judicial review of OLAF’s activities is therefore central in this context. Article 263 TFEU provides, under certain conditions, for an avenue for individuals to bring actions for annulment against the Commission before the CJEU.659 In the Sigma Orionis case, the General Court has stressed that OLAF final reports can only be annulled by the Court itself and not by national judicial authorities – in a case where the Indictment Division of a French court had annulled an OLAF report, the General Court noted that ‘according to the case-law, the EU courts alone have jurisdiction to determine that an act of the European Union is invalid … Therefore, irrespective of the findings made by the Indictment Division in its judgment, OLAF’s report continues to be lawful in the EU legal order in so far as it has not been invalidated by the EU judicature’ (emphasis added).660 At most, the Court clarified, ‘pursuant to the judgment 657 [2020] OJ L437, 28 December, 49. Regulation (EU, Euratom) 2020/2223 introduced arts 9a (‘Controller of procedural guarantees’) and 9b (‘Complaints mechanism’) in the text of Regulation (EU, Euratom) 883/2013. 658 For these and the further detailed rules on the newly established complaints mechanism, see art 9b of Regulation (EU, Euratom) 883/2013. While the OLAF’s Director-General should take appropriate action as warranted by the Controller’s recommendation, he or she can also decide not to follow such recommendation after communicating to the Controller and the complainant the main reasons for that decision, and unless such a communication would affect the ongoing investigation (art 9b(7) of Regulation (EU, Euratom) 883/2013). 659 The Court has refused standing to MEPs seeking annulment of amendments to the European Parliament Rules of Procedure following the adoption of an Inter-institutional Agreement between, inter alia, the Parliament and OLAF – however, it reiterated its case law that the rules relating to recourse to EU Courts must be interpreted in the light of the principle of effective judicial protection. See Case C-167/02P, Rothley and Others v European Parliament, judgment of 30 March 2004, EU:C:2004:193, paras 46–54. 660 Case T-48/16, Sigma Orionis v Commission, EU:T:2018:245, para 62.

428 Bodies, Offices and Agencies of the Indictment Division, OLAF’s report could not be used in criminal proceedings … against the applicant’, but the fact remains ‘that in administrative proceedings under EU law … the Commission was entitled to rely on that report … in so far as it had not been invalidated by the EU judicature’.661 So far, however, the Court of Justice has adopted an approach that has resulted in the failure of actions for annulment of OLAF acts, which are routinely declared inadmissible. A prime example has been the Tillack saga. OLAF’s investigation concerned the publication in February and March 2002 by Hans-Martin Tillack of two articles in Stern containing reports of alleged irregularities based on a report by an EU official (Paul van Buitenen) and on confidential OLAF documents. On 27 March 2002, OLAF issued a press release announcing an internal inquiry which would also include an investigation on bribery as ‘it is not excluded that payment may have been made to somebody within OLAF (or possibly another EU institution) for these documents’.662 Following a complaint by Mr Tillack, the European Ombudsman found that the publication of such allegations by OLAF without a factual basis was disproportionate and constituted an act of maladministration, and subsequently found, in a special report to the European Parliament, that OLAF made incorrect and misleading statements in its submissions to the Ombudsman in the context of this inquiry.663 Allegations of maladministration did not stop OLAF from forwarding information concerning suspicions of breach of professional secrecy and bribery to the judicial authorities in Brussels and Hamburg in February 2004.664 Both authorities opened investigations, and the Belgian investigation led to the Belgian police carrying out a search of Mr Tillack’s home and office, and the seizure of professional documents and personal belongings.665 Following these developments, Mr Tillack brought an action for annulment of the measure by which OLAF forwarded certain information to the Hamburg and Brussels prosecuting authorities to the Court of First Instance (CFI), now known as the General Court, of the Court of Justice. He also asked the CFI to take interim measures to order the suspension of any further action by the Belgian and German authorities, and to order that OLAF should refrain from obtaining, inspecting or examining the contents of any documents in possession of the Belgian authorities as a result of the search and seizure operation. Both the CFI and the Court of Justice on appeal rejected the application for interim measures.666 Finally, in October 2006, the judgment of the CFI was published.667 The Court dismissed the applicant’s action for damages and declared his action for annulment of the act by which OLAF, on the basis of Article 10(2) of Regulation 1073/1999 (now Article 11(5) of Regulation 883/2013), forwarded information to the German and 661 ibid para 66. 662 Cited in the facts of the CFI judgment on the Tillack case (Tillack v Commission (n 268) para 14). 663 European Ombudsman, ‘Special Report to the European Parliament following the draft recommendation to the European Anti-Fraud Office in complaint 2485/2004/GG’, Strasbourg, 12 May 2005. 664 Tillack v Commission (n 268) para 27. 665 ibid para 29. 666 Order of the President of the Court of First Instance of 15 October 2004 in Case T-193/04R, Tillack v Commission, EU:T:2004:311; and Order of the President of the Court of 19 April 2005 in Case C-521/04 P(R), Tillack v Commission, EU:C:2005:240. For the background and analysis of these judgments, see J Wakefield, ‘Good Governance and the European Anti-Fraud Office’ (2006) 12(4) European Public Law 549. 667 Tillack v Commission (n 268). For a commentary, see J Wakefield ‘Case Note’ (2008) 45(1) CML Rev 199.

OLAF 429 Belgian judicial authorities to be inadmissible. On the second point, the Court largely followed the interim measures orders by finding that in the present case, ‘the contested act does not bring about a distinct change in the applicant’s legal position’.668 While national authorities are under a duty to examine the information forwarded by OLAF, this does not mean that the forwarded information has binding effect, ‘in the sense that the national authorities are obliged to take specific measures, since such an interpretation would alter the division of tasks and responsibilities as prescribed for the implementation of Regulation No 1073/99’.669 This division of tasks is now included in Recital 31 of Regulation 883/2013, which confirms that the choice of what action should be taken on the basis of OLAF reports lies either with the competent authorities of the Member States (external investigations) or with the competent EU body in the case of internal investigations. In Tillack, the Court followed the established case law on Article 263 TFEU (previously Article 230 EC), pursuant to which actions brought by natural and legal persons are admissible if the binding legal effects of the contested act are capable of affecting the interests of the applicant by bringing about a distinct change in that applicant’s legal position.670 The CFI has thus tried not to rock the boat regarding the role of OLAF in domestic criminal investigations by emphasising the autonomy of national authorities in deciding on whether to act on the basis of OLAF’s reports. However, in stressing national autonomy, the Court at the same time refused to look at the substance of the document which triggered the domestic investigation and search and seizure measures, namely OLAF’s report in itself. The reluctance of the Court to examine the substance and accuracy of a report by a Community body, which has resulted – albeit in a domestic context – in the taking of coercive measures against an individual is hardly indicative of meaningful judicial control of OLAF or of effective judicial protection for the individuals concerned.671 By rejecting the action for damages, the Court also appeared not to be inclined to examine the general conduct of OLAF’s campaign against Mr Tillack, notwithstanding the sustained criticism of such conduct by the European Ombudsman.672 The CFI refusal to look at the substance of OLAF’s report (which was linked to an aggressive campaign against a journalist publicising allegations of internal mismanagement in the Commission) is also in sharp contrast to the stance of the ECtHR in 668 Tillack v Commission (n 268) para 68. For previous cases where the Court had adopted a similar stance, see X Groussot and Z Popov, ‘What’s Wrong with OLAF? Accountability, Due Process and Criminal Justice in European Anti-fraud Policy’ (2010) 47(3) CML Rev 605, 608–11; Wade (n 466) 201–02. 669 Tillack v Commission (n 268) para 72. 670 See, among many, Joined Cases C-463/10 P and C-475/10 P, Deutsche Post and Germany v Commission, EU:C:2011:656. For an analysis of standing requirements under art 263(4) TFEU, see K Lenaerts, I Maselis and K Gutman, EU Procedural Law (Oxford University Press, 2014) para 7.21, 268–69. 671 See also Inghelram (n 639) 626–27. 672 The Court found that the applicant had failed to show the existence of a sufficiently serious breach of (then) Community law attributable to OLAF capable of causing him harm (Tillack v Commission (n 268) para 135). It found that the applicant had not established the existence of a sufficiently direct causal link between the forwarding of the information by OLAF to the Belgian judicial authorities and the damage claimed (at para 124). According to the Court, the recommendations of the European Ombudsman in this context were not relevant, as ‘the classification as an “act of maladministration” by the Ombudsman does not mean, in itself, that OLAF’s conduct constitutes a sufficiently serious breach of a rule of law’, adding that the alternative non-judicial Ombudsman remedy ‘meets specific criteria and does not necessarily have the same objective as judicial proceedings’ (at para 128).

430 Bodies, Offices and Agencies Strasbourg. In its examination of the case of Mr Tillack against Belgium, alleging breach of his fundamental rights by the measures taken by the Belgian authorities following the forwarding of the OLAF report to them, the Strasbourg Court found that these measures were disproportionate and thus violated the applicant’s right of freedom of expression under Article 10 ECHR.673 In reaching this conclusion, the Court took into account the fact that the applicant was a journalist (triggering thus freedom of the press issues).674 It also looked at the measures taken by the Belgian authorities in the light of the information provided to them by OLAF. The Court agreed with the European Ombudsman that the corruption suspicions against the applicant were founded upon ‘simple rumours’ – thus, there was no preponderant imperative of public interest which could justify the measures taken by the national authorities.675 Judicial protection to Mr Tillack was thus provided in the context of the examination of measures taken by national authorities. This seems to be in line with the approach of the CFI. However, one cannot help but notice the following paradox: the examination of the substance of the OLAF Report was conducted in Strasbourg and not in Luxembourg – thus, it was not an EU Court which examined the action of an EU institution, but the Strasbourg Court in the context of its investigation of national proceedings.676 The differences in the outcome of the Tillack cases highlights the limits to effective judicial protection for the individuals affected and the detailed scrutiny of OLAF’s activities before the EU courts. The CFI reaffirmed its line of reasoning on the inadmissibility of actions for annulment of OLAF’s acts in the case of Violetti, where it adopted a narrow view on the impact of the requirement of effective judicial protection on the interpretation of the standing criteria for such actions.677 The concerns on the right to effective judicial protection had been partially addressed in a previous judgment, Franchet and Byk.678 The case involved OLAF internal investigations against Mr Franchet and Mr Byk, the former General Director and Director of Eurostat respectively, which resulted in the transmission of files and the opening of prosecutions in courts in France and Luxembourg. The Court began by differentiating between the eventual outcome of the cases at the national level and the need to examine the manner in which OLAF conducted its investigations.679 It found that the transmission of the dossiers by OLAF to the national authorities involved an internal (and not an external) investigation.680 In examining the conduct of the internal investigation, the Court found in no uncertain terms that OLAF violated not only Article 11 of Regulation (EC) 1073/1999 (now Article 17(5)(b) of Regulation 883/2013)

673 ECtHR, Tillack v Belgium, App No 20477/05, judgment of 27 November 2007 (final version 27 February 2008), para 68. 674 See in particular ibid para 65. 675 ibid para 63 (our translation). 676 It has since been reported that the Belgian police dropped the case against Mr Tillack – see ‘Belgian Police Drop Case against EU Journalist’, 30 January 2008, https://euobserver.com/justice/25567. 677 Case T-261/09 P, Commission v Violetti and Others, judgment of 20 May 2010 and reported in French, EU:T:2010:215, para 56. Some have even claimed that, according to the Court, the lack of effective judicial protection is not, in itself, sufficient to justify the admissibility of an action for annulment (V Covolo, ‘The Legal Framework of OLAF Investigations: What Lessons for the European Penal Area?’ (2011) 2(2) New Journal of European Criminal Law 201, 216). 678 Case T-48/05, Franchet and Byk v Commission, judgment of 8 July 2008, EU:T:2008:257. 679 ibid para 90. 680 ibid para 124.

OLAF 431 in not informing the OLAF Supervisory Committee of the transmission of the dossiers sent to the national authorities,681 but also Article 4 of Decision 1999/396 on the right to inform the interested party and the rights of the defendants in the context of the transmission of the dossiers to the national authorities.682 As mentioned above, Article 9(4) of Regulation 883/2013 now expressly provides that the person concerned by OLAF investigations must be given the opportunity to comment on facts concerning them once the OLAF investigation has been completed and before conclusions are drawn up. Of equal significance are the findings of the Court in relation to the spreading of rumours by OLAF with regard to the defendants. In a departure from its outlook in Tillack, the Court found that OLAF was responsible for information leaks with regard to one of the dossiers683 and that, in doing so, it violated the principle of the presumption of innocence.684 It also found that the principle of the presumption of innocence was violated by the Commission too as a result of the publication of a press release concerning the defendants685 and ordered the Commission to pay the sum of €56,000 to the applicants. The CFI judgment is extremely significant, not only in finding that there is a causal link between the conduct of OLAF and the European Commission and the worsening of the position of individuals under investigation, but also in signalling that the Court is ready to scrutinise in detail the activities of OLAF and their impact on the rights of individuals affected by OLAF’s operations. It is particularly noteworthy that in this case, the Court looked in detail at the substance of OLAF’s conduct and was not hindered by the formal distinction between what constitutes an ‘internal’ or an ‘external’ OLAF investigation. This step is welcome as it should reduce cases where OLAF activities may be shielded from scrutiny. On the other hand, the Court’s ruling against the Commission on the question of the presumption of innocence may also signify that the latter may not evade responsibility in evoking the fact that an OLAF investigation is taking place.

C. Final Remarks: The Future of OLAF in the Light of the EPPO OLAF’s main features are different from those of Eurojust and Europol. The latter are EU agencies that were created with strong intergovernmental features and support national authorities’ investigations and prosecutions on cross-border crimes. OLAF instead 681 ibid paras 164 and 166. 682 ibid para 152. The Decision concerns the terms and conditions of internal investigations in relation to the prevention of fraud, corruption and any other illegal activity detrimental to the Communities’ interests – [1999] OJ L149, 16 June, 57. Article 4 (‘Informing the interested party’) reads as follows: ‘Where the possible implication of a Member, official or servant of the Commission emerges, the interested party shall be informed rapidly as long as this would not be harmful to the investigation. In any event, conclusions referring by name to a Member, official or servant of the Commission may not be drawn once the investigation has been completed without the interested party’s having been enabled to express his views on all the facts which concern him’ (emphasis added). The same provision also lays down an exception to this rule in ‘cases necessitating the maintenance of absolute secrecy for the purposes of the investigation and requiring the use of investigative procedures falling within the remit of a national judicial authority’. 683 Franchet and Byk v Commission (n 678) para 206. 684 ibid para 217. The respect of the principle of the presumption of innocence is now expressly required by art 9(1) of Regulation 883/2013. See also Groussot and Popov (n 684) 623–29. 685 Franchet and Byk v Commission (n 678) para 313.

432 Bodies, Offices and Agencies conducts investigations, albeit of an administrative nature, to protect purely supranational interests, that is, the EU’s financial interests. Furthermore, OLAF is – somehow contradictorily – independent from the Commission and at the same time a sui generis ‘directorate-general’686 of it. This may raise doubts over the full impartiality of its investigations, especially the ‘internal’ investigations that concern the Commission itself. The relations of OLAF with other EU bodies, notably Europol and Eurojust, have not always been smooth: there are risks of overlap between the work of the three bodies, since their mandate is in one form or another relating to criminal investigations. This potential overlap, along with existential concerns regarding the role and future of OLAF and fears that it may be subsumed under, or merged with, one of the other EU criminal justice bodies, may explain why the relationship between OLAF on the one hand and Europol and in particular Eurojust on the other has been at times marred by competition rather than cooperation.687 Indeed, there have been calls for a merger (‘fusion’) between OLAF and Europol under the control of the EPPO.688 Moreover, the Lisbon Treaty provides that the EPPO should be established ‘from Eurojust’689 and does not mention OLAF, raising questions about the future of the latter, even though the EPPO Regulation has eventually kept the role and status of OLAF unchanged. To ensure consistency between the EPPO Regulation and Regulation 883/2013 on OLAF, the Commission tabled a proposal to amend Regulation 883/2013 in May 2018,690 which led to the adoption of the above-mentioned Regulation 2020/2223. As will be discussed further below, the EPPO Regulation lays down some rules on the relations between the two offices, and Regulation 883/2013 had to be updated accordingly. The Commission then seized the opportunity to propose the some rules of the OLAF’s legal framework, taking into account the evaluation of the application of Regulation 883/2013.691 According to this evaluation, which was concluded in 2017, Regulation 883/2013 had improved the overall effectiveness of OLAF activities, yet there were still some shortcomings that had to be addressed. In particular, as OLAF’s legal framework often refers to national law, it was not entirely clear when OLAF applies (or should apply) national law: ‘different interpretations of the relevant provisions, and differences in national law, lead to a fragmentation in the exercise of OLAF’s powers in the Member States, in some cases hindering OLAF’s ability to successfully conduct investigations’.692 Furthermore, 686 European Court of Auditors (n 656) 2. 687 On the competitive relationship between OLAF and Eurojust in particular, see section III.B.vii above. 688 Report by the French National Assembly (n 586) above. See also the evidence in House of Lords European Union Committee (n 615) para 90; Covolo (n 539) 641–44. For further details on the relations between OLAF and the EPPO, see section V.B.vi below. 689 Article 86(1) TFEU. 690 ‘Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 883/2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of OLAF investigations’ COM (2018) 338 final, Brussels, 23 May 2018. 691 ‘Report from the Commission to the European Parliament and the Council. Evaluation of the application of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999’ COM (2017) 589 final, Brussels, 2 October 2017. 692 ibid 3.

OLAF 433 OLAF did not have satisfactory access to bank account information and lacked the tools to enforce its powers if persons under investigations refused to collaborate. In such cases, OLAF relied on national authorities, which would then undertake the necessary investigative measures in accordance with national law.693 The evaluation also acknowledged the different views on the procedural safeguards listed in Regulation 883/2013, which are excessive according to some and insufficient according to others.694 Further issues were reported with regard to the rules on the admissibility of OLAF-collected evidence in national judicial proceedings. The ‘assimilation rule’ of Article 11(2) of Regulation 883/2013, which obliged national judicial authorities to consider OLAF reports as if they were reports of analogous national administrative authorities, did not always ensure the admissibility of such reports and therefore the effectiveness of OLAF investigations.695 It may indeed happen that national authorities repeat OLAF activities to secure the admissibility of evidence. Such a duplication is arguably a failure for the EU, national authorities and individuals, since it runs counter to the principle of procedural economy and, at the same time, obliges the persons who are subject to OLAF investigations to be the subject of further investigations – on the same facts – by national authorities. Furthermore, the repetition of investigative acts could not be effective or even possible in some circumstances, eg, because the suspected person destroyed the relevant evidence. This may in turn deter national authorities from providing any judicial follow-up to OLAF investigations.696 Further problems are linked with the occasional long duration of OLAF investigations; at the end of these investigations, the crimes that are uncovered by the Office and that national authorities could (or should) prosecute are sometimes (either already or on the brink of being) statute-barred,697 so that a duplication of investigative measures would only worsen this state of affairs.698 Against this backdrop, Regulation 2020/2223, along the lines of the 2018 Commission’s proposal, has first amended Regulation 883/2013 by introducing some rules on the relations between OLAF and the EPPO.699 Second, it clarifies that it is only when an economic operator resists an OLAF on-the-spot check or inspection that national authorities should intervene and apply national law; otherwise, EU rules on OLAF investigations apply.700 Third, it spells out the ‘duty of competent national authorities to provide bank account information to the Office, as part of their general duty to assist

693 ibid. As the Court clarified in Sigma Orionis, if the person does not resist OLAF inspections, OLAF will instead carry out the relevant measures in accordance with EU law (Sigma Orionis v Commission (n 660) paras 73–97). 694 COM (2017) 589 final, n 735 final, 4. 695 ibid. This rule still applies when OLAF reports are to be used in national criminal proceedings (see n 614 above and immediately below in the text). 696 Ligeti (n 615) 28. 697 ‘Opinion 2/2017 of the OLAF Supervisory Committee Accompanying the Commission Evaluation report on the application of Regulation (EU) of the European Parliament and of the Council No 883/2013 (Article 19)’, paras 29–31. 698 F Giuffrida, ‘Comparative Analysis’ in Giuffrida and Ligeti (n 614) 222–87 at 268. 699 See the newly introduced arts 12c–12g of Regulation (EU, Euratom) 883/2013. 700 Recitals 20, 21 and 22 of Regulation (EU, Euratom) 2020/2223 and art 3(4)–(10) of Regulation (EU, Euratom) 883/2013, which in essence codify the principles laid down by the CJEU in Sigma Orionis (n 660).

434 Bodies, Offices and Agencies the Office’.701 Fourth, it amends the rule on the admissibility of OLAF-collected evidence by providing that OLAF reports should be admissible as such in judicial proceedings of a non-criminal nature before national and EU courts, and in national and EU administrative proceedings. As for national criminal proceedings, the assimilation rule continues to apply.702 These changes were already envisaged in the original Commission’s proposal, which however seemed mostly driven by the need to ensure consistency between the EPPO Regulation and Regulation 883/2013 with respect to the relations between the two offices. The final text of Regulation 2020/2223 has instead amended further rules of the OLAF’s legal framework and added new ones. During the negotiations, the European Parliament, which adopted its legislative resolution in April 2019,703 took a bold approach and suggested several amendments to Regulation 883/2013. Among these, it suggested removing the ‘assimilation rule’ with respect to criminal proceedings. Therefore, in its view, OLAF reports should also be admissible in national criminal proceedings upon simple verification of their authenticity, without any further reference to the reports of comparable administrative authorities.704 It also paid considerable attention to procedural safeguards and suggested introducing provisions on: (i) the right of access to the OLAF file when the Office recommends a judicial follow-up to its investigations;705 (ii) the right to bring before the General Court an action against the Commission for annulment of OLAF reports on the grounds of lack of competence, infringement of an essential procedural requirement, infringement of the Treaties, including violation of the Charter, or misuse of powers, in this way overturning the established case law on the inadmissibility of actions for annulment concerning OLAF reports;706 and (iii) the establishment of the ‘Controller of procedural guarantees’.707 As discussed above, only the latter proposal was eventually endorsed. In sum, it is likely that OLAF’s status and powers will continue to be at the centre of debates concerning the future of the AFSJ, especially since the establishment of the EPPO raises the question of whether it is tenable to have two different bodies with such a similar mandate. Some authors have, for instance, envisaged that OLAF can become, in the long run, the ‘police financière’ of the EPPO,708 in this way avoiding duplication, maximising the expertise and at the same time strengthening the protection of the EU’s

701 Recital 31 of Regulation (EU, Euratom) 2020/2223. 702 Art 11(2) of Regulation (EU, Euratom) 883/2013. For more on this, see n 614 above. 703 ‘European Parliament legislative resolution of 16 April 2019 on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 883/2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of OLAF investigations (COM(2018)0338 – C8-0214/2018 – 2018/0170(COD))’. For some remarks on this resolution, see Giuffrida (n 698) 272ff. 704 ‘European Parliament legislative resolution of 16 April 2019’ (n 703) amendment 85. 705 ibid amendment 75. 706 ibid amendment 94. 707 ibid amendment 76. 708 L López Sanz-Aranguez, ‘Le Point de Vue du Comité de Surveillance de l’OLAF’ in Ghaleh Marzban (n 602) 37–48 at 45. For further remarks on OLAF as the potential ‘investigatory arm’ of the EPPO, see A Weyembergh and C Brière, ‘The Future Cooperation between OLAF and the European Public Prosecutor’s Office’, Study for the European Parliament’s Committee on Budgetary Control, 2017, 20–21.

The EPPO 435 financial interests. However, for the time being, this option has attracted very limited support.

V. The EPPO A. Background The establishment of an EPPO has been perhaps the most contested issue in the development of EU criminal law in recent years. Towards the end of the 1990s, the establishment of the Office was proposed in the corpus juris, an academic study funded by the European Commission which resulted in a mini-criminal code for the protection of the Community’s financial interests.709 The corpus juris would cover offences of fraud, market-rigging, money laundering, conspiracy, corruption, misappropriation of funds, abuse of office and disclosure of secrets pertaining to one’s office (Articles 1–8). It then included provisions on criminal law principles and sanctions, as well as prosecution. In this context, it called for the establishment of a EPP, which was defined as follows: The EPP is an authority of the European Community, responsible for investigation, prosecution, committal to trial, presenting the prosecution case at trial and the execution of sentences concerning the offences defined above (Articles 1–8). It is independent as regards both national authorities and Community institutions.710

In accordance with the corpus juris, ‘the territory of the Member States of the EU constitutes a single legal area’711 for the purposes of the investigation, prosecution, trial and execution of sentences concerning the offences mentioned therein. The corpus juris contained a number of detailed provisions on the EPP, including provisions on the opening of proceedings, powers of investigation (including, inter alia, powers to conduct investigations and powers of questioning, collecting documents, and search and seizure), the termination of the investigation,712 and the bringing and termination of a prosecution, stating that ‘the EPP prosecutes at the court of trial, according to the laws of the Member State’.713 The proposal to create an EU prosecutorial body with coercive powers in the territory of Member States, and the treatment of the EU as a single legal area, was met with strong opposition by a number of Member States, which objected to what seemed to be a loss of sovereignty over criminal justice.714 Member States’ reactions led to the corpus juris not becoming EU law and, as mentioned above, to proposals for the establishment of Eurojust as a counterweight of the centralising EPP proposals. The Commission 709 On the corpus juris, see also ch 2. For the text and further details regarding its potential implementation, see M Delmas-Marty and JAE Vervaele (eds), The Implementation of the Corpus Juris in the Member States, vol 1 (Intersentia, 2000). 710 Article 18(2) of the corpus juris 2000. 711 ibid art 18(1). 712 Respectively, ibid arts 19, 20(2) and 21. 713 ibid art 22(1). 714 For an early overview of the debate, see House of Lords European Union Committee, Prosecuting Fraud on the Communities’ Finances – The Corpus Juris, 9th Report, 1998–99, HL paper 62.

436 Bodies, Offices and Agencies reiterated – in a watered-down version – proposals to establish the EPP in 2001,715 but these proposals were not taken up by the Council (which was in the process of agreeing the 2002 Eurojust Decision at the time).716 The debate continued in the deliberations of the Justice and Home Affairs Working Group at the Convention on the Future of Europe, with the Group finally being unable to reach a conclusion and its Report noting that ‘the discussion in the Group showed that members were divided on the issue’.717 This disagreement led to a compromise provision on the establishment of the EPP in the Constitutional Treaty (Article III-274), which was replicated in the Lisbon Treaty (Article 86 TFEU). Unsurprisingly for a constitutional provision, Article 86 TFEU is drafted in rather general terms. It calls for the establishment of the EPPO ‘from Eurojust’718 and states that the EPPO will be responsible for investigating, prosecuting and bringing to judgment – when appropriate in liaison with Europol – the perpetrators of, and accomplices in, offences against the EU’s financial interests. The EPPO will exercise the functions of prosecutor in the competent courts of the Member States in relation to such offences.719 Article 86 TFEU thus confirms, on the one hand, that Eurojust is currently well established (with the EPPO coming ‘from Eurojust’), but it is not clear what form it will take if an EPPO is established from it. On the other hand, the provision emphasises Europol’s role as a partner of the EPPO (in furtherance of its current partnership role with Eurojust) rather than establishing a mechanism subordinating Europol to the judicial control of the EPPO. The Treaty provision instead neglects – surprisingly, in light of their similar mandate (protection of the EU budget) – the relations between the EPPO and OLAF. Article 86 TFEU represents, for the first time in EU constitutional law, a concrete and express legal basis for the – possible but not mandatory720 – establishment of the EPPO, but it mentions only a few basic features of the Office. It is for secondary EU law to determine the general rules applicable to the EPPO, the conditions governing the performance of its functions and the rules of procedure that are applicable to its activities, as well as those governing the admissibility of evidence, and the rules applicable to the judicial review of procedural measures taken by it in the performance of its functions.721 These rules shall be laid down in regulations to be adopted in accordance with a special legislative procedure, where the Council acts unanimously after obtaining the consent of the European Parliament.722 Inherited from the Constitutional

715 See Commission, ‘Criminal-law protection of the financial interests of the Community and the establishment of a European Public Prosecutor’ (Green Paper) COM (2001) 715 final, Brussels, 11 December 2001. For comments on this, see C Fijnaut and MS Groenhuijsen, ‘A European Public Prosecution Service: Comments on the Green Paper’ (2002) 10(4) European Journal of Crime, Criminal Law and Criminal Justice 321. See also Commission, ‘Follow-up report on the Green Paper on the criminal-law protection of the financial interests of the Community and the establishment of a European Prosecutor’ COM (2003) 128 final, Brussels, 19 March 2003. 716 See also House of Lords European Union Committee (n 615) paras 91–92. 717 Final Report of Working Group X (n 23) 20. 718 Article 86(1) TFEU. 719 ibid art 86(2). 720 ‘[T]he Council … may establish a European Public Prosecutor’s Office from Eurojust’ (ibid art 86(1), emphasis added). 721 ibid art 86(3). 722 ibid art 86(1).

The EPPO 437 Treaty, the choice of the special legislative procedure is a testament to the high sensitivity of the topic. Despite two of the main constitutional improvements brought about by the Lisbon Treaty in the field of EU criminal law, namely the decrease of cases where unanimity in the Council is required and the extension of what was previously called the co-decision procedure, Article 86 TFEU is still rooted in a ‘third-pillar mindset’. Member States are fully in control of the political choice to create the EPPO, while the European Parliament is sidelined.723 Due to the sensitivity of the matter, unanimity was always considered unlikely. Article 86 TFEU therefore provides for an ‘emergency accelerator’724 that allows Member States to rapidly establish an enhanced cooperation to create the Office, and this represents the only substantial difference between Article 86 TFEU and the provision of the Constitutional Treaty on the EPPO. Pursuant to Articles 20(2) TEU and 329(1) TFEU, enhanced cooperation usually needs to be authorised by the Council following a proposal of the Commission and after obtaining the consent of the European Parliament. Article 86(1) TFEU provides instead that if there is no unanimity within the Council, the draft EPPO Regulation can be referred to the European Council if at least nine Member States wish to proceed; in the meantime, the procedure in the Council is suspended. Within four months of the suspension, if there is consensus in the European Council, the latter refers the draft back to the Council for adoption. Otherwise, in the event of disagreement, a group of at least nine Member States may decide to establish an enhanced cooperation to set up the Office by notifying the Commission, the Council and the European Parliament accordingly. In this case, the authorisation of the Council ‘shall be deemed to be granted’.725 These rules suggest that the lack of unanimous support to the EU intervention in this sensitive area was to be expected, so that the drafters of the Treaty provided for a ‘coopération renforcée facilitée’.726 This procedure was triggered during the negotiations on the EPPO, which was eventually established by means of enhanced cooperation. The Commission tabled its proposal for a Regulation on the EPPO in July 2013,727 arguing that the damage to the EU budget resulting from offences against the EU’s financial interests is very significant, yet neither Member States nor EU bodies (Eurojust, Europol and OLAF) can tackle these crimes in an effective way.728 A European body competent to investigate such illegal conduct would thus be needed. In light of the groundbreaking impact of the EPPO’s establishment on national criminal justice systems, negotiations have been troubled since the beginning. A group of 723 For some criticism of the limited role assigned to the European Parliament in such a sensitive field, see A Nieto Martín, ‘Principio di Legalità e European Public Prosecutor’s Office (EPPO)’ in G Grasso et al (eds), Le Sfide dell’Attuazione di una Procura Europea: Definizione di Regole Comuni e Loro Impatto sugli Ordinamenti Interni (Giuffrè, 2013) 305–323 at 319. 724 P Craig and G de Búrca, EU Law: Texts, Cases, and Materials, 6th edn (Oxford University Press, 2015) 985. 725 Article 86(1) TFEU. 726 D Flore, ‘La Perspective d’un Procureur Européen’ (2008) 9 ERA Forum 229, 236. 727 COM (2013) 534 final (n 420). This proposal is part of a package of instruments issued by the Commission on that date, namely the proposal for a Regulation on Eurojust (n 419), the Communication on reinforcing the role of OLAF (n 421) and the Communication on ‘Better protection of the Union’s financial interests: Setting up the European Public Prosecutor’s Office and reforming Eurojust’ COM (2013) 532 final, Brussels, 17 July 2013. 728 COM (2013) 534 final (n 420) 2.

438 Bodies, Offices and Agencies national parliaments objected that the Commission’s proposal did not comply with the principle of subsidiarity, triggering the so-called ‘yellow card’ procedure provided for by Protocol No 2 to the Lisbon Treaty.729 The Commission then had to review its proposal and decided to maintain it, confirming the pressing need to establish the EPPO.730 After three years of negotiations, during which the European Parliament issued three resolutions calling on the Council to introduce some modifications in the text,731 most Member States agreed on the key provisions of the Regulation; however, the unanimous adoption of the text turned out to be unfeasible. The Council registered the absence of unanimity on 7 February 2017.732 One week later, the Permanent Representatives of 17 Member States, who were convinced that ‘the project to set up a European Public Prosecutor’s Office is of utmost importance’,733 sent a letter to the President of the European Council, referring the draft Regulation and requesting to put it on the agenda of the European Council of 9 and 10 March 2017. As expected, the European Council could not reach agreement on the matter.734 The doors for the establishment of the EPPO by means of enhanced cooperation were formally opened and, at the beginning of April 2017, 16 Member States – later joined by another four – notified the European Parliament, the Council and the Commission of their wish to establish enhanced cooperation on the establishment of the EPPO.735 As noted above, the authorisation to proceed with enhanced cooperation was deemed to be granted. Negotiations went on for a few more months and the 20 Member States agreed on the text of the Regulation in June 2017.736 Council Regulation (EU) 2017/1939 implementing enhanced cooperation on the establishment of the EPPO (hereinafter the ‘EPPO Regulation’) was finally adopted in October 2017.737 At the time of writing, Denmark, Ireland,738 Sweden,739 Poland and Hungary do not participate in the EPPO.740 The Office is located in Luxembourg and started its operational activities on 1 June 2021. 729 See Council Doc 15686/13, Brussels, 7 November 2013. 730 COM (2013) 851 final, Brussels, 27 November 2013. For an analysis of this Communication and the objections of national Parliaments, see D Fromage, ‘The Second Yellow Card on the EPPO Proposal: An Encouraging Development for Member State Parliaments?’ (2015) 35(1) Yearbook of European Law 1; I Wieczorek, ‘The EPPO Draft Regulation Passes the First Subsidiarity Test: An Analysis and Interpretation of the European Commission’s Hasty Approach to National Parliaments’ Subsidiarity Arguments’ (2015) 16(5) German Law Journal 1247. 731 See European Parliament resolution of 12 March 2014 on the proposal for a Council regulation on the establishment of the European Public Prosecutor’s Office, P7_TA (2014) 0234; European Parliament resolution of 29 April 2015 on the proposal for a Council regulation on the establishment of the European Public Prosecutor’s Office, P8_TA (2015) 0173; and European Parliament resolution of 5 October 2016 on the European Public Prosecutor’s Office and Eurojust, P8_TA (2016) 0376. 732 See the press release of the General Affairs Council meeting of 7 February 2017, no 48/17. 733 EUCO Doc 4/17, Brussels, 14 February 2017, 2. 734 See the Conclusions by the President of the European Council, 9 March 2017, 6. 735 Council Doc 7761/17, Brussels, 3 April 2017, 1. 736 Council Doc 9941/17, Brussels, 30 June 2017. 737 [2017] OJ L283, 31 October, 1 (hereinafter the ‘EPPO Regulation’). 738 These two countries enjoy a special status vis-a-vis post-Lisbon measures concerning the AFSJ (see ch 1). The unanimity required in art 86(1) TFEU – which was not reached at the end of the negotiations – therefore had to be understood as referring to all EU Member States except for Ireland and Denmark (as well as the UK at the time). 739 Sweden is likely to join the enhanced cooperation in the future (see the blogpost by the then European Commissioner for Budget and Administration, Günther Oettinger, ‘Sweden Open to Join the European Public Prosecutor’s Office’, 4 April 2019, https://www.eumonitor.eu/9353000/1/j9vvik7m1c3gyxp/vkxdlvtgl6y6?ctx= vhyzn0ikkwxq). 740 The Netherlands and Malta joined in 2018.

The EPPO 439 The sections below discuss some key aspects of the EPPO by analysing, when appropriate, the differences between the original Commission’s proposal and the final text, in this way highlighting the shift from the centralised, vertical model envisaged by the European Commission to the more intergovernmental, collegial model finally endorsed by the Member States. In particular, due attention will be paid to two sticking points of the negotiations, namely the protection of human rights of individuals affected by the EPPO activities and the judicial review of EPPO acts and decisions.741

B. The Regulation i. Structure and Powers The wording of the Treaty left a number of open questions with regard to the precise powers and structure of the EPPO, its relationship with national prosecutors, and the operation of the EU body within the criminal justice systems of the Member States. A number of models on the structure and powers of the EPPO and its relationship with national legal systems have been put forward. These models viewed the EPPO from the perspective of the establishment of a vertical/hierarchical structure in relation to Member States (juxtaposing this model to strengthening horizontal cooperation under Eurojust), while other commentators have focused more on the degree of centralisation of prosecutorial power within the EPPO and the relationship between a centralised and a decentralised prosecutorial model in this context.742 The Commission’s proposal for a Regulation on the establishment of the EPPO envisaged a model of vertical cooperation based on a combination of centralised and decentralised elements of prosecution. The main features of the EPPO in the Commission’s text were the following. The EPPO would be established as an EU body with a decentralised structure.743 The structure of the EPPO would be composed of an EPP, their deputies and staff, and European Delegated Prosecutors located in the Member States.744 The EPPO would have exclusive competence to investigate and prosecute offences against the EU’s financial interests.745 It would be headed by the EPP who directed its activities and organised its work, assisted by four deputies.746 The investigations and prosecutions of the EPPO would be carried out by the European Delegated 741 The following analysis will provide a general overview of the Regulation, which is composed of 121 Recitals and 120 Articles. For some more in-depth commentaries on a previous draft of the Regulation, which was broadly similar to the final version, see A Weyembergh and C Brière, ‘Towards a European Public Prosecutor’s Office’, Study for the LIBE Committee of the European Parliament, November 2016; and F Giuffrida, ‘The European Public Prosecutor’s Office: King without Kingdom?’, CEPS Research Report No 2017/03, February 2017, https://www.ceps.eu/ceps-publications/european-public-prosecutors-office-king-without-kingdom. 742 On key academic and policy discussions of various EPPO models, see V Mitsilegas (ed), ‘The Future of Prosecution after Lisbon’ (2013) 4 New Journal of European Criminal Law (see in particular: K Ligeti and M Simonato, ‘The European Public Prosecutor’s Office: Towards a Truly European Prosecution Service?’ (2013) 4 New Journal of European Criminal Law 7; S White, ‘Towards a Decentralised European Public Prosecutor’s Office?’ (2013) 4 New Journal of European Criminal Law 22; and L Harman and E Szabova, ‘European Public Prosecutor’s Office – Cui Bono?’ (2013) 4 New Journal of European Criminal Law 40). 743 COM (2013) 534 final (n 420) art 3(1). 744 ibid art 6(1). 745 ibid art 11(4). 746 ibid art 6(2) and (3).

440 Bodies, Offices and Agencies Prosecutors – who would be appointed and might be dismissed by the EPP747 – under the direction and supervision of the EPP. Where it was deemed necessary in the interests of the investigation or prosecution, the EPP might also exercise their authority directly by reallocating the case to another Delegated Prosecutor or leading the case themself.748 There would be at least one European Delegated Prosecutor in each Member State who would act under the exclusive authority of the EPP and would only follow their instructions, guidelines and decisions when carrying out investigations and prosecutions.749 The Commission had thus put forward a centralised, hierarchical and vertical model of European prosecution. The proposed Regulation clearly goes beyond mutual recognition as it forms a passage from horizontal cooperation to vertical integration.750 In the Commission’s vision, centralisation is synonymous with independence and betrays a lack of trust towards the capacity or willingness of national authorities to effectively combat fraud against the EU budget;751 after all, the EPPO has been legitimised primarily on the grounds of the current lack of effectiveness in combating fraud across the EU.752 This link between effectiveness, independence and lack of trust towards Member States is epitomised in the following statement by a Commission official: The Commission considers that creating EPPO with an intergovernmental collegial structure would seriously hamper the independence of EPPO to take decisions on prosecutions … A collegial structure as foreseen for Eurojust allows pursuing national interests in the field of judicial cooperation and in this form contravenes the notion to create an independent prosecutorial office.753

The Commission’s vision for a centralised EPPO caused concerns in a number of EU Member States, both at the level of governments and at the level of parliaments. Some months before the Commission even tabled its proposal, the French and German Ministers of Justice sent a joint letter to the Justice and Anti-Fraud Commissioners expressing the view that the EPPO should be instituted on a collegial basis.754 Since the tabling of the Commission’s draft Regulation, national parliamentarians have raised subsidiarity concerns and expressed their preference for the collegial structure and for shared and not exclusive competence of the EPPO.755 Negotiations in the Council of the European 747 ibid art 10(1). 748 ibid arts 6(4) and 18(5). 749 ibid art 6(5). 750 K Ligeti and A Weyembergh, ‘The European Public Prosecutor’s Office: Certain Constitutional Issues’ in LH Erkelens, AWH Meij and M Pawlik (eds), The European Public Prosecutor’s Office: An Extended Arm or a Two-Headed Dragon? (TMC Asser Press/Springer, 2015) 53–77 at 59. 751 According to Schutte, ‘Member States which would support this draft regulation would implicitly recognise that at least with regard to EU fraud offences their public prosecution services are incompetent’ (JE Schutte, ‘Establishing Enhanced Cooperation under Article 86 TFEU’ in Erkelens, Meij and Pawlik (n 750) 195–208 at 197). 752 The Commission’s Explanatory Memorandum to the draft EPPO Regulation asserts that Member States’ criminal investigation and prosecution authorities are currently unable to achieve an equivalent level of protection and enforcement – COM (2013) 534 final (n 420) 2. 753 V Alexandrova, ‘Presentation of the Commission’s Proposal on the Establishment of the European Public Prosecutor’s Office’ in Erkelens, Meij and Pawlik (n 750) 11–20 at 15. 754 Common Position of the Ministers of Justice of France and Germany on the European Public Prosecutor’s Office (current as of 4 March 2013). 755 Interparliamentary meeting on the EPPO, Assemblée Nationale, 17 September 2014. Common declaration on the proposal for a Council regulation on the establishment of the European Public Prosecutor’s Office

The EPPO 441 Union have revealed a strong preference of Member States for the collegial model and successive presidencies of the Council have produced substantially revised drafts of the Regulation. An analysis of the EPPO Regulation demonstrates that Member States have adopted a much more intergovernmental model of an EPPO compared to the Commission’s draft. The structure of the EPPO is now largely a collegial structure, which is reminiscent of the structure of Eurojust. This move towards a collegial model has been accompanied by increased complexity in the structure of the EPPO, with additional layers of prosecutors being introduced in between the central EPPO collegial structure (which will be led not by a ‘European Public Prosecutor’, but by a ‘European Chief Prosecutor’) and the work of European Delegated Prosecutors at the national level. In the final text, the EPPO is defined as ‘an indivisible Union body operating as one single Office with a decentralised structure’.756 The central level consists of a Central Office at the seat of the EPPO consisting of the College, Permanent Chambers, the European Chief Prosecutor, their deputies and the European Prosecutors.757 The College includes the European Chief Prosecutor and one European Prosecutor per Member State.758 The decentralised structure consists of (at least two) European Delegated Prosecutors located in the Member States.759 The European Chief Prosecutor is the head of the EPPO. The Chief Prosecutor organises the work of the Office, directs its activities and takes decisions in accordance with the Regulation and rules of procedure and also assumes representation functions.760 The College is responsible for the general oversight of the activities of the Office and for taking decisions in strategic matters and on general issues arising from individual cases, but is not involved in taking operational decisions in individual cases.761 The College sets up Permanent Chambers to direct and monitor the casework of the EPPO.762 Unless otherwise stated, the College takes decisions by a simple majority – with the Chief Prosecutor having the casting vote.763 The Permanent Chambers are chaired by the European Chief Prosecutor or one of the deputies, or a European Prosecutor appointed as Chair, and have two additional members.764 In addition to the permanent members, the European Prosecutor who is supervising an investigation or a prosecution participates in the deliberations of the Permanent Chamber.765 The Permanent Chambers direct and monitor the i nvestigations

(COM (2013) 534), signed in their own name by members of national parliaments of the European Union, representing Members of Parliament from 16 national parliaments’ chambers of the European Union. 756 Article 8(1) of the EPPO Regulation. 757 ibid art 8(3). The Administrative Director of the EPPO is part of the central Office as well; for more on this, see arts 18–20. 758 ibid art 9(1). 759 ibid arts 8(4) and 13(2). 760 ibid art 11(1) and (3). 761 ibid art 9(2). 762 ibid arts 9(3) and 10(2). 763 ibid art 9(5). 764 ibid art 10(1). In accordance with the College Decision 15/2020 of 25 November 2020, 15 Permanent Chambers have been established. 765 ibid art 10(9), which also lists the cases where the supervising European Prosecutor does not have the right to vote.

442 Bodies, Offices and Agencies and prosecutions conducted by the European Delegated Prosecutors.766 Directing and monitoring refers to certain clear powers to monitor and direct individual investigations and prosecutions when such directions appear necessary. This role is to be distinguished by supervision (which, as will be seen below, is entrusted to the European Prosecutors), which is understood as a closer and continuous oversight of investigations and prosecutions including, when necessary, intervening and giving instruction on investigations and prosecution matters.767 However, the Permanent Chambers may also give instructions in specific cases to the European Delegated Prosecutors.768 The Permanent Chambers also ensure the coordination of investigations and prosecutions in cross-border cases and the implementation of decisions taken by the College.769 They decide under simple majority, with the Chair having a casting vote.770 As argued below, the powers of the Permanent Chambers are key to the work of the EPPO as they have the final word in the prosecution phase. The European Prosecutors will, on behalf of the Permanent Chamber and in compliance with its instructions, ‘supervise the investigations and prosecutions for which the European Delegated Prosecutors handling the case in their Member State of origin are responsible’ (emphasis added).771 They function as liaisons and channels of information between the Permanent Chambers and the European Delegated Prosecutors, and monitor the implementation of the tasks of the Office in their respective Member States in close consultation with the European Delegated Prosecutors.772 At the decentralised level, the European Delegated Prosecutors are responsible for the investigations and prosecutions which they have initiated and follow the direction and instructions of the Permanent Chamber in charge of the case as well as the instructions from the supervising European Prosecutor.773 They are also responsible for bringing a case to judgment.774 The European Delegated Prosecutors act on behalf of the EPPO in their respective Member States and should have the same powers as national prosecutors in respect of investigations,775 prosecutions and bringing cases to judgment, in addition and subject to the specific powers and status conferred on them and under the conditions provided for in the EPPO Regulation.776 The European Delegated Prosecutors may also order or request arrest or pre-trial detention in accordance with the

766 ibid art 10(2). 767 ibid Recital 23. 768 ibid art 10(5). 769 ibid art 10(2). 770 ibid art 10(6). 771 ibid art 12(1). 772 ibid art 12(5). 773 ibid art 13(1), second indent. In exceptional circumstances, the supervising European Prosecutor may take a reasoned decision to conduct the investigation personally, after having obtained the approval of the competent Permanent Chamber (art 28(4)). 774 ibid art 13(1), third indent. 775 ibid art 13(1), first indent. Pursuant to art 30(1), investigative measures include, inter alia, in cases of serious offences (ie, punishable by a maximum penalty of at least four years of imprisonment), search and seizure, freezing of instrumentalities or proceeds of crime and telecommunications interceptions. 776 ibid art 13(1), first indent. See also art 30(4), which states that the European Delegated Prosecutors, in addition to the measures listed in art 30(1) (see n 775), must be entitled to order or request the same type of measures in their Member State which are available to the prosecutors according to national law in similar national cases.

The EPPO 443 national law applicable in similar domestic cases and, if necessary, they can issue or request the competent authority to issue an EAW.777 They may also exercise functions as national prosecutors to the extent that this does not prevent them from fulfilling their obligations under the EPPO Regulation.778 Where cross-border cases necessitate measures to be undertaken in a Member State other than the state of the European Delegated Prosecutor handling the case, the latter must assign the case to a European Delegated Prosecutor located in the Member State where that measure needs to be carried out.779 Prosecutors in the second state are referred to as ‘assisting’ European Delegated Prosecutors.780 As for the status of evidence collected abroad, the Commission’s proposal laid down a bold rule providing that such evidence shall be admitted in the trial – insofar as its admission would not adversely affect the fairness of the procedure or the rights of defence – ‘without any validation or similar legal process even if the national law of the Member State where the court is located provides for different rules on the collection or presentation of such evidence’.781 This provision was watered down in the negotiations and the final text only states that evidence shall not be denied admission in the trial ‘on the mere ground that the evidence was gathered in another Member State or in accordance with the law of another Member State’.782 Finally, when the European Delegated Prosecutor considers the investigation to be completed, they submit a report to the supervising European Prosecutor, containing a summary of the case and a draft decision on how to proceed with the case.783 These documents, accompanied if necessary by the assessment of the supervising European Prosecutor,784 will then be forwarded to the competent Permanent Chamber, which decides whether the case should be referred to national prosecuting authorities,785 dismissed786 or concluded by means of simplified prosecution procedures provided by 777 ibid art 33(1) and (2). 778 ibid art 13(3). 779 ibid art 31(1). 780 See, inter alia, art 31(3) and (4). On the procedure envisaged by art 31, see L Bachmaier Winter, ‘Crossborder Investigation under the EPPO Proceedings and the Quest for Balance’ in L Bachmaier Winter (ed), The European Public Prosecutor’s Office: The Challenges Ahead (Springer, 2018) 117–39. Whereas the Regulation requires the European Delegated Prosecutors to issue or request the competent authorities to issue an EAW when a person living abroad has to be arrested, it does not allow the use of the European Investigation Order to collect evidence abroad. As has been noted: ‘One may wonder why a consistent regime does not apply, and why the negotiators have not [designed] an EPPO specific mechanism for both situations’ (Weyembergh and Brière (n 741) 32–33). 781 Article 30(1) of the Commission’s proposal (n 420). 782 ibid art 37(1). On the sensitive issue of evidence within the framework of the EPPO activities, see D Helenius, ‘Admissibility of Evidence and the European Public Prosecutor’s Office’ and I Zerbes, ‘Collecting and Using Evidence: A Patchwork of Legal Orders’, both in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stiftelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015) 178–209 and 210–33 respectively. See also Weyembergh and Brière (n 741) 33–34; S Allegrezza and A Mosna, ‘Cross-border Criminal Evidence and the Future European Public Prosecutor: One Step Back on Mutual Recognition?’ in Bachmaier Winter (ed) (n 780) 141–64. 783 Article 35(1) of the EPPO Regulation. 784 ibid. 785 ibid art 34. The case is referred to national authorities either when the offence under investigation no longer falls within the competence of the EPPO or when the impact on the EU’s financial interests is limited (less than €100,000) and there is no need to investigate or to prosecute the case at the EU level (see art 34(1)–(3)). 786 ibid art 39. The case has to be dismissed where prosecution has become impossible on account of any of the grounds exhaustively listed in art 39(1), spanning from the death or insanity of the suspect to ne bis in idem

444 Bodies, Offices and Agencies national law.787 However, if the European Delegated Prosecutor proposes to bring the case to judgment, the Permanent Chamber has limited room for manoeuvre: on the one hand, it cannot decide to dismiss the case; on the other hand, if it does not take a decision within 21 days,788 the decision proposed by the European Delegated Prosecutor is deemed to be accepted.789 In principle, the trial takes place in the Member State of the European Delegated Prosecutor who handles case, namely the Member State where investigations have been conducted.790 In turn, a case should as a rule be initiated and handled by a European Delegated Prosecutor from the Member State where ‘the focus of the criminal activity is or, if several connected offences within the competences of the EPPO have been committed, the Member State where the bulk of the offences has been committed’ (emphasis added).791 However, some deviations from this rule, which in essence enshrines the principle of territoriality,792 are possible in accordance with some criteria hierarchically listed in the Regulation; the EPPO is therefore allowed – yet within strict limits – to ‘“switch” between different legal orders’793 during the investigation or at the stage of prosecution. However, uncertainty on the applicable law should be avoided since: ‘As early as possible, the accused person must have clarity as to the Member State and the national law he will be accountable to. This is the only way to ensure effective defence in pre-trial investigations’.794 The issue can be even more contentious in the light of the lack of judicial review at the EU level of the EPPO decision on the choice of forum, as will be argued below. and lack of relevant evidence. On the EPPO’s decision to dismiss the case, see M Caianiello, ‘The Decision to Drop the Case: Res Iudicata or Transfer of Competence?’ in Bachmaier Winter (ed) (n 780) 103–15. 787 Article 40 of the EPPO Regulation. 788 Since it cannot take the decision to dismiss the case, the Permanent Chamber should in essence be entitled only to ‘postpone it, [eg] by asking for further evidence’ (Council Doc 15057/16, Brussels, 5 December 2016, 4). 789 Article 36(1) and (2) of the EPPO Regulation. 790 ibid art 36(3). 791 ibid art 26(4). 792 On the interpretation of the Regulation’s rules on the matter, see M Luchtman, ‘Forum Choice and Judicial Review under the EPPO’s Legislative Framework’ in W Geelhoed, AWH Meij and L Erkelens (eds), Shifting Perspectives on the European Public Prosecutor’s Office (TMC Asser Press/Springer, 2018) 155–70 at 157–59. 793 F Zimmermann, ‘Choice of Forum and Choice of Law under the Future Regulation on the Establishment of a European Public Prosecutor’s Office’ in Asp (n 782) 156–77 at 167. The criteria that allow a deviation from the principle of territoriality in the initiation of the EPPO investigations are, in hierarchical order: ‘(a) the place of the suspect’s or accused person’s habitual residence; (b) the nationality of the suspect or accused person; (c) the place where the main financial damage has occurred’ (art 26(4)). On the basis of these criteria, the Permanent Chambers can also reallocate the case to an European Delegated Prosecutor in another Member State at a later time, ie, during the investigations, if this is ‘in the general interest of justice’ (art 26(5)). Likewise, the Permanent Chamber can decide, in accordance with those same criteria, to initiate the prosecution before the courts of another Member State that is equally competent, if there are ‘sufficiently justified grounds’ (art 36(3)). For further remarks on the choice of forum within the framework of EPPO activities, see F Giuffrida, ‘Cross-border Crimes and the European Public Prosecutor’s Office’ (2017) 3 Eucrim 149–56. 794 German Federal Bar and German Bar Association, ‘Joint Position on the Creation of a European Public Prosecutor’s Office’, 2012, https://anwaltverein.de/de/newsroom/id-2012-80-engl, 4. On the choice of forum and applicable law in the framework of EPPO proceedings, see also JAE Vervaele, ‘European Territoriality and Jurisdiction: The Protection of the EU’s Financial Interests in its Horizontal and Vertical (EPPO) Dimension’ in Luchtman (n 467) 167–84 at 173–82; M Wasmeier, ‘The Choice of Forum by the European Public Prosecutor’ in Erkelens, Meij and Pawlik (n 750) 139–61; S Ruggeri, ‘Criminal Investigations, Interference with Fundamental Rights and Fair Trial Safeguards in the Proceedings of the European Public Prosecutor’s Office: A Human Rights Law Perspective’ in Bachmaier Winter (ed) (n 780) 201–33 at 209–15.

The EPPO 445 In sum, the Regulation has put forward a multi-level, complex and at first sight rather bureaucratic system of European prosecution with clear and strong intergovernmental elements as regards the structure, composition and decision-making underpinning the activities of the EPPO. Although the investigations are mostly carried out on the ground by the European Delegated Prosecutors, central to the function of the EPPO are the Permanent Chambers, which operate in a collegial manner and are assisted by members from the states where investigations take place. This move is a clear signal to ensure ownership of the process by Member States,795 but might hamper the possibility for the Office to take swift decisions during the investigations.

ii. Competence, Scope and Territoriality The Commission had introduced two strong federal elements in its vision of the EPPO: exclusive competence and European territoriality. By granting the EPPO exclusive competence, the Commission sent a strong signal to Member States that it is only the EPPO which is responsible and competent for the investigation and prosecution of the EU offences associated with fraud against the EU budget.796 The powers of the EPPO in this context had been backed up by the application by the Commission of the principle of European territoriality. In accordance with Article 25 of the Commission’s draft, for the purpose of investigations and prosecutions conducted by the EPPO, ‘the territory of the Union’s Member States will be considered a single legal area in which the European Public Prosecutor’s Office may exercise its competence’ (emphasis added).797 The Commission’s proposal thus mirrored the approach taken by the drafters of the corpus juris.798 The Guiding Principles of corpus juris introduced the principle of European territoriality by stating that for the purposes of investigation, prosecution, trial and execution of sentences concerning the corpus juris offences, the territory of the EU Member States constitutes a single area, called the ‘European judicial area’, and that the competence ratione loci of the EPP and of national prosecutors to issue warrants and judgments pursuant to the corpus juris extends to the entire European judicial area.799 The principle is reflected in Article 18(1) of the corpus juris.800 However, this single legal area does not signify the application of a single legislative framework to the operation of the EPPO, but rather has to take into account the national legal systems of the Member States. The symbiotic relationship between the ‘European’ aspects of the EPPO

795 See also H Satzger, ‘The European Public Prosecutor and the National Prosecution: Potential Conflicts and How They Could Be Avoided’ in Asp (n 782) 69–87 at 75–76. 796 Article 11(4) of the Commission’s proposal (n 420). 797 ibid art 25(1). The notion of ‘single legal area’ was also endorsed in the ‘Model Rules for the procedure of the EPPO’, ie, a corpus of 67 rules for the functioning of the EPPO drafted in the framework of a project conducted at the University of Luxembourg between 2010 and 2012 under the direction of Katalin Ligeti (available at https://orbilu.uni.lu/handle/10993/42085). 798 For a background to the corpus juris, see M Delmas-Marty, ‘Guest Editorial: Combatting Fraud: Necessity, Legitimacy and Feasibility of the Corpus Juris’ (2000) 37(2) CML Rev 247. 799 Guiding Principles of Corpus Juris 2000, https://ec.europa.eu/anti-fraud/sites/antifraud/files/docs/body/ corpus_juris_en.pdf. 800 For an analysis of the concept of European territoriality in the evolution of proposals for an EPP, see Vervaele (n 794) 167–84.

446 Bodies, Offices and Agencies and the applicability of national law is evident throughout the text of the Commission’s draft, and in particular in the provisions regarding the applicability of national law in the context of EPPO investigations.801 The references of the Commission’s draft to the applicability of national law have led commentators to argue that the proposal leads to a situation where the investigative powers of the EPPO are defined by the national criminal procedural law of each Member State.802 Unsurprisingly, both the concepts of exclusive competence and European territoriality have been rejected by the Council. The final version of the Regulation has replaced exclusive competence by ‘priority’ competence of the EPPO, backed up by a right to evocation.803 If the EPPO is informed or becomes otherwise aware of the fact that an investigation in respect of an offence falling within its mandate is already undertaken by the authorities of a Member State, it will consult with the latter authorities and thereafter decide whether to open its own investigation and request the competent authorities to transfer the proceedings to it.804 This is therefore another circumstance where an EU body needs to be regularly informed by national authorities in order to be able to achieve its goals.805 The departure from exclusive EPPO competence is consistent with the general shift from a highly centralised to a more cooperative and interactive model. The Commission would confer exclusive competence in a field that under general EU constitutional law falls under shared EU/Member State competence.806 Similarly, the Regulation has abandoned the concept of European territoriality and merely states that when conducting investigations and prosecutions in the territory of the EU’s Member States, the EPPO shall operate as one single office.807 The Regulation thus rejects the view of the EU as one single legal area and confirms the view of it consisting of a number of different national legal orders. As mentioned above, the abandonment of European territoriality – and the in principle negation of action of European Delegated Prosecutors beyond the borders of their Member State this entails – has added an extra layer to the EPPO structure: in cross-border cases necessitating measures to be undertaken in a Member State other than the state of the European Delegated Prosecutor handling the case, the latter must assign the case to the ‘assisting’ European Delegated Prosecutor located in the Member State where that measure needs to be carried out.808 If developments in the Council with regard to bold Commission proposals on exclusive competence and European territoriality have not come as a surprise, further disagreements with regard to the powers and ratione materiae scope of the EPPO demonstrate deeper concerns in Member States regarding the potential impact of European prosecution on their national legal diversity and sovereignty. The first example of 801 See in particular arts 11(3) and 26(2) of the Commission’s proposal (n 420). 802 K Ligeti, ‘The European Public Prosecutor’s Office’ in Mitsilegas, Bergström and Konstadinides (n 93) 480–504. 803 See Recital 58 of the EPPO Regulation on priority competence and art 27 on the right of evocation. 804 ibid art 27(1), (3), (4) and (5). 805 For more on this, see ibid art 24, concerning, inter alia, the duty of reporting of national authorities. 806 See also the comments of Asp, who argues that granting exclusive competence is not consistent with the principle of subsidiarity: P Asp, ‘Jeopardy on European Level: What is the Question to Which the Answer is the EPPO?’ in Asp (n 782) 51–68 at 64–65. 807 Article 8(1) of the EPPO Regulation. 808 ibid art 31(1).

The EPPO 447 this kind is the resistance of some Member States to the attribution of mandatory investigation or prosecution powers to the EPPO, arguing that this will have an impact on the discretionary nature of their domestic systems.809 The Commission’s draft acknowledged that the EPPO should work in accordance with the ‘principle of mandatory prosecution’,810 while the Regulation refers to the – more neutral – ‘legality principle’.811 However, the latter is not too different from the principle of mandatory prosecution, as its application implies that the EPPO investigations ‘should as a rule lead to prosecution in the competent national courts in cases where there is sufficient evidence and no legal ground bars prosecution, or where no simplified prosecution procedure has been applied’ (emphasis added).812 Further disagreements arose with regard to the offences for which the EPPO would have competence to act. The Regulation defines such competence by reference to the offences that are included in Directive (EU) 2017/1731 on the fight against fraud to the EU’s financial interests by means of criminal law (hereinafter the ‘PIF Directive’).813 However, it has been noted that there is a degree of uncertainty as such offences (hereinafter ‘PIF offences’) will be those resulting from the implementation of the Directive by Member States,814 which may result in divergent criminalisation approaches.815 A more fundamental question has concerned what these offences will actually be. The negotiations on the PIF Directive and the EPPO Regulation were marked by a disagreement between Member States on the one hand and the European Parliament and the European Commission on the other with regard to the inclusion of VAT fraud within the scope of the Directive (and thus within the mandate of the EPPO), with 809 See the reservations of France and the Netherlands, arguing that initiation of investigations should be discretionary (Council Doc 9372/15, Brussels, 12 June 2015, 34). See also, in the literature, the concerns of Smulders, who argues that the right to bring proceedings should not be mandatory but discretionary as one could not justify within a national system that financial damage to the EU always leads to criminal proceedings, but that similar harm to the national state will not: B Smulders, ‘Is the Commission Proposal for a European Public Prosecutor’s Office Based on a Harmonious Interpretation of Articles 85 and 86 TFEU?’ in Erkelens, Meij and Pawlik (n 750) 41–52 at 44. 810 Recitals 20 and 31 of the Commission’s proposal (n 420). 811 ibid Recitals 66 and 81. 812 ibid Recital 81. 813 [2017] OJ L198, 28 July, 29. For an analysis of the EPPO’s competence, see G Grasso, R Sicurella and F Giuffrida, ‘EPPO Material Competence: Analysis of the PIF Directive and the Regulation’ and P Caeiro and J Amaral Rodrigues, ‘A European Contraption: The Relationship between the Competence of the EPPO and the Scope of Member States’ Jurisdiction over Criminal Matters’, both in K Ligeti, MJ Antunes and F Giuffrida (eds), The European Public Prosecutor’s Office at Launch (Wolters Kluwer – CEDAM, 2020) 23–56 and 57–83 respectively. 814 ‘The EPPO shall be competent in respect of the criminal offences affecting the financial interests of the Union that are provided for in [the PIF Directive], as implemented by national law’ (art 22(1), emphasis added). The same goes, with the shortcomings pointed out immediately below in the text, for the offence of participation in a criminal organisation, for which the EPPO is competent ‘if the focus of the criminal activity of such a criminal organisation is to commit [PIF offences]’ (art 22(2)). The Regulation refers to such an offence ‘as defined in Framework Decision 2008/841/JHA, as implemented in national law’ (ibid, emphasis added). 815 D Flore, ‘Garantie Judiciaire et Droit Applicable: Quelques Éléments de Réflexion’ in G Giudicelli-Delage, S Manacorda and J Tricot (eds), Le Contrôle Judiciaire du Parquet Européen. Nécessité, Modèles, Enjeux (Collection de l’UMR de Droit Comparé de Paris (Université Paris 1), Société de législation comparée, 2015) 299–310 at 302. See also, inter alia, JAE Vervaele, ‘The Material Scope of Competence of the European Public Prosecutor’s Office: Lex Uncerta and Unpraevia?’ (2014) 15(1) ERA Forum 85, 92–96; R Sicurella, ‘A Blunt Weapon for the EPPO? Taking the Edge off the Proposed PIF Directive’ in Geelhoed, Meij and Erkelens (n 792) 99–127.

448 Bodies, Offices and Agencies Member States taking the view that VAT fraud should not be included in the scope of the Directive as it is primarily a national issue.816 Excluding VAT fraud from the scope of the Directive would have cast doubt on the Commission’s justification on the necessity of an EPPO, if one accepts that revenues from VAT fraud across the EU are indeed very substantial. It is perhaps in the light of these developments that the Court of Justice has sent a very strong signal in its ruling in Taricco by confirming that VAT fraud falls within the scope of the third pillar fraud Convention which the new Directive replaces.817 While the approach of Member States can be seen as an attempt to guard their sovereignty in criminal matters in relation to the EPPO, disagreement at such a deep level between the EU institutions is worrying in that it reveals ultimately a basic lack of understanding and agreement on what fraud against the EU budget is. A compromise on this sensitive issue was eventually found: the PIF Directive applies to – and the EPPO is thus competent for – VAT fraud that is connected with the territory of two or more Member States and involves a total damage of at least €10 million.818 The two requirements – entity of the total damage and cross-border nature of VAT fraud – confirm the Member States’ limited willingness to lose control on the matter, as emerges from other provisions of the PIF Directive and the EPPO Regulation that draw the boundaries of the EU’s intervention in the PIF sector.819 The competence over exclusively cross-border VAT fraud does not sit well with the EPPO’s mission, namely to fight against crimes affecting the EU’s financial interests because of their nature of inherently European crimes independently of their cross-border impact.820 However, it should be noted that Article 86(4) TFEU allows for an extension of the EPPO’s material scope which could only cover ‘serious crime having a cross-border dimension’.821 The European Parliament and the Commission strongly support such an extension of the Office’s competence, with the latter issuing a Communication in September 2018 which called for the EPPO’s competence to be extended to serious cross-border terrorism crimes.822 Since most Member States oppose the enlargement of 816 See Council Doc 17359/12, Brussels, 11 December 2012, 3; and Council Doc 9547/13, Brussels, 17 May 2013, 2. 817 Case C-105/14, Taricco and Others, judgment of 8 September 2015, EU:C:2015:555, para 41. For some commentaries, see F Giuffrida, ‘The Limitation Period of Crimes: Same Old Italian Story, New Intriguing European Answers – Case Note on C-105/14, Taricco’ (2016) 7(1) New Journal of European Criminal Law 100; S Allegrezza, ‘On Legality in Criminal Matters between Primacy of EU Law and National Constitutional Traditions: A Study of the Taricco Saga’ and V Manes, ‘Taricco, Endgame’, both in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Hart Publishing, 2019) 165–87 and 188–95 respectively. 818 Article 2(2) of the PIF Directive. 819 Article 2(3) of the PIF Directive states that the structure and functioning of the tax administration of the Member States are not affected by the Directive. Likewise, the EPPO Regulation clarifies that: ‘In any case, the EPPO shall not be competent for criminal offences in respect of national direct taxes including offences inextricably linked thereto. The structure and functioning of the tax administration of the Member States shall not be affected by [the] Regulation’ (art 22(4)). 820 See, inter alia, R A Morán Martínez, European Public Prosecutor: Working Group Conclusions (Fiscalía General del Estado, 2009) 16; R Sicurella, ‘Setting up a European Criminal Policy for the Protection of EU Financial Interests: Guidelines for a Coherent Definition of the Material Scope of the European Public Prosecutor’s Office’ in K Ligeti (ed), Towards a Prosecutor for the European Union, vol I (Hart Publishing, 2012) 870–904 at 880. 821 Article 86(4) TFEU. 822 COM (2018) 641 final, Brussels, 12 September 2018. See also European Parliament resolution of 25 October 2016 on the fight against corruption and follow-up of the CRIM resolution (2015/2110(INI)), P8_TA (2016) 0403, para 54.

The EPPO 449 EPPO competence, it is unlikely that the EPPO’s mandate will be extended in the near future.823 Finally, the EPPO is also competent for crimes that are ‘inextricably linked’ to PIF offences.824 Some guidance on what is meant with ‘inextricably linked offences’ is to be found in Recital 54, which refers to ‘the identity of the material facts (or facts which are substantially the same), understood in the sense of the existence of a set of concrete circumstances which are inextricably linked together in time and space’. The requirements to trigger this further competence of the EPPO – called ‘ancillary competence’ in Article 13 of the Commission’s draft – are laid down in another provision of the Regulation:825 the guiding principle is that the EPPO is competent for inextricably linked offences when the PIF offence is punished with a penalty that is as serious as, or higher than, the one provided for the inextricably linked crime. In any case, the Regulation gives the final word to national authorities (and not to the EPPO) in cases of disagreement on whether the EPPO has competence over these ‘inextricably linked’ offences826 and does not provide for the review of this choice at the EU level.

iii. Procedural Safeguards: Human Rights and Judicial Review A chapter of the Regulation is devoted to the procedural safeguards of the persons concerned by EPPO activities. It is composed of two Articles, which deal with strictly relating matters, namely the rights of the suspects and accused persons and the judicial review of EPPO acts.827 a. Rights of Suspects and Accused Persons The Regulation provides three different levels of protection. First, in light of the EPPO’s entrenchment in national systems, suspects and accused persons, as well as other persons involved in EPPO proceedings (eg, witnesses or victims), have the procedural rights available to them under the applicable national law.828 Such a regulation of defence rights on the basis of domestic law is in line with the EPPO’s ‘hybrid’ nature,829 ie, that of a body which will be partly European and partly based on national criminal justice systems. However, if such a complementarity of domestic law can be ‘practically favorable for rights’, the envisaged system may become: [D]ysfunctional and ineffective for individuals concerned, due to its high complexity brought forth not only by the combination of EU and national law, but also by the multitude of applicable national provisions. Moreover, it does not ensure legal certainty or foreseeability for suspects and defendants in order to enable effective defense patterns. (Emphasis added)830 823 In accordance with art 86(4) TFEU, the decision on the extension of the EPPO’s mandate is to be taken by the European Council acting unanimously after consulting the Commission and obtaining the consent of the European Parliament. 824 Article 22(3) of the of the EPPO Regulation. 825 ibid art 25(3). 826 ibid art 25(6). 827 V Mitsilegas and F Giuffrida, ‘The European Public Prosecutor’s Office and Human Rights’ in Geelhoed, Meij and Erkelens (n 792) 59–98, upon which the following two sections draw. 828 Article 41(3) of the EPPO Regulation. 829 Satzger (n 795) 74. 830 M Kaiafa-Gbandi, ‘The Establishment of an EPPO and the Rights of the Suspects and Defendants: Reflections upon the Commission’s 2013 Proposal and the Council’s Amendments’ in Asp (n 782) 234–54 at 245–46.

450 Bodies, Offices and Agencies To avoid similar consequences of the ‘fragmentation’ of defence rights,831 the Regulation provides for two further layers of protection – at the EU level – of the rights of the persons involved in EPPO activities. First, the Regulation requires that any suspected or accused person in EPPO criminal proceedings should, ‘at a minimum’,832 have those procedural rights provided for in EU law, including the Directives on procedural rights adopted by the European Parliament and the Council in accordance with Article 82(2) TFEU.833 In particular, the Regulation refers to the Directives on: the right to interpretation and translation;834 the right to information and access to the case materials;835 the right to access to a lawyer;836 the right to remain silent and the right to be presumed innocent;837 and legal aid.838 These Directives can enhance the protection of fundamental rights during the EPPO proceedings in four different ways:839 a number of key provisions conferring rights in the Directives have direct effect; the Commission monitors the transposition of these Directives by Member States and has the power to introduce infringement proceedings before the CJEU when it considers that the Directives have not adequately been implemented; national criminal procedural law must be applied and interpreted in compliance and conformity with the Directives; and, finally, the implementation of the Directives must take place in compliance with the Charter. Moreover, the transformative effect of the Directives is enhanced by the potential for a number of key concepts included therein to be interpreted by the Court of Justice in an autonomous manner.840 These can be concepts determining both the scope (who is a ‘suspect’ or an ‘accused’ person) and the applicability of the defence rights (eg, when are the rights triggered), as well as the interpretation of the content of the rights granted (for instance, what is the meaning of granting rights ‘promptly’ or ‘without undue delay’). Although the reference to the Directives is to be welcomed for all the abovementioned reasons, most of their provisions represent a compromise among the Member States. Their wording and content are often broad and vague, with the consequence that the Directives’ impact on national legal systems risks being all in all quite limited; this means that ‘suspects and accused will continue to be subject to different standards depending on the applicable national law’.841

831 See T Wahl, ‘The European Public Prosecutor’s Office and the Fragmentation of Defence Rights’ in Ligeti, Antunes and Giuffrida (n 813) 85–113. 832 Article 41(2) of the EPPO Regulation. 833 ibid. 834 [2010] OJ L280, 26 October, 1. 835 [2012] OJ L142, 1 June, 1. 836 [2013] OJ L294, 6 November, 1. 837 [2016] OJ L65, 11 March, 1. 838 [2016] OJ L297, 4 November, 1. 839 For more on this, see Mitsilegas and Giuffrida (n 827) 68–70. 840 On the role of autonomous concepts in the evolution of EU criminal law, see V Mitsilegas, ‘Managing Legal Diversity in Europe’s Area of Criminal Justice: The Role of Autonomous Concepts’ in R Colson and S Field (eds), EU Criminal Justice and the Challenges of Legal Diversity: Towards A Socio-legal Approach to EU Criminal Policy (Cambridge University Press, 2016) 125–59. 841 Weyembergh and Brière (n 741) 35. Further concerns arise with respect to the costs of defence, which could be rather high in cross-border cases; see also F Falletti, ‘The European Public Prosecutor’s Office and the Principle of Equality’ (2017) 1 Eucrim 25, at 25.

The EPPO 451 Finally, in addition to the Directives and applicable national law, the third level of protection is the Charter, expressly referred to in Article 41(1) of the Regulation, which also recalls the right to a fair trial and the rights of defence.842 The applicability of the Charter to the EPPO is not contentious:843 the provisions of the Charter are addressed to a broad range of EU entities (‘institutions, bodies, offices and agencies’ (emphasis added)),844 which include the EPPO. The rights that could be relevant within the framework of EPPO activities are both those specifically concerning the field of criminal justice and other rights, which bear some kind of connection with that field. As far as the rights specifically concerning the field of criminal justice are concerned, the title of the Charter devoted to ‘Justice’ comes into consideration. It is composed of four provisions and some of the rights listed therein are now regulated in more detail by the Directives on procedural safeguards,845 such as the rights to legal aid (Article 47) and to the presumption of innocence (Article 48). In this context, the Charter may serve as a tool to clarify the meaning of certain provisions and address possible shortcomings in the wording of secondary law. Article 48 of the Charter also concerns the more general right of defence and Article 47 lists the rights to an effective remedy and to a fair trial. Furthermore, in accordance with the right to ne bis in idem – enshrined in Article 50 of the Charter846 – the Regulation provides that if the EPPO ‘decides to exercise its competence, the competent national authorities shall not exercise their own competence in respect of the same criminal conduct’.847 In a similar vein, the Regulation also prohibits OLAF from opening parallel administrative investigations into the same facts where the EPPO decides to open a case.848 Finally, as for the rights that are not regulated in the Title of the Charter concerning Justice, EPPO activities – like those of national authorities – can encroach upon a number of human rights such as privacy (eg, in case of interceptions or searches) and liberty (pre-trial detention measures). Therefore, the Charter can also play a relevant role in that respect.849 b. Judicial Review Notwithstanding the establishment of the EPPO as an EU body operating within a single legal area, the Commission’s proposal excluded the judicial review of the EPPO

842 Article 5(1) similarly states that the EPPO ‘shall ensure that its activities respect the rights enshrined in the Charter’. 843 See, eg, AWH Meij, ‘Some Explorations into the EPPO’s Administrative Structure and Judicial Review’ in Erkelens, Meij and Pawlik (n 750) 101–19 at 103–05. 844 Article 51(1) of the Charter. 845 Among those four provisions, art 49 is not addressed in the text, since it concerns the principles of legality and proportionality of criminal offences and penalties, which could come into consideration especially in the implementation of the PIF Directive by national legislators. 846 For more on this, see ch 3. 847 Art 25(1). 848 ibid art 101(2). 849 See, for instance, Recitals 98 and 118 of the EPPO Regulation, which mention art 8 of the Charter on the protection of personal data and art 42 of the Charter on the right of access to documents respectively.

452 Bodies, Offices and Agencies at the EU level.850 Article 36 of the Commission’s draft clearly states that when adopting procedural measures in the performance of its functions, the EPPO is considered as a national authority for the purpose of judicial review.851 It was further added that where provisions of national law are rendered applicable by the Regulation, such provisions are not considered as provisions of EU law for the purpose of Article 267 TFEU.852 The Commission justified the exclusion of EU judicial review on three main grounds: the perceived specificity and difference of the EPPO from all other EU bodies and agencies which require special rules on judicial review;853 the strong link between the operations of the EPPO and the legal orders of the Member States;854 and the need to respect the principles of subsidiarity and proportionality.855 The Commission’s treatment of the EPPO as a national body for the purposes of judicial review was at odds with its overall vision of the EPPO as a centralised body establishing a system of vertical cooperation in the field of investigation and prosecution in the EU. The Commission emphasised the links of the EPPO with national legal orders, yet disregarded the fact that EPPO acts and decisions are acts adopted by an EU agency, with the Commission’s draft effectively creating a European agency lying outside European judicial control.856 The Commission further justified this exclusion on the basis of the special nature of the EPPO. However, if anything, the specificity of the EPPO in relation to other EU agencies – which consists of the fact that the EPPO is an operational body whose action has the potential to affect significantly fundamental rights across the EU – should render EU judicial review even more imperative. Moreover, the possibilities allowed by the Lisbon Treaty for specific rules concerning judicial review of EU agencies in general857 and the EPPO in particular858 do not mean that these rules can entail the total exclusion of EU judicial review for EU agencies, including the EPPO.859 The total exclusion of EU judicial review of the EPPO would in particular be hard to reconcile with the rule of law and the right to effective judicial protection, which has assumed a central role in EU constitutional law in recent years.860

850 For a number of different views on the judicial review of EPPO acts and decisions, see the several contributions in Giudicelli-Delage, Manacorda and Tricot (n 815). See also Z Đurđević, ‘Judicial Control in Pre-trial Criminal Procedure Conducted by the European Public Prosecutor’s Office’ in Ligeti (n 820) 986–1010. 851 Art 36(1) of the Commission’s proposal (n 420). 852 ibid art 36(2). 853 ibid, Explanatory Memorandum, para 3.3.5. 854 ibid. 855 ibid 4–5. For an in-depth analysis of the provisions of the Commission’s proposal on judicial review, see V Mitsilegas, EU Criminal Law after Lisbon: Rights, Trust and the Transformation of Justice in Europe (Hart Publishing, 2016) 113–19, upon which the following remarks draw. 856 See also in this context established Luxembourg case law, according to which national courts have no jurisdiction themselves to declare the invalidity of measures taken by EU institutions – see Case 314/85, Foto-Frost v Hauptzollamt Lübeck-Ost, judgment of 22 October 1987, EU:C:1987:452. 857 Article 263, fifth para TFEU. 858 ‘The regulations … shall determine the general rules applicable to the European Public Prosecutor’s Office … as well the rules applicable to the judicial review of procedural measures taken by it in the performance of its functions’ (ibid art 86(3)). 859 See also Meij (n 843) 115–17. 860 See, for instance, the Court’s rulings in the Kadi litigation, and in particular its findings in Kadi II – Joined Cases C-584/10 P, C-593/10 P and C-595/10 P, European Commission v Kadi, judgment of 18 July 2013, EU:C:2013:518.

The EPPO 453 Finally, the Commission’s approach linked the rules on judicial review with the respect of the principles of subsidiarity and especially proportionality. However, the question of judicial review is a meta-question concerning the functioning of the EPPO, which should arise after the decision on whether the establishment of an EPPO per se meets the requirements of the subsidiarity test. In accordance with the principle of proportionality, the Commission explained that ‘this Regulation does not go beyond what is necessary to achieve this objective … Key features of the proposal, such as … the system of judicial review, were designed in order not to go beyond what was necessary to achieve the main objectives of the proposal’.861 The provision on judicial review was therefore among the most contested ones during the negotiations. Nevertheless, the final text has limitedly departed from the Commission’s proposal. The Regulation reaffirms the competence of national courts to rule on the ‘[p]rocedural acts of the EPPO that are intended to produce legal effects vis-à-vis third parties’.862 The same applies when the EPPO has failed to adopt procedural acts ‘which are intended to produce legal effects vis-à-vis third parties and which it was legally required to adopt’863 under the Regulation. However, the role of the Court of Justice has been partially enhanced, mainly in two directions. First, the CJEU has jurisdiction to give preliminary rulings concerning: (i) the validity of procedural acts of the EPPO, ‘insofar as such question of validity is raised before any court or tribunal of a Member State directly on the basis of Union law’;864 (ii) ‘the interpretation or the validity of provisions of Union law’,865 including the Regulation; and (iii) the interpretation of the Articles of the Regulation that set the boundaries of the EPPO material competence.866 Second, pursuant to the fourth paragraph of Article 263 TFEU, the Court of Luxembourg is competent to review the decisions of the EPPO to dismiss a case, ‘in so far as they are contested directly on the basis of Union law’.867 Even though the Regulation has enhanced EU scrutiny of EPPO activities, a closer look shows that this development is all in all quite limited.868 The competence of the 861 Explanatory Memorandum to the Commission’s proposal (n 420) 4–5 (under the section on ‘Subsidiarity and proportionality’, which the Commission concludes by claiming that ‘the proposed package complies with the requirement of subsidiarity’ (at 5). For an analysis of the subsidiarity principle in EU criminal law in general, and in the PIF sector in more detail, see I Wieczorek, ‘The Principle of Subsidiarity in EU Criminal Law’ in Brière and Weyembergh (n 143) 71–106. 862 Article 42(1) of the EPPO Regulation. 863 ibid. 864 ibid art 42(2)(a). 865 ibid art 42(2)(b). 866 ibid art 42(2)(c). 867 ibid art 42(3). On the EPPO’s dismissal decisions and their judicial review, see more in J Göhler, ‘To Continue or Not: Who Shall Be in Control of the European Public Prosecutor’s Dismissal Decisions?’ (2015) 6(1) New Journal of European Criminal Law 102; A Novokmet, ‘The EPPO and Judicial Review of a Decision Not to Prosecute: A Slippery Area or a Final Arrangement?’ in Z Đurđević and M Bonačić (eds), Integration of the EPPO in the National Criminal Justice Systems: Institutional, Procedural and Cooperative Challenges (Croatian Annual of Criminal Sciences and Practice, vol 27, issue 1) (Zagreb, Croatian Association of Criminal Sciences and Practice, 2020) 133–63. 868 In addition to the cases mentioned in the text, the Court of Justice is also competent in any dispute concerning: (i) compensation for damage caused by the EPPO; (ii) arbitration clauses contained in contracts concluded by the EPPO; and (iii) staff-related matters (art 42(4), (5) and (6) respectively). The CJEU has jurisdiction on the dismissal of the European Chief Prosecutor or European Prosecutors (art 42(7)). Finally, pursuant to the fourth paragraph of art 263 TFEU, the Court is competent to review EPPO administrative decisions (art 42(8)), eg, decisions on data protection or the decisions of the College to dismiss the European Delegated Prosecutors.

454 Bodies, Offices and Agencies CJEU to give preliminary rulings on the interpretation or validity of the Regulation (an EU legislative act), including its Articles on the EPPO material competence, was already uncontested on the basis of EU law. Indeed, the Commission’s proposal excluded from the scope of application of Article 267 TFEU only national law that was rendered applicable by the Regulation. On the contrary, the Commission’s draft prevented the Court from giving preliminary rulings concerning the validity of EPPO procedural acts,869 but this limitation has been lifted in the final text. Furthermore, while the Council decided to raise the scrutiny of the Permanent Chambers’ decisions to dismiss the case at the EU level, the same regime does not apply to the decision to prosecute. In the corpus juris, the decision of the European Delegated Prosecutor to bring a case to judgment had to be ‘verified’ by a national judicial authority, the ‘judge of freedoms’.870 However, such a solution was considered unsatisfactory and the option to set-up a European pre-trial chamber was discussed: ‘This chamber could … exercise all the functions of a judge of freedoms at the level of the European Judicial Space and could fully control the preparatory stage and the decision to bring a case to court.’871 One of the members of the study group that drafted the corpus juris suggested a more limited role for such a pre-trial chamber, namely that to monitor the choice of the Member State where the case had to be brought to judgment: This Preliminary Chamber would oversee the choice of the forum … this would be a nihil ostat procedure rather than a fiat procedure: only if one of the parties wanted to challenge the forum choice of the prosecutor (Eurojust or European Public Prosecutor) would there be a decision of the court.872

The issue of the choice of forum also remains contentious in the EPPO Regulation, since the decision of the Permanent Chamber on the Member State where investigations have to be initiated or conducted and prosecutions launched873 are not subject to judicial review at the EU level. However, since the EPPO will mainly function on the basis of national law, the choice of the Member State where its activities are carried out or where the case will be brought to court is of fundamental importance and would have required judicial scrutiny at the EU level.874 In conclusion, EU judicial review should have applied to the acts and decisions of the EPPO, which is an EU office. As seen, the Court of Justice has interpreted the standing criteria for natural and legal persons under the fourth paragraph of Article 263 TFEU as applying if the binding legal effects of the contested act are capable of affecting the interests of the applicant by bringing about a distinct change in its legal position.875 869 See Recital 38 of the Commission’s proposal (n 420). 870 Article 21(3) of Corpus Juris 2000. 871 M Delmas-Marty, ‘Necessity, Legitimacy and Feasibility of the Corpus Juris’ in Delmas-Marty and Vervaele (n 709) 11–104 at 53. Eventually, the pre-trial chamber was not included in the text of the Corpus Juris 2000. 872 Van den Wyngaert (n 397) 238–39. 873 Article 26(4) of the EPPO Regulation. 874 For similar views on the need of an EU scrutiny on the matter, see, among many others, JAE Vervaele, ‘Quel Statut pour le Ministère Public?’ in Ghaleh Marzban (n 602) 171–200 at 192; K M Lohse, ‘The European Public Prosecutor: Issues of Conferral, Subsidiarity and Proportionality’ in Erkelens, Meij and Pawlik (n 750) 165–82 at 181; S Manacorda, ‘La Localisation de la Garantie Juridictionnelle du Parquet Européen’ in Giudicelli-Delage, Manacorda and Tricot (n 815) 255–72 at 264–67; Ligeti (n 802) 497–98. 875 See, eg, Tillack v Commission (n 268).

The EPPO 455 These would apply to investigative acts and decisions by the EPPO, while it would be contentious to apply the Court’s case law on OLAF in the case of the EPPO, since the legal position of EPPO’s investigative acts is qualitatively different from the acts of OLAF. Many of the investigative acts of the EPPO clearly have the effect of bringing a distinct change in the legal position of affected individuals. Moreover, and unlike the system of cooperation established in OLAF’s legal framework, EPPO investigative acts can lead not to a national, but to a European prosecution by the EPPO itself – a fact that maintains the EU dimension of investigation and prosecution throughout the proceedings. The balance found in the Regulation therefore seems to be justified by the fact that, in practice, it would be difficult to extend the Court’s direct jurisdiction to all the measures that the EPPO adopts and, in some instances, it could even be more convenient to leave such scrutiny to national authorities. However, the effective use of the possibilities offered in the Treaties would have contributed towards both effective judicial protection and the development of EU law in this important field, which may lead to the reconfiguration of the relationship between the individual and the state in Europe via the introduction of a new, EU layer of investigation and prosecution – with the full involvement of the Court of Justice.

iv. Data Protection Around one-third of the provisions of the EPPO Regulation concern data protection. The pattern is similar to the Europol and Eurojust Regulations: Directive (EU) 2016/680 on data protection in the law enforcement sector does not apply and the Regulation provides for a special regime, which should be interpreted and applied in accordance with that Directive.876 The ‘self-sufficient system of data protection rules’877 of the EPPO Regulation fits the ‘data protection exceptionalism’878 that characterises the recent EU approach to data protection. Since the EPPO can directly initiate an investigation, some provisions are even more relevant in the framework of its activities than in that of the activities of Europol or Eurojust. For instance, the EPPO should distinguish, as far as possible, ‘operational personal data’879 based on facts from operational personal data based on personal assessments.880 Likewise, it is of the utmost importance to protect the right of the individual not to be subject to a ‘decision of the EPPO based solely on automated processing, including profiling’ (emphasis added).881 876 Recital 93 of the EPPO Regulation. There are provisions concerning, inter alia, the general principles relating to data processing and more detailed rules thereof (art 47 and arts 51–53 and 55), time limits for the storage of personal data (art 50), and the rights of data subjects such as those to access, rectification and erasure (arts 57–62). 877 P de Hert and V Papakonstantinou, ‘Data Protection and the EPPO’ (2019) 10(1) New Journal of European Criminal Law 1, 4. 878 ibid 10. 879 ‘Operational personal data’ refers to all personal data processed by the EPPO for the purposes of: criminal investigations and prosecutions undertaken in accordance with the EPPO Regulation; information exchange with the national competent authorities and with other EU entities in accordance with the Regulation; and cooperation with third countries and international organisations in accordance with the Regulation (arts 2(18) and 49(1)). 880 ibid art 52(1). This rule is laid down also in Recital 42 of the Europol Regulation. 881 ibid art 56(1).

456 Bodies, Offices and Agencies The supervision of EPPO data processing activities is divided between the internal DPO882 and the EDPS,883 to whom the data subjects have the right to lodge a complaint if they consider that the processing by the EPPO of operational personal data relating to them infringes the Regulation.884 The data subjects can bring an action against the decision of the EDPS before the CJEU.885 Finally, the EPPO can transmit operational personal data to other EU bodies and agencies only ‘if the data are necessary for the legitimate performance of tasks covered by the competence’886 of the other EU body or agency. The requirements for the transfer of operational personal data to third countries or international organisations are much more detailed887 and are very similar to those provided for by Eurojust and Europol Regulations: among other things, the transfer should be necessary for the performance of the tasks of the EPPO888 and it can only take place if there is a previous adequacy decision of the Commission or if appropriate safeguards have been given by the third state.889

v. Independence and Accountability Financed by the general budget of the EU,890 the EPPO is accountable for its general activities to the European Parliament, the Council and the Commission,891 to which it should transmit its annual reports.892 Moreover, the European Chief Prosecutor should appear once a year before the European Parliament and before the Council, and before national parliaments of the Member States at their request, to give account of the general activities of the Office.893 Unlike Europol, but like Eurojust, the supervisory role of national parliaments is quite limited. This is due to the peculiar nature of the EPPO as a prosecuting authority exercising direct investigative powers.894 The Regulation requires indeed the EPPO to be independent: The EPPO shall be independent. The European Chief Prosecutor, the Deputy European Chief Prosecutors, the European Prosecutors, the European Delegated Prosecutors, the 882 See especially ibid arts 77–79. 883 See especially ibid arts 85–89. See also art 72 on those cases where the EDPS shall be consulted in advance by the EPPO. 884 ibid art 88(1). 885 ibid art 89. 886 ibid art 54(1). 887 See ibid arts 80–84. 888 ibid art 80(1)(a). 889 See ibid arts 80(1)(c), 81 (transfers on the basis of an adequacy decision) and 82 (transfer subject to appropriate safeguards). However, art 83 allows the EPPO to transfer operational personal data to a third country or an international organisation even in the absence of an adequacy decision or of appropriate safeguards in urgent cases. 890 ibid art 91(3), which concerns the revenues of the EPPO. As for the expenditures, in principle they should not include costs relating to investigations measures (art 91(5)); however, the Regulation lays down a procedure allowing the EPPO to partly fund an ‘exceptionally costly investigation measure … carried out on behalf of the EPPO’ (art 91(6)). 891 ibid art 6(2). 892 ibid art 7(1). The annual report should be sent to the national parliaments as well. 893 ibid art 7(2). 894 Unlike arts 85 (Eurojust) and 88 (Europol) TFEU, art 86 TFEU on the EPPO does not mention the evaluation or scrutiny of the Office by national parliaments.

The EPPO 457 Administrative Director, as well as the staff of the EPPO shall act in the interest of the Union as a whole, as defined by law, and neither seek nor take instructions from any person external to the EPPO, any Member State of the European Union or any institution, body, office or agency of the Union in the performance of their duties under [the] Regulation. The Member States of the European Union and the institutions, bodies, offices and agencies of the Union shall respect the independence of the EPPO and shall not seek to influence it in the exercise of its tasks.895

Already envisaged in the Commission’s proposal,896 the independence of the Office has been a sticking point during the negotiations, since the status of prosecutors in domestic legal systems varies throughout the EU.897 However, the EPPO’s independence and its accountability at the EU level cannot overshadow the partially national nature of the EPPO. The Office has a structure in which some of its members (the European Delegated Prosecutors) are at the same time national and European prosecutors. This status is usually described with the metaphor of ‘double hat’.898 More precisely, the Regulation provides for two ‘double hat’ situations. European Delegated Prosecutors are national prosecutors who work for the EPPO for a renewable term of five years (mandatory ‘double hat’ status)899 and who may be authorised to continue to investigate and prosecute other crimes in accordance with their ordinary tasks, while at the same time being EPPO members (optional ‘double hat’).900 Furthermore, the Office’s multiple layers represent an intergovernmental element, which is reinforced by the rules regarding the appointment of its members, and arguably demonstrate that Member States’ concerns on potential losses of sovereignty underlie the whole Regulation. The European Chief Prosecutor is appointed by the Council and the European Parliament by common accord, with the Council acting by simple majority.901 The Deputy Chief Prosecutors are instead appointed by the EPPO College among the European Prosecutors.902 The European Prosecutors are nominated by their respective Member States (who nominate a pool of three candidates each), but eventually appointed by the Council, acting by a simple majority and taking into account the opinion of a selection panel.903 The European Delegated Prosecutors, nominated by 895 Article 6(1) of the EPPO Regulation. 896 Article 5 of the Commission’s proposal (n 420). See also Explanatory Memorandum, 5–6. 897 See the comparative overview of M Zwiers, The European Public Prosecutor’s Office: Analysis of a Multilevel Criminal Justice Systems (Intersentia, 2011) 37–152. The EPPO’s status was, for instance, contentious in the Netherlands, where the Minister of Justice is politically accountable for the activities of the prosecution service. On the Dutch position vis-a-vis the EPPO, see the analysis of N Franssen, ‘Comments on the EPPO from a Dutch Perspective’ in Ligeti, Antunes and Giuffrida (n 813)197–219. 898 See, among many others, Ligeti and Simonato (n 742) 15; Weyembergh and Brière (n 741) 12. 899 Article 17(1) and (2) of the EPPO Regulation. 900 ibid art 13(3). The difference between the two ‘double hat’ situations is highlighted by H-H Herrnfeld, ‘The Draft Regulation on the Establishment of the European Public Prosecutor’s Office: Issues of Balances between the Prosecution and the Defence’ in Brière and Weyembergh (n 143) 386–87. 901 Article 14(1) of the EPPO Regulation. In October 2019, Laura Codruța Kövesi, the former chief of the Romania’s National Anticorruption Directorate, was appointed as first European Chief Prosecutor. 902 Article 15(1) of the EPPO Regulation. 903 ibid art 16(1)–(3). The first 22 European Prosecutors composing the EPPO College were appointed in July 2020 [2020] (OJ L244, 29 July, 18) and the first College took up its functions on 28 September 2020 (Commission, ‘European Chief Prosecutor and 22 European Prosecutors take oath before Court of Justice of the European Union’ (press release), https://ec.europa.eu/info/news/european-chief-prosecutor-and22-european-prosecutors-take-oath-court-justice-european-union-2020-sep-28_en).

458 Bodies, Offices and Agencies Member States, are appointed by the College on a proposal from the European Chief Prosecutor.904

vi. Relations with the Partners a. The Regulation In order to facilitate the EPPO activities, all EU institutions, bodies, offices and agencies have an obligation to report to it any criminal conduct in respect of which the Office could exercise its competence.905 During the negotiations of the Regulation, the EPPO’s relations with other EU agencies and bodies were discussed at length, and so were those with the non-participating Member States and third countries. As the Europol and Eurojust Regulations, the EPPO Regulation’s guiding principle in the field is that the EPPO may establish and maintain cooperative relations with EU entities, international organisations, and the competent authorities of third countries and of Member States which do not participate in enhanced cooperation.906 However, with all of them, the EPPO may conclude working arrangements that ‘may neither form the basis for allowing the exchange of personal data nor have legally binding effects on the Union or its Member States’.907 They will instead concern the exchange of strategic information and other technical details of cooperation.908 The establishment of the EPPO has added further complexity in the AFSJ and has triggered debates on whether (some of) the existing bodies should be subsumed within the EPPO or vice versa.909 Eventually, the Member States have decided to keep the status quo. Eurojust and Europol remain agencies that aim to facilitate the cooperation of national authorities dealing with cross-border crimes, whereas OLAF maintains its administrative tasks in the PIF sector. The question of how to regulate the relations of these bodies with the EPPO has then become pressing in order to reduce overlaps and risks of inefficiency to the minimum. As for Europol, which is clearly not meant to be the police judiciaire of the EPPO as had instead been suggested in the past, the EPPO should be able to obtain, at its request, any relevant information held by this agency and may also ask Europol to provide analytical support to a specific investigation.910 A working arrangement between the two bodies lays down further rules on their cooperation.911

904 Article 17(1) of the EPPO Regulation. 905 ibid art 24(1). 906 ibid art 99(1). 907 ibid art 99(3). The exchange of personal data follows the rules of the ad hoc chapter of the Regulation (see section V.B.iv above). 908 See ibid arts 99(3) (in general), 102(1) (Europol), 104(1) (third countries and international organisations) and 105(1) (non-participating Member States). 909 See section IV.C above. 910 Article 102(2) of the EPPO Regulation. 911 ibid art 102(1). The Working Arrangement establishing cooperative relations between the EPPO and Europol was signed in January 2021, and its text is available on the EPPO and Europol websites. On the relations between the two bodies, see, among others, N Franssen and A Weyembergh, ‘The Future Relationship between the European Public Prosecutor’s Office and Eurojust’ in C Chevallier-Govers and A Weyembergh (eds), La Création du Parquet Européen. Simple évolution ou Révolution au sein de l’Espace Judiciaire Européen ? (Bruylant, 2021) 195–210.

The EPPO 459 b. Relations with Eurojust In accordance with the ‘special relationship’912 between the EPPO and Eurojust singled out in Article 86(1) TFEU,913 the Regulation provides that the relations between the two bodies should be based not only on mutual cooperation within their respective mandates,914 but also on ‘the development of operational, administrative and management links’.915 This strong relation had been advocated during the negotiations, but may be downsized by the choice of placing the EPPO in Luxembourg, rather than in the same building of Eurojust in The Hague.916 Nevertheless, at the operational level, Eurojust’s support will be crucial for the EPPO at least in two situations. First, Eurojust will facilitate judicial cooperation in cases concerning serious crimes which fall within the remit of the EPPO, but also involve non-participating Member States or third countries. The overarching principle laid down in the Eurojust Regulation is indeed that Eurojust should not be competent with regard to cross-border PIF crimes if the EPPO exercises its competence unless the case involves some of the Member States that are currently not participating in the EPPO and they, or the EPPO, require Eurojust’s support.917 The EPPO may therefore associate Eurojust with activities concerning cross-border cases by sharing information with the agency or by inviting it or its national member(s) to ‘provide support in the transmission of its decisions or requests for mutual legal assistance to, and execution in’918 non-participating Member States as well as third countries. The provision of the Eurojust Regulation concerning relations with the EPPO similarly provides that in operational matters relevant to the EPPO’s competences, the agency can associate the EPPO with its activities.919 Second, Eurojust can also support national authorities of Member States taking part in the EPPO enhanced cooperation when they deal with crimes in respect of which ‘the EPPO does not have competence or decides not to exercise its competence’.920 This may refer, for example, to cases of cross-border PIF crimes that the EPPO decides to refer back to national authorities921 or not to evoke,922 as well as those escaping its competence (eg, because the damage caused by those crimes to the EU budget is less than €10,000).923 In addition, Eurojust may play a role with respect to offences that are inextricably linked to PIF crimes, but that do not meet the threshold to be dealt with by the EPPO;924 912 This expression was used in art 58(1) of the Commission’s proposal, but was eventually dropped. 913 As mentioned, the EPPO is to be established ‘from Eurojust’ (art 86(1) TFEU). 914 Article 100(1) of the EPPO Regulation. 915 ibid, where it is also stated that ‘the European Chief Prosecutor and the President of Eurojust shall meet on a regular basis to discuss issues of common concern’. Article 100(1) has been almost verbatim replicated in art 50(1) of the Eurojust Regulation (‘Relations with the EPPO’), which only adds that the President of Eurojust and the European Chief Prosecutor meet at the request of one of the two. 916 The European Parliament submitted that ‘it would be best for the EPPO and Eurojust to operate in the same location if the cooperation and information exchange between them is to operate efficiently’ (European Parliament resolution of 5 October 2016 (n 731) para 10). 917 Article 3(1) of the Eurojust Regulation. 918 Article 100(2)(b) of the EPPO Regulation. 919 Article 50(4) of the Eurojust Regulation, which clarifies that the EPPO can be associated with Eurojust’s activities by sharing information on Eurojust cases or by requesting the EPPO to provide support. 920 Article 3(2) of the Eurojust Regulation. 921 Article 34 of the EPPO Regulation. 922 For more on this, see ibid art 27. 923 See ibid art 25(2). 924 ibid art 25(3).

460 Bodies, Offices and Agencies in similar circumstances, the EPPO will be competent for PIF offences and the national authorities for linked offences, with Eurojust playing a coordinating role.925 Finally, both the EPPO and the Eurojust Regulations provide for the possibility of the two bodies to have indirect access to the other’s case management system on the basis of a hit/no-hit system.926 In February 2021, the EPPO and Eurojust concluded a working arrangement to facilitate their cooperation. c. Relations with OLAF In addition to the specific provision on the relations between OLAF and the EPPO (Article 101), which will be discussed below, the Regulation mentions the role of OLAF in the context of EPPO activities in further provisions. On the one hand, when the EPPO decides to dismiss a case, the dismissed case can be referred to OLAF for recovery or other administrative follow-up.927 This rule creates continuity between OLAF and EPPO activities, which is founded on these Offices’ similar competence ratione materiae, that is, competence over illegal conduct affecting the EU budget. On the other hand, OLAF can provide support to EU institutions, bodies, offices and agencies that entertain doubt over whether an alleged PIF crime should be reported to the EPPO. As the Preamble to the EPPO Regulation states: In order to comply fully with their obligation to inform the EPPO where a suspicion of an offence within its competence is identified … institutions, bodies, offices and agencies of the Union should follow the existing reporting procedures and have in place efficient mechanisms for a preliminary evaluation of allegations reported to them. The institutions, bodies, offices and agencies of the Union may make use of [OLAF] to that end.928

Its expertise therefore allows OLAF to support EU bodies struggling with the evaluation of allegations to be reported to the EPPO and this may benefit the EPPO itself, which would otherwise risk being overwhelmed with ‘manifestly unsubstantiated allegations’.929 Moving on to the provision on relations between OLAF and the EPPO, Article 101, like Article 100 on Eurojust, provides for the access of the EPPO to OLAF’s case management system on the basis of a hit/no-hit system930 and requires OLAF and the EPPO to ‘establish and maintain a close relationship based on mutual cooperation between their respective mandates and on information exchange’.931 Furthermore, in the same way as Eurojust should not exercise its powers in cases investigated by the EPPO, unless some of the conditions mentioned in the above section occur, OLAF should not in principle 925 See C Deboyser, ‘European Public Prosecutor’s Office and Eurojust: “Love Match or Arranged Marriage”?’ in Erkelens, Meij and Pawlik (n 750) 79–100 at 84. 926 Article 100(3) of the EPPO Regulation and art 50(5) of the Eurojust Regulation. On the hit/no-hit system, see section II.B.vi.b above. 927 Article 39(4) of the EPPO Regulation. 928 ibid Recital 51. See also art 12c(6) of Regulation (EU, Euratom) 883/2013. Article 12c was added by Regulation (EU, Euratom) 2020/2223 and deals with OLAF’s role in the reporting to the EPPO. 929 Article 12c(3) of Regulation (EU, Euratom) 883/2013. 930 Article 101(5) of the EPPO Regulation. 931 ibid art 101(1). The EPPO and OLAF signed a working arrangement in July 2021. The text is available on the websites of both Offices.

The EPPO 461 open any parallel administrative investigation into the same facts which the EPPO is already investigating.932 However, this is without prejudice to the actions that OLAF can take in the course of an investigation by the EPPO upon the request of the latter. In particular, the EPPO can ask OLAF to support or complement the EPPO’s activities by: (a) providing information, analysis, expertise and operational support; (b) facilitating coordination of specific actions of the competent national administrative authorities and EU bodies; or (c) conducting administrative investigations.933 In particular, the reference to OLAF administrative investigations to be conducted ‘in the course of an investigation by the EPPO … to support the EPPO’s activity’,934 and upon its request, raises a number of questions. In light of the ambiguous wording of the Regulation, the risk is that the EPPO may delegate tasks to OLAF with the ‘aim of circumventing’935 the EPPO Regulation rules on procedural safeguards.936 The EPPO should therefore not be tempted to ‘outsource’ some of its investigative activities to OLAF with the aim of obtaining evidence via the latter’s administrative investigations. In that respect, it should be noted that the regime of safeguards that OLAF has to respect in the course of its investigations is a crucial factor that influences the admissibility of OLAF-collected evidence in national criminal proceedings. As mentioned above, the procedural safeguards listed in Article 9 of Regulation 883/2013 are robust overall when compared with the usual safeguards for administrative investigations in the Member States, yet there are still some shortcomings from a criminal law perspective.937 The reinforcement of the safeguards listed in Regulation 883/2013 is often met with resistance by practitioners at the national and EU levels, who consider subjecting OLAF investigations to criminal law standards to be disproportionate, since the Office does not have criminal law powers. However, in light of the increasing powers bestowed upon OLAF – including those to be exercised within the framework of the EPPO investigations – the enhancement of the safeguards provided by the OLAF Regulation is worth considering. In principle, the higher the standards OLAF is called upon to respect during its investigations, the fewer the obstacles to OLAF-collected evidence being admitted and used in national criminal procedures. In particular, if Article 101 of the EPPO Regulation should be read as referring to a situation where the EPPO could somehow end up delegating to OLAF investigative activities aimed at collecting evidence that the EPPO intends to use in national criminal proceedings, the respect of criminal law rules and standards by OLAF could hardly be avoided. The newly introduced 932 ibid art 101(2). For more on this, see the newly introduced art 12d of Regulation 883/2013 (‘Nonduplication of investigations’). 933 Art 101(3)(a), (b) and (c) of the EPPO Regulation. For instance, the expertise of OLAF could prove useful to the EPPO when the latter investigates PIF crimes that involve third countries (see C Scharf-Kröner and J Seyderhelm, ‘OLAF Investigations outside the European Union: Practical and Legal Aspects’ (2019) 3 Eucrim 209, 215–16). See also art 12e of Regulation (EU, Euratom) 883/2013. 934 Article 101(3) of the EPPO Regulation. 935 ‘European Parliament legislative resolution of 16 April 2019’ (n 703) amendment 110. 936 Giuffrida (n 698) 280ff, upon which the following remarks partially draw. See also L Kuhl, ‘The European Public Prosecutor’s Office: More Effective, Equivalent, and Independent Criminal Prosecution against Fraud?’ (2017) 3 Eucrim 135. 937 For instance, the absence of the right of access to the case file (see section IV.A above). cf K Ambos, European Criminal Law (Cambridge University Press, 2018) 562–63.

462 Bodies, Offices and Agencies Article 12e(3) of Regulation 883/2013 now clarifies that in order to protect the admissibility of evidence as well as fundamental rights and procedural guarantees, where OLAF performs supporting measures requested by the EPPO, the EPPO and OLAF, acting in close cooperation, shall ensure that the applicable procedural safeguards laid down in the EPPO Regulation are observed. d. Non-participating Member States and Third Countries Unlike the Commission’s proposal, the EPPO Regulation contains a provision concerning the relations with non-participating Member States.938 On the basis of working arrangements, they could post liaison officers to the EPPO, which can in turn designate contact points in the non-participating Member States.939 The same possibility on such an ‘exchange of personnel’ is mentioned in the Article concerning the relations of the EPPO with third countries and international organisations.940 However, the key question behind the relations with third countries and nonparticipating Member States is whether the EPPO should be regarded as a competent authority for the purpose of implementation of the instruments concerning judicial cooperation. In other words, should the EPPO be allowed to issue and receive requests for mutual recognition, mutual legal assistance or extradition? The Regulation does not offer a one-size-fits-all answer to this question. First, with regard to extradition from third countries, the handling European Delegated Prosecutor ‘may request the competent authority of his/her Member State to issue an extradition request in accordance with applicable treaties and/or national law’.941 The EPPO will not be attributed any additional or new power in the field: the European Delegated Prosecutors will act on behalf of the EPPO and on the basis of their national law. However, the EPPO can be recognised as the competent authority in all the other matters of legal assistance with regard to third countries, in accordance with the detailed rules of the Regulation.942 Second, as far as non-participating Member States are concerned, during the negotiations it was suggested that the Member States establishing the EPPO should recognise the Office as the competent authority for the purposes of implementation of the applicable EU acts on judicial cooperation and surrender in their relations with non-participating Member States. The Regulation has kept this rule as the second-best option: if there will not be a legal instrument expressly regulating cooperation in criminal matters and surrender between the EPPO and the competent authorities of the non-participating Member States, then the Member States participating in the EPPO ‘shall notify the EPPO as a competent authority for the purpose of implementation of the applicable Union acts on judicial cooperation in criminal matters in respect of cases falling within

938 Article 105 of the EPPO Regulation. The following remarks draw upon Giuffrida (n 741) 35–37. 939 Article 105(1) and (2) of the EPPO Regulation. 940 ibid art 104(1) and (2). 941 ibid art 104(7). 942 See ibid art 104. For a detailed analysis of the legal challenges raised by this provision, see N Franssen, ‘The Future Judicial Cooperation between the EPPO and Third Countries’ (2019) 10(2) New Journal of European Criminal Law 168.

The EPPO 463 the competence of the EPPO’ (emphasis added).943 In other words, this ‘would mean that once recognised as a competent authority by the participating [Member States] the EPPO would autonomously rely on EU instruments to cooperate with non-participating [Member States]’ (emphasis added),944 and this would arguably strengthen the EPPO’s effectiveness. However, the provision at hand raises several questions.945 First, it is not clear upon which legal basis the new separate legal instrument on the cooperation between the EPPO and non-participating Member States should be adopted (Article 86 TFEU, Article 82 TFEU, Article 325 TFEU or even a combination of some of them) and, perhaps more importantly, what its nature should be (regulation, directive etc).946 Second, it is unclear whether the notification by the Member States participating in the EPPO of the latter as a competent authority would be sufficient to oblige the competent authorities of the Member States that do not take part in Office to cooperate with the EPPO. The doubts on the matter have been summarised as follows: Can the effect of such a notification, legally speaking, by definition go any further than the basic obligation on the receiving end to take good note of it, for instance? It would prima facie appear to be highly improbable … to argue that the [non-participating Member States] be legally bound to simply accept the notification without any further ado. By contrast, the [non-participating Member States] will need to express their willingness to accept the EPPO’s role from then onward and to start cooperating with the EPPO rather than with national authorities only as before the notification.947

The broader constitutional issue behind these potential problems of cooperation is whether the principle of sincere cooperation can (or even should) play a role in this context.948 On the one hand, it is established EU law that the acts adopted in the framework of enhanced cooperation bind only participating Member States949 and that any enhanced cooperation must respect the competences, rights and obligations of those Member States that do not participate in it.950 However, on the other hand, nonparticipating Member States should not impede its implementation by the participating Member States,951 which is an obligation that follows from the more general principle of sincere cooperation that underpins the whole functioning of the EU.952 A constitutionally oriented interpretation of the Regulation would arguably require non-participating Member States to accept the notification of the EPPO as a competent authority without

943 Article 105(3) of the EPPO Regulation. 944 Weyembergh and Brière (n 741) 47. 945 See N Franssen, ‘The Future Judicial Cooperation between the EPPO and Non-participating Member States’ (2018) 9(3) New Journal of European Criminal Law 291. 946 ibid 297–99. 947 ibid 295. 948 This principle is mentioned in Recital 110, which deals with the EPPO’s relations with non-participating Member States. 949 Article 20(4) TEU. 950 Article 327 TFEU. 951 ibid. 952 Article 4(3) TEU. When relations between the EPPO and the UK were discussed before the House of Lords European Union Committee (The Impact of the European Public Prosecutor’s Office on the United Kingdom, 4th Report, session 2014–15, HL Paper 53), Jorge Espina emphasised that Member States are bound by the principle of sincere cooperation (written evidence, cited in para 50 of the Report).

464 Bodies, Offices and Agencies requiring further formalities. In other words, under EU law, they are free not to join the EPPO, yet they should not impair its activities, which may at times require the cooperation of their own authorities.953 Finally, the arrangements with non-participating Member States could also draw inspiration from the legal framework of Frontex: the Frontex Regulation states the agency will facilitate operational cooperation of the Member States with (non-participating) Ireland and the UK in specific activities.954 The UK participated in several joint operations subject to the acceptance on a case-by-case basis of the Frontex Management Board, on which the UK had observer status. A similar arrangement could be reached between the prosecution authorities of non-participating Member States and the Permanent Chambers in particular cases.

C. Final Remarks The EPPO Regulation is probably the boldest and most ambitious instrument of EU (criminal) law adopted thus far. In tabling its proposal, the Commission had to grapple with three main challenges: the relationship between EU powers and national powers to investigate and prosecute (the sovereignty question); the relationship between EU law and national criminal justice systems (the legal cultural/legal diversity issue); and the impact of Europeanisation of investigations and prosecutions on the affected individuals (the human rights question). The broader and underlying question – and perhaps the elephant in the room – was the extent to which the fight against fraud affecting EU budget is an EU interest, separate and distinct from national interests, which merits a separate intervention from an EU body, and whether such an approach can provide legal certainty in a constitutional landscape which allows the development of an EPPO à la carte. The arm wrestling between the Commission and the Council on VAT fraud, to mention just one example, shows that the answer to this question is far from straightforward. The Commission produced a highly innovative and contested vision of centralised prosecution at the EU level, replete with echoes of federalism via the use of concepts such as ‘single legal area’ and exclusive competence. National parliaments and governments were not convinced. A considerable number of national chambers raised subsidiarity concerns on the establishment of an EPPO. Member States on the other hand replaced the Commission’s federal vision with the usual intergovernmental, collegial vision present in a number of current EU judicial cooperation structures, and in particular Eurojust. Not all of them were satisfied with the text and the EPPO was eventually set up by means of enhanced cooperation, which is contentious in the light of the intrinsically European nature of the interest that the EPPO aims to protect (the EU budget). The Member States’ vision addresses issues of perceived lack of trust to state authorities by reassociating national prosecutors with cases involving their own Member State. 953 See also Weyembergh and Brière (n 741) 47. 954 Article 70 of Regulation (EU) 2019/1896 of the European Parliament and of the Council of 13 November 2019 on the European Border and Coast Guard and repealing Regulations (EU) No 1052/2013 and (EU) 2016/1624 [2019] OJ L295, 14 November, 1. For more on this, see section VI below.

Other Bodies 465 Compared to the Commission’s proposal, the Regulation provides a greater degree of participation of prosecutors from the Member State in whose territory EPPO investigations and prosecutions take place. Although the collegial model does not negate the fact that the EPPO is a European body subject to EU law and all duties stemming from the EU constitutional order, at least two features of the EPPO do not sit easily with the post-Lisbon architecture of the EU: first, the limited accountability of the EPPO to the European Parliament and national parliaments – although this feature is a natural consequence of the independence of the Office; and, second, the judicial review of EPPO acts and decisions, which could lead to some gaps in effective judicial protection for individuals affected by the considerable investigation and prosecution powers of the EPPO. It remains to be seen whether the EPPO’s relations with other actors in the AFSJ will yield good results or will instead complicate the status quo. The EPPO is radically different from Eurojust and Europol on the one hand, and from OLAF on the other. Nonetheless, it will not be able to carry out its investigations and prosecutions without their support, not least because of the non-participation of some Member States in the enhanced cooperation. Overlap and competition are even more realistic than in the past and should be avoided to the greatest extent possible. In this complex and multi-level landscape, where EU and national law are inextricably linked and where a number of EU bodies with complementary functions coexist, issues relating to the place and effective protection of human rights should not be left behind. It is ensuring effective protection of fundamental rights which will grant legitimacy to any EU project for further integration in the field of prosecution and will address issues of lack of mutual trust between EU Member States, and also between Member States and the EU, and create further conditions for acceptance of the EPPO project by the European public.

VI. Other Bodies: Counter-terrorism, Migration, Informality and the Legacy of ‘Cross-Pillarisation’ Along with the above flagship bodies in EU action in criminal law, a number of other organisations have emerged in recent years at the EU level working on various aspects of police and judicial cooperation in criminal matters in the EU. The nature, legal basis and degree of centralisation of these bodies vary considerably. In the field of judicial cooperation in criminal matters, the main body complementing the work of Eurojust is the EJN.955 In the field of police cooperation, EU initiatives other than Europol include the European Union Agency for Law Enforcement Training (CEPOL) and the Police Chiefs’ Task Force. CEPOL was first established in 2000956 and was relaunched in 2005 by a Decision granting it legal personality and outlining in greater detail the body’s

955 See section III above. 956 Council Decision of 22 December 2000 establishing a European Police College (CEPOL) [2000] OJ L336, 30 December, 1.

466 Bodies, Offices and Agencies objectives and tasks.957 In 2015, a Regulation was adopted and formally recognised CEPOL as an agency of the EU.958 CEPOL, which was previously based in Bramshill (UK) and is now located in Budapest,959 is essentially a network bringing together the national police training institutes of Member States,960 and its main purpose is to support, develop, implement and coordinate training for law enforcement officials, in particular in the areas of the prevention of and the fight against serious crime affecting two or more Member States and terrorism.961 This should be done ‘while putting particular emphasis on the protection of human rights and fundamental freedoms in the context of law enforcement’.962 As noted above, the Commission proposed the merger of CEPOL and Europol in the aftermath of Lisbon, but the European Parliament and the Member States opposed it.963 The European Police Chiefs’ Task Force (EPCTF), which meets under the auspices of the European Police Chiefs Convention (EPCC) in the aftermath of Lisbon,964 does not have a formal legal basis. It was established, following the relevant mandate of the Tampere European Council, in 2000.965 Given the absence of a legal basis and a clear mandate for the EPCTF (which would meet within the framework of Europol as regards its operational tasks and within the Council as regards its strategic tasks),966 there was a considerable lack of clarity and transparency as to what it actually did. This opaqueness did not contribute to meaningful scrutiny and accountability with regard to its operations. According to the public information available, its successor – the EPCC – is a forum where high-level representatives of national police forces meet and exchange views among themselves and with representatives of Europol, non-EU countries, agencies and institutions of the EU, and international organisations.967 But it is the development of an EU response to terrorism which proved to be a catalyst for putting yet more bodies on the map of EU criminal law cooperation. Part of the EU’s response to terrorism has been to strengthen its institutional capacity, either by expanding and focusing the mandate of existing structures on counter-terrorism or by creating new structures to deal with the issue.968 These structures transcended the 957 [2005] OJ L256, 1 October, 63. 958 Regulation (EU) 2015/2219 of the European Parliament and of the Council of 25 November 2015 on the European Union Agency for Law Enforcement Training (CEPOL) and replacing and repealing Council Decision 2005/681/JHA, OJ L319, 4 December 2015, 1. 959 Article 25(3) of the CEPOL Regulation. 960 ibid art 3(3). 961 ibid art 3(1). 962 ibid. 963 See section II above. 964 J Doody, ‘The Institutional Framework of EU Counter-terrorism’ in F de Londras and J Doody (eds), The Impact, Legitimacy and Effectiveness of EU Counter-terrorism (Routledge, 2015) 40–62 at 61. 965 See M den Boer, C Hillebrand and A Noelke, ‘Legitimacy under Pressure: The European Web of Counterterrorism Networks’ (2008) 46(1) Journal of Common Market Studies 101, 113; Peers (n 11) 322. 966 Conclusions of Justice and Home Affairs Council of 19 November 2004, Council Doc 14615/04 (Presse 321), Brussels, 19 November 2004. For further information, see Peers (n 11). 967 Europol, ‘2018 European Police Chiefs Convention: First Convention under Catherine de Bolle’s Leadership’ (press release), 28 September 2018, https://www.europol.europa.eu/newsroom/news/2018european-police-chiefs-convention-first-convention-under-catherine-de-bolle%E2%80%99s-leadership. 968 On the proliferation of these structures, see House of Lords European Union Committee, After Madrid: The EU’s Response to Terrorism, 5th Report, session 2004–05. On the strengthening of the institutional aspect, see J Monar, ‘Common Threat and Common Response? The European Union’s Counter-terrorism Strategy and its Problems’ (2007) 42(3) Government and Opposition 292, 307–08.

Other Bodies 467 former third pillar, with counter-terrorism being viewed both as a criminal law and a foreign policy issue. A prime example of focusing existing EU structures on counterterrorism has been the development of the work of the EU Joint Situation Centre (SitCen) in the field. Later transformed in IntCen (EU Intelligence Analysis Centre),969 SitCen did not have a formal legal basis, but was established under the then second pillar to report to the EU High Representative of the Common Foreign and Security Policy, renamed High Representative of the European Union for Foreign Affairs and Security Policy after Lisbon (HR).970 According to the first SitCen Director, William Shapcott, SitCen was given an intelligence assessment function by the then EU High Representative of the Common Foreign and Security Policy Javier Solana in 2001.971 Previously located within the General Secretariat of the Council, since 2011 IntCen has been a Directorate of the European External Action Service (EEAS).972 Albeit laconic, a provision of the 2010 Council Decision establishing the organisation and functioning of the EEAS represents the current legal basis for IntCen.973 It is stated that the central administration of the EEAS includes: [T]he European Union Situation Centre, placed under the direct authority and responsibility of the High Representative, and which shall assist him/her in the task of conducting the Union’s CFSP [Common Foreign and Security Policy] in accordance with the provisions of the Treaty while respecting, in accordance with Article 40 TEU, the other competences of the Union.974

The mission of IntCen is to ‘provide intelligence analyses, early warning and situational awareness to the High Representative of the European Union for Foreign Affairs and Security Policy … and to the European External Action Service’,975 especially in the field of counter-terrorism.976 IntCen can carry out its tasks on the basis of information shared by Member States and open sources; unlike Europol, it is only responsible for strategic analysis.977 The recent EU Security Union Strategy acknowledges that IntCen ‘has played a key role in promoting the exchange of strategic intelligence between Member States Intelligence and Security Services providing intelligence situational awareness in favour of EU institutions’.978 IntCen includes national intelligence analysts seconded by a number of Member States and produces external intelligence disseminated mainly to structures acting in the fields of the CFSP and the Common Security and Defence Policy (CSDP).979 However, 969 http://statewatch.org/news/2016/may/eu-intcen-factsheet.pdf. 970 See art 18 TEU. 971 Oral evidence to the House of Lords European Union Committee (n 968) Q152. 972 http://statewatch.org/news/2016/may/eu-intcen-factsheet.pdf. 973 [2010] OJ L201, 3 August, 30. 974 Article 4(3)(a), third indent of the 2010 Council Decision establishing the EEAS. 975 http://statewatch.org/news/2016/may/eu-intcen-factsheet.pdf. 976 ibid. See also MKD Cross, ‘The Limits of Epistemic Communities: EU Security Agencies’ (2015) 3(1) Politics and Governance 90, 95. 977 http://statewatch.org/news/2016/may/eu-intcen-factsheet.pdf. 978 COM (2020) 605 final (n 334) 21, where it is also added that IntCen ‘serves as the only gateway for Member States Intelligence and Security Services to provide intelligence-led situational awareness to the EU’. 979 http://statewatch.org/news/2016/may/eu-intcen-factsheet.pdf. See also B Müller-Witte, For Our Eyes Only? Shaping an Intelligence Community within the EU, European Union Institute for Security Studies, Occasional Paper No 50, January 2004, 29.

468 Bodies, Offices and Agencies IntCen has also been increasingly involved in the production and exchange of ‘internal’ intelligence, mainly by developing links with Europol.980 The previous Eurojust Decision expressly mentioned SitCen/IntCen among the bodies with which Eurojust should establish and maintain cooperative relations,981 while nothing similar can be found in the Eurojust Regulation and in the Europol Regulation. However, they both empower these agencies to establish and maintain cooperative relations with EU institutions, bodies, offices and agencies, which include IntCen. Given the absence of a concrete legal framework governing IntCen and the very limited information concerning its work, the limits of knowing what exactly IntCen does are evident, as are the limits to scrutiny, transparency, accountability and judicial control of this body.982 The challenges in this context may be considerable if there is a spill-over of foreign and defence policy secrecy into EU criminal law. Another example of blurred boundaries between EU criminal law and foreign and defence policies in EU counter-terrorism action – in pre-Lisbon terms, ‘crosspillarisation’ – this time via the establishment of a new structure, has been the creation of the post of an EU Counter-Terrorism Coordinator. Again there is no legislation establishing the post and setting out the Coordinator’s powers. Rather, the post was established by the European Council in its Declaration on Combating Terrorism, which was adopted shortly after the Madrid bombings in 2004.983 According to the European Council: [T]he Co-ordinator, who will work within the Council Secretariat, will co-ordinate the work of the Council in combating terrorism and, with due regard to the responsibilities of the Commission maintain an overview of all the instruments at the Union’s disposal with a view to regular reporting to the Council and effective follow-up of Council decisions.984

However, this job description is rather general, and the precise tasks of the Coordinator not entirely clear. This lack of clarity was also ascertained a few months after the creation of the post by the House of Lords European Union Committee, which took evidence from the first EU Counter-Terrorism Coordinator (Gijs de Vries), whose appointment (by Javier Solana, then EU High Representative of the Common Foreign and Security Policy) was confirmed by the European Council in the same Declaration.985 The Committee also pointed out the lack of oversight with regard to the Coordinator’s work. This lack of clarity and oversight has been seen by EU officials as granting the Coordinator the flexibility to help the General Secretary wherever possible,986 but does not provide 980 See D Keohane, ‘The Absent Friend: EU Foreign Policy and Counter-terrorism’ (2008) 46(1) Journal of Common Market Studies 125–46 at 129. 981 Article 26(1)(d) of the Eurojust Council Decision. 982 See also C Jones, ‘Secrecy Reigns at the EU’s Intelligence Analysis Centre’, 2013, www.statewatch.org/ analyses/no-223-eu-intcen.pdf; Cross (n 976) 96. 983 Declaration of 25 March 2004, para 14, www.consilium.europa.eu/uedocs/cms_data/docs/pressdata/en/ ec/79637.pdf. 984 ibid. In this context, see the Report by the Counter-Terrorism Coordinator on the ‘Implementation of the EU Counter-Terrorism Strategy – Priorities for further action’, Council Doc 9417/08, Brussels, 19 May 2008, which was presented to the June 2008 Justice and Home Affairs Council. The Report contains a lengthy section on transmission of information to Europol and Eurojust. 985 House of Lords European Union Committee (n 968) paras 54–60. 986 See M Wesseling, ‘Gijs de Vries : vers la coordination des politiques antiterroristes européennes, efficacité ou symbolisme?, Master Mémoire’, thesis, Institut d’Etudes Politiques de Paris, 2005, 49.

Other Bodies 469 (beyond his reporting to the HR) sufficient accountability mechanisms. Moreover, the broad reference to coordination and follow-up of Council Decisions by the Coordinator may create competition or overlap with EU institutions such as the European Commission, which is entrusted to monitor the implementation of legislation.987 The situation has not changed following the appointment of Mr de Vries’ successor, Gilles de Kerchove (formerly of the Council Secretariat), while the replacement of a diplomat by a high-ranking EU civil servant for the post is noteworthy, the job d escription – as described in the Council press release confirming the appointment – has not really changed.988 What is not clearly visible from this press release is the potential role of the Coordinator as the EU’s representative or ‘voice’ in external relations.989 In the aftermath of the terrorist attacks in Europe in the mid-2010s, the Coordinator has become a key figure in the field of counter-terrorism at the EU level. In the Stockholm Programme and in the 2014 strategic guidelines for legislative and operational planning within the AFSJ, the European Council reaffirmed the importance of the role of the Coordinator,990 and after the 2015 statement of EU leaders on counter-terrorism,991 the Coordinator ‘regularly reports to the Council on the implementation of counter-terrorism tools at [the] EU level’.992 Besides counter-terrorism, migration is another field witnessing a process of agencification. After Amsterdam, this policy area was moved to the then first pillar, but links between migratory flows and security issues were progressively highlighted in the political arena, contributing once more to further ‘cross-pillarisation’. Frontex is a case in point. Conceived as a body supporting national authorities dealing with migratory challenges, the European Border and Coast Guard Agency (Frontex) was established in 2004 within the then first pillar.993 In 2016, a new Regulation entered into force and renamed the agency the ‘European Border and Coast Guard Agency’994 – although 987 On the reactions of the Commission to the creation of a Coordinator’s post within the Council, see ibid, which also contains a very interesting picture of the inter-institutional battles behind the creation of the post (at 41–43). 988 ‘Javier Solana, EU High Representative for the CFSP, Appoints Mr Gilles de Kerchove as EU CounterTerrorism Coordinator’, press release, Brussels, 19 September 2007, S256/07. In July 2021, Ilkka Salmi was appointed as new Counter-Terrorism Coordinator. 989 Such a role was envisaged by the Presidency Conclusions of 17 and 18 June 2004, stating that the appointment of an EU Counter-Terrorism Coordinator would help to improve coordination and visibility of the EU’s actions in this field (ibid para 13, emphasis added). 990 See the Stockholm Programme (n 43) para 4.5 (at 24); and the Conclusions of the European Council held in Ypres, Belgium, on 26 and 27 June 2014 (EUCO Doc 79/14, Brussels, 27 June 2014), 5. 991 Informal meeting of the Heads of State or Government, Brussels, 12 February 2015 – Statement by the members of the European Council, https://www.consilium.europa.eu/en/meetings/europeancouncil/2015/02/12. 992 ‘Counter-Terrorism Coordinator’, https://www.consilium.europa.eu/en/policies/fight-against-terrorism/ counter-terrorism-coordinator/?hc_location=ufi. 993 Council Regulation (EC) No 2007/2004 [2004] OJ L349, 25 November, 1. The Regulation was amended by Regulation (EC) No 863/2007 of the European Parliament and of the Council of 11 July 2007 establishing a mechanism for the creation of Rapid Border Intervention Teams and amending Council Regulation (EC) No 2007/2004 as regards that mechanism and regulating the tasks and powers of guest officers ([2007] OJ L199, 31 July, 30). 994 Regulation (EU) 2016/1624 of the European Parliament and of the Council of 14 September 2016 on the European Border and Coast Guard and amending Regulation (EU) 2016/399 of the European Parliament and of the Council and repealing Regulation (EC) No 863/2007 of the European Parliament and of the Council, Council Regulation (EC) No 2007/2004 and Council Decision 2005/267/EC [2016] OJ L251, 16 September, 1.

470 Bodies, Offices and Agencies this will ‘continue to be commonly referred to as Frontex’995 – and was subsequently repealed in 2019.996 Together with the national authorities responsible for border management, the agency is part of the so-called ‘European Border and Coast Guard’,997 which is tasked with ensuring an integrated border management at the external borders with a view to managing those borders efficiently in full compliance with fundamental rights and increasing the efficiency of the EU return policy.998 Thus, border control still lies with the exclusive competence of the Member States,999 yet it requires support and coordination at the European level: such an integrated external border management is based on the ‘shared responsibility’ between Member States and the EU,1000 and is a ‘necessary corollary to the free movement of persons within the Union’ and a ‘fundamental component of an area of freedom, security and justice’.1001 However, in addition to border control, which includes both measures to facilitate legitimate border crossings and measures relating to the prevention and detection of cross-border crime at the external border (eg, migrant smuggling or terrorism),1002 the integrated border management consists of a number of other components listed in the Regulation, spanning from search and rescue operations for persons in distress at sea to the return of third-country nationals who are the subject of return decisions issued by a Member State.1003 An important element of the integrated border management is also the enhancement of cooperation within and among Member States, among the relevant EU entities, and with third countries.1004 In this framework, Frontex – which is based in Warsaw – has several tasks. The 2019 Regulation has further contributed to the gradual transformation of Frontex into a security agency, which is now composed, inter alia, of standing corps that are given executive powers, such as the verification of the identity and nationality of persons and the authorisation or refusal of entry.1005 Frontex staff can also be deployed at the borders to support national authorities.1006 The agency can coordinate and organise 995 ibid Recital 11. 996 Regulation (EU) 2019/1896 (hereinafter the ‘Frontex Regulation’). 997 ibid art 4(1). 998 ibid art 1. The reference to the ‘integrated’ system in the previous 2016 Regulation had been hailed as the ‘main innovation of the new Regulation’; see F Ferraro and E de Capitani, ‘The New European Border and Coast Guard: Yet Another “Half Way” Reform?’ (2016) 17(3) ERA Forum 385, 388. 999 ‘While Member States retain the primary responsibility for the management of their external borders in their interest and in the interest of all Member States and are responsible for issuing return decisions, the Agency should support the application of Union measures relating to the management of the external borders and return by reinforcing, assessing and coordinating the actions of the Member States which implement those measures’ (Recital 12, emphasis added). Moreover, Frontex should carry out its tasks without prejudice to the responsibilities of the Member States with regard to defence and to maintaining law and order and safeguarding internal security (see Recitals 23 and 22 respectively). 1000 ibid art 7. 1001 ibid Recital 1. 1002 ibid art 3(a). 1003 ibid art 3(b) and (i). 1004 ibid art 3(e), (f) and (g). 1005 ibid art 55(7)(a)–(c). 1006 Frontex may, inter alia, ‘set up a technical equipment pool, including a rapid reaction equipment pool, to be deployed in joint operations, in rapid border interventions and in the framework of migration management support teams, as well as in return operations and return interventions’ (ibid art 10(1)(k)). On the ‘dual character’ of Frontex as a regulatory and operational agency, see JJ Rijpma, ‘Frontex and the European System of Border Guards: The Future of the European System of Border Guards’ in Fletcher, Herlin-Karnell and Matera (n 411) 217–44 at 219–20.

Other Bodies 471 joint operations1007 and can send its personnel in the so-called ‘hotspot areas’.1008 As noted in the literature: The main idea of the Hotspots is to dispatch personnel from EU agencies like Frontex, EASO, Europol and Eurojust to Italy and Greece to support national authorities in the screening, identification and fingerprinting of people arriving in specific locations.1009

Other Frontex tasks are instead more strategic1010 or aim to enhance the expertise of national authorities or to develop platforms for information exchange, such as the European Border Surveillance System (EUROSUR).1011 The cooperation of Frontex with other EU agencies is further addressed in the new Regulation.1012 An agreement with Europol was concluded in 2008 and then repealed in 2015, whereas an MoU was signed with Eurojust in 2013. Frontex shares a common trait with the other entities analysed in this chapter: within the hotspots, and more in general during its activities, Frontex can perform its tasks insofar as Member States are willing to cooperate with the agency.1013 The specificity of Frontex is that it deals with very sensitive, sometimes dramatic and extremely urgent situations, where there is a pressing need to ensure an adequate protection of fundamental rights of the concerned individuals. However, Frontex’s operations have been criticised over the years because they are not fully compliant with human rights.1014 To address the issue, the new Regulation provides, inter alia, that the Agency adopts a fundamental rights strategy and action plan.1015 In addition, the Management Board of Frontex should appoint a fundamental rights officer1016 who, among the several tasks listed in Article 109 of the Regulation, handles the complaints of persons who

1007 Article 10(1)(g) of the Frontex Regulation. For some remarks on the ‘Triton’ and ‘Poseidon’ operations, see S Carrera and L den Hertog, ‘A European Border and Coast Guard: What’s in a Name?’, CEPS Paper in Liberty and Security in Europe No 88, March 2016, https://www.ceps.eu/ceps-publications/european-border-andcoast-guard-whats-name, 5–8. On the increasingly operational role of Frontex, including in ‘[contributing] to the detection, prevention and combating of cross-border crime at the external borders’ (art 1 of the Frontex Regulation), see S Hartwig, ‘Frontex: From Coordinating Controls to Combating Crime’ (2020) 2 Eucrim 134. 1008 Article 10(1)(m) of the Frontex Regulation. 1009 Carrera and den Hertog (n 1007) 8. EASO is the European Asylum Support Office. Established by Regulation (EU) 439/2010 ([2010] OJ L132/11, 29 May, 11), it is based in Malta and aims to facilitate, coordinate and strengthen practical cooperation among Member States on asylum and help to improve the implementation of the Common European Asylum System. However, it has no powers in relation to the taking of decisions by Member States’ asylum authorities on individual applications for international protection. For further details, see Guild et al (n 132) 30–33. 1010 For instance, Frontex monitors migratory flows and carry out risk analyses (art 10(1)(a) of the Frontex Regulation) and ‘vulnerability assessment[s]’ (art 10(1)(c)), which are meant to ‘monitor and assess the availability of the technical equipment, systems, capabilities, resources, infrastructure and adequately skilled and trained staff of Member States necessary for border control’ (art 32(2)). 1011 ibid art 18. 1012 ibid art 68. 1013 See ibid Recital 25: ‘The Agency relies on the cooperation of Member States to be able to perform its tasks effectively. In that respect, it is important for the Agency and the Member States to act in good faith and to exchange accurate information in a timely manner. No Member State should be obliged to supply information the disclosure of which it considers contrary to the essential interests of its security.’ 1014 See the Report of the Parliamentary Assembly of the Council of Europe, ‘Frontex: Human Rights Responsibilities’ (2013) 25(2) International Journal of Refugee Law 407. See also Guild et al (n 132) 39–42 and 57–65. 1015 Article 80 of the Frontex Regulation. 1016 ibid art 100(2)(z).

472 Bodies, Offices and Agencies believe their fundamental rights have been breached by Frontex actions.1017 However, in the past, doubts have been cast on the efficiency and the independence of this mechanism, not least because the fundamental rights officer is elected by the agency’s Management Board.1018 Against this backdrop, it was striking that in the 2016 Frontex Regulation, there was no provision on the accountability of the agency before national parliaments.1019 The new Regulation (partially) overcomes this shortcoming by stating that the European Parliament and the national parliaments ‘may’ cooperate in the framework of Article 9 of Protocol 1 to the Treaties,1020 which in turn provides that the ‘European Parliament and national Parliaments shall together determine the organisation and promotion of effective and regular interparliamentary cooperation within the Union’.1021 In addition, the agency is now required to transmit its annual activity report to the national parliaments.1022 The territorial scope of application of the Frontex Regulation is affected by the rules governing the Schengen acquis and the AFSJ: whereas Norway, Iceland, Switzerland and Liechtenstein take part in the Regulation,1023 Denmark and Ireland are not bound by it.1024 However, this should not lead to an inefficient control of the borders, with the consequence that the Regulation empowers Frontex to facilitate operational cooperation of Member States with Ireland (and at the time the UK) in specific activities.1025 In addition, the representatives of these countries may be invited to attend meetings of the Management Board which allow them to participate fully in the preparation of such specific activities.1026 The UK has thus far participated in several joint operations subject to the acceptance on a case-by-case basis of the Frontex Management Board. A similar, if not more complicated, geographical fragmentation can be found in another EU agency, namely the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA). Established in 2011,1027 this agency began its activities at the end of 2012 and is responsible for the operational management of large-scale IT systems in the AJSJ,1028 such as

1017 ibid art 111(4). 1018 See E Guild et al, ‘What is Happening to the Schengen Borders?’, CEPS Paper in Liberty and Security in Europe No 86, December 2015, https://www.ceps.eu/ceps-publications/what-happening-schengenborders, 21. 1019 See Ferraro and de Capitani (n 998) 391–92. 1020 Article 112(1) of the Frontex Regulation. 1021 Article 9 of Protocol No 1 on the Role of national parliaments in the European Union. 1022 Article 112(3) of the Frontex Regulation. 1023 ibid Recitals 121–24. 1024 As well as the UK before it left the EU. See ibid Recitals 125–27. 1025 ibid art 70(1). See section V.B.vi.d above. 1026 ibid Recital 128 and art 104(4) and (5). 1027 Regulation (EU) 1077/2011 of the European Parliament and of the Council of 25 October 2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice [2011] OJ L286, 1 November, 1 (hereinafter the ‘eu-LISA Regulation’). To be aligned with the Eurodac recast Regulation, the eu-LISA Regulation was later amended by Regulation (EU) No 603/2013 of the European Parliament and of the Council ([2013] OJ L 180, 9 June, 1). The 2011 Regulation was then repealed by Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011 [2018] OJ L295, 21 November, 99. 1028 Article 1(2) of Regulation (EU) 2018/1726.

Inter-agency Cooperation 473 the second-generation Schengen Information System (SIS II), the VISA Information System (VIS) and Eurodac.1029 Eu-LISA is also responsible for the preparation, development or operational management of the Entry/Exit System (EES), DubliNet, and the European Travel Information and Authorisation System (ETIAS).1030 Furthermore, eu-LISA should also be given responsibility for the necessary actions to enable interoperability, which is discussed in another chapter of this book.1031 Because of its competence in relation to a number of IT systems concerning different policy fields, variable geometry is an inherent feature of the agency.1032 However, the ‘operational management’ referred to in the eu-LISA Regulation does not consist in any exchange of data, but simply in carrying out all the tasks necessary to keep large-scale IT systems functioning in accordance with the specific provisions applicable to each of them.1033 Since this calls for a high level of security of the premises where eu-LISA works – Tallinn (where the seat of the agency is), but also Strasbourg and Sankt Johann im Pongau, Austria1034 – the Regulation provides for the establishment of a security officer,1035 which is not mentioned in any of the legal texts concerning the other EU bodies discussed so far. Another specific feature of this agency is that its structure also comprises a number of Advisory Groups, each of them relating to a largescale IT system for which eu-LISA is responsible.1036

VII. Inter-agency Cooperation The proliferation of EU bodies and networks in the field of criminal law has been accompanied by increased calls to enhance cooperation between them, in particular as regards the exchange of strategic and personal data. Such calls for cooperation have been translated on a number of occasions, as seen above, into legally binding provisions in secondary legislation regulating EU bodies such as Europol, Eurojust, OLAF, Frontex and the EPPO, while also leading to the conclusion of bilateral agreements between EU bodies. Calls for cooperation are frequently made also by Ministers at the Justice and Home Affairs Council.1037 Calls for ‘inter-agency’ cooperation were also central to The Hague and the Stockholm Programmes, where Member States’ leaders stressed

1029 ibid art 1(3). 1030 ibid art 1(4). 1031 ibid art 1(7)(b). On interoperability, as well as the databases mentioned so far, see ch 9. 1032 See the detailed considerations of the Commission in the Explanatory Memorandum to the proposal for a new Regulation on eu-LISA, COM (2017) 352 final, Brussels, 29 June 2017, 11–14. 1033 Article 1(6) of the eu-LISA Regulation. 1034 Some tasks of the agency are carried out in in Strasbourg, whereas a back-up site capable of ensuring the operation of a large-scale IT system in the event of failures has been installed in Austria (ibid art 17(3)). 1035 ibid art 18(2)(b). 1036 Pursuant to ibid art 27(1), the structure of eu-LISA currently includes the SIS II Advisory Group, the VIS Advisory Group, the Eurodac Advisory Group and the EES-ETIAS Advisory Group. 1037 A good example was the Council of June 2008, which stressed not only the need to formalise cooperation between Europol and Eurojust, but also called – in the context of the Conclusions on the management of the external borders of EU Member States – for closer cooperation between Frontex and Europol (point 4 of the Conclusions).

474 Bodies, Offices and Agencies both operational work and operational cooperation across the EU. The Stockholm Programme highlighted the need to: [E]nhance the internal coordination in order to achieve greater coherence between external and internal elements of the work in the area of freedom, security and justice. The same need for coherence and improved coordination applies to the Union agencies (Europol, Eurojust, Frontex, European Police College (CEPOL), the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA), the future European Asylum Support Office (EASO) and the European Union Agency for Fundamental Rights).1038

The conclusions of the 2014 European Council meeting in Ypres and the 2020 EU Security Union Strategy emphasised the same need.1039 This move towards greater inter-agency cooperation – also reflected in the provision of the Lisbon Treaty on the ‘internal security’ standing committee within the Council (COSI)1040 – does not always sit easily with the fact that the various EU bodies are vested with different powers, and have been established under different legal bases for different purposes. A well-documented example is the move to link the policy fields of immigration and crime under a strategy of creating an (in)security continuum, presenting cooperation between immigration and police authorities as necessary to achieve security.1041 This approach, which is particularly highlighted post-9/11 with the emergence of the concept of ‘border security’ in government discourse across the Atlantic, has led to calls at the EU level for cooperation between Frontex on the one hand and enforcement authorities such as Europol on the other.1042 However, such cooperation, in particular as regards the exchange and transfer of personal data, may disregard the different nature and tasks of these bodies and the principle of purpose limitation which forms the backbone of data protection systems, and may become even more problematic in the wake of the adoption of EU regulations on the interoperability of databases. Similar issues arise with regard to calls for cooperation between EU police and defence/ military bodies, as well as cooperation between police and intelligence bodies.1043 In the current stage of constitutional development of the EU, calls for maximum interagency cooperation also raise a number of issues of legality and accountability. It has been demonstrated that EU bodies dealing in one way or another with criminal matters exist in fields relating to the previous first (OLAF and Frontex), second (IntCen and the Counter-Terrorism Coordinator) and third (Europol, Eurojust and eu-LISA) pillars, 1038 The Stockholm Programme (n 43) para 1.2.4 (at 6). See also paras 4.1 and 4.3.1 (at 18 and 20 respectively). 1039 Conclusions of the European Council (n 990) 1–2; Commission (n 334) 10 and 21. 1040 See section II.B.v.b above. 1041 On the (in)security continuum, see Bigo (n 6) above. 1042 On border security, see V Mitsilegas, ‘Border Security in the European Union. Towards Centralised Controls and Maximum Surveillance’ in E Guild, H Toner and A Baldaccini (eds), Whose Freedom, Security and Justice? EU Immigration and Asylum Law and Policy (Hart Publishing, 2007) 359–94. With regard to Europol, Frontex and EASO, Guild et al ((n 132) 13) argue that: ‘inter-EU cooperation between Home Affairs agencies in migration management and exchange of information is also reinvigorating a nexus between migration and various forms of insecurities and criminalities. The security of the Union and its Member States, as perceived, becomes the driving force behind individual and joint activities between agencies like Europol and Frontex. Immigration is constructed as a ‘threat’ and linked with “risk”, hence justifying the application of police-led and coercive control policy measures and operations’. 1043 For different takes on ‘cross-pillarisation’ before Lisbon and inter-agency cooperation in this context, see Müller-Witte (n 248); and Bigo et al (n 104).

Controlling Bodies by Other Bodies and Agencies 475 whereas the EPPO is regulated in a way that resembles Eurojust and Europol, even though its mission is in principle closer to that of OLAF. Moreover, while some of these bodies have been established under a clear legal basis and via secondary Union/ Community law, others do not have a clear legal basis or tasks. In the light of this constitutional and functional fragmentation, it is difficult to establish mechanisms of meaningful scrutiny of such inter-agency cooperation. Moreover, the increased emphasis on operational cooperation raises further questions regarding transparency and accountability – in particular, if the emphasis on operational cooperation may lead to the choice of action which will not take the form of publicly negotiated legislation. Calls for increased inter-agency cooperation may also reveal tensions between the various EU bodies and stress competition rather than cooperation, and overlap rather than synergy. The prime example of such complexity is the relationship between Eurojust and OLAF, and it remains to be seen whether such a relation will be affected by the establishment of the EPPO, which has eventually not subsumed any of the two bodies, but will instead rely on their support. As was highlighted on a number of occasions in this chapter, tensions in inter-agency cooperation may be caused by both the lack of clarity with regard to the tasks of the various EU bodies and the potential overlap with regard to their tasks. For instance, the recent refugee crisis has led Europol and Frontex to carry out joint operations where ‘there is a blurring of “who is doing what”’, which inevitably produces ‘opaque responsibility allocation’.1044 As the negotiations on the development of Europol and Eurojust – but also the debate over the future of OLAF and the establishment of the EPPO – have demonstrated, an effective and accountable inter-agency cooperation presupposes a clear answer to the existential questions with regard to the role, powers, tasks and mandates of the EU bodies.

VIII. Controlling Bodies by Other Bodies and Agencies The proliferation of bodies in EU criminal law has been accompanied by the introduction of forms of control and accountability. As mentioned in the analysis of the legal framework on Eurojust and Europol in particular, these bodies are accountable in one form or another to a number of EU institutions. However, there are also specific provisions inserted in the legislation establishing these bodies which provide for their control by other bodies. Prime examples of such control – in the specific field of data protection – were the Joint Supervisory Bodies (JSBs), such as those provided for by the Eurojust and Europol Council Decisions. The powers of JBSs were limited from the point of view of the binding nature of their actions.1045 A similar example is the Supervisory Committee of OLAF – it consists of independent experts, monitors compliance with fundamental rights more broadly, but its recommendations are not legally binding.

1044 Guild et al (n 132) 78. 1045 On JSBs and data protection supervision before Lisbon, see G González Fuster and P Paepe, ‘Reflexive Governance and the EU Third Pillar: Analysis of Data Protection and Criminal Law Aspects’ in Guild and Geyer (n 295) 129–52.

476 Bodies, Offices and Agencies These bodies were or are internal to the EU criminal law agencies and offices, and have specific, sectoral tasks, dealing primarily with the protection of personal data. The same goes for the Data Protection Officer, who should be appointed in all EU bodies discussed in this chapter. At the same time, further bodies and organs have been established at the EU level with the aim of monitoring, at a more ‘horizontal’ level, the protection of a number of fundamental rights. A prime example is the EDPS, an independent authority established by Regulation (EC) 45/2001 and providing independent supervision of EU institutions and bodies.1046 The EDPS now exercises most of the functions that previously fell within the mandate of the JBSs. However, and notwithstanding the activist role of the EDPS in practice, its powers are limited. The story is similar with regard to the European Union Agency for Fundamental Rights (FRA), established in 2007.1047 Its powers are limited and it originally covered Community law only (as was the case with the EDPS).1048 Still in 2017, the FRA could carry out its tasks within the area of ‘judicial cooperation, except in criminal matters’ (emphasis added).1049 This limitation to the agency’s mandate is the offspring of an out-of-date approach to EU actions and cuts the FRA out of a field that is extremely sensitive from a human rights perspective. It is telling that a recent opinion of the agency’s Management Board recommended lifting the current exception for criminal matters and to add police cooperation to the 2018–22 Multi-Annual Framework of the FRA.1050 Despite these calls for extending the FRA’s supervisory activities, however, the Multi-Annual Framework for 2018–22 still provides that judicial cooperation falls within the areas of competence of the FRA with the exception of cooperation in criminal matters.1051 Notwithstanding these limits, the move towards specialised bodies and agencies to monitor data protection and human rights raises the question of ‘agency inflation’, but also the broader question of whether it is desirable to focus predominantly on sectoral agencies as protectors of fundamental constitutional values and rights in the EU rather than mainstreaming such rights in the work of EU institutions and agencies.1052 1046 On the EDPS, see H Hijmans, ‘The European Data Protection Supervisor: The Institutions of the EC Controlled by an Independent Authority’ (2006) 43(5) CML Rev 1313. 1047 Council Regulation (EC) No 168/2007 establishing a European Union Agency for Fundamental Rights [2007] OJ L53, 22 February, 1. For one of the first studies of the potential of the Agency, see P Alston and O de Schutter (eds), Monitoring Fundamental Rights in the EU: The Contribution of the Fundamental Rights Agency (Hart Publishing, 2005). See also GN Toggenburg, ‘The Role of the New EU Fundamental Rights Agency: Debating the “Sex of Angels” or Improving Europe’s Human Rights Performance?’ (2008) 33(3) European Law Review 385. 1048 On the debate regarding extending the mandate of the Agency to the previous third pillar, see House of Lords European Union Committee, Human Rights Protection in Europe: The Fundamental Rights Agency, 29th Report, session 2005–06, HL Paper 155; see also G N Toggenburg, ‘The EU Fundamental Rights Agency: Satellite or Guiding Star?’, SWP Comments 5, March 2007, https://www.swp-berlin.org/publikation/ the-eu-fundamental-rights-agency. 1049 ‘FRA Strategic Plan 2013–2017’, at https://fra.europa.eu/sites/default/files/fra_strategic_plan_en.pdf, 3. 1050 See ‘Opinion of the Management Board of the EU Agency for Fundamental Rights on a new Multi-annual Framework (2018–2022) for the agency’, Vienna, 12 February 2016, 2–3, where the Management Board also reminds that the ‘European Parliament has repeatedly stressed that … police and judicial cooperation in criminal matters has become “standard EU policy”’. 1051 Council Decision (EU) 2017/2268 of 7 December 2017 establishing a Multiannual Framework for the European Union Agency for Fundamental Rights for 2018–2022 [2017] OJ L326, 9 December, 1, art 2(d). 1052 Further proposals for the creation of EU bodies perceived as necessary to counterbalance the emphasis of EU criminal law on enforcement include the creation of a ‘Eurodefensor’, who would monitor the

Conclusion: Extending the Field of Enforcement in the EU? 477

IX. Conclusion: Extending the Field of Enforcement in the EU? A number of attempts have been made to provide neat categories or typologies of EU agencies.1053 This is far from an easy task given the ever-increasing number of European agencies and their diverse mandate. With regard to the constitutional landscape of the pre-Lisbon EU, a distinction was commonly drawn between the Community/Commission agencies (first pillar) and the Union/Council agencies (third pillar).1054 As for the former, although it was difficult to come up with a precise classification, some key functions emerged – most notably functions of information, persuasion and coordination, placed within the more general framework of market regulation in the Community.1055 The question then arose as to whether the criminal law/Union bodies bore similarities with Community agencies. Some of the functions described above could be found – and can still be found – in criminal law bodies in one form or another, in particular: information and strategy (see especially Europol and its threat assessments and situation reports), persuasion (most notably Eurojust and OLAF, in asking national authorities to investigate and prosecute) and coordination (in particular, Europol and Eurojust). However, a major difference between Community agencies and EU bodies dealing with criminal matters came soon to light: the latter’s acts (which can increasingly be deemed ‘operational’) have a significant impact on the position of the individuals in the criminal justice process, the protection of their fundamental rights and their relationship with the state more generally. Acts of criminal law bodies may have consequences such as the deprivation of liberty, and their impact calls for a high level of accountability and judicial control. As with mutual recognition, transposing the features of Community agencies to criminal law may not reflect the reality of action in criminal matters. Market considerations cannot be equated with criminal justice considerations. The recognition of the ‘special nature’ of criminal law came into play in Member States’ choices regarding the establishment, powers and accountability of EU criminal law bodies. As has been noted in the context of Frontex, established in the framework of the then first pillar, delegation in this context was from the Council to the agency and not from the Commission.1056 This certainly applies to criminal law EU bodies (with the exception of OLAF). What was also noteworthy was the avoidance of calling these bodies ‘agencies’: before the adoption of the Regulations, Eurojust was ‘unit’ or a ‘body’

rotection of the rights of the defendant in the EU – see the section on ‘Eurodefensor’ in B Schünemann (ed), p A Programme for European Criminal Justice (Carl Heymanns Verlag, 2006). 1053 For attempts at categorisation, see, inter alia, A Kreher, ‘Agencies in the European Community: A Step towards Administrative Integration in Europe’ (1997) 4(2) Journal of European Public Policy 225; E Chiti, ‘The Emergence of a Community Administration: The Case of European Agencies’ (2000) 37(2) CML Rev 309; Busuioc (n 1) 13–43; Chamon (n 639) 3–51; C Tovo, Le Agenzie Decentrate dell’Unione Europea (Editoriale Scientifica, 2016) 31–66. 1054 Among many others, see Busuioc (n 1) 21–22. 1055 See in particular G Majone, ‘The New European Agencies: Regulation by Information’ (1997) 4(2) Journal of European Public Policy 262; see also M Shapiro, ‘The Problems of Independent Agencies in the United States and the European Union’ (1997) 4(2) Journal of European Public Policy 276. 1056 See D Curtin, ‘Holding (Quasi-)autonomous EU Administrative Actors to Public Account’ (2007) 13(4) European Law Journal 523, 528–29.

478 Bodies, Offices and Agencies of the EU and Europol an ‘office’. This choice of words may be significant in recognising the more ‘intergovernmental’ nature of these bodies, but also in shielding them to the extent possible from accountability mechanisms that they so need. The Lisbon Treaty has brought about significant developments in boosting to some extent the judicial control and accountability of a number of EU criminal law bodies, but also – in the case of Europol and Eurojust – again launching a debate (this time under co-decision) over their role, powers and accountability and their relationship with the national level. Because of pressing political reasons and concerns, the Lisbon Treaty has only been the starting point for similar discussions, which eventually ended up paying too little attention to the Treaty itself in two opposite ways. On the one hand, despite the silence of the Treaties, the strategic role of Europol – which largely affects and steers the development of EU criminal law policy – has been confirmed by the new Europol Regulation, which was adopted pursuant to Article 88 TFEU. The promotion of fundamental criminal justice choices by bodies with limited accountability may lead to the increased depoliticisation of EU criminal law, with highly political decisions assuming the guise of ‘technical’ choices.1057 This may not bode well for achieving the increased legitimacy that further EU action in criminal matters requires. On the other hand, although the Treaty would allow Eurojust to play a more active role in the field of judicial cooperation, the Regulation adopted in 2018 barely enhances the tasks of the agency and, in any case, does not confer upon it any binding power. However, the scenario may change with the future revision of the Europol Regulation. The entry into force of the Lisbon Treaty has opened the door to the establishment of the EPPO, which is the first EU body that directly exercises powers traditionally reserved to the criminal law authorities of the Member States.1058 Several questions arose in relation to the key features of the Office, which show some degree of deference to the Member States’ concerns over losses of sovereignty. In sum, the longstanding battles between Member State and EU interests in the criminal justice field have led to a steady proliferation of EU bodies in the field of criminal law. This proliferation and further development of criminal law bodies may be explained by a number of factors, such as the integrationist vision of certain Member States (see in particular Europol and the EPPO), the need for the Council to ‘tone down’ Commission’s proposals deemed over-ambitious (see the establishment of Eurojust as a response to the EPPO), and the need to be seen to respond to high-profile phenomena such as corruption within the Commission (OLAF), terrorism (Europol, Eurojust, SitCen and the Counter-Terrorism Coordinator), migratory flows (Frontex) and fraud in relation to the EU budget (the EPPO). The establishment of these bodies, as well as the recent amendments to the legal framework of a number of them (especially Frontex and Europol), has contributed and will contribute significantly to the development of EU criminal law.

1057 On this point in relation to agencies in general, see Shapiro (n 1055). On depoliticisation in the context of Frontex, see Mitsilegas (n 1042). An important strategic role is also played by the Counter-Terrorism Coordinator (see section VI above). 1058 See D Flore, ‘A European Public Prosecutor’s Office: Guidelines for the European Agenda’ in Grasso et al (n 723) 705–14 at 706–07.

Conclusion: Extending the Field of Enforcement in the EU? 479 Yet, notwithstanding attempts to develop the mandate of these bodies, their powers remain contested and to some extent unclear. This lack of clarity is even more visible in bodies such as IntCen which have not been established under a clear legal basis. Lack of clarity in the sensitive criminal law sphere is exacerbated by limits to the accountability and judicial control of these bodies – both bodies established by secondary EU legislation (eg, Europol, Eurojust, OLAF and the EPPO), but also, and perhaps more importantly, bodies with no legal basis. The increased emphasis on informality and operational cooperation between bodies poses further challenges for transparency, accountability and legal certainty.1059 This lack of clarity and transparency – and the definition of the mandate of EU criminal law bodies and the terms of their relationship with national authorities in broad terms – may lead to a significant expansion of the enforcement field in the EU. With one glaring and somehow limited exception (the EPPO),1060 rather than replacing national authorities, EU criminal law bodies work with and in addition to national authorities. This implies, first, that the success of the former depends on the support they receive from the latter: although the principle of sincere cooperation should underpin their mutual relations, national authorities are often reluctant to share their information with EU bodies, which are thus prevented from yielding the expected results. Second, cases of investigative or prosecutorial ‘forum shopping’ may occur and at the same time fall short of judicial review at the EU level. Two prime examples of this trend are the assertion by the Court of Justice that the OLAF activities in the Tillack case did not have an impact on the legal position of the applicant, and the exercises by Eurojust to allocate jurisdiction in cases of concurrent jurisdiction on the basis of vague criteria and at informal meetings. The EPPO Regulation poses similar challenges: scrutiny at the EU level on many decisions of the Office has been excluded and risks of ‘forum shopping’ may stem from its power to choose the Member State where investigations and prosecutions should be carried out – yet within the strict limits set out in the Regulation.1061 The extension of the enforcement field is also the outcome of the lack of clarity and overlap between the mandate of the various EU bodies, with a prime example being that Europol and Eurojust are both involved in ‘investigations’ – although the former is supposed to be a police and the latter a judicial/prosecutorial body. This may be the outcome of the differences in national criminal justice systems on the stages of criminal investigations and prosecutions, but at the EU level, they are translated in the expansion of the field of action of EU bodies. In this complex landscape where the boundaries between powers and responsibilities of the different actors become increasingly blurred, it is imperative to avoid the risk of downplaying the protection of fundamental rights.

1059 Highlighting perhaps the point about differences between regulatory market approaches and the criminal law, it is noteworthy that, in the context of the internal market, the so-called ‘Community agencies’ have been perceived as legitimacy providers, contributing to the improvement of transparency in the regulatory process – see R Dehousse, ‘Regulation by Networks in the European Community: the Role of European Agencies’ (1997) 4(2) Journal of European Public Policy 246, 257. 1060 In accordance with the rules provided for by the EPPO Regulation, the EPPO replaces national authorities of participating Member States in the investigations and prosecutions of PIF offences, yet its unique structure and functioning still make it a hybrid body rather than a truly European prosecuting authority (see section V above). 1061 See n 791 above.

9 Databases VALSAMIS MITSILEGAS AND NIOVI VAVOULA

I. Introduction A central pillar of the development of EU criminal law has been the establishment of legal and technical mechanisms aiming at facilitating the processing of personal data,1 particularly in the context of combating terrorism and other serious criminal offences. The possibilities offered by modern technologies for law enforcement authorities to collect, combine and exchange personal data seamlessly and in a timely manner have resulted in the emergence of an elaborate legal framework concerning these different forms of processing personal data. Initiatives in that regard have been twofold: on the one hand, to establish EU-wide centralised information systems (databases); and, on the other hand, to eliminate obstacles to the exchange of personal data among national law enforcement authorities. The competence to adopt legislation in this respect relies upon Article 87(2)(a) TFEU, which provides for the setting-up of information exchange mechanisms which enable the collection, storage, further processing, analysis and exchange of relevant information. Information processing is also significantly boosted by the involvement of the private sector, which is increasingly called to cooperate with the state in the fight against crime. This chapter examines how information is used in the development of EU criminal law and is structured as follows: section II focuses on: (a) the setting-up of databases by looking into the databases established by Europol, the Schengen Information System (SIS) and the Customs Information System (CIS); (b) access by national law enforcement authorities and Europol to EU (Schengen) information systems established for

1 Directive (EU) 2016/680 defines the processing of personal data as follows: ‘any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction’. See Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA [2016] OJ L119/89 (hereinafter the ‘Law Enforcement Directive’), art 3(2).

Centralised Databases 481 immigration-related purposes, specifically the Visa Information System (VIS), Eurodac, the Entry/Exit System (EES) and the European Travel Information and Authorisation System (ETIAS); and (c) efforts to enable information systems to become interoperable. Then, section III examines legal instruments boosting cooperation among national law enforcement authorities through decentralised structures, namely the European Criminal Record Information System (ECRIS), the Swedish Initiative, and the Prüm framework. Next, section IV examines the privatisation of the collection and further processing of personal data focusing on financial, mobility and telecommunications data, as well as electronic evidence. Section V places these developments in the broader context of the EU legal framework on data protection and privacy law, as has emerged particularly in the post-Lisbon Treaty era, where the EU Charter of Fundamental Rights became binding and the right to protection of personal data was recognised as a distinct fundamental right (Article 8), alongside the right to respect for private life (Article 7). Throughout the chapter, the case law of the CJEU (and to a lesser extent that of the ECtHR) safeguarding those rights is analysed. The chapter concludes with an assessment of the significance of the proliferation of EU avenues enabling the processing of personal data for the individual and the state.

II. Centralised Databases A key method of processing personal data in the EU has been the setting-up of EU-wide centralised databases that operate for a wide range of purposes. There are variations in their establishment and operation; for example, the Europol Information System (EIS) is linked to a specific EU law enforcement body,2 whereas the SIS is self-standing.3 The operation of these databases requires a strong element of interaction and contact among national authorities, and presupposes the existence of trust both to the offerings of digital technology and to the national authorities in other Member States as to how they collect and process personal data. Furthermore, the question of which national authorities may access these databases and under which conditions is of primary importance, particularly with regard to databases established for immigration control purposes (VIS, Eurodac, EES and ETIAS) and thus a priori unrelated to law enforcement. In that respect, the established trend is to enable national law enforcement authorities and Europol to conduct searches in these information systems under specific conditions in the course of preventing, detecting and investigating terrorist offences and serious crimes. In addition, efforts to maximise access to information systems have been coupled with calls to enable interoperability among them, particularly in view of the terrorist events that have taken place in the territory of several Member States since 2015.

2 Personal data are also processed by Eurojust and the EPPO. See ch 4. 3 The Schengen Information System, examined below, is maintained by the Schengen Member States. See Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU [2018] OJ L312/56, art 6.

482 Databases Against that background, this section examines the establishment of and synergies among EU-wide databases broadly operational in the field of police cooperation in criminal matters.

A. Europol The legal framework underpinning Europol’s mandate and operations, including the relevant provisions on the Europol data analysis and its databases, has been analysed in detail in Chapter 8. For the purposes of this chapter, the analysis will focus on the evolution of the legal framework on personal data processing and the increasing powers of the agency in that respect. From the outset, it should be recalled that as an ‘enormous data processing agency rather than a law enforcing police office’,4 a central task of Europol is to ‘collect, store, process, analyse and exchange information, including criminal intelligence’.5 Prior to the adoption of Regulation (EU) 2016/794 (hereinafter the ‘Europol Regulation’),6 Europol’s information architecture comprised separate information systems enabling the storage and analysis of personal data, the EIS and the analysis work files (AWFs).7 Operational since 2005,8 the EIS was developed to interconnect the computerised networks of the national authorities of the Member States with Europol and enable the insertion and retrieval of data from it. Article 12(1) of the Europol Decision prescribed that the data inserted in the EIS ought to be necessary for the performance of Europol’s tasks and relate to persons suspected of having committed, having taken part in or having been convicted of criminal offences pursuant to the national law of the Member State that provided the information concerned and in respect of which Europol was competent. Furthermore, an entry in the EIS could be possible where there existed ‘factual indications or reasonable grounds to believe that a person will commit criminal offences’.9 This marked a considerable expansion of the requirements to be fulfilled in order to register personal data into the EIS, as Article 8 of the Europol Convention required ‘serious grounds’ for recording

4 Sabine Gless, ‘Europol’ in Valsamis Mitsilegas, Maria Bergström and Theodore Konstadinides (eds), Research Handbook on EU Criminal Law (Edward Elgar, 2016) 457–79, at 465. 5 Europol Regulation, art 4(1)(a). 6 Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council D ecisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA [2016] OJ L135/53 (hereinafter the ‘Europol Regulation’). 7 The two databases were developed pursuant to the Convention based on Art. K 3 of the Treaty on the European Union, on the establishment of a European Police Office [1995] OJ C316/1, art 6 (hereinafter the ‘Europol Convention’). See arts 13–14 of the Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol) [2009] OJ L131/37 (hereinafter the ‘Europol Decision’). An index system was also foreseen to enable finding AWFs. In addition, a secure information exchange tool, the Secure Information Exchange Network (SIENA), connects the Member States via the Europol national units and the Europol liaison bureaus. 8 But all Member States started using the EIS in 2008. See House of Lords, submission by Europol, Select Committee on European Union, Call for Evidence, File no 3100–174 (28 April 2008) 18. 9 Europol Decision, art 12(1)(b).

Centralised Databases 483 personal information into the EIS.10 In addition to basic personal information (name, place of birth, nationality and sex), as prescribed by the Europol Convention, the Europol D ecision extended the categories of data by enabling recording of additional data such as an individual’s social security number, driving licence, their whereabouts, profession and, where necessary, biometric information such as fingerprints and DNA profiles.11 Additional data relating to the particulars of criminal offences, the means used to commit such offences, the suspected membership of a criminal organisation or convictions of the past were also foreseen.12 As for AWFs, which could be created for specific crime areas, Article 14 of the Europol Decision allowed the storage and further processing of broader information so as to provide operational analysis for investigations carried out by the Member States or more general analysis of a strategic nature. In addition to information on persons referred to above, AWFs could include data about witnesses, victims, contacts and associates, as well as data on persons who can provide information on the criminal offences under consideration.13 In contrast to the EIS, the Europol Decision did not further specify the types of data that may be recorded in an AWF, but Council Implementing Decision 2009/936 laid down no fewer than 69 categories of personal data.14 Finally, Article 10 of the Europol Decision allowed the establishment of other data processing systems, provided that the new data processing system would comply with the Decision.15 Data stored in the EIS could be investigated and accessed by Europol officials, Member States liaison officers and seconded national experts, as well as liaison officers from third states.16 However, access to AWFs was more limited.17 The retention period of data would initially be for three years, after which an annual review must take place, but data may be stored for as long ‘as it is necessary for the performance of its tasks’.18 Overall, the EIS and AWFs were legally separated and operated for different purposes and under distinct rules concerning access and use, and Europol could not link or cross-examine data from the different databases.19

10 Francesca Boehm, Information Sharing and Data Protection in the Area of Freedom, Security and Justice: Towards Harmonised Data Protection Principles for Information Exchange at EU-Level (Springer, 2013) 183. However, see art 12(5) of the Europol Decision, which stipulated that in case Europol entered the information itself and gave a filing reference, Europol had to specify the source of the information and that the entries had to be deleted if proceedings against the person concerned are ‘definitively dropped or if that person is definitively acquitted’. Nonetheless, as Boehm notes, a provision protecting the data relating to possible c riminals who have never committed a crime and may never be subject to investigations or court proceedings was missing. 11 Europol Decision, art 12(2). 12 ibid art 12(3). 13 However, it is worrying that data about totally innocent persons who have never been suspected of having committed a crime are processed in the same AWF as data about persons under art 12 (1) of the Europol Decision, the latter mostly being suspects or offenders. See Boehm (n 10) 188. 14 Council Decision 2009/936/JHA of 30 November 2009 adopting the implementing rules for Europol analysis work files [2009] OJ L325/14. 15 This would be subject to the approval of the Council, but this Decision was adopted pre-Lisbon, so the involvement of the European Parliament was not foreseen. 16 Europol Decision, art 13. 17 ibid arts 14(2) and 14(4). 18 ibid art 20(1). 19 Florin Coman-Kund, ‘Europol’s International Exchanges of Data and Interoperability of AFSJ Databases’ (2020) 26(1) European Public Law 181, 182. See EDPS, ‘Opinion of the European Data Protection Supervisor

484 Databases The Europol Regulation has adopted a new, simplified ‘privacy by design approach’20 so as to allow Europol to link and make analyses of relevant data, reduce delays in identifying trends and patterns, and reduce multiple storage of data.21 No reference to pre-defined databases is made and a new integrated data management strategy has been introduced, whereby the rules for information processing relate to the data rather than the systems of databases used to store them.22 In order to provide a data processing environment that will support Europol analysts in performing their tasks, emphasis is no longer placed on the regulation of Europol’s databases, but rather on the specific purposes of information-processing activities, the sources of information and the bodies that may access the relevant data. In particular, Article 18 of the Europol Regulation enables Europol to process personal data ‘in so far as necessary for the achievement’ of its objectives, which are:23 (1) cross-checking aimed at identifying connections or relevant links between information relating to suspected or convicted criminals – the wording used here replicates the categories of persons whose data could be inserted in the EIS, as outlined above; (2) strategic or thematic analyses; (3) operational analyses; (4) facilitating exchanges of information between Member States, Europol and other EU bodies, as well as third countries and international organisations.24 Annex II of the Europol Regulation laid down the categories of personal data that may be collected for the purpose of data processing.25 Whereas the basic rules on the retention period of stored data, as stated above, remain,26 it is also foreseen that in cases when storage exceeds a period of five years, the European Data Protection Supervisor (EDPS), who supervises the work of Europol,27 shall be informed accordingly.28 Moreover, the Europol Regulation includes safeguards concerning the processing of special categories of personal data, particularly data on victims, witnesses, minors and sensitive data, such as that revealing a person’s racial or ethnic origin.29 However, biometric data are not listed as a special category.30 Finally, rules on the role and tasks of the Data Protection

on the Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA’ (31 May 2013) 8–9. 20 Europol Regulation, art 33. 21 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and Repealing Decisions 2009/371/ JHA and 2005/681/JHA’ COM (2013) 173 final, 8. 22 Europol, ‘Europol Strategy 2016–2020’ (19 May 2016), https://www.europol.europa.eu/publicationsdocuments/europol-strategy–2016–2020, 12. 23 Europol Regulation, art 18(1). 24 For the purposes of objectives (2)–(4), personal data may also be collected in relation to witnesses, victims, contacts and associates and persons who can provide information on the criminal offences under consideration. 25 This replicates the provisions of art 12 of the Europol Decision and the Council Implementing Decision 2009/936/JHA. 26 Europol may decide upon their continued storage even when erased by the original source. See Europol Regulation, arts 31(4) and 31(5). 27 ibid art 43; see also arts 44–45. This includes a complaints procedure for citizens under EU law (see art 47). 28 ibid art 31(3). 29 ibid art 30. 30 See Florin Coman-Kund, ‘Europol’s International Exchanges of Data and Interoperability of AFSJ Databases’ (2020) 26(1) European Public Law 181, 193.

Centralised Databases 485 Officer (DPO)31 and further transfer of Europol data to EU bodies or outside the EU are also foreseen.32 This new data processing paradigm has provided a wider degree of flexibility and increased information-related powers to Europol. However, it has raised significant concerns as regards the transparency of personal data processing and the purpose limitation principle; the structure of databases that operate in silos is precisely aimed at safeguarding that principle by preventing the linking of data and the building of comprehensive profiles about individuals.33 By removing the restrictions of architectural infrastructure, the Europol Regulation has paved the way for the creation of an overarching EU database of criminal data and criminal intelligence34 without detailing how the purpose limitation principle will be safeguarded. Operational effectiveness remains the key goal so that links between data and behavioural patterns may be discerned. Furthermore, Europol may obtain information from various sources:35 Member States,36 EU bodies, third countries, international organisations37 and private parties or persons in accordance with the rules and procedures provided for in Article 17 of the Europol Regulation.38 However, Europol may also retrieve and process information – including personal data – both from publicly available sources and, if allowed by specific legal instruments, from EU, international and national information systems.39 The wide range of information collected and analysed by Europol has extended via its growing cooperation with third countries, and EU and third bodies with which numerous agreements have been adopted, as outlined in Chapter 8.40 Such agreements have been concluded with third countries in the vicinity of the EU, as well with global partners, such as the US,41 Australia, Canada and Colombia. Over the years, Europol has concluded a number of agreements with EU bodies, including the European Union Agency for the Criminal Justice Cooperation (Eurojust), the European Anti-Fraud Office (OLAF), the European Union Agency for Law Enforcement Training (CEPOL), the European Union Agency for Law Enforcement Training (EBCG/Frontex), the European Union Intellectual Property Office (EUIPO), the European Commission, the European Central Bank 31 Europol Regulation, art 41. 32 ibid arts 24–26. It is beyond the scope of this chapter to discuss the fundamental rights concerns of international data transfers of Europol. See Coman-Kund (n 30). 33 Fanny Coudert, ‘The Europol Regulation and Purpose Limitation: From the “Silo-Based Approach” to … What Exactly?’ (2017) 3(3) European Data Protection Law Review 313. 34 ibid. 35 Europol Regulation, art 17. See art 19 regarding the delimitation of purposes for which the information may be used. On access to Europol data by Member States or other EU bodies, see arts 20–21. 36 In accordance with national law and ibid art 7. 37 In accordance with ibid ch V. 38 ibid art 27. 39 ibid art 17(2) and (3) respectively. 40 For an overview on Europol’s mandate as regards international cooperation, see Florin Comin-Kund, ‘Europol’s International Cooperation between “Past Present” and “Present Future”: Reshaping the External Dimension of EU Police Cooperation’ (2018) 2(1) Europe and the World: A Law Review 1. 41 For details on the Europol-USA Agreement, see Valsamis Mitsilegas, ‘The New EU-US Co-operation on Extradition, Mutual Legal Assistance and the Exchange of Police Data’ (2008) 8 European Foreign Affairs Review 515. These agreements must be distinguished from the strategic agreements that Europol has concluded with Russia, China Turkey and the United Arab Emirates, which explicitly exclude the exchange of personal data and enable the exchange of information in a broader sense, which may include criminal investigation or crime prevention methods.

486 Databases and the European Public Prosecutor’s Office (EPPO).42 As for the conditions and rules underpinning the exchange of personal data with its partners, these are laid down in Article 23 of the Europol Regulation. It is noteworthy that according to Article 17(3) of the Europol Regulation, where data are retrieved from EU, international or national legal instruments, those instruments will prescribe access and use of that information by Europol, insofar as they provide for stricter rules on access and use than those laid down by the Europol Regulation. This is a rather ambiguous rule43 that could have wide implications, for example, as regards biometric data which the Europol Regulation does not recognise as special categories of data and could thus be processed without additional safeguards. Therefore, on the one hand, it could be argued that if data are retrieved from other systems, Europol should treat that in accordance with the rules governing the systems from which the data originate. On the other hand, it could equally be argued that the lack of an explicit provision safeguarding biometric data as a special category of personal data raises concerns regarding their use in a data-driven analysis.44 As for Europol’s relations with third countries and international organisations, prior to the entry into force of the Lisbon Treaty, Europol had concluded 16 ‘operational’ agreements and four ‘strategic’ agreements,45 with third countries and some international organisations, namely the World Customs Organization and the United Nations Office on Drugs and Crime (UNODC), as well as with Interpol. However, in the aftermath of the Lisbon Treaty, the power to conclude international agreements rests only with the Council, in accordance with Article 218 TFEU. Therefore, Europol may exchange information, including personal data, with third countries and international organisations on the basis of the Council’s agreements, which should adduce ‘adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals’.46 However, three further options are available. First, Europol may exchange information with international partners pursuant to previously signed operational agreements,47 which remain valid.48 Second, information with third countries or international organisations can also be exchanged if the Commission has adopted an ‘adequacy decision’.49 Finally, the Executive Director can authorise the transfer of personal data to third countries and international organisations on a case-by-case basis for certain exceptional – but arguably broadly worded – reasons.50 As for private parties and private persons, Europol may exchange information, including personal data, with them in accordance with the stringent conditions51 42 The text of these agreements, as well as a list of all Europol’s partners, may be found at: https://www. europol.europa.eu/partners-agreements. 43 Coman-Kund (n 19) 193. 44 Teresa Quintel, ‘Interoperable Data Exchanges within Different Data Protection Regimes: The Case of Europol and the European Border and Coast Guard Agency’ (2020) 26(1) European Public Law 205, 213–14. 45 Europol’s international dimension has been examined in depth by Florin Coman-Kund, European Union Agencies as Global Actors: A Legal Study of the European Aviation Safety Agency, Frontex and Europol (Routledge, 2018) 274–328. 46 Europol Regulation, art 25(1)(b). 47 ibid art 25(1)(c). 48 ibid art 25(4). 49 ibid art 26(1)(a). 50 ibid art 25(5). 51 ibid Recital 23.

Centralised Databases 487 provided for in Articles 26 and 27 of the Europol Regulation. In particular, personal data from private persons and bodies may be processed as far as they are received via Europol National Units (ENUs) or via a contact point or a competent authority of a third country which is subject to an adequacy decision of the Commission, or with which an (operational) agreement has been signed (either by Europol or by the Council).52 In addition, Europol should not contact private parties and persons to retrieve information.53 In exceptional circumstances, and on a case-by-case basis, Europol can transfer personal data only to private parties (even if established outside the EU), but not to private persons.54 As the EU criminal information hub, safeguarding the rights to respect for private life and the protection of personal data is crucial. Europol is subject to an autonomous data protection regime, which applies to its work as lex specialis. Overall, the Europol Regulation distinguishes between processing of operational personal data (for the purpose of attaining the agency’s objectives) and non-operational or administrative personal data55 – Europol’s data protection safeguards are applicable to the former group only. As for the latter group, the general data protection rules under Regulation (EU) 2018/1725 on the processing of personal data by EU institutions, bodies, offices and agencies, which replaced Regulation 45/2001, apply.56 However, Europol’s special regime should take into account the principles upon which Regulation 2018/1725 is based57 and be consistent with other relevant legal instruments applicable in the area of police cooperation. Yet, the enforcement of these provisions is ambiguous, given that Regulation 2018/1725 clearly stipulates that it does not apply to Europol.58 Although the above analysis has demonstrated that the Europol regime raises significant privacy and data protection concerns, there have also been some improvements to the underlying data protection rules. The Europol Convention contained a number of data protection rules, such as the existence of right to access to the system59 and provided the legal basis for the establishment of a Joint Supervisor Body (JSB) for data protection,60 although with limited powers.61 Then, the Europol Decision called for the establishment of a DPO without introducing any further important changes with regard to data protection safeguards. The reform in Europol’s mandate via the Europol

52 ibid arts 26(1) and 27(1). 53 ibid arts 26(9) and 27(4). 54 Compare art 26(5) and (6) with art 27(5) of the European Regulation. 55 Europol Regulation, Recital 53 and art 46. 56 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC [2018] OJ L295/39. 57 Europol Regulation, Recital 30. Yet based on Recitals (12)–(13) and art 98 of Regulation 2018/1725, the Commission shall review the Europol Regulation by 30 April 2022 with a view to applying ch IX on processing of operational data to the Agency. 58 Regulation (EU) 2018/1725 2(3). 59 Europol Decision, art 9. 60 ibid art 24. 61 This is particularly the case when Europol concludes agreements with third states or bodies, whereby the Europol Joint Supervisory Body had the mandate to give an Opinion on the adequacy of data protection in the third state/organisation involved, but does not have the power to block the agreement from going ahead.

488 Databases egulation has been accompanied by increased data protection safeguards, such as R the explicit reference to the principle of ‘privacy by design’62 and the supervision by the EDPS, which enhances the transparency of Europol’s operations. The fruits of this supervision are already visible; on 17 September 2020, the EDPS found that the way in which operational analyses of Europol is conducted on the basis of large amounts of information (so-called big data) which is stored for several years is not supported by its legal framework and goes against the data minimisation principle.63 Indeed, Article 18(3) of the Regulation requires the determination of, inter alia, the categories of personal data and the categories of data subjects, both of which are further circumscribed by Article 18(5). The EDPS admonished Europol, in a bold move that has sent shockwaves through the agency, the core work of which is based on the processing of large datasets.64 As mentioned in Chapter 8, on 9 December 2020, the Commission presented a proposal for a Regulation amending the Europol Regulation,65 which aimed at enhancing the Europol’s mandate in numerous respects. The proposal encompasses widespread reforms to Europol’s data processing tasks, which will radically transform the nature and powers of Europol and its relationship with key stakeholders.66 In particular, a first set of revisions concerns the enhancement of cooperation between Europol and private parties in countering criminal offences committed in abuse of the cross-border services of private parties. Currently, according to Article 26 of the Europol Regulation, Europol is allowed to exchange personal data with private parties, subject to a series of restrictions: the traditional way for the agency to receive personal data from private parties is indirectly via competent intermediaries and Europol is prohibited from transferring personal data directly to private parties, unless one of the three exceptions applies. The proposal aims to establish the agency as a central point of contact in cases of multijurisdictional or non-attributable datasets, Europol will be enabled to receive personal data directly from private parties on a more regular basis, inform such private parties of missing information and ask Member States to request private parties to share further information. In addition, it will be able to provide its infrastructure for the exchange of data between national authorities and private parties, and support Member States in preventing the large-scale dissemination of terrorist content or violent extremism. 62 Europol Regulation, art 33: ‘Privacy by design must be understood as the inclusion of appropriate technical and organisational measures and procedures in such a way that the data processing will comply with the Regulation and protect the rights of the individuals concerned.’ 63 EDPS, ‘EDPS Decision of 17 September 2020 relating to EDPS’ own initiative inquiry on Europol’s big data challenge’ (2020). According to the EDPS, the handling of large datasets for analysis work (and beyond that for all operational processing purposes based on art 18(5) in connection with art 18(2) of the Europol Regulation) does not include the process to identify and segregate relevant data from large datasets, but has to commence on the basis of pre-sifted information containing only information of data subject categories of Annex II. 64 Council, Document 11512/20 (9 October 2020). 65 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation’ COM (2020) 796 final (hereinafter the ‘Proposal for a revised Europol Regulation’). 66 For an analysis, see Niovi Vavoula and Valsamis Mitsilegas, ‘Strengthening Europol’s Mandate: A Legal Assessment of the Commission’s Proposal to Amend the Europol Regulation’ (Study for the LIBE Committee of the European Parliament, 2021).

Centralised Databases 489 These changes constitute a considerable paradigm shift for the agency, which is in line with the emergence of the trend in past years, to establish direct channels of communication between law enforcement and private parties, and foster a public/private partnership. Questions about the ability of private parties to undertake the role of law enforcement authorities in fully and effectively scrutinising the fundamental rights implications of transfer of personal data held by them for the purposes of law enforcement emerge, as Europol will be enabled to forward requests on behalf of Member States and proactively request information. Private parties do not enjoy equality with public authorities in terms of cooperation and the same will also apply in the case of Europol. Therefore, they may find themselves in a subordinate position, being ‘cornered’ by both Europol and Member States to hand over the personal data requested. Important safeguards, in particular obtaining prior judicial authorisation and scrutiny of compliance with fundamental rights, risk being bypassed. Applying this approach to the case of Europol requires detailed rules on the duties of Europol, Member States and the private sector (eg, when the private parties may refuse to cooperate) as well as provisions on independent authorisation of transfers and remedies for individuals, which are missing from the proposal. Whereas certain safeguards are included (eg, the requirement for ‘absolute’ or ‘strict’ necessity), the EDPS could be involved before the agency makes such transfers. Finally, it must be ensured that Europol’s role in supporting Member States to prevent the dissemination of online content relating to terrorism and violent extremism conforms with Europol’s role as foreseen in Regulation (EU) 2021/784 on preventing the dissemination of terrorist content online.67 Furthermore, in order to address the so-called ‘big data challenge’ following the admonishment of the agency by the EDPS on 17 September 2020, the proposal aims to enable Europol to conduct ‘pre-analyses’ of large and complex datasets received and identify whether these concern individuals whose personal data may be processed by Europol68 in line with Annex II of the Europol Regulation. Another proposed provision aims to enable the pre-analysis in support of a criminal investigation following transmission of an investigative case file to Europol. Overall, it is welcome that the prior processing is limited to a maximum period of one year, which can be extended following authorisation by the EDPS. A suggestion is to define the terms ‘large datasets’ and ‘digital forensics’, and explicitly delimit processing when there is an objective necessity, which is not mentioned, so as to ensure that the derogation of Article 18(5a) does not become the rule. Clear criteria to determine that it is justified to extend the maximum period of pre-analysis must be laid down and it could be useful to consider that prior to each pre-analysis, the EDPS must be at least informed and that the Europol DPO must provide authorisation. The relationship between the new rules and the existing derogation under Article 18(6) of the Europol Regulation must also be clarified, as well as the relationship between the two new provisions that are foreseen. As these rules constitute an exception, their application must be strict, and the existence of a link to an ongoing

67 Regulation (EU) 2021/784 of the European Parliament and of the Council of 29 April 2021 on addressing the dissemination of terrorist content online [2021] OJ L172/79. 68 Commission (n 65) art 18(5)a.

490 Databases investigation is crucial. In addition, the Regulation should lay down certain conditions and/or thresholds, such as the scale, complexity, type or importance of investigations. Finally, the involvement of the EDPS not only in cases where an investigative case file is submitted by a third country, but also in general in supervising the processing of large and complex datasets should be maintained and enhanced. Moreover, the proposal foresees a greater role for Europol as regards processing of personal data for research and innovation matters for the development of tools, including the use of AI for law enforcement.69 However, it is necessary to be mindful that when developing new technologies, extensive processing of large quantities of personal data may be required – for example, to create and test algorithms or for encryption. Therefore, the potential impact of such processing for research and innovation purposes to the principle of non-discrimination and the rights to respect for private life and protection of personal data must be guaranteed. The processing of personal data for research and innovation should take place only if needed in order to reach the objectives of the project. Furthermore, the processing of synthetic, anonymised or pseudo-anonymised personal data, as opposed to real operational data, must be preferred where possible, and the processing of special categories of personal data must be explicitly excluded or accompanied by additional safeguards. Moreover, principles of data protection law – in particular, the principles of data minimisation, data quality and privacy by design and by default – must be taken into account. Another important reform concerns cooperation with third countries by enabling the Executive Director to authorise not only transfers, but also ‘categories of transfers of personal data’ to third countries or international organisations in specific situations and on a case-by-case basis.70 However, it is not clear what exactly is meant by ‘categories of transfers’ and this reform may broaden the remit of such transfers from criminal investigations on specific suspects to surveillance activities in general, thus changing Europol’s powers. That said, within the Council, Member States have expressed their wish to further expand Europol’s capabilities to exchange personal data with third countries by transplanting the wording of Directive (EU) 2016/680 (hereinafter the ‘Law Enforcement Directive’) and Regulation (EU) 2018/1727 (hereinafter the ‘Eurojust Regulation’)71 to the Europol legal framework, and creating a new legal ground for exchanges of personal data on the basis of appropriate safeguards outside the three already-prescribed grounds. This reform bypasses existing institutional safeguards and undermines the importance of an adequacy decision, the procedure for assessing the data protection framework of a third country as adequate in violation of the constitutional limits placed by the CJEU,72 and the institutional framework for adopting international agreements. Finally, a positive development of the proposal is the enhancement of Europol’s data protection framework by extending the reach of Article 3 and Chapter IX of

69 ibid art 33a. 70 ibid art 1(11) and Recital 24. 71 Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA [2018] OJ L295/138. 72 Case C-362/14, Maximillian Schrems v Data Protection Commissioner, ECLI:EU:C:2015:650.

Centralised Databases 491 egulation (EU) 2018/1725 concerning the data protection framework applicable to R the processing of personal data by EU institutions, bodies and agencies to the work of Europol and explicitly adding biometric data within special categories of personal data. Whereas this is a welcomed reform, further alignment is necessary, not least because the general powers of the EDPS are still not aligned with the prescriptions of Article 58 of Regulation (EU) 2018/1725. Overall, the proposal entails widespread reforms to Europol’s mandate, which transform the nature of the agency and its relationship with the Member States. This massive expansion of Europol’s powers is explained; Europol’s ability to bring about results is tightly related to Member States’ input and participation, and research shows the reluctance of national authorities that were, and are, sometimes not very keen to share their data with the agency. As a result, the proposal wishes to bypass such reluctance by enabling the agency to directly ‘deal the cards’ and centralise information processing. At the same time, certain operational reforms (particularly the SIS-related ones) have been met with greater scepticism, albeit without an outright dismissal. At the time of writing, the negotiations are ongoing and it remains to be seen whether the Parliament will success in adding further safeguards to circumscribe these additional powers and enhance its own role.

B. The SIS At the ‘heart of the compensatory measures designed to play a key role in minimising the deficits of the abolition of internal border controls’73 is the SIS,74 the oldest information system in the Schengen Area.75 The legal framework of this system has been amended multiple times and the following sections will provide an overview of the evolution of its legal framework.

i. The Early Years Established by the Convention Implementing the Schengen Agreement (CISA),76 which was incorporated into EC/EU law by the Amsterdam Treaty,77 the SIS became 73 Bernd Schattenberg, ‘SIS: Privacy and Legal Protection’ in Henry Schermers et al (eds), Free Movement of Persons in Europe: Legal Problems and Experience (Martinus Nijhoff, 1993) 45. 74 This section updates and expands Valsamis Mitsilegas, ‘Databases in the Area of Freedom, Security and Justice’ in Constantin Stefanou and Helen Xanthaki (eds), Towards a European Criminal Record (Cambridge University Press, 2008) 311–335; see also Niovi Vavoula, Immigration and Privacy in the Law of the European Union: The Case of Information Systems (Brill Nijhoff, forthcoming, 2022). 75 At the time of writing, SIS II is operational in 30 states (including EU/Schengen Member States and associated Schengen states). Ireland and Cyprus are not yet connected to SIS II. Bulgaria and Romania operate SIS II, though they are not fully fledged Schengen states, and in Croatia there are certain restrictions regarding its use of alerts for the purposes of refusing entry into or stay in the Schengen Area. Until 31 December 2020, the UK operated SIS II for the purpose of law enforcement cooperation only. 76 Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders [2000] OJ L239/19 (CISA). 77 A particularly controversial issue concerned the allocation of a legal basis for every instrument of the Schengen acquis in view of its incorporation into the EU/EC legal order. For an analysis, see Steve Peers,

492 Databases operational in 1995 with the overarching purpose of ensuring a high level of security in the Schengen Area by facilitating both border control and police investigations. By default, the system is designed to perform as a hybrid instrument: on the one hand, as a tool for police and judicial cooperation in criminal matters; and, on the other hand, as an instrument for immigration and border control. In that respect, the SIS enables Member States to register personal data in the form of alerts on various categories of persons and objects,78 namely on foreigners who should be denied entry or stay in the Schengen Area,79 persons wanted for extradition to a Schengen state,80 missing persons,81 persons wanted as witnesses or for the purposes of prosecution or the enforcement of sentences,82 persons or vehicles to be subject to discreet or specific checks,83 as well as objects sought for the purpose of seizure or use in criminal proceedings.84 In its early years, each SIS alert was composed of a limited set of personal data, such as biographical details (eg, name, sex and nationality), any specific objective physical characteristics not subject to change, whether persons concerned are armed, violent or have escaped, and the reason for the alert.85 National competent authorities could search the system through an automatic, direct query procedure to check whether an individual or an object had been registered in the SIS and what action needed to be taken in accordance with the alert.86 In effect, the SIS had limited capacities as it operated on a hit/ no-hit basis and was thus was no more than a reporting system for Member States. As a result, an auxiliary system named SIRENE was set up in every participating country, which provided the infrastructure for exchanging additional information to that held in the SIS, as well as facilitating the exchange of police information taking place outside the SIS.

ii. The Second-Generation SIS (SIS II) The challenge of adaptation of candidate countries to SIS standards (and their participation to the SIS after their accession to the EU) was also particularly complex in light of efforts by the Schengen members to develop further the system, in order for the latter to respond to both events such as terrorist attacks and to technological advances.

‘Key Legislative Developments on Migration in the European Union: SIS II’ (2008) 10 European Journal of Migration and Law 77; Niels Bracke, ‘Flexibility, Justice Cooperation and the Treaty of Amsterdam’ in Clotilde Marinho (ed), Asylum, Immigration and Schengen Post-Amsterdam (EIPA, 2001) 59. 78 For further details, see House of Lords European Union Committee, ‘Schengen Information System II (SIS II)’ (9th Report, session 2006–07, HL Paper 49); see also Steve Peers, EU Justice and Home Affairs Law, 2nd edn (Oxford University Press, 2006) 547–49; Constantin Stefanou, ‘Organised Crime and the Use of EU-Wide Databases’ in Ilias Bantekas and Giannis Keramidas (eds), International and European Financial Law (Butterworths, 2006) 224–25. 79 CISA, art 96. 80 ibid art 95. 81 ibid art 97. 82 ibid art 98. 83 ibid art 99. 84 ibid art 100. 85 ibid art 94(1). 86 For example, an alert on a person wanted for extradition purposes would require the national authorities to arrest that person.

Centralised Databases 493 articular aims of proposals to develop the SIS have been to extend the data included P in the database and to broaden the categories of national authorities having access to Schengen data. A significant step towards the achievement of the latter goal has been made on the basis of counter-terrorism considerations: in 2004, the Council adopted a first pillar Regulation and a third pillar Decision concerning the introduction ‘of some new functions for the Schengen Information System, including in the fight against terrorism’.87 The Regulation extended access to SIS data to national judicial authorities, and access to immigration data specifically to authorities responsible for issuing visas and residence permits and for examining visa applications. The Decision extended access to certain categories of ‘criminal law’ SIS data to Europol and Eurojust. In the meantime, a broader debate on the nature and development of the system was taking place in the context of discussions on the establishment of a so-called secondgeneration SIS (SIS II). In May 2005, the Commission tabled three draft legislative proposals (two first pillar Regulations and one third pillar Decision, reflecting the fact that the SIS covers both immigration and criminal law data), which would constitute the legal basis for the establishment of SIS II.88 This resulted in the formal adoption of the Regulations in 200689 and the adoption of the third pillar Decision some months later.90 However, due to delays in the operational development of SIS II, it was decided that at the first stage, Member States will be integrated in a developed version of the original SIS (SIS1+), a proposal called ‘SISone 4all’.91 Following significant delays in the operational development,92 SIS II launched in April 2013. In the meantime, the management of SIS II was not given to the Commission, but after a transitional period to a ‘Management Authority’.93 The Commission had the interim operational management of the system,94 but in reality the Commission had delegated the management to France and Austria, where the back-up of the system is located.95 The Management Authority has since been replaced by the European Union Agency for the Operational

87 Council Regulation (EC) 871/2004 concerning the introduction of some new functions for the Schengen Information System, including in the fight against terrorism [2002] OJ L162/29; Council Decision 2005/211/ JHA of 24 February 2005 concerning the introduction of some new functions for the Schengen Information System, including in the fight against terrorism [2005] OJ L68/44 88 Commission, ‘Proposal for a Council Decision on the establishment, operation and use of the second generation Schengen Information System’ COM (2005) 230 final; ‘Proposal for a Regulation on the establishment, operation and use of the second generation Schengen Information System’ COM (2005) 236 final; ‘Proposal for a Regulation regarding the access to SIS II by the services of Member States responsible for issuing vehicle registration certificates’ COM (2005) 237 final. 89 Regulation 1987/2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II) [2006] OJ L381/4 (hereinafter the ‘SIS II Regulation’); Regulation 1986/2006 regarding access to the second generation Schengen Information System (SIS II) by the services in the Member States responsible for issuing vehicle registration certificates [2006] OJ L381/1. 90 Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II) [2007] OJ L205/63 (hereinafter the ‘SIS II Decision’). 91 Council, Document 15801/06 (11 December 2006) 20–22. For further details, see Peers (n 77) 79–81. 92 See Joanna Parkin, ‘The Difficult Road to the Schengen Information System II – The Legacy of Laboratories and the Cost for Fundamental Rights and the Rule of Law’, CEPS, 2011. 93 SIS II Decision, art 15. See SIS II Regulation, art 15. 94 SIS II Decision, art 15(3). See SIS II Regulation, art 15(3). 95 Peers (n 77) 86.

494 Databases Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA).96 The provisions of the SIS II Regulation were largely mirrored in the third pillar Decision. Article 20(1) of the SIS II Decision prescribed that Member States may record alerts in respect of: (a) persons wanted for arrest for surrender purposes on the basis of a European Arrest Warrant97 or wanted for arrest for extradition purposes;98 (b) missing persons and those who need to be placed under protection;99 (c) persons sought to assist with a judicial procedure – in particular, witnesses, persons summoned or persons sought to be summoned to appear before the judicial authorities in connection with criminal proceedings; (d) persons who are to be served with a criminal judgment or other documents in connection with criminal proceedings, and or to be served with a summons to report in order to serve a penalty involving deprivation of liberty;100 and (e) persons subject to discreet checks or specific checks.101 A number of data on objects are included in the system.102 Alerts on persons entered in the SIS II are retained only for the time required to achieve the purpose for which they were entered.103 The need to keep an alert in the system must be reviewed by the Member State issuing the alert within three years of its registration.104 Member States may decide to keep the alert longer, following a ‘comprehensive individual assessment’105 – they may also decide to have shorter review periods.106 If data is no longer needed, alerts are automatically erased after the expiry of the review period.107 According to latest statistics, until 31 December 2019, the SIS II contained 91,069,599 alerts, with the largest category being ‘issued document’, with over 75.5 per cent of the total alerts. The alerts on persons were 983,124, the majority of which involved undesirable third-country nationals to be refused entry or stay in the Schengen Area (527,099).108 A major change in the SIS legal framework involved the nature and use of personal data included in the system. Both the SIS II Regulation and the Decision provide the legal basis for the inclusion of biometric identifiers, in the form of photographs and

96 Regulation (EU) No 1077/2011 of the European Parliament and of the Council of 25 October 2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice [2011] OJ L286/1, as repealed by Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice, and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011 [2018] OJ L295/99. 97 Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States [2002] OJ L190/1. 98 SIS II Decision, arts 26–31. 99 ibid arts 32–33. 100 ibid arts 34–35. 101 ibid arts 36–37. 102 In relation to objects required for discreet checks, see ibid arts 36–37; as regards objects for seizure or use as evidence in criminal proceedings, see arts 38–39. 103 ibid art 44(1). 104 ibid art 44(2) – the retention period would be one year for alerts issued for the purposes of discreet checks. 105 ibid art 44(4). 106 ibid art 44(3). 107 ibid art 44(5). 108 Eu-LISA, ‘SIS II – 2019 Statistics’ (March 2020).

Centralised Databases 495 fingerprints, in SIS II.109 The provisions on the use of biometrics – the use of which has been generalised in both EU and national databases – are extremely significant in this context.110 Article 22 of the SIS II Decision foresaw that at the first stage, biometrics would be used only for ‘one-to-one’ searches, seeking to confirm someone’s identity by comparing the biometric identifiers of the person only with those existing in SIS II under this person’s name; however, at the second stage and following the presentation by the Commission of a report on the availability and readiness of the required technology, biometrics would also be used for ‘one-to-many’ searches, where biometric data of one person will be compared with the whole SIS database.111 The introduction of biometrics had been stalled until March 2016, when the Commission released the report, setting mid-2017 as the deadline for implementing the new functions.112 The addition entailed that in cases where it would be possible, the issuing Member State would collect a full set of fingerprints of the individual subject to an alert and those fingerprints would be attached to the alert and compared with fingerprints already stored in the system with the aim of revealing possible links to other alerts (on interlinking of alerts; see below).113 Latent fingerprints – incomplete fingerprints left at a crime scene – may also be used for consultation. This development has substantial privacy implications, particularly in the light of the fact that biometric identifiers constitute a special category of personal data.114 As for the nature of SIS II, their inclusion has meant that SIS II has gradually transformed from a hit/no-hit reporting database to a general intelligence tool. The fact that such an important decision to instigate one-to-many searches was essentially deemed to be a technical issue and was taken with minimal debate – the European Parliament was merely consulted – raises serious concerns of transparency and democratic scrutiny.115 Another sign of the transformation of SIS II into a general intelligence/investigative database was the provision, in both the Regulation and the Decision, allowing the interlinking of alerts, whereby when an alert on a person would be entered in the system, 109 SIS II Decision, art 22. See also SIS II Regulation, art 22. 110 On the use of biometrics in EU information systems, see Annaliese Baldaccini, ‘Counter-terrorism and the EU Strategy for Border Security: Framing Suspects with Biometric Documents and Databases’ (2008) 10 European Journal of Migration and Law 31; see also Evelien Brouwer, ‘The Use of Biometrics in EU Databases and Identity Documents’ in Juliet Lodge (ed), Are You Who You Say You Are? The EU and Biometric Borders (Wolf Legal Publishers, 2007). 111 For further explanation of these searches, see House of Lords (n 78) paras 57–60. 112 Commission, ‘The availability and readiness of technology to identify a person on the basis of fingerprints held in the second generation Schengen Information System (SIS II)’ (Report) COM (2016) 93 final. 113 ibid 7. 114 See S and Marper v UK (2009) 48 EHRR 50. See also art 10 of the Law Enforcement Directive, which is analysed below. On the fundamental rights implications of biometrics, see more generally Els Kindt, Privacy and Data Protection Issues of Biometric Identifiers (Springer, 2013). 115 As the EDPS has pointed out, the lack of specific requirements on how biometrics would be collected and stored is crucial and such aspects should not have been marginalised. See EDPS, ‘Opinion of the European Data Protection Supervisor on the Proposal for a Council Decision on the establishment, operation and use of the Second Generation Schengen Information System (SIS II) (COM (2005)230 final); the Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Second Generation Schengen Information System (SIS II) (COM (2005)236 final), and the Proposal for a Regulation of the European Parliament and of the Council regarding access to the Second Generation Schengen Information System (SIS II) by the services in the Member States responsible for issuing vehicle registration certificates (COM (2005)237 final)’ [2005] OJ C91/38, 43–44. See also Article 29 Working Party, ‘Opinion 6/2005 on the Proposals for a Regulation of the European Parliament and of the Council (COM (2005) 236 final) and Council Decision (COM (2005) 230 final) on the establishment, operation and use of

496 Databases a link to further alerts on other persons or objects could be added as well, thus forming a relationship between the two alerts.116 There have been reported no fewer than 45 examples of possible combinations of alerts that may be interlinked,117 which could be entered only if there is a ‘clear operational need’.118 However, this assessment would be subject to the national law of the Member State that decides to use this option;119 thus, significantly different practices across the EU may emerge.120 Interlinking of alerts was a major departure from the limited hit/no-hit character of the previous incarnation of the system and its potential for profiling is significant. As the EDPS noted in his Opinion on the SIS II proposals, ‘the person [would be] no longer “assessed” on the basis of data relating only to him/her, but on the basis of his/her possible association with other persons’, which may lead to their treatment with greater suspicion if they were deemed to be associated with criminals or wanted persons. Furthermore, the EDPS noted that interlinking would extend investigative powers because it would enable the registration of alleged gangs or networks (eg, data on irregular immigrants and data on traffickers).121 The EDPS further pointed out that authorities with no right of access to certain categories of data should not even be aware of the existence of these links.122 The SIS II Regulation and the SIS II Decision stated in that respect that authorities with no right of access to certain categories of alert would not be able to see the link to an alert to which they did not have access.123 However, this may not necessarily mean that these authorities would not be aware of the existence of a link. A further extension compared to the previous legal regime was the provision – in the SIS II Decision only and with regard to the criminal law part of the system – that the processing of such data may take place for other purposes than those expressly mentioned in the legislation. In order for this to be allowed, processing must be linked to a specific case and justified by the need ‘to prevent an imminent serious threat to public policy and public security, on serious grounds of national security or for the purposes of preventing a serious criminal offence’.124 This provision (which did not exist in CISA)125 was a challenge to the purpose limitation principle and could lead to a considerable extension of the use of Schengen data. In turn, in a departure from the Commission’s original proposals, the rules on access to SIS II data did not change drastically.126 Some

the second generation Schengen Information System (SIS II) and a Proposal for a Regulation of the E uropean Parliament and of the Council regarding access to the second generation Schengen Information System (SIS II) by the services in the Member States responsible for issuing vehicle registration certificates (COM (2005) 237 final)’ (2005) 15. 116 SIS II Decision, art 52. See SIS II Regulation, art 37. 117 Council, Document 12573/3/04 (30 November 2004) 3. 118 SIS II Decision, art 52(4). See SIS II Regulation, art 37(4). 119 SIS II Regulation 2006, art 37(5); SIS II Decision, art 52(5). 120 SIS II Decision, Recital 17 and art 52. See SIS II Regulation, art 37. 121 EDPS (n 115) 38. 122 ibid. 123 SIS II Decision, art 52(3). See SIS II Regulation, art 37(3). 124 SIS II Decision, art 46(5). 125 See CISA, arts 101–02; see also House of Lords (n 78) para 92. 126 See House of Lords (n 78). In particular, on the express prohibition of transferring or making SIS II data available to third countries or international organisations, see SIS II Decision, art 54. See also SIS II Regulation, art 39.

Centralised Databases 497 changes were introduced in the context of access to SIS II data by Eurojust – along with access to extradition and missing persons data, Eurojust would also have access to alerts concerning wanted persons and objects.127 As regards Europol,128 Article 41(1) if the SIS II Decision prescribed that Europol has the right ‘within its mandate’ to access and search directly data entered into SIS II of persons wanted for arrest for surrender or extradition purposes, of persons and objects for discreet checks and of objects for seizure or use as evidence in criminal proceedings. If a Europol search would reveal the existence of an alert in SIS II, the Member States that registered the alert must be informed.129 Nevertheless, the use of information obtained from a search in SIS II would be subject to the consent of the Member State concerned.130 Furthermore, the SIS II Decision prohibited the transfer of SIS II information by Europol to third countries and third bodies without the consent of the Member State concerned.131 Finally, the SIS II Decision contained a specific chapter on data protection envisaging tailor-made data protection rules, which applied as lex specialis.132 The lex generalis was the 1981 Council of Europe Convention on data protection (as at that time, a legal instrument regulating the processing of personal data in the law enforcement context had not been adopted yet; see below).133 Following the adoption of Framework Decision 2008/977/JHA134 in November 2008 on the processing of personal data in the law enforcement context, that legislation applied as lex generalis. Furthermore, the processing of sensitive data was prohibited.135 The SIS II Decision also included provisions establishing rights of access, correction of inaccurate data and deletion of unlawfully stored data,136 as well as a provision on remedies; actions could be brought before courts or the authority competent under the law of any Member State by any person to access, correct, delete or obtain information, or to obtain compensation in connection with an alert relating to them.137 However, the right of information, according to which a person had the right to know that a file with their personal data has been created, along with who has created the file and for what purpose, was missing. This discrepancy raised transparency and legal certainty concerns in view of the fact that SIS II essentially constituted a hybrid database encompassing both immigration and criminal law alerts.138 Furthermore, unless a person was aware of the alert recorded in their respect, the exercise of other rights was rendered almost meaningless.139 The data protection 127 SIS II Decision, art 42. See House of Lords (n 78) para 45. This extension reflects related calls by Eurojust. See Council, Document 11102/06 (30 June 2006). 128 Such access was granted in December 2014. 129 SIS II Decision, art 41(2). 130 ibid art 41(3). 131 ibid. 132 ibid arts 56–63. 133 ibid art 57. 134 Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters [2008] OJ L350/60. For an analysis of this, see further below. 135 SIS II Decision, art 56. 136 ibid art 58. 137 ibid art 59(1). 138 Maria Tzanou, ‘The Added Value of Data Protection as a Fundamental Right in the EU Legal Order in the Context of Law Enforcement’, PhD thesis, European University Institute, 2013, 168. 139 ibid 175.

498 Databases chapter also contained provisions on supervision, with the main change from the previous legal framework being that supervision was undertaken by the EDPS.140

iii. The SIS Legal Framework Following the 2018 Revision In the aftermath of the terrorist attacks in France in 2015, a new impetus for strengthening security measures emerged as a matter of national and European emergency. With the SIS deemed as the centrepiece of police information exchange, the system was first in line to assist in the effective tackling of the phenomenon of so-called foreign terrorist fighters.141 Emphasis was placed on the possibility of reporting foreign terrorist fighters to the SIS in the form of alerts on persons or objects for discreet or specific checks.142 According to Article 36(2) of the SIS II Decision, national authorities may register alerts pursuant to national law for the purposes of prosecuting criminal offences and for the prevention of threats to public security where there is a clear indication that a person intends to commit or is suspected of committing a serious criminal offence or where an overall assessment of a person gives reason to believe that that person will also commit serious criminal offences in the future. Furthermore, Article 36(3) of the SIS II Decision stipulated that authorities responsible for national security may also request the issuance of an alert for the prevention of threats including threats to internal or external national security. Following the terrorist events in Paris in November 2015, Member States were called to ensure that national authorities systematically register alerts on suspected foreign fighters, since the absence of binding criteria for issuing such alerts143 and the lack of trust among Member States as to how national information will be processed by other Member States created significant disparities in the operationalisation of these alerts. Furthermore, in its Communication on Stronger and Smarter Information Systems of April 2016, the Commission suggested possible ways of expanding the functionalities of the SIS,144 inter alia, through the inclusion of facial images for biometric identification in addition to fingerprints, automated transmission of information on a hit following a check, and the creation of a new alert category on ‘wanted unknown persons’ linked to forensic data existing in national databases, such as latent fingerprints. In that respect, in December 2016, the Commission issued an evaluation

140 SIS II Decision, art 61. Supervision of the ‘national’ part of the SIS II would continue to be provided by an independent national supervisory authority. See SIS II Decision, art 60. 141 For an overview of these developments, see Niovi Vavoula, ‘Detecting Foreign Fighters: The Reinvigoration of the Schengen Information System in the Wake of Terrorist Attacks’ (EU Immigration and Asylum Law and Policy Blog, 3 May 2016), http://eumigrationlawblog.eu/detecting-foreign-fighters-the-reinvigoration-of-the-schengen-information-system-in-the-wake-of-terrorist-attacks. For a detailed analysis, see Niovi Vavoula, ‘Prevention, Surveillance, and the Transformation of Citizenship in the “Security Union”: The Case of Foreign Terrorist Fighters”’ in Ulrich Sieber et al (eds), Alternative Systems of Crime Control. National, Transnational, and International Dimensions (Duncker & Humblot, 2018) 307–34. 142 Council, Document 14438/15 (23 November 2015). See also Council, Document 9946/1/13 (28 May 2013). 143 See Council, Document 14438/15 (23 November 2015); Document 9368/1/16 (6 June 2016) 31–33; Document 12286/16 (19 September 2016). 144 Commission, ‘Stronger and smarter information systems for borders and security’ (Communication) COM (2016) 205 final, 7–8.

Centralised Databases 499 of SIS145 and adopted three legislative proposals with a view to improving and expanding the use of SIS.146 As a result, in December 2018, three Regulations were adopted: one on police and judicial cooperation in criminal matters,147 one on border checks148 and one on the return of irregular migrants,149 with emphasis placed on enhancing its use for counter-terrorism purposes.150 The architecture of the system has remained relatively the same: a central system (the Central SIS – CS-SIS) on the one hand, and national sections (N.SIS) on the other hand, connected via a communication infrastructure.151 The SIS Regulation on police and judicial cooperation has introduced new types of alerts. In particular, Member States may enter alerts on ‘unknown wanted persons’ containing only dactyloscopic data – fingerprints and palm prints – both complete and incomplete. These alerts may be issued in cases where such prints are discovered at crime scenes and when it is highly probable that the owner is the perpetrator of the offence in question.152 Furthermore, the existing category of alerts in connection to missing persons has been extended to include ‘vulnerable persons who need to be prevented from travelling’.153 This type of alert has been especially created in order to assist in cases of parental abduction, but also covers children at risk of becoming victims of trafficking in human beings as well as children at risk of being recruited as foreign terrorist fighters.154 In addition, a new category of alerts on ‘objects of high value’ has 145 Commission, ‘Evaluation of the second generation Schengen Information System (SIS II) in accordance with art 24(5), 43(3) and 50(5) of Regulation (EC) No 1987/2006 and art 59(3) and 66(5) of Decision 2007/533/JHA’ (Report) COM (2016) 880 final. 146 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1986/2006, Council Decision 2007/533/JHA and Commission Decision 2010/261/EU’ COM (2016) 883 final (hereinafter ‘Proposal for SIS in the field of police and judicial cooperation’); ‘Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1987/2006’ COM (2016) 882 final; ‘Proposal for a Regulation of the European Parliament and of the Council on the use of the Schengen Information System for the return of illegally staying third-country nationals’ COM (2016) 881 final. 147 Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU [2018] OJ L312/56. 148 Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006 [2018] OJ L311/14. 149 Regulation (EU) 2018/1860 of the European Parliament and of the Council of 28 November 2018 on the use of the Schengen Information System for the return of illegally staying third-country nationals [2018] OJ L312/1. 150 For example, see art 21(2) of the SIS II Regulation on police and judicial cooperation, which requires Member States to issue alerts for cases related to terrorist offences, and art 48(8) on the obligation of Member States inform Europol of hit alerts linked to terrorism in order to help to ‘connect the dots’ of terrorism at the EU level. 151 Regulation 2018/1862, art 4(1). See below how interoperability will change the structure of information systems. 152 ibid Recital 23. 153 ibid art 32. 154 ibid arts 32–33. See Council, Document 9594/17 (8 June 2017).

500 Databases been introduced, including items of information technology.155 Another new category of alert is the ‘inquiry check’, in addition to discreet and specific checks,156 which allows authorities to interview the person concerned.157 As a result, it is more in-depth than a discreet check, but does not allow searching or arresting of the individual subject to such an alert, as a specific check. The effectiveness of these alerts in tackling the phenomenon of foreign terrorist fighters is based on the existence of mutual trust among Member States, first, in that they will effectively cooperate in locating the individuals subject to an alert and, second, that the quality of personal data comprising the alert is ensured, including that the alert has been entered proportionately and lawfully. This latter dimension of mutual trust is safeguarded through Article 21, which requires a proportionality assessment, according to which only adequate, relevant and important enough data must be stored in the system. In the absence of common criteria, individuals may find themselves unlawfully registered in the SIS in breach of the principle of proportionality.158 Therefore, depending on national practices, individuals may be subjected to differentiated practices. En masse registration not only abuses the system and jeopardises its effectiveness by potentially wasting resources on less significant cases, but also runs counter to the explicit requirement of a proportionality assessment prior to the recording of an alert. With respect to the categories of personal data processed by the system, the use of biometrics has been expanded by enabling the SIS to store dactylographic data (palm prints), facial images and DNA profiles.159 This reform has not been justified, as the legislative proposals for revising the SIS were not accompanied by a fundamental rights impact assessment.160 That said, as mentioned above, the nature of biometrics as a special category of personal data has been taken into account, and Articles 42 and 43 of the SIS Regulation on police and judicial cooperation prescribe that biometric data must be registered following a quality check;161 DNA profiles must be inserted solely in relation to alerts on missing persons who need to be placed under protection and only where photographs, facial images or dactyloscopic data are not available or not suitable for identification;162 and dactyloscopic data shall be searched to identify a person where the identity of the person cannot be ascertained by other means.163 However, incomplete dactyloscopic data are not excluded and may also be used to assist in identifying unknown wanted persons,164 which may result in higher chances of false matches.

155 Regulation 2018/1862, art 38. 156 ibid art 26. 157 ibid art 37(4). 158 This danger has recently materialised in France due to the storage of alerts on individuals with only loose, if any, connections to terrorist activities. See Andrej Hunko. ‘Secret Alerts are Increasing Rapidly: Why?’ (21 February 2018), https://andrej-hunko.de/presse/3990-secret-alerts-are-increasing-rapidly-why; Lori Hinnant, ‘France Puts 78,000 Security Threats on Vast Police Database’ (Associated Press, 4 April 2018), https://apnews.com/a1690ac25cea4d5b8d2b622d3fd4e646. 159 Regulation 2018/1862, art 20(2). 160 EDPS, Opinion 7/2017 – EDPS Opinion on the new legal basis of the Schengen Information System (2 May 2017) 8. 161 Regulation 2018/1862, art 42(1). 162 ibid art 42(3). 163 ibid art 43(2). 164 ibid art 43(3).

Centralised Databases 501 Furthermore, with regard to DNA profiles, each profile must contain only the minimum information strictly necessary for the identification of the missing person.165 This is a welcome addition, although opening up the SIS to DNA data may increase the appetite to Member States to require the registration of such data in relation to other types of alerts. Another change in the operation of the SIS involves the authorities and bodies allowed to access the system. In particular, the pool of users in two respects has been enlarged in two respects. At the national level, boat and aircraft registration authorities166 as well as services responsible for registering firearms167 have been granted access to the system. The latter authorities are thus allowed to verify whether the firearm is being sought for seizure in Member States or whether there is an alert on the person requesting the registration. At the EU level, Europol’s access rights have been extended to give it full access to the system, including missing persons,168 but it must inform the issuing Member State and cannot take the required action.169 In addition, the European Border and Coast Guard Authority (Frontex)170 and its teams have been granted access to all categories of alerts, ‘insofar as it is necessary for the performance of their tasks and as required by the operational plan for a specific border guard operation’.171 Finally, the retention period of alerts on persons is subject to the following rules; extradition and surrender alerts, as well as alerts on missing persons may be entered for a period of five years,172 which has been increased from three years under the previous legal framework. As regards alerts on persons sought to assist in a judicial procedure and alerts on unknown wanted persons, the foreseen retention period is three years,173 and in relation to alerts for discreet, inquiry or specific checks and children or vulnerable persons, it is one year.174 The extension of the retention period from three to five years is attributed to two reasons: first, in order to reflect national practices of extending the expiry date if an alert has not yet fulfilled its purpose while the person concerned remains wanted175 and in order to align the SIS with the retention periods prescribed in other instruments, including other information systems (see below). The second justification is somewhat weak – personal data should be stored and further processed for as long as this is strictly necessary,176 so the proportionality of the retention period of

165 ibid. 166 ibid art 46. 167 ibid art 47. 168 ibid art 48(1). 169 ibid art 48(2). 170 Regulation (EU) 2019/1896 of the European Parliament and of the Council of 13 November 2019 on the European Border and Coast Guard and repealing Regulations (EU) No 1052/2013 and (EU) 2016/1624 [2019] OJ L295/1. 171 Regulation 2018/1862, art 50. 172 ibid art 53(2). 173 ibid art 53(3) 174 ibid art 53(4). 175 Commission, ‘Proposal for SIS in the field of police and judicial cooperation’ (n 146) 20. 176 See the analysis below on Joined Cases C-293/12, Digital Rights Ireland Ltd v Ireland and C-594/12 Kärntner Landesregierung et al, ECLI:EU:C:2014:238; Joined Cases C-203/15, Tele2 Sverige AB v Post-och telestyrelsen and C-698/15, Secretary of State for the Home Department v Tom Watson, Peter Brice and Geoffrey Lewis, ECLI:EU:C:2016:970.

502 Databases alerts stored under a specific legal basis should not pre-empt or affect the storage period of records processed under different legal instruments.177

iv. Enabling Europol to Enter Alerts into the SIS As noted earlier, following the latest reform of the SIS legal framework, Europol has ‘read-only’ access to all categories of alerts178 and is not allowed to feed the system with information that it holds. In the course of the Europol reform, as discussed in the previous section, calls to enable the agency to enter alerts into the SIS have led to the adoption of a Commission proposal179 that creates a new alert category that Europol can use to enter alerts into the system following consultation with the Member States and after authorisation by its Executive Director. A detailed process for the issuance of so-called ‘information alerts’ is foreseen so that such alerts will be issued based on Europol’s analysis of information from third countries or international organisations received. Whether this power, which to an extent equates Europol with Member States, fits within Europol’s mandate (as laid down in Article 88 TFEU) is doubtful. It is also questionable whether Europol will be able to conduct a proper quality check before issuing alerts into SIS. Importantly, the operational value of such alerts is also questionable, as the alerts will provide significant discretion to national authorities to follow up, and wide divergences may arise in practice. The impact on individuals whose personal data will be inserted into the SIS is significant and potential liability issues may also arise if the quality of data contained in the alert is not high. In light of the concerns voiced by a number of Member States within the Council, the Portuguese presidency proposed an alternative to delimit these alerts to terrorism-related cases. However, opening up Europol to the SIS will become the gateway through which Europol may acquire further powers to enter other types of alerts into the system (e.g. on missing persons) in the future.

C. The CIS With the establishment of the internal market in the 1990s and the abolition of internal checks and formalities in respect of goods, the risk of fraud significantly increased. Consequently, Member States decided to establish, on the one hand, a mechanism of mutual administrative assistance to assist in preventing, investigating and prosecuting operations in breach of (then) Community customs and agriculture legislation, and, on the other hand, customs cooperation aimed at enabling the detection and prosecution of violations of national customs provisions, notably by enhancing cross-border

177 EDPS (n 160) 11. 178 Regulation 2018/1862, art 48. 179 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters as regards the entry of alerts by Europol’ COM (2020) 791 final

Centralised Databases 503 information exchange. To that end, the Council adopted a Convention on mutual assistance and cooperation between customs administrations (the ‘Naples II’ Convention)180 and a 1995 third pillar Convention establishing the CIS.181 In 1997 a first pillar Regulation also established the CIS for the purposes of mutual assistance in respect of customs and agricultural matters.182 The Convention has since been supplemented by a series of Protocols on the jurisdiction of the Court of Justice of the EU to give preliminary rulings on the Convention,183 the definition of money laundering for the purposes of the Convention,184 and the creation of a customs identification database.185 The Convention has now been ratified by all EU Member States.186 The CIS itself was launched in March 2003.187 The CIS Convention and the Protocols attached to it have been replaced by Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes.188 The aim of the CIS, as envisaged in both the Convention and the Decision, is ‘to assist in preventing, investigating and prosecuting serious contraventions of national laws by making information available more rapidly, thereby increasing the effectiveness of the cooperation and control procedures of the customs administrations of the Member States’.189 It is managed by the Commission190 and a Committee consisting of representatives from the Customs Administrations of the Member States.191 The

180 Convention drawn up on the basis of Article K.3 of the Treaty on European Union, on mutual assistance and cooperation between customs administrations [1998] OJ C24/1. 181 Convention drawn up on the basis of Article K.3 of the Treaty on European Union, on the use of information technology for customs purposes [1995] OJ C31634. 182 Council Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters [1997] OJ L82/1. See Regulation (EC) No 766/2008 of the European Parliament and of the Council of 9 July 2008 amending Council Regulation (EC) No 515/97 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters [2008] OJ L218/48. See also Regulation (EU) 2015/1525 of the European Parliament and of the Council of 9 September 2015 amending Council Regulation (EC) No 515/97 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters [2015] OJ L243/1. 183 Council Act of 29 November 1996 drawing up, on the basis of Article K.3 of the Treaty on European Union, the Protocol on the interpretation, by way of preliminary rulings, by the Court of Justice of the European Communities of the Convention on the use of information technology for customs purposes [1997] OJ C151/15. 184 Council Act of 12 March 1999 drawing up, on the basis of Article K.3 of the Treaty on European Union, the Protocol on the scope of the laundering of proceeds in the Convention on the use of information technology for customs purposes and the inclusion of the registration number of the means of transport in the Convention [1999] OJ C91/1. 185 Council Act of 8 May 2003 drawing up a Protocol amending, as regards the creation of a customs files identification database, the Convention on the use of information technology for customs purposes [2003] OJ C139/1. 186 Council, Document 16245/07 (7 December 2007). 187 Council, Document 5160/04 (9 January 2004). 188 Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes [2009] OJ L323/20 (hereinafter the ‘CIS Decision’). The Convention was replaced by the CIS Decision on 27 May 2011. 189 ibid art 1(2). 190 The Commission is involved in the technical management of the system – see ibid art 3(2). 191 Responsible, inter alia, for the proper functioning of the CIS with regard to technical and operational aspects and for reporting annually to the Council – see ibid art 27.

504 Databases CIS comprises a centralised database that is accessible via terminals in each Member State, the Commission, Europol and Eurojust.192 It stores a number of data, including personal data, in relation to commodities, means of transport, businesses, persons and goods and cash retained, seized or confiscated. For each entry, the Decision exhaustively enumerates the categories of data to be entered.193 Personal data are only included in the CIS for the purposes of sighting and reporting, discreet surveillance and specific checks, strategic and operational analysis, as well as if there are real indications – in particular, on the basis of prior illegal activities – that the person concerned has committed, is in the act of committing or will commit serious contraventions of national laws.194 Direct access to CIS data is reserved exclusively for national authorities designated at the national level – it is noteworthy that these may include authorities other than customs administrations.195 In addition, Europol196 and Eurojust197 may also use the data of the CIS in order to assist in its purposes. The CIS Decision contains a purpose limitation clause regarding the use of CIS data by Member States, Europol and Eurojust (use only for CIS purposes); however, this clause is effectively undermined by a provision allowing Member States to use CIS data ‘for administrative or other purposes with the prior authorisation of, and subject to any conditions imposed by, the Member State that entered the data in the System. In that case the laws and procedures of that Member State are applicable also in relation to that use’.198 Moreover, data obtained from the CIS may under certain conditions imposed by the recording Member State be communicated for use by national authorities other than those designated and also to non-Member States and international organisations.199 Regarding data retention, in a provision structured similarly to the SIS II legal instruments200 data are kept ‘only for the time necessary to achieve the purpose for which it was included’.201 However, the review of the necessity to retain the data must take place on an annual basis.202 The CIS Decision prescribes the creation of a special database, the customs files identification database (FIDE), whereby national authorities responsible for carrying out customs investigations are enabled to identify competent authorities of other Member States which are investigating or have investigated those persons or businesses.203 In addition, the CIS Decision includes a number of p rovisions

192 ibid art 3(1). 193 ibid art 4. These include, inter alia, names, date and place of birth, nationality, sex, ‘any particular objective and permanent physical characteristics’, and a warning code indicating any history of being armed, violent or escaping. 194 ibid art 5(1) and (2). 195 ibid art 7(1). According to art 7(3), the Council may, by a unanimous decision, permit access to the CIS by international or regional organisations. In making this decision, the Council shall take account of any reciprocal arrangements and any opinion on the adequacy of data protection measures by the Joint Supervisory Authority referred to in art 25. 196 ibid art 11. 197 ibid art 12. 198 ibid art 8(1). 199 ibid art 8(4). 200 See SIS II Regulation for police and judicial cooperation, art 53(1). See also Regulation 2018/1861, art 39(1). 201 CIS Decision, art 14(1). 202 ibid. 203 ibid arts 15–19.

Centralised Databases 505 on data protection, containing rules on the application of Council Framework Decision 2008/977/JHA,204 now replaced by Directive 2016/680 (see below section V), rights of persons (access, erasure, rectification, blocking and legal remedies),205 and data protection supervision. Supervision is conducted by national supervisory authorities designated by Member States,206 a Joint Supervisory Authority supervising the operation of the CIS207 and the EDPS.208

D. Access to Information Systems for Third-Country Nationals by Law Enforcement Authorities and Europol In efforts to enhance the exchange of personal data, in the past two decades, great emphasis has been placed on enabling the flow of data amongst the various EU information systems and/or EU agencies and bodies. Examples of amending existing legal instruments to allow access by EU bodies to information systems for the purposes of police and judicial cooperation in criminal matters have been examined above in the context of access by Europol and Eurojust to SIS. These efforts have been coupled by other initiatives, such as agreements enabling the exchange of personal data between EU bodies, with the agreement between Europol and Eurojust being a prime example in that respect.209 In addition, largely justified on the basis of the fight against terrorism – both in the aftermath of 9/11 and in response to the terrorist events that have taken place across the EU since 2015 – efforts for greater synergies in data sharing have proliferated primarily in the form of allowing consultation of information systems established for immigration control purposes and storing personal data on foreigners by law enforcement authorities and Europol. This trend of opening up of these systems, which along with the SIS are managed by an EU agency (eu-LISA),210 to law enforcement is notwithstanding the undoubtedly different purposes of managing migration and asylum and fighting crime, with the justification put forward being that access by police authorities to immigration data is necessary for security reasons.211 These trends were clearly already visible in 2004, when in the Declaration on combating terrorism issued shortly after the Madrid bombings, the European Council linked the monitoring of the movement of people to the ‘war on terror’ by stressing that ‘improved border controls and document security play an important role in combating terrorism’.212 Justifying the observation that immigration and security are increasingly linked in EU JHA discourse

204 ibid art 20. 205 ibid art 22–23. For a guide on how rights of persons exercise the right to access, see the CIS Supervision Coordination Group, ‘A Guide for Exercising the Right of Access to the Customs Information System’ (December 2015). 206 CIS Decision, art 24. 207 ibid art 25. 208 ibid art 26. For other similarities between the CIS and SIS II, see Peers (n 78) 550–51. 209 For more details on these agreements, see ch 4. 210 See section II above. 211 Valsamis Mitsilegas, ‘Contrôle des Étrangers, des Passagers, des Citoyens: Surveillance et Anti-Terrorisme’ (2005) 58 Cultures et Conflits 155. 212 European Council, ‘Declaration on combating terrorism’ (25 March 2004) 7.

506 Databases and policy-making, thus creating an (in)security continuum,213 The Hague Programme – adopted by the European Council later on in 2004 – articulated more clearly the perceived link between movement, migration and terrorism, stating that: [T]he management of migration flows, including the fight against illegal immigration should be strengthened by establishing a continuum of security measures that effectively links visa application procedures and entry and exit procedures at external border crossings. Such measures are also of importance for the prevention and control of crime, in particular terrorism. (Emphasis added)214

Against that background, the sections below outline the legal framework based on which personal data stored in EU (Schengen) information systems may be accessed by national law enforcement authorities and Europol and critically evaluate this policy choice.

i. The VIS The first information system the legal basis of which allowed consultation for criminal law purposes was the VIS, which contains a wide array of personal data, including biometrics (fingerprints and photographs) on short-stay visa applicants.215 The development of the VIS is a clear example of the trend to blur the boundaries between immigration and police databases, as the VIS was conceived as ‘a direct consequence of the terrorist attacks’ of 9/11.216 The conflation of immigration and terrorism was apparent; in the Council’s own words, ‘[t]he events of 11 September 2001 … radically altered the situation, showing that visas are not just about controlling immigration but are above all an issue of EU Member States’ internal security’.217 Then, in February 2004, the JHA Council adopted detailed conclusions on the development of the VIS, which clearly stated that one of the purposes of the system would be to ‘contribute towards improving the administration of the common visa policy and towards internal security and combating terrorism’.218 It also called for access to the VIS to be granted to border guards and ‘other national authorities to be authorised by each Member State such as police departments, immigration departments and services responsible for internal security’.219 In June 2004, the Council adopted a Decision

213 See in particular Didie Bigo, Polices en Réseaux – l’Éxperience Européenne (Presses Sciences Po, 1996). 214 The Hague Programme: Strengthening Freedom, Security and Justice in the European Union [2004] OJ C53/1, 7. 215 Following a revision of the VIS legal framework, the system will store records on long-stay visa holders, as well as holders of residence cards and residence permits. See Regulation (EU) 2021/1134 of the European Parliament and of the Council of 7 July 2021 amending Regulations (EC) No 767/2008, (EC) No 810/2009, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2019/817 and (EU) 2019/1896 of the European Parliament and of the Council and repealing Council Decisions 2004/512/EC and 2008/633/JHA, for the purpose of reforming the Visa Information System [2021] OJ L248/11. 216 Baldaccini (n 110) 32; Council, Document 12019/01 (20 September 2001) pt 26. 217 Council, Document 14523/01 (26 November 2001). 218 Council, Document 5831/04 (28 November 2003). 219 ibid.

Centralised Databases 507 f orming the legal basis for the establishment of the VIS, the negotiations of which were accelerated by the Madrid bombings,220 and discussions began to define its purpose and functions and formulate rules on access and exchange of the VIS data. The Commission subsequently tabled a draft Regulation aiming to take the VIS further by defining its aims and rules on data access and exchange.221 The JHA Council of 24 February 2005 called for access to the VIS to be given to national authorities responsible for ‘internal security’ when exercising their powers in preventing, detecting and investigating criminal offences, including terrorist acts or threats.222 Since the core objective of the VIS would be the improvement of the EU common visa policy, the instrument had to be adopted by qualified majority voting and through a co-decision process with the Parliament. However, consultation of visa data for law enforcement purposes fell within the remits of the former third pillar, so a separate measure needed to be adopted under unanimity within the Council and mere consultation of the Parliament. A proposal for a VIS Decision aiming at regulating access by law enforcement authorities and Europol was released,223 and both instruments were linked and negotiated in parallel.224 Following rigorous negotiations, agreement on both proposals was confirmed at the JHA Council of 12–13 June 2007225 and they were published following considerable delays, in August 2008.226 Reflecting the logic of the Conclusions of the 2005 JHA Council, the VIS Regulation expressly stated that one of the purposes of the VIS is to ‘contribute to the prevention of threats to internal security of the Member States’.227 However, as the CJEU has clarified, this objective is ancillary.228 The UK, which in the pre-Brexit era did not apply the VIS Regulation at it constituted a development of the Schengen acquis in which it did not participate, sought annulment of the VIS Decision on the grounds that since it constituted a police cooperation measure, the UK should have been given access to VIS for law enforcement purposes. The Court dismissed the UK’s arguments and

220 Council Decision of 8 June 2004 establishing the Visa Information System (VIS) [2004] OJ L213/5. 221 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council concerning the VIS and the exchange of data between Member States on short-stay visas’ COM (2004) 835 final. 222 Council, Document 6228/05 (4 March 2005) 15–16. 223 Commission, ‘Proposal for a Council Decision concerning access for consultation of the Visa Information System (VIS) by the authorities of Member States responsible for internal security and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences’ COM (2005) 600 final. 224 For details, see Valsamis Mitsilegas, ‘Human Rights, Terrorism and the Quest for Border Security’, in Marco Pedrazzi (ed), Individual Guarantees in the European Judicial Area in Criminal Matters (Bruylant, 2011). 225 Council, Document 10267/07 (25 June 2007). 226 Regulation (EC) 767/2008 of the European Parliament and of the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas [2008] OJ L218/60, as amended by Regulation (EC) 810/2009 of the European Parliament and of the Council establishing a Community Code on Visas (Visa Code) [2009] OJ L243/1 (hereinafter the ‘VIS Regulation’); Decision 2008/633/ JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences [2008] OJ L218/129 (hereinafter the ‘VIS Decision’). 227 VIS Regulation, art 2(g). 228 Case C-482/08 UK v Council [2010] ECR I-10413.

508 Databases upheld the VIS Decision, basing its reasoning on the effectiveness and the special nature of Schengen cooperation. Although it contended that the aim of the VIS Decision falls within the sector of police cooperation, it opined that the content relates to both the common visa policy and police cooperation. Furthermore, it observed that: [The VIS Decision] provisions nevertheless contain conditions restricting access to the VIS … which make clear that they organise in essence the ancillary use of a database concerning visas, the principal purpose of which is linked to the control of borders and of entry to the territory and which is therefore available, merely by way of consultation, for police cooperation purposes on a secondary basis only, solely to the extent that use for those purposes does not call into question its principal use.229

The judgment thus clarified that the development of the common visa policy is the core objective and the use of the database in law enforcement context has to be treated as secondary and collateral. In order to justify this view, the Court took note of the specific conditions of law enforcement access that testify to its exceptional character.230 In efforts of the Parliament to include as many safeguards as possible – given that the adoption of the VIS Decision was not under its direct negotiating influence – the VIS Regulation contained an intensely negotiated ‘bridging clause’ to the VIS Decision.231 The clause (Article 3) stipulated the core rules on law enforcement access; that national ‘designated’ authorities may access VIS data in individual cases ‘if there are reasonable grounds to consider that consultation of VIS data will substantially contribute to the prevention, detection and investigation of a terrorist offences and of other serious criminal offences’. Europol may also access the system ‘within the limits of its mandate and when necessary for the performance of its tasks’.232 However, the modalities of consulting VIS data by law enforcement authorities and Europol have been prescribed in detail in the third pillar Decision.233 Access to the VIS has been granted to national ‘designated’ authorities defined as those ‘responsible for the prevention, detection or investigation of terrorist offences or of other serious criminal offences’.234 Member States must also designate central access points that verify that the conditions of access are fulfilled – it is through these access points that consultation of the VIS takes place.235 Access to VIS has thus been extended to a wide range of national authorities with diverse tasks.236 According to Article 3(2) of the VIS Decision, a list

229 ibid paras 50–52. 230 For further analysis, see Niovi Vavoula, ‘Consultation of EU Immigration Databases for Law Enforcement Purposes: a Privacy and Data Protection Assessment’ (2020) 22 European Journal of Migration and Law 139. 231 VIS Regulation, art 3. 232 ibid art 3(1). 233 In particular, VIS Decision, arts 5–7. 234 ibid art 2(1)(e). 235 ibid art 3(3); VIS Regulation, art 3(2). Similarly, according to art 7(3) of the VIS Decision, Europol must designate a specialised unit with Europol officials acting as the central access point to the VIS. Access to the VIS only via central units seems to be a safeguard advocated by the European Parliament. See Council, Document 8540/07 (18 April 2007). 236 The possibility to transfer VIS data to third countries should also be noted. For further details, see Mitsilegas (n 224).

Centralised Databases 509 of these designated authorities and the central access point(s) must be communicated to the Commission and the General Secretariat of the Council,237 without the provision of a mechanism of controlling and checking which authorities are designated at the national level, except the Schengen Evaluation Mechanism more generally. A wide range of agencies may be responsible for the prevention, detection or investigation of terrorist offences at the national level, including intelligence services. The VIS Decision has prescribed further limits when specifying the conditions of access by requiring that access for consultation must be necessary in a specific case, thus proscribing routine access and ‘fishing expeditions’,238 involving terrorist offences239 or other serious crimes, as prescribed in Article 2(2) of the European Arrest Warrant Framework Decision,240 and only if there are reasonable grounds to believe such consultation may substantially contribute to the prevention, detection and investigation of the offences in question.241 The aforementioned conditions did not provide for a particularly high threshold, with a view being put forward that the existence of factual indications or evidence as the basis for the reasonable grounds would have been more appropriate.242 As for consultation by Europol, the prescription of corresponding conditions of access is missing.243 Furthermore, as regards the definition of serious crimes, the barrier has been rather low, as there has been no further specification regarding the specific penalty framework of the crimes encompassed.244 Importantly, the task of checking whether the conditions of access are met is entrusted to the central access point and the VIS Decision does not clarify the nature of it, so it is highly doubtful whether this procedure is fully independent or critical of police requests. Their operation does not seem to be in line with landmark judgments of the CJEU, in particular Digital Rights Ireland and Tele2, which are analysed below, according to which access to data by the competent national authorities should be made dependent on a prior review carried out by a court or an independent administrative body.245 In addition, the fact that law enforcement authorities and Europol have access to information in relation to people issuing an invitation and/or sponsoring a stay also raises privacy concerns, as it may lead to extensive profiling by creating links between thirdcountry nationals for the mere fact that they have established and developed personal

237 For the latest list, see List of competent authorities the duly authorised staff of which shall have access to enter, amend, delete or consult data in the Visa Information System (VIS) [2016] OJ C187/4. 238 VIS Decision, art 5(1)(b). 239 As prescribed in Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA [2017] OJ L88/6. 240 This is the list of 32 offences for which dual criminality has been abolished for the purposes of the European Arrest Warrant. See Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States [2002] OJ L190/1. 241 VIS Decision, art 5(1)(c). 242 See Council, Document 5456/1/07 REV 1 (20 February 2007). That would be in line with the judgment of the ECtHR in Zakharov v Russia 4.12.2015 39 BHRC 435, para 255. 243 VIS Decision, art 7. Consultation may take place within the limits of its mandate and when necessary for its tasks for the purposes of a specific analysis, or for an analysis of a general nature and of a strategic type. 244 Vavoula (n 74) ch 3. 245 Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v Ireland, ECLI:EU:C:2014:238, para 62; Joined Cases C-203/15 and C-698/15, Tele2 Sverige AB v Post-och Telestyrelsen, and Secretary of State for the Home Department v Tom Watson, Peter Brice, Geoffrey Lewis, ECLI:EU:C:2016:970, para 120.

510 Databases relationships. Following the reform of the VIS legal framework in July 2021, Regulation (EU) 2021/1134 amended the modalities of law enforcement access to VIS data, for example, by introducing conditions of access to VIS data by Europol, which were not foreseen in the VIS Decision, and by enabling national law enforcement authorities to bypass the conditions of access and search VIS data with fingerprints only in cases relating to the identification of persons who have gone m issing, were abducted or were identified as victims of trafficking in human beings.246 In practice, the use of the VIS data for law enforcement purposes seems to take place in a fragmentary manner and to a limited extent, with a few Member States being mainly responsible for the majority of checks, whereas others did not report much activity.247 This low interest in the VIS, at least in the first years of its consultation for law enforcement purposes, may be interpreted as meaning either that there have not been that many cases that require the assistance of the VIS, thus questioning the necessity and proportionality of law enforcement access in light of the millions of affected individuals, or that the conditions of access as outlined above have been too strict and effectively hinder access to VIS data. Regrettably, there is no information as to the number of ‘hits’ on the basis of the VIS searches, possible false matches, follow-up procedures in cases of ‘hits’, including possible convictions, or information on refusals of access.

ii. Eurodac Perhaps the most prominent example showcasing the controversial nature of law enforcement access to information systems for third-country nationals is Eurodac, which processes the fingerprints of applicants for international protection (asylum seekers) and certain categories of irregular migrants.248 Operational since 2003,249 the primary purpose of Eurodac was to assist in the implementation of the Dublin mechanism250 for the determination of the Member State responsible for examining an asylum claim. Opening up Eurodac to law enforcement authorities and Europol was a prolonged political process. In the 2005 Commission Communication on improved effectiveness, enhanced interoperability and synergies among databases, it was stated that ‘authorities responsible for internal security could … have access to Eurodac in well-defined cases, when there is a substantiated suspicion that the perpetrator of a serious crime had applied for asylum’.251

246 Regulation 2021/1134, art 22p. 247 Commission, ‘Implementation of Regulation (EC) No 767/2008 of the European Parliament and of the Council establishing the Visa Information System (VIS), the use of fingerprints at external borders and the use of biometrics in the visa application procedure/REFIT Evaluation’ COM (2016) 655 final, 11–12. 248 Those apprehended irregularly crossing the external borders of the EU and found irregularly staying. 249 Regulation 2725/2000 of 11 December 2000 concerning the establishment of ‘Eurodac’ for the comparison of fingerprints for the effective application of the Dublin Convention [2000] OJ L316/1. 250 Regulation 604/2013 of the European Parliament and of the Council of 26 June 2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast) [2013] OJ L180/31 (hereinafter the ‘Dublin III Regulation’). 251 Commission, ‘Improved effectiveness, enhanced interoperability and synergies among European databases in the area of Justice and Home Affairs’ (Communication) COM (2005) 600 final, 8.

Centralised Databases 511 The Commission tabled no fewer than four proposals (in 2008,252 2009,253 2010254 and 2012),255 but only the proposals of 2009 and 2012 contained rules on access by law enforcement authorities to Eurodac data. However, the 2009 proposal was severely criticised256 and eventually blocked by the European Parliament. In May 2012, the Commission released a fourth proposal and, after a limited period of negotiations, the European Parliament – in a profound shift of its position257 – backed the Council, and the recast Regulation was adopted in June 2013.258 Compared to the law enforcement provisions in the VIS Decision, the Eurodac rules are more refined. The recast Eurodac Regulation permits national law enforcement bodies and Europol to consult Eurodac data for the purposes of preventing, detecting or investigating terrorist offences and other serious crimes if they are punishable

252 Commission, ‘Proposal for a Regulation of the European Parliament and the Council concerning the establishment of ‘Eurodac’ for the comparison of fingerprints for the effective application of Regulation (EC) No […/…] [establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person] (Recast version)’ COM (2008) 825 final,. 253 Commission, ‘Amended proposal for a Regulation of the European Parliament and of the Council concerning the establishment of ‘EURODAC’ for the comparison of fingerprints for the effective application of Regulation No […/…] [establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person] (Recast version)’ COM (2009) 342 final; ‘Proposal for a Council Decision on requesting comparisons with EURODAC data by Member States’ law enforcement authorities and Europol for law enforcement purposes’ COM (2009) 344 final. 254 Commission, ‘Amended proposal for a Regulation of the European Parliament and the Council concerning the establishment of ‘EURODAC’ for the comparison of fingerprints for the effective application of Regulation (EC) No […/…] [establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person] (Recast version)’ COM 2010) 555 final. 255 Commission, ‘Amended proposal for a Regulation of the European Parliament and of the Council on the establishment of ‘EURODAC’ for the comparison of fingerprints for the effective application of Regulation (EU) No […/…] (establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a thirdcountry national or a stateless person) and to request comparisons with EURODAC data by Member States’ law enforcement authorities and Europol for law enforcement purposes and amending Regulation (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (Recast version)’ COM (2012) 254 final. 256 EDPS, ‘Opinion of the European Data Protection Supervisor on the amended proposal for a Regulation of the European Parliament and of the Council concerning the establishment of “EURODAC” for the comparison of fingerprints for the effective application of Regulation (EC) No […/…] [establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person], and on the proposal for a Council Decision on requesting comparisons with EURODAC data by Member States’ law Enforcement authorities and Europol for law enforcement purposes’ [2010] OJ C92/1. 257 For an explanation, see Briggita Juster and Vassilis Tsianos, ‘Erase Them! Eurodac and Digital Deportability’ (Transversal/EIPCP Multilingual Webjournal, 2013), http://eipcp.net/transversal/0313/kustertsianos/en. 258 Regulation 603/2013 of the European Parliament and of the Council of 26 June 2013 on the establishment of ‘Eurodac’ for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member States responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and on requests for the comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes, and amending Regulation (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (recast) [2013] OJ L180/1 (hereinafter the ‘recast Eurodac Regulation’).

512 Databases under national law by a custodial sentence or a detention order for a maximum period of at least three years.259 Furthermore, intelligence services are explicitly excluded.260 The conditions of access are very similar to those prescribed in the VIS Decision, but with certain important tweaks. First, Eurodac may also be used in cases where asylum seekers are victims of terrorist offences or serious crimes.261 Second, national designated authorities must have consulted national fingerprint databases, as well as the Automated Fingerprinting Identification Systems (AFIS) of other Member States pursuant to Decision 2008/615/JHA (hereinafter the ‘Prüm Decision’)262 and VIS, and such consultation must have been futile. However, in the case of the AFIS, such comparisons must have taken place, unless there are reasonable grounds to believe that a comparison with such systems will not lead to the establishment of the identity of the data subject.263 Third, Article 21(1) of the Regulation prescribes specific conditions of access by Europol. Finally, a verifying authority is entrusted with the role of checking that the conditions of access are fulfilled.264 In accordance with Recital 30 of the Regulation, the designated and verifying authority can be within the same organisation, but the latter must act independently. Nevertheless, the deviation from the original purpose of Eurodac cannot be underestimated.265 The use of asylum seekers’ fingerprints for law enforcement purposes signifies a radical transformation of Eurodac from a merely administrative tool into an instrument of criminal intelligence gathering. It disregards the fact that asylum seekers constitute a particularly vulnerable group of people who require protection266 and may lead to their increased stigmatisation.267 Asylum seekers who have committed no crime could face a greater likelihood of being involved in criminal investigations than other individuals whose biometric data are not collected, stored and processed on a systematic basis for the sole reason that these individuals have applied for international protection, a right to which they enjoy in accordance with Article 29 of the Charter. Although the modalities of law enforcement access are circumscribed more carefully in the recast Eurodac Regulation, a series of concerns have been raised. First, in relation to the specification that serious offences are those entailing a custodial sentence or a

259 Recast Eurodac Regulation, art 2(1)(k). 260 ibid art 5(1) 261 ibid Recital 31. 262 See below. 263 See Council, Document 14559/12 (4 December 2012). 264 Recast Eurodac Regulation, art 6. 265 For an analysis, see Niovi Vavoula, ‘The Recast Eurodac Regulation: Are Asylum Seekers Treated as Suspected Criminals?’ in Céline Bauloz et al (eds), Seeking Asylum in the European Union: Selected Protection Issues Raised by the Second Phase of the Common European Asylum System (Brill Nijhoff, 2015) 247–73. See also Standing Committee of Experts on International Immigration, Refugee and Criminal Law (Meijers Committee), ‘Note on the proposal of the JHA Council to give law enforcement authorities access to Eurodac’ (CM0712-IV 2007); ‘Note on the proposal for a Regulation on the establishment of Eurodac (COM (2012) 254)’ (CM1216 2012); UNHCR, ‘An Efficient and Protective Eurodac’, www.unhcr.org/50adf9749.pdf; EDPS, ‘Opinion of the European Data Protection Supervisor on the amended proposal for a Regulation of the European Parliament and of the Council on the establishment of “EURODAC” for the comparison of fingerprints for the effective application of Regulation (EU) No […/…] (Recast version) (executive summary)’ [2013] OJ C28/3 (hereinafter the ‘Opinion on the amended proposal’). 266 Meijers Committee (n 265) 3; EDPS (n 265) para 39; UNHCR (n 265) 10–11. 267 EDPS, ‘Opinion on the amended proposal’ (n 265) 37–38; UNHCR (n 265) 10–11.

Centralised Databases 513 detention order for a maximum period of at least three years, the threshold is relatively low, particularly in those Member States whose criminal law allows for potentially long custodial sentences for fairly minor crimes.268 Second, as the verifying authority may be a law enforcement authority, it is likely that the decision regarding the fulfilment of conditions could be biased, particularly if the officials involved are situated within the same organisation and/or the same premises. Besides, despite the intervention of the verifying authority, access to Eurodac data by the competent national authorities is not made dependent on a prior review carried out by a court or an independent administrative body, as mandated in the judgments of Digital Rights Ireland and Tele2 (see below).269 Finally, searches in Eurodac may be based on latent fingerprints found in a crime scene, which may lead to a high number of possible matches, given the wider range of possible correlations with partial or fragmentary prints.270 The Eurodac legal framework has been subject to revision; in 2016, the Commission adopted a proposal, which did not touch upon the provisions on law enforcement access.271 However, that proposal provided an opportunity to remove important safeguards that the recast Eurodac Regulation includes. For instances, this involves the prerequisite for prior search to VIS and the possibility to also conduct searches in connection with specific persons. The simplification of the modalities of access is wrongly premised on the equivalence of the VIS with Eurodac as centralised information systems processing personal data of third-country nationals, and disregards the specificities of the personal scope and the purposes of each system. This approach embraces the trend of assimilating the different groups of third-country nationals falling in the realms of Eurodac, all of whom present a security risk.272

iii. The Entry/Exit System (EES) Since the adoption of the recast Eurodac Regulation in 2013, allowing the consultation of information systems for third-country nationals by national law enforcement bodies and Europol has become the norm. Another example of this trend involves the 268 Steve Peers et al, EU Immigration and Asylum Law, 2nd edn (Brill, 2015) 437. 269 Digital Rights Ireland (n 245) para 62; Tele2 (n 245) para 120. 270 EDPS, ‘Opinion on the amended proposal’ (n 265) para 61. 271 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council on the establishment of “Eurodac” for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless persons], for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes (recast)’ COM (2016) 272 final (hereinafter the ‘Eurodac proposal of 2016’. Another proposal was adopted in 2020, which does not entail further revisions. See Commission, ‘Commission, ‘Amended proposal for a Regulation of the European Parliament and of the Council on the establishment of “Eurodac” for the comparison of biometric data for the effective application of Regulation (EU) XXX/XXX [Regulation on Asylum and Migration Management] and of Regulation (EU) XXX/XXX [Resettlement Regulation], for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes and amending Regulations (EU) 2018/1240 and (EU) 2019/818’ COM (2020) 614 final. 272 For further analysis, see Niovi Vavoula, ‘The Transformation of Eurodac under the New Pact on Migration and Asylum: From the Sidekick of the Dublin System to a Database in Support of EU Policies on Asylum, Resettlement and Irregular Migration (ECRE Policy Paper, 2021).

514 Databases forthcoming EES.273 The latter will record border crossing both at entry and exit of third-country nationals admitted for a short stay.274 EES will also be a multi-purpose tool: it will enhance the efficiency and automation of border checks; it will assist in the identification of irregular migrants and overstayers; it will combat identity fraud and misuse of travel documents; and it will strengthen internal security by allowing law enforcement authorities access to travel history records.275 To those ends, it will record the identities of third-country nationals by storing alphanumeric data, four fingerprints and a facial image, along with details of their travel documents, which will be linked to electronic entry and exit records.276 However, when the Commission first tabled a proposal for the establishment of the EES in 2013,277 a decision on whether to include law enforcement access among its objectives was postponed at a later stage, ‘[g]iven the high number of personal data contained in the EES’.278 Member States were dissatisfied with that approach, with no fewer than 20 of them expressing their wish to grant law enforcement authorities access to EES data from the outset of its operations.279 The Commission noted with concern the lack of proportionality between, on the one hand, the data collected and stored in EES and, on the other hand, the usefulness of EES data in combating serious crime due to difficulties in ascertaining the rate of success on the basis of using such data.280 Under the pressure of realising a ‘Security Union’281 in the aftermath of a series of terrorist events across Europe, the Commission drafted a revised proposal in 2016282 that allowed consultation of EES data by national law enforcement bodies and Europol already from the outset of EES operations. The justification of the usefulness of EES data for criminal law purposes was grounded on vague references to VIS cases: Member States have reported cases of people who died violently and whose identification was only possible through accessing the VIS. Other cases reported are related to human being trafficking, terrorism or drug trafficking for which the access to VIS data allowed the investigators to make substantial progress.283 273 Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 [2017] OJ L327/20 (hereinafter the ‘EES Regulation’). 274 ibid art 1. 275 ibid art 6(1). 276 ibid arts 14–20. 277 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council establishing an Entry/Exit System (EES) to register entry and exit data of third country nationals crossing the external borders of the Member States of the European Union’ COM (2013) 95 final. 278 ibid Recital 23. 279 Council, Document 9863/13 (28 May 2013) 5. 280 ibid. 281 Commission, ‘Delivering on the European Agenda on Security to fight against terrorism and pave the way towards an effective and genuine Security Union’ COM (2016) 230 final. 282 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011’ COM (2016) 194 final (hereinafter the ‘EES Proposal of 2016’). 283 ibid 6.

Centralised Databases 515 Regulation 2017/2226 was adopted on 30 November 2017 envisaging rules that are a mixture of those prescribed in the recast Eurodac Regulation and the VIS Decision with a few tweaks. As in the case of Eurodac, consultation of EES data is allowed in relation to terrorist offences and other serious crimes listed in Article 2(2) of the European Arrest Warrant Framework Decision if they are punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;284 as in the case of the VIS, Member States are not excluded from intelligence services to have access to EES data.285 Furthermore, a Central Access Point will verify that the conditions of access are fulfilled and shall act fully independently of the designated authorities when performing its tasks.286 In addition, the Central Access Point shall be separate from the designated authorities and shall not receive instructions from them.287 Europol shall also designate an authority that may request access as well as a specialised unit to verify that the conditions of access are met.288 As for the conditions of access as such, Article 32 of the EES Regulation foresees that access must be necessary and proportionate in a specific case concerning a terrorist offence or another serious crime, where there is evidence or reasonable grounds to consider that the consultation will contribute to the prevention, detection or investigation of the offences in question, in particular where there is a substantiated suspicion that the suspect, perpetrator or victim falls with the personal scope of the EES Regulation. Though a requirement of ‘evidence’ as a basis for the request was added, this may not have a significant impact as the request may well be based on reasonable grounds only.289 In addition, as in the case of Eurodac, the EES Regulation prescribes that in cases where access is used as a tool for the purpose of identifying an unknown suspect, perpetrator or victim of an offence, a prior search must have been conducted in national databases and in the national AFIS.290 However, this condition will not apply when there are reasonable grounds to believe that such comparison would not lead to the verification of the identity of the data subject or in case of urgency. Therefore, once again, the inclusion of an additional safeguard has been downgraded via the addition of a caveat. Finally, the usefulness of EES is doubtful. In theory, the EES could provide travel histories of third-country nationals who are suspected of terrorism or another serious criminal offence. However, as it has been pointed out: If a person who entered the Schengen territory subsequently was suspected of involvement in a terrorist offence, the entry-exit system would provide the limited facility of providing information as to whether (and if so, when and where) the suspect had exited that territory legally.291

284 EES Regulation, art 3(25). 285 ibid art 29. 286 ibid art 29(3). 287 ibid. 288 ibid art 30. 289 Vavoula (n 231). 290 EES Regulation, art 32(2). 291 Steve Peers, ‘Proposed New Border Control Systems’ (Study for the European Parliament, PE408.296, 2008) 9.

516 Databases

iv. The ETIAS The latest information system which was opened up to law enforcement authorities and Europol is the ETIAS,292 which will oblige all visa-exempt tourists to apply for travel authorisation prior to their departure via an online application.293 The ETIAS will be a platform which will enable pre-screening of applicants for travel authorisation through algorithmic profiling, so as to identify unknown persons who must a priori be excluded from travelling to the EU.294 Each applicant will be requested to provide a series of personal data (biographical information and travel information),295 which will be then cross-checked against national, European and Interpol databases,296 a watchlist and certain screening rules.297 Consultation of ETIAS data for law enforcement purposes constitutes a secondary objective and the rules governing this issue largely mirror the provisions of the EES Regulation.298 However, a novelty of the ETIAS Regulation is that search by law enforcement authorities will be enabled not only on the basis of biographical data, but also on other types of information such as the home address, phone number, email address or digital blueprint (IP address).299 The Commission proposal took it for granted that ETIAS data may be useful in order to establish evidence and information relating to a person suspected of having committed a crime or being the a victim of a crime.300 The fact that the forthcoming EES, which was already on the negotiating table, will also store records on visa-free travellers that will be accessed by law enforcement authorities and Europol was not commented upon.301

E. The Interoperability of Information Systems The establishment of EU information systems for third-country nationals has been based on a compartmentalised approach, without an overarching information system whereby personal data would be collected and stored from all categories of foreigners. As a result, data are separately stored in various information systems at the EU level, but

292 Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 [2018] OJ L236/1 (hereinafter the ‘ETIAS Regulation’). 293 EES Regulation, art 1. 294 For an evaluation of the Commission proposal, see Susie Alegre, Julien Jeandesboz and Niovi Vavoula, ‘European Travel Information and Authorisation System (ETIAS): Border management, fundamental rights and data protection’ (Study for the European Parliament PE 583.148, 2017). 295 ETIAS Regulation, art 17. 296 ibid art 12. 297 ibid arts 33–35. 298 ibid arts 50–54. 299 ibid art 52(2). 300 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 515/2014, (EU) 2016/399, (EU) 2016/794 and (EU) 2016/1624’ COM (2016) 731 final, 11. 301 EDPS, Opinion 3/2017 – EDPS Opinion on the Proposal for a European Travel Information and Authorisation System (ETIAS) (14 March 2017) 14.

Centralised Databases 517 the systems operate in silos and in principle cannot communicate with each other. In order to rectify this perceived gap in information exchange, the interaction in various ways of records and files present in one information system with those contained in other databases has been a key component in information exchange under the umbrella term of interoperability.302 Debates about interoperability first started in the aftermath of 9/11,303 with a key issue being whether the then negotiated VIS could be linked or incorporated into the SIS.304 The Hague Programme also mentioned interoperability both in the context of strengthening security (calling for interoperability of national databases or direct online access including for Europol to existing central EU databases)305 and in the context of migration management, where the European Council called on the Council to examine ‘how to maximise the effectiveness and interoperability of EU information systems’ and invited the Commission to present a Communication on the interoperability between the SIS, the VIS and Eurodac.306 In its Communication on improved effectiveness, enhanced interoperability and synergies among EU databases, the Commission defined interoperability as the ‘ability of IT systems and of the business processes they support to exchange data and to enable the sharing of information and knowledge’.307 However, details on the legal aspect for the interoperability of databases were spared, as the concept was reduced to a technical rather than a legal or political matter.308 For years interoperability was discussed, albeit in a sporadic manner, without being accompanied by concrete proposals.309 After the events of 13 November 2015 in Paris, the issue gained fresh impetus. In its Communication on stronger and smarter borders, the Commission identified four different models of interoperability: (a) single search interface to query several information systems simultaneously and to produce combined results on one single screen; (b) interconnectivity of information systems, where data registered in one system will automatically be consulted by another system; (c) establishment of a shared biometric matching service in support of various information systems; and (d) a common repository of data for different information systems.310 With a view to addressing the legal, technical and operational aspects of the different options, an Expert Group on Information Systems and Interoperability (HLEG) was set up.311 In the meantime, Member States agreed in the Roadmap to enhance 302 For a detailed analysis of the implication of interoperability for the protection of fundamental rights, see Niovi Vavoula, ‘Interoperability of EU Information Systems: The Deathblow to the Rights to Privacy and Personal Data Protection of Third-Country Nationals?’ (2020) 26(1) European Public Law 131. 303 Council, Document 13176/01 (24 October 2001). 304 Commission, ‘Development of the Schengen Information System II’ (Communication) COM (2001) 720 final, 8. 305 The Hague Programme (n 214) para 2.1. 306 ibid para 1.7.2. 307 Commission (n 251). 308 See Paul de Hert and Serge Gutwirth, ‘Interoperability of Police Databases within the EU: An Accountable Political Choice?’ (2006) 20(1–2) International Review of Law Computers & Technology 21, 22; EDPS, ‘Comments on the Communication of the Commission on interoperability of European databases’ (10 March 2006). 309 For instance see Council, Document. 6975/10 (1 March 2010) pt 20. 310 Commission, ‘Stronger and smarter information systems for borders and security’ (Communication) COM (2016) 205 final. 311 Commission. ‘Decision of 17 June 2016 setting up the High Level Expert Group on Information Systems and Interoperability’ [2016] OJ C257/3.

518 Databases information exchange and information management to implement the first option as a matter of priority and the remaining options to be discussed in the medium and longer term.312 The HLEG final report was released on 5 May 2017 and gave the green light for the setting up of a European search portal, a shared biometric matching service and a common identity repository.313 In the meantime, interoperability was already embedded in the proposals for the EES,314 the revised Eurodac315 and the ETIAS,316 despite the lack of an impact assessment and a comprehensive evaluation of the necessity and proportionality of interoperability. The inclusion of provisions on interoperability prior to the official enactment of the relevant policy or even the adoption of specific proposals pre-empted legal developments by inserting provisions through the back door without prior scrutiny.317 In December 2017, the Commission adopted two legislative proposals on interoperability amongst information systems; the first built on the Schengen acquis, covering the VIS, the EES, ETIAS and the immigration branch of the SIS,318 whereas the scope of the second proposal included Eurodac, the criminal law branch of the SIS and the forthcoming ECRIS-TCN, which is analysed below.319 Two sets of proposals were necessary, as the legal bases of the information systems were different and the degrees of EU Member States’ involvement in the various databases vary. These proposals were revised in June 2018320 and following speedy negotiations Regulations (EU) 2019/817321 and 2019/818322 were published in May 2019. Interoperability is viewed as ‘the ability 312 Council, Document 9368/1/16 (6 June 2016). See also Council, Document 7711/16 (12 April 2016). 313 HLEG, ‘Final report’ (May 2017). 314 Commission (n 282) Recital 13 and art 7. 315 Commission (n 271) 5. 316 Commission, Proposal for a Regulation of the European Parliament and of the Council establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 515/2014, (EU) 2016/399, (EU) 2016/794 and (EU) 2016/1624, COM (2016) 731 final, art 10. 317 Alegre, Jeandesboz and Vavoula (n 294) 37–40. 318 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council on establishing a framework for interoperability between EU information systems (borders and visa) and amending C ouncil Decision 2004/512/EC, Regulation (EC) No 767/2008, Council Decision 2008/633/JHA, Regulation (EU) 2016/399 and Regulation (EU) 2017/2226’ COM (2017) 793 final (hereinafter collectively the ‘Interoperability Proposals’). 319 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council on establishing a framework for interoperability between EU information systems (police and judicial cooperation, asylum and migration)’ COM (2017) 794 final (hereinafter the ‘Interoperability Proposals’. 320 Commission, ‘Amended proposal for a Regulation of the European Parliament and of the Council on establishing a framework for interoperability between EU information systems (borders and visa) and amending Council Decision 2004/512/EC, Regulation (EC) No 767/2008, Council Decision 2008/633/JHA, Regulation (EU) 2016/399, Regulation (EU) 2017/2226, Regulation (EU) 2018/XX [the ETIAS Regulation], Regulation (EU) 2018/XX [the Regulation on SIS in the field of border checks] and Regulation (EU) 2018/ XX [the eu-LISA Regulation]’ COM (2018) 478 final; ‘Amended proposal for a Regulation of the European Parliament and of the Council on establishing a framework for interoperability between EU information systems (police and judicial cooperation, asylum and migration) and amending [Regulation (EU) 2018/ XX (the Eurodac Regulation)] Regulation (EU) 2018/XX [the Regulation on SIS in the field of law enforcement], Regulation (EU) 2018/XX [the ECRIS-TCN Regulation] and Regulation (EU) 2018/XX [the eu-LISA Regulation]’ COM (2018) 480 final. 321 Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa [2019] OJ L135/27 (hereinafter collectively the ‘Interoperability Regulations’). 322 Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial

Centralised Databases 519 to exchange data and to share information so that authorities and competent officials have the information they need, when and where they need it’.323 The Interoperability Regulations have been adopted in response to the perceived need to improve EU border management, to combat cross-border crime and, more generally, to enhance the internal security of the EU.324 Interoperability will enable information systems to ‘speak to each other’ and will function as an evolutionary tool that will allow further uses through the aggregation of data from different sources. In particular, interoperability will allow faster, seamless and more systematic access to information, enable the detection of individuals who use multiple identities, facilitate identity checks of thirdcountry nationals and streamline access for law enforcement purposes.325 Its four main components are: the European Search Portal (ESP), the shared Biometric Matching Service (BMS), the Common Identity Repository (CIR) and the Multiple Identity Detector (MID). In particular, the ESP will enable competent authorities to simultaneously query the underlying systems to which they have access and the combined results will be displayed on one single screen.326 Even though the screen will indicate in which databases the information is held, access rights will remain unaltered and will proceed following the rules of each database.327 Furthermore, the BMS will generate and store templates from all biometric data recorded in the underlying systems,328 thus effectively becoming a new database compiling biometrics from the SIS, the VIS, Eurodac, the EES and the ECRIS-TCN, and will substitute separate searches. An extension of the BMS and a novel tool not foreseen by the HLEG, the MID will use alphanumeric data stored in the CIR and the SIS with the aim of detecting multiple identities. The MID will create links between identical data to indicate whether the individual is lawfully registered in more than one system or whether identity fraud is suspected.329 At the core of interoperability lies the CIR, ‘a shared container of identity data, travel document and biometric data’.330 This will store an individual file for each person registered in the systems containing both biometric and biographical data as well as a reference indicating the system from which the data were retrieved.331 The CIR will combine data from all information systems for third-country nationals, but the SIS and its main objectives will be to enable identification of third-country nationals without (proper)

c ooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 [2019] OJ L135/85 (hereinafter collectively the ‘Interoperability Regulations’). 323 Commission (n 318); Commission (n 319) 2. 324 Commission, ‘Commission Staff Working Document – Impact assessment accompanying the document Proposal for a Regulation of the European Parliament and the Council on establishing a framework for interoperability between EU information systems (borders and visa) and amending Council Decision 2004/512/EC, Regulation (EC) No 767/2008, Council Decision 2008/633/JHA, Regulation (EU) 2016/399 and Regulation (EU) 2017/2226 and Proposal for a Regulation of the European Parliament and the Council on establishing a framework for interoperability between EU information systems (police and judicial cooperation, asylum and migration)’ SWD (2017) 473 final, 3; Interoperability Regulations, Recital 9. 325 Commission (n 318); Commission (n 319) 15. 326 Interoperability Regulations, arts 6–11. 327 ibid Recital 15. 328 ibid arts 12–16. 329 ibid arts 25–36. 330 ibid Recital 26. 331 ibid arts 17–24.

520 Databases travel documents, assist in the detection of individuals with multiple identities and streamline the procedure for consulting information systems for law enforcement purposes.332 It is beyond the remit of this chapter to exhaustively analyse the fundamental rights implications of interoperability. It suffices to mention that interoperability marks a fundamental shift from the compartmentalised approach to information systems which are governed by tailor-made rules to that of a shared environment entailing increased connectivity, with important implications for the purpose limitation principle.333 New databases (MID the BMS and the CIR) will be established and the exercise of individual rights as well as judicial review will be significantly hindered.334 That said, interoperability has enabled the revision of the procedure regarding law enforcement access to immigration data; through the CIR, a two-step process is foreseen, named ‘hit-flag’ functionality, which will replace law enforcement access to individual information systems, as outlined earlier. In the first step, a law enforcement officer will be able to query all systems at once so as to identity whether any records on an individual exist in any of these without obtaining prior authorisation or need to fulfil specific conditions. Access will be restricted to a mere ‘hit/no-hit’ notification, indicating the presence (or non-presence) of data. In the event of a ‘hit’, the officer will not have access to any specific data stored in the system. However, in the second step, the officer will request full access to those information systems that generated hits. The officer would need to justify the need to access these systems through the procedure prescribed for each database and subject to prior authorisation by a designated authority.335 Nevertheless, the first step can take place on a routine basis and will not require ex ante authorisation. Streamlining law enforcement access has been prompted by complaints at the national level that the current ‘cascade mechanism’ is a cumbersome procedure from an administrative perspective that results in delays and missed opportunities to uncover necessary information.336 However, interoperability may progressively lead to routine access. As noted by the EDPS, the existence of a ‘hit’ – that the indicated database holds a file on the individual in question – is significant, since it reveals elements of an individual’s personal life (for instance, that they are visa-free travellers or asylum seekers) and therefore this first step of checking whether there are personal data in any of the underlying systems should also take place after fulfilling the specific conditions of access prescribed in the legal basis of each database.337 Conversely, if there is no ‘hit’, the authorities may have still acquired some information as regards the individual in question – for example, as to whether they belong to a specific group of third-country nationals. Importantly, it is hard to conceive that upon finding that a database holds

332 ibid art 17(1). 333 EDPS, ‘Opinion 4/2018 on the Proposals for two Regulations establishing a framework for interoperability between EU large-scale information systems’ (16 April 2018) 12. 334 Vavoula (n 302) 140–44 and 153–54. 335 Interoperability Regulations, art 22. 336 Commission, ‘Interoperability Proposals (n 318–319) 23 and 45. 337 EDPS (n 333) 17. See also Teresa Quintel, ‘Connecting Personal Data of Third Country Nationals: Interoperability of EU Databases in the Light of the CJEU’s Case Law on Data Retention’, University of Luxembourg Working Paper 2/2018, SSRN Paper, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3132506.

Centralised Databases 521 information on a person, the verifying authority ensuring that the conditions for access have been met will not allow such access. This will be particularly the case when this function will be used in cases of unknown perpetrators or victims of offences, where the existence of information on the individual in a system will pre-empt the verification of the conditions of access. In other words, not only the independence and objectivity but also the very existence of a verifying authority may be biased by the two-step approach. Arguably, this new function may enable national authorities to engage in ‘fishing expeditions’, whereby the importance of the conditions of access will be marginalised. Access to immigration data may be legitimised simply because these data are available in one or more information systems.338 The establishment of the CIR may even grow the appetite to expand surveillance of movement to EU nationals with a view to even out the negative implications for third-country nationals. Discussions to further expand interoperability to passengers’ data, such as Passenger Name Record (PNR) and Advanced Passenger Information (API) data, both discussed below)339 as well as data contained in the CIS340 are examples of how interoperability may have a wider reach in the future. Additional concerns are raised in relation to Article 20 of the Interoperability Regulations, which empowers national police authorities to query the CIR with biometric data taken during an identity check in the presence of the person in question, for the sole purpose of identifying them. The circumstances under which identity checks may be carried out are: (a) where a police authority is unable to identify a person due to the lack of a travel document or another credible document proving that person’s identity; (b) where there are doubts about the identity data provided by a person; (c) where there are doubts about the authenticity of the travel document or another credible document provided by a person; (d) where there are doubts about the identity of the holder of a travel document or of another credible document; or (e) where a person is unable or refuses to cooperate.341 Where a search indicates that data on that person are stored in the CIR, the querying authority may access to the record retained in the CIR and obtain a reference to the underlying data to which the record belongs.342 A police authority will perform a query if they are so empowered through national legislative measures that must specify the precise purposes of the identification, designate the competent police authorities and prescribe the procedures, conditions and criteria of such checks.343 The purposes for which queries may take place are those referred to in Article 2(1)(b) and (c) of the Interoperability Regulations, namely the prevention and the combating of illegal immigration, the high level of security including the maintenance of public security and public policy and safeguarding security in the territories of the Member States.

338 See Vavoula (n 302) 149–52. 339 ‘Europol Foresees Key Role in “the EU Travel Intelligence Architecture”’ (Statewatch, 5 November 2018), www.statewatch.org/news/2018/nov/eu-pnr-iwg-update.htm. 340 Commission, ‘Study on Advance Passenger Information (API) – Evaluation of Council Directive 2004/82/ EC on the obligation of carriers to communicate passenger data’ (February 2020) 75. 341 Interoperability Regulations, art 20(1). cf the Commission Proposals, where these circumstances were not listed. See Council, Document 14691/18 (10 December 2018) 163–70. 342 Interoperability Regulations, art 20(3). 343 ibid art 20(5).

522 Databases This novelty that has been characterised as the ‘most controversial use(s)’344 of interoperability raises serious proportionality concerns. In essence, Article 20 will enable random identity checks to be carried out at the national level on the basis of biometric data in the CIR, and Member States that wish to benefit from this facility must circumscribe relevant provisions at the national level. The only requirement is that the purposes of identity checks must be aligned with those of fighting irregular migration and ensuring a high level of security.345 Article 20 contains specific circumstances under which police authorities are authorised for identification checks; however, the lack of common criteria and purposes may lead to highly divergent rules and practices at the national level, whereby third-country nationals, or EU nationals looking like foreigners, may find themselves being subjected to different practices depending on how proactive a police authority in a Member State is. As noted by the Article 29 Working Party (now the European Data Protection Board), ‘querying the CIR … could result in a very large number of accesses given the volume of identity checks led by police authorities’.346 Extensive identity checks by police authorities may fuel discriminatory practices based on increased suspicion towards specific categories of individuals, which may proceed to identification checks to third-country nationals on the spot solely on the basis of extensive (racial) profiling.347 In that respect, the Interoperability Regulations state that ‘Member States shall take into account the need to avoid any discrimination against third-country nationals’348 – a wording which is arguably not particularly strong. Importantly, no further limitations as to intensity (eg, coercion in fingerprinting) or frequency have been elaborated.

F. EU Information Systems: Maximising the Collection of and Access to Personal Data The previous sections aimed at illustrating the growing blurring of the boundaries between databases established for different, often divergent, purposes and containing information on different categories of individuals. Databases established primarily for

344 Tony Bunyan, ‘The “Point of No Return”: Interoperability Morphs into the Creation of a Big Brother Centralised EU State Database Including All Existing and Future Justice and Home Affairs Databases’ (Statewatch, July 2018), statewatch.org/analyses/no-332-eu-interop-morphs-into-central-database-revised.pdf. 345 The conduct of random identity checks for both immigration and law enforcement purposes has been accepted by the EU Court of Justice in several cases: Joined Cases C-188/10 and C-189/10 Aziz Melki and Sélim Abdeli [2010] ECLI:EU:C:2010:363, paras 69–70; Case C-9/16, A v Staatsanwaltschaft Offenburg, ECLI:EU:C:2017:483, para 46. 346 Article 29 Working Party, ‘Opinion on Commission proposals on establishing a framework for interoperability between EU information systems in the field of borders and visa as well as police and judicial cooperation, asylum and migration’ (WP266, 2018) 11. 347 See Teresa Quintel, ‘Interoperability of EU Databases and Access to Personal Data by National Police Authorities under Article 20 of the Commission Proposals’ (2018) 4 European Data Protection Law Review 470. See also Statewatch and PICUM, ‘Data Protection, Immigration Enforcement and Fundamental Rights: What the EU’s Regulations on Interoperability Mean for People with Irregular Status’ (2019), https://picum. org/wp-content/uploads/2019/11/Data-Protection-Immigration-Enforcement-and-Fundamental-RightsFull-Report-EN.pdf, 35. 348 Interoperability Regulations, art 20(5).

Decentralised Mechanisms of Data Exchange 523 immigration control purposes are designed to store personal data on individuals engaging in legitimate activities, such as applying for a short-stay visa or for international protection, sponsoring a visa applicant or merely travelling for tourism or business purposes. Yet, as seen above, the trend of allowing access to these systems by law enforcement authorities and Europol has become the norm, under the logic of ‘filling the gaps’ in information exchange. This is notwithstanding the fact that the justification has been fragile and the actual effectiveness of such access is based on limited anecdotal information. These developments run counter to the data protection principle of purpose limitation as well as to the principle of proportionality, which is key in the protection of individuals’ right to respect for private life and protection of their personal data; in broader terms, they signify the elimination of the distinction between innocent and suspect activity under a securitised approach, whereby the quest for security justifies the maximum collection and further processing of personal data, regardless of their administrative nature. Behind the trend of granting access to immigration data by law enforcement authorities lies the perception that third-country nationals collectively are de facto risky individuals suspected of criminality, the movement of whom constitutes an inherently dangerous activity that must be controlled and monitored.349 Law enforcement access is a prime example of preventive justice through risk assessment, whereby emphasis is placed on identifying unknown threats by assigning risk to different suspect populations.350 Furthermore, it is evident that once personal data are collected and stored in centralised databases, there seems to be no barrier to prevent that data from becoming available for objectives unrelated to the original context within which they were collected. Further challenges are posed by the move towards interoperability of information systems: despite it being framed otherwise, the issue is viewed as a ‘technical’ one, and the significant legal implications are marginalised in lieu of enhancing administrative and law enforcement efficiency, automaticity and maximised use of resources. The lack of a definite definition of interoperability suggests that its outer limits are yet to be reached and will be informed by technological evolution.

III. Decentralised Mechanisms of Data Exchange Amongst National Authorities Alongside the proliferation and development of EU-wide centralised information systems and attempts to enhance their synergies and interoperability, another central element to the development of law enforcement cooperation in the EU has been the promotion of cooperation among national authorities through decentralised instruments. Such efforts have surfaced most prominently in the field of police cooperation, with mutual legal assistance and judicial cooperation being pushed primarily via specialised proposals such as the exchange of national criminal records, DNA files or

349 Thomas Gammeltoft-Hansen, ‘Filtering out the Risk Migrant: Migration Control, Risk Theory and the EU’ (AMID Working Paper Series 52/2006, 2006). 350 Louise Amoore and Marieke de Goede (eds), Risk and the War on Terror (Routledge, 2008).

524 Databases fingerprint data. Attempts to establish a framework facilitating the exchange of personal data between national authorities, in particular police authorities, represent formidable challenges of legality and fundamental rights. This is the case in particular with regard to the differences in the regulation of police authorities between Member States, differences which are closely related to the position of the police in the criminal justice system and the domestic constitutional framework. This section will examine these challenges when looking at mechanisms of boosting the exchange of personal data between national authorities in criminal matters.

A. Criminal Records: From a Decentralised to a Centralised Approach? A key strand of EU action in efforts to boost the exchange of personal data in criminal matters has focused in facilitating the exchange of criminal records between national authorities. A first, modest step in that respect was a 2005 (former) third pillar Decision ‘on the exchange of information extracted from the criminal record’.351 This Decision required Member States to designate a central authority,352 which would inform without delay the central authorities of the other Member States of criminal convictions and subsequent measures in respect of their nationals,353 answer to requests by central authorities of other Member States,354 and request criminal record data from these authorities on behalf of requesting individuals in its Member State.355 Exchange of information took place on the basis of a form annexed to the Decision. As a second step, in 2005 the Commission tabled another proposal, this time for a Framework Decision on the organisation and content of the exchange of information extracted from criminal records between Member States, which would repeal the 2005 Decision.356 Framework Decision 2009/315/JHA357 contained more detailed provisions on the exchange of information on criminal records between national authorities.358 These developments did not stop the Commission from pushing for further integration and the establishment of an EU-wide system of criminal records exchange.359

351 Council Decision 2005/876/JHA of 21 November 2005 on the exchange of information extracted from the criminal record [2005] OJ L322/33. See also in this context Council Framework Decision 2008/675/JHA of 24 July 2008 on taking into account of convictions in the Member States of the European Union in the course of new criminal proceedings [2008] OJ L220/32. 352 Council Decision 2005/876/JHA, art 1. 353 ibid art 2. 354 ibid art 3(1) first indent. 355 ibid art 3(1) second indent. 356 Commission, ‘Proposal for a Council framework Decision on the organisation and content of the exchange of information extracted from criminal records between Member States’ COM (2005) 690 final. 357 Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States [2009] OJ L93/23. 358 For background and analysis, see James B Jacobs and Dimitra Blitsa, ‘Major “Minor” Progress under the Third Pillar: EU Institution Building in the Sharing of Criminal Record Information’ (2008) 8 Chicago-Kent Journal of International and Comparative Law 111. 359 For a discussion of the development of a centralised EU criminal records database, see Constantin Stefanou and Helen Xanthaki (eds), Towards a European Criminal Record (Cambridge University Press, 2008).

Decentralised Mechanisms of Data Exchange 525 Based on Article 11 of Framework Decision 2009/315/JHA, which contains a general statement that the format and other ways of exchanging criminal records would be set up by the Council at a future date,360 the Commission tabled a proposal for a Decision establishing a European Criminal Records Information System (ECRIS),361 which would consist of national criminal records databases, a ‘common communication infrastructure that provides an encrypted network’ and interconnection software allowing the exchange of information between various criminal records databases.362 Council Decision 2009/316/JHA was soon adopted363 and the ECRIS became operational in April 2012. The ECRIS is based on a decentralised architecture, enabling the electronic interconnection between Member States, and prescribes rules to ensure that information on past convictions as included in domestic criminal records systems can be exchanged via electronic standardised formats in a uniform and speedy manner and within specific deadlines. The underlying rationale of the ECRIS is that complete information on previous convictions of an EU citizen should be available from the Member State of nationality of that person. Member States that have convicted a citizen of another Member State are obliged to notify the Member State through the ECRIS of that person’s nationality and send any information relating to the conviction, including any subsequent updates. As a result, the ECRIS operates on the basis of the principle of nationality, whereby each Member State maintains a central repository of all convictions handed down in the EU by criminal courts against its nationals; that Member State must store, update and exchange such information upon request and can thus provide exhaustive and updated information on its nationals criminal records. The conviction information must be exchanged for the purpose of criminal proceedings and, if so permitted by national law, can be exchanged for other purposes, such as administrative procedures, employment and licences. As at the time when the ECRIS proposal was adopted, the parent Framework Decision had not been formally adopted yet, the ECRIS proposal appeared premature, especially in light of the variety of institutional issues and human rights concerns raised by the exchange of criminal records. These concerns were exacerbated by the diversity in what constitutes a ‘criminal conviction’ and what is included in a ‘criminal record’ in national systems, as well as the lack of clarity as to the categories of information which would be exchanged, the purpose of the exchange and the use of such information in the receiving state.364

360 Which would coincide with the deadline for the implementation of the Framework Decision – see Framework Decision 2009/315/JHA, art 11(3). 361 Commission, ‘Proposal for a Council Decision on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2008/XX/JHA’ COM (2008) 332 final (hereinafter ‘Proposal for ECRIS’). 362 ibid art 3. 363 Council Decision 2009/316/JHA of 6 April 2009 on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2009/315/JHA [2009] OJ L93/33. 364 There is ongoing debate in particular regarding the exchange of data on convictions on administrative offences (along with criminal offences) and whether data on disqualifications (which may not constitute criminal convictions) should be exchanged. Moreover, it is noteworthy that Framework Decision 2009/315JHA also requires the exchange of fingerprints – see below.

526 Databases Indeed, the Commission implementation report365 published in January 2016 reveals that in a considerable number of Member States, the definition of ‘criminal conviction’ goes beyond the decisions of criminal courts, including decisions taken by a prosecutor and, in some cases, judicial data on investigations or ongoing cases.366 In other cases, no data as to what constitutes a ‘criminal conviction’ are available. In practice, though all Member States have transposed the legal basis, none of them exchanges information through the ECRIS with all other Member States.367 Furthermore, whilst the number of requests is increasing, the use of the ECRIS seems unequal, with certain Member States being more active in terms of requesting information rather than receiving it.368 In addition, implementation of the obligation to notify other Member States is uneven, as some Member States send few notifications about convictions of EU citizens who are not nationals of that Member State. In the wake of the terrorist events in France in January 2015, calls to boost the exchange of information extracted from criminal records of convicted persons proliferated. In the Riga Joint Statement released by the JHA Ministers, the possibility of further developing the ECRIS was stressed369 and the improvement of the ECRIS featured in the European Agenda on Security that was adopted in April 2015: the ECRIS ‘does not work effectively for non-EU nationals convicted in the EU’.370 After the terrorist attacks in November 2015, both the JHA Ministers and the European Council highlighted the need to share more information on terrorist activity, notably by extending the ECRIS to third-country nationals.371 However, the key shortcoming in the operation of the ECRIS was that although the legal framework allowed for the exchange of information on convictions concerning third-country nationals, there was no mechanism or procedure in place to do so efficiently, due to the emphasis placed on the EU nationality of the convicted person. As third-country nationals have no EU Member State of nationality, a complete overview of the criminal history of a particular individual must be requested directly from the convicting Member State(s). A requesting Member States would usually not know in which Member State(s) a third-country national has previously been convicted, hence the only way forward was to send requests to all states (blanket requests) in order to obtain information. In practice, this administrative burden deterred Member States from sending such requests and often relied only on information stored in their own national criminal record registers. In order to address this issue, the Commission adopted a proposal for a Directive amending the existing legal framework so as to enable the exchange of criminal records of

365 Commission, ‘The implementation of Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from criminal record between Member States’ (Report) COM (2016) 6 final. 366 ibid 3. 367 Commission, ‘The exchange through the European Criminal Records Information System (ECRIS) of information extracted from criminal records between the Member States’ (Report) COM (2017) 341 final, 4. 368 ibid. 369 Council, Document 5855/15 (2 February 2015). 370 Commission, ‘The European Agenda on Security’ (Communication) COM (2015) 185 final, 7–8. 371 Council, Document 14419/15 (20 November 2015); European Council, Document EUCO 28/15 (18 December 2015).

Decentralised Mechanisms of Data Exchange 527 third-country nationals.372 Member States would be required to create an index-filter of identification data on convicted third-country nationals and transmit it to the other Member States in an anonymised way. Other Member States would be able to search that index in order to identify which Member State holds criminal record information on third-country nationals. The inclusion of fingerprints was also foreseen as a means of identifying the individual in question.373 Early on in the discussions within the Council, it became clear that a decentralised structure of the ECRIS in relation to third-country nationals was technically and administratively too burdensome.374 Consequently, the negotiations on the proposed Directive were suspended, following the request by the Member States to the Commission, at the JHA Council meeting of 9 June 2016, to present a proposal for establishment of a centralised database for convicted third-country nationals.375 In June 2017, the Commission tabled a proposal for a Regulation foreseeing the creation of the ECRIS for third-country nationals (ECRIS-TCN),376 and an accompanying proposal for a Directive amending Framework Decision 2009/315/JHA and replacing Framework Decision 2009/316/JHA.377 This development is notwithstanding the fact that when the Commission had adopted the proposal for ECRIS Directive, it discarded the option of a centralised system, claiming that: It risks violating the principle of subsidiarity and the non-discrimination principle with regard to TCN and EU nationals, as the storage of full criminal record information at central level and only for TCN (for EU nationals full criminal record information is only stored at Member State level) is not necessary to reach the objectives.378

372 Commission, ‘Proposal for a Directive of the European Parliament and of the Council amending Council Framework Decision 2009/315/JHA, as regards the exchange of information on third country nationals and as regards the European Criminal Records Information System (ECRIS), and replacing Council Decision 2009/316/JHA’ COM (2016) 7 final (hereinafter ‘Proposal for ECRIS Directive’). Two reports have also been released in that respect. See UNiSYS, ‘Feasibility Study: Establishing a European Index of Convicted Third Country Nationals’ (11 June 2010). See also ICT, ‘ICT Final Report – Assessment of ICT impacts of the legislative proposal for ECRIS TCN system regarding the exchange of convictions for third country nationals and stateless people (TCN)’ (4 December 2015). 373 Commission, ‘Proposal for ECRIS Directive’ (n 372) art 1(4); see also Recital 10. 374 Council, Document 9376 (30 May 2016). 375 Council, Document 9979/16 (8–9 June 2016). 376 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council establishing a centralised system for the identification of Member States holding conviction information on third country nationals and stateless persons (TCN) to supplement and support the European Criminal Records Information System (ECRIS-TCN system) and amending Regulation (EU) No 1077/2011’ COM (2017) 344 final (hereinafter ‘Proposal for the ECRIS-TCN Regulation’). See Wavestone, ‘Feasibility Study and Cost Assessment of the Establishment of a Centralised ECRIS TCN Solution’ (13 June 2017), https://www. statewatch.org/media/documents/news/2017/jul/eu-com-ecris-tcn-proposal-feasibility-study-centralisedsystem.pdf. 377 Council, Document 11568/17 (31 July 2017). 378 Commission, ‘Commission Staff Working Document, Impact Assessment Accompanying the proposal for a Directive of the European Parliament and of the Council amending Council Framework Decision 2009/315/ JHA, as regards the exchange of information on third country nationals and as regards the European Criminal Records Information System (ECRIS), and replacing Council Decision 2009/316/JHA’ SWD (2016) 4 final (hereinafter the ‘ECRIS Impact Assessment’) 31.

528 Databases The two proposals were negotiated in parallel and Regulation (EU) 2019/816379 and Directive 2019/884380 were adopted in June 2019. The purpose of the ECRIS-TCN will be to identify the Member State(s) holding criminal record information on a thirdcountry national in order to obtain information on previous convictions through the decentralised ECRIS.381 To that end, the system will record the identity information of third-country nationals who have been subject to convictions in the Member States. The ECRIS-TCN may be used when criminal record information on that person is requested in the Member State concerned for the purposes of criminal proceedings against that person, or for any of the following objectives, provided that the processing of criminal record data is enshrined under national law and subject to domestic rules.382 These purposes are: checking a person’s own criminal record on their request; security clearance; obtaining a licence or permit and employment vetting; vetting for voluntary activities involving direct and regular contacts with children or vulnerable persons; visa, acquisition of citizenship and migration procedures, including asylum procedures; and checks relating to public contracts and public examinations.383 However, a Member State may decide to use ECRIS-TCN for purposes other than those set out above if prescribed under, and in accordance with, national law.384 Eurojust, Europol and the EPPO will have direct access to the ECRIS-TCN in order to fulfil their tasks and to identify the Member States holding information on past convictions of third-country nationals.385 In the case of a hit indicating the Member States holding criminal record information on a third-country national, Eurojust, Europol and the EPPO may use their respective contacts to the national authorities of those Member States to request the criminal records information.386 Eurojust will also function as a central hub for information requests, addressed by third countries and international organisations, as to which Member States (if any) hold criminal records information on a third-country national.387

379 Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726 [2019] OJ L135/1 (hereinafter the ‘ECRISTCN Regulation’). 380 Directive (EU) 2019/884 on the exchange of information on third country nationals and the European Criminal Records Information System (ECRIS) [2019] OJ L151/143. The Directive effected the Regulation and introduced necessary modifications to the ECRIS; Member States were obliged to take necessary measures to ensure that convictions are accompanied by information on the nationality/nationalities of the convicted person if they have such information at their disposal. It also introduced procedures for replying to requests for information and ensured that a criminal records extract requested by a third-country national is supplemented by information from other Member States. 381 ECRIS-TCN Regulation, art 1. 382 ibid art 7. 383 In the future, ECRIS-TCN will also be used to support the aims of ETIAS in determining whether an ETIAS applicant constitutes a security threat. See Commission, ‘Proposal for a Regulation of the European Parliament and of the Council establishing the conditions for accessing the other EU information systems and amending Regulation (EU) 2018/1862 and Regulation (EU) yyyy/xxx [ECRIS-TCN])’ COM (2019) 3 final. 384 In that regard, a notification to the Commission is required, which will be published in the Official Journal of the EU. See ECRIS-TCN Regulation, art 7(2). 385 ECRIS-TCN Regulation, arts 14–17. 386 ibid art 14(4). 387 ibid art 17.

Decentralised Mechanisms of Data Exchange 529 The ECRIS-TCN will contain a series of personal data, including names, addresses and two types of special categories of personal data – fingerprints and potentially facial images388 – so as to allow more accurate identification of third-country nationals, whose information is often less reliable due to uncertainties regarding the identity documents presented. In a first phase, facial images may be used only to confirm the identity of a third-country national who has been identified as a result of an alphanumeric search or a search using fingerprint data. After technical readiness, facial images can also be used for automated biometric matching.389 Each record will be stored for as long as the data relating to the convictions of the person concerned are stored in the criminal records.390 The inclusion of fingerprints faced a series of technical and legal challenges. First, considering that between 2012 and 2016, only 1–3 per cent of requests through the existing ECRIS resulted in multiple identities being found, the necessity of recording a huge amount of fingerprint data to enable correct identification has been deemed unnecessary and disproportionate.391 Second, many Member States stored fingerprint data separately in other information systems and only a few include fingerprints in their criminal records or have a link between their criminal records and fingerprint databases.392 Third, proportionality challenges stemming in particular from the different conditions under which fingerprints are collected during a criminal procedure and various modalities of storage across Member States, depending among other things on the type of crime and the stage of the criminal procedure, were voiced.393 The divergent legal framework at the national level could lead to situations whereby a Member State may be obliged to collect and store the fingerprints of a person for a minor offence, even though its national law does not require the fingerprints to be stored in relation to the criminal record of that person.394 Different options were proposed in that respect; the obligation to exchange fingerprints of all convicted third-country nationals, which would lead to storage of fingerprints even in relation to minor offences; the use of lists of specific criminal offences, either those envisaged in the Europol Regulation or in the European Arrest Warrant Framework Decision;395 the obligation to exchange fingerprints in all cases where a custodial sentence would be handed down or in all cases stipulated under the national law.396 The latter option could potentially result in a relatively low number of fingerprints entered into the central system or could

388 If the national law of the Member State where a conviction is handed down allows for the collection and storage of facial images of a convicted person. See ibid art 5(3). 389 ibid art 6. 390 ibid art 8. 391 The EDPS suggested that ‘the use of fingerprints should be for the identification of TCN only if the identity of TCN cannot be ascertained by other means’. EDPS, Opinion 11/2017 – EDPS Opinion on the proposal for a Regulation on ECRIS-TCN (12 December 2017) 14. 392 Commission (n 378) 15. 393 Council, Document 6691/17 (24 February 2017). See also Council, Document 12033/17 (15 September 2017); EDPS, Opinion 3/2016 – Opinion on the exchange of information on third country nationals as regards the European Criminal Records Information System (ECRIS) (13 April 2016). 394 Opinion 3/2016 (n 393). 395 ECRIS-TCN Regulation, art 2(2). 396 Council, Document 6691/17 (24 February 2017).

530 Databases potentially increase the amount of false or incorrect data entered into the system, thus undermining the whole aim of establishing the ECRIS-TCN.397 In the end, the ECRISTCN Regulation follows a dual approach; according to Article 5(1)(b), the system will store fingerprint data that have been collected in accordance with national law during criminal proceedings. As a minimum, fingerprints must be recorded either when the third-country national has received a custodial sentence of at least six months or when the third-country national has been convicted of a criminal offence carrying a custodial sentence of a maximum of at least 12 months.398 The new minimum criteria may introduce a new requirement for fingerprinting convicted third-country nationals in many Member States, provided that their conviction meets one of the two thresholds. This is despite the fact that in relation to EU nationals, such fingerprinting requirement will not exist, thus leading to discriminatory treatment of third-country nationals.399 Another thorny aspect of the ECRIS-TCN was whether dual nationals – EU nationals who also hold the nationality of a third country – should be included in the personal scope of the system.400 The Regulation stresses that the exclusion of such persons would result in the information stored in the ECRIS-TCN being incomplete and would jeopardise the reliability of the system.401 The conditions for the inclusion of fingerprint data of dual nationals are different from those for persons who have only the nationality of a non-EU country; fingerprint data should only be included in the ECRIS-TCN where they have been collected in accordance with national law during criminal proceedings.402 This means that in connection to those dual nationals whose fingerprints are recorded, Member States should be able to use the data for law enforcement purposes, as well as for other purposes, where such use is permitted under national law.403 In this way, the conditions under which fingerprint data can be included in the ECRIS-TCN with regard to dual nationals will be comparable to the conditions under which fingerprint data are exchanged between Member States with respect to EU citizens under the ECRIS system established by Framework Decision 2009/315/JHA.404 The inclusion of dual nationals within the scope of the ECRIS-TCN has been criticised,405 as it effectively introduces the idea of first-class and second-class EU citizens406 and as such leads to

397 Council, Document 12596/17 (2 October 2017). 398 See Council, Document 13794/17 (31 October 2017); See also Council, Document 14633/17 (24 November 2017). 399 Chris Jones, ‘Disproportionate and Discriminatory: the European Criminal Records Information System on Third-Country Nationals (ECRIS-TCN)’ (Statewatch, February 2019), https://www.statewatch.org/media/ documents/analyses/no-340-ecris-tcn.pdf, 12. 400 ECRIS-TCN Regulation, art 2. 401 ibid Recital 9. 402 Therefore, art 5(1)(b)(ii) is not applicable to dual nationals. 403 ECRIS-TCN Regulation, Recital 9. The Commission was so dissatisfied with the non-inclusion of dual nationals’ fingerprints in ECRIS-TCN that it issued a declaration on the issue. See Council, Document 7870/19 ADD 1 (29 March 2019). 404 Council, Document 11310/18 (6 September 2018), https://www.statewatch.org/news/2018/sep/eu-councilecris-trn-multi.htm. 405 Council, Document 9894/18 (11 June 2018), where the Parliament seemed to have removed dual nationals from the scope of the proposal. 406 Meijers Committee – Standing committee of experts on international immigration, refugee and criminal law, ‘Note on the definition of third-country nationals in the Commission’s ECRIS- TCN proposal’ (CM1710, 2 October 2017).

Decentralised Mechanisms of Data Exchange 531 discriminatory treatment of a large category of the EU population.407 Concerns regarding the potential violation of the principle of non-discrimination are compounded by Article 7(4), which prescribes for an ‘access facility’,408 whereby national authorities, Europol, Eurojust and the EPPO will be able to query the system to verify whether, in respect of a person having the nationality of a Member State, any Member State holds criminal record information concerning this person as a third-country national.

B. Exchange of Information between Police Authorities: The Swedish Initiative It is in the field of police cooperation where major initiatives to boost the exchange of personal data between national authorities have occurred in recent years. The Hague Programme introduced the principle of availability according to which ‘the mere fact that information crosses borders should no longer be relevant’.409 Furthermore: [T]hroughout the Union, a law enforcement officer in one Member State who needs information in order to perform his duties can obtain this from another Member State and that the law enforcement agency in the other Member State which holds this information will make it available for the stated purpose, taking into account the requirement for ongoing investigations in that State.410

A key instrument towards the implementation of the principle of availability was an initiative tabled by Sweden411 following political impetus by the European Council in its Declaration on combating terrorism after the Madrid bombings.412 According to the Swedish government, the point of departure for the proposal was: [T]hat a national competence to detect, prevent or investigate a crime or a criminal activity attributed to a national authority by national law should be recognised by other Member States and constitute a right to request and obtain information and intelligence available in other Member States without any other formal requirements than those laid down in the Framework Decision.413

Negotiations resulted in the adoption in 2006 of Framework Decision 2006/960/JHA on simplifying the exchange of information and intelligence between law enforcement authorities of Member States.414 The Framework Decision is a measure building on

407 Meijers Committee – Standing committee of experts on international immigration, refugee and criminal law, Document CM1902 (22 January 2019). See Jones (n 399). 408 The term ‘access facility’ is used to describe this process in a number of Council documents. See Council, Document 11310/18 (n 404) and Document 9750/18 (8 June 2018). 409 The Hague Programme (n 214) pt 2.1. 410 ibid. 411 Council, Document 10215/04 (4 June 2004). 412 European Council (n 212). 413 Council, Document 10215/04 ADD 1 (16 June 2004). 414 Council Framework Decision 2006/960/JHA of 18 December 2006 on simplifying the exchange of information and intelligence between law enforcement authorities of the Member States of the European Union [2006] OJ L386/89.

532 Databases the Schengen acquis, in that it replaces Articles 39(1)–(3) and 46 CISA insofar as they relate to the exchange of information and intelligence.415 The purpose of the instrument is ‘to establish the rules under which Member States’ law enforcement authorities may exchange existing information and intelligence effectively and expeditiously for the purpose of conducting criminal investigations or criminal intelligence operations’ (emphasis added).416 In light of this broad objective, one of the major tasks has been to define with clarity the scope of the instrument and in particular: how to define ‘law enforcement authorities’; what is included under information and intelligence; and what constitutes criminal investigations and proceedings for the purposes of the Framework Decision.417 The Framework Decision contains a specific provision on definitions.418 A competent law enforcement authority is an authority designated as such by Member States and is ‘a national police, customs or other authority that is authorised by national law to detect, prevent and investigate offences or criminal activities and to exercise authority and take coercive measures in the context of such activities’ (emphasis added).419 It is clear – in particular by the potential extension to ‘other’ authorities and the reference to prevention – that the definition is broad and may lead both to the inclusion of a wide range of authorities within the scope of the instrument and to considerable diversity in the implementation of the instrument among Member States.420 Furthermore, information is exchanged with Europol and Eurojust.421 However, the Framework Decision also contains a limitation in the categories of ‘competent authorities’: it states that agencies or units dealing especially with national security issues are not covered by the concept of a competent law enforcement authority.422 While the wording is not entirely clear, the provision is designed to exclude intelligence agencies from the scope of the Framework Decision.423 Intelligence falls within the scope of the Framework Decision from the point of view of the information exchanged – ‘information and/or intelligence’ is defined very

415 Framework Decision 2006/960/JHA, art 12(1). See also Recitals 13 and 14. 416 Framework Decision 2006/960/JHA, art 1(1). 417 For a discussion of the treatment of some of these issues in the negotiations of the Framework Decision, see the correspondence between the House of Lords European Union Committee and the Home Office, reproduced in House of Lords, European Union Committee, ‘Correspondence with Ministers. March 2005 to January 2006’ (45th Report, session 2005–06, HL Paper 243) 512–20. 418 Framework Decision 2006/960/JHA, art 2. 419 ibid art 2(a). 420 This broad definition is confirmed in Council, Document 14258/07 (24 October 2007) 1, where it is mentioned that it is sufficient that Member States provide a general description of the type of authorities covered by the concept. On this point, see also the study by Geyer, who has provided an overview of the implementation of the Framework Decision with regard to the competent authorities in Member States: Florian Geyer, ‘Taking Stock: Databases and Systems of Information Exchange in the Area of Freedom, Security and Justice’ (CEPS Research Paper No 9, May 2008). Geyer notes more generally that efforts to limit the number of competent authorities having access to EU databases and involved in the exchange of data might be fruitless due to the discretion left to Member States to designate competent authorities. 421 Framework Decision 2006/960/JHA, art 6(2). 422 ibid art 2(a). 423 The Commission has also tried unsuccessfully to expressly include intelligence services within the EU legal framework of information exchange. See Commission, ‘Proposal for a draft Decision on the transmission of information resulting from the activities of security and intelligence services with respect to terrorist offences’ COM (2005) 695 final.

Decentralised Mechanisms of Data Exchange 533 broadly, including ‘any type of information or data which is held by law enforcement authorities’ and even ‘any type of information or data which is held by public authorities or by private entities and which is available to law enforcement authorities without the taking of coercive measures’.424 The scope of the Framework Decision with regard to the information to be exchanged is thus extremely broad. This is particularly the case in the light of the fact that the scope of the Framework Decision is defined – in a departure from the original Swedish proposal425 – in general terms and applies to any offence, as no provisions defining its scope on the basis of specific offences (or serious crime in general) have been included in the text.426 The Framework Decision also contains definitions of a criminal investigation and a criminal intelligence operation. Criminal investigation is defined as ‘a procedural stage within which measures are taken by competent law enforcement or judicial authorities, including public prosecutors, with a view to establishing and identifying facts, suspects and circumstances regarding one or several identified concrete criminal acts’ (emphasis added).427 Criminal intelligence operation is defined as ‘a procedural stage, not yet having reached the stage of a criminal investigation, within which a competent law enforcement authority is entitled by national law to collect, process and analyse information about crime or criminal activities with a view to establishing whether concrete criminal acts have been committed or may be committed in the future’ (emphasis added).428 Three points are noteworthy here: the wide range of information that can be exchanged for the purposes of criminal intelligence operations; the wide range of competent authorities included in the definition of a criminal investigation, which include judges – the definition reflects diversity in national criminal justice systems as to which authorities are involved in the various stages of the criminal justice process; and, last but not least, the fact that although definitions depend largely on national law, this is one of the marked instances where an EU instrument provides definitions of what constitutes a criminal investigation or a criminal intelligence operation. In light of the potentially broad scope of the instrument, the Framework Decision also contains a series of caveats and limitations. It is a rare example of an instrument beginning with clarification of what is not covered and what is not required by EU law. The opening article clarifies that the Framework Decision does not impose any obligation on Member States to gather and store information and intelligence for the purpose of providing it to the competent law enforcement authorities of other Member States,429

424 Framework Decision 2006/960/JHA, art 2(d). 425 This defined the scope on the basis of various categories of persons whose data could be exchanged by national authorities – see art 6 of the original proposal. 426 But note that the national authorities may refuse a request in cases pertaining to an offence punishable by a term of imprisonment of one year or less in the requested Member State. See art 10(2). In a sense, this reverses the approach of the original Swedish proposal, which stated that all offences punishable by a maximum sentence of 12 months or more would be included in its scope (art 3). Member States thus agreed to in principle extend the scope of the Framework Decision beyond the 12-month minimum maximum custodial sentence threshold (with refusal to execute a request if an offence falls below this threshold being only discretionary). 427 Framework Decision 2006/960/JHA, art 2(b). 428 ibid art 2(c). 429 ibid art 1(3).

534 Databases obtain information or intelligence by means of coercive measures,430 or provide information and intelligence to be used as evidence before a judicial authority.431 It is also clarified that the Framework Decision does not give any right to use such information or intelligence for that purpose.432 This is one of the major limitations of the scope of the instrument and may lead to further proposals aiming to address the thorny issue of the use of exchanged police information as evidence in courts. Overall, these provisions can be seen as an attempt to safeguard national autonomy in not requiring national authorities to be proactive in obtaining information or intelligence on behalf of their counterparts in other Member States. Subject to these definitions and limitations, the Framework Decision aims to boost and speed up the exchange of information and intelligence. Requests for information are made – in a manner reminiscent of the operation of the mutual recognition instruments – on the basis of a minimum standard set out in a form annexed to the Framework Decision, which aims at standardisation and a degree of automaticity in the process. However, the Framework Decision itself also sets out a number of conditions governing such requests – these require the requesting authority to substantiate in detail the request.433 Member States are under the obligation to ensure that information is provided to the competent authorities of other Member States conducting a criminal investigation or a criminal intelligence operation.434 They must ensure that conditions are not stricter than those applicable at the national level for providing and requesting information to these authorities,435 thus introducing one facet of the principle of equivalence in the exchange of information.436 Requests may be refused only if one of the following exhaustively enumerated grounds laid down in Article 10 apply where the provision of information or intelligence will harm the essential national security interests of the requested state, or jeopardise the success of a current investigation/ intelligence operation or the safety of individuals, or clearly be disproportionate or irrelevant; the request pertains to an offence punishable by a term of imprisonment of one year or less in the requested Member State; and a judicial authority in the requested Member State has not authorised the access and exchange of information.437 430 ibid art 1(5). However, information or intelligence previously obtained by coercive measures may be provided when permitted by the law of the sending state. See art 1(6). 431 ibid art 1(4). 432 ibid. 433 See ibid art 5. Article 5(1) states that the request must set out factual reasons to believe that relevant information and intelligence is available in another Member State and explain the purpose for which the information and intelligence is sought, and the connection between the purpose and the person who is the subject of the information and intelligence. Moreover, art 5(2) states that the requesting authority must refrain from requesting more information or intelligence, or setting narrower timeframes than are necessary for the purpose of the request. 434 ibid art 3(1) and (2). 435 ibid art 3(3). 436 However, it has been argued that equivalence is not being achieved, as the Framework Decision no longer includes expressly the caveat of art 39 CISA that mutual assistance between police authorities must take place in compliance with national law. It was thought that the Framework Decision would give the authorities of requesting Member States more privileged access than the authorities in the requested Member State. See letter of the Chairman of the House of Lords European Union Committee to Hazel Blears MP, then Minister of State for Policing, Security and Community Safety, Home Office, 26 May 2005, reproduced in House of Lords, European Union Committee (n 417) 512. 437 Framework Decision 2006/960/JHA, art 10(1)–(3).

Decentralised Mechanisms of Data Exchange 535 The Framework Decision also introduces speed. Member States must respond to requests within at most eight hours to urgent438 requests regarding the offences included in Article 2(2) of the European Arrest Warrant Framework Decision when the information is held in a database directly accessible by a police authority;439 for non-urgent cases of this nature, the deadline is one week,440 and for all other cases, it is two weeks.441 This is a significant change from Articles 39 and 46 CISA, which did not contain specific rules on time limits. The Framework Decision also allows the spontaneous exchange of information or intelligence – that is, without a prior request – on the basis of the law of the sending Member State in cases involving offences referred to in Article 2(2) of the European Arrest Warrant Framework Decision. A provision on data protection is included, aimed at regulating the exchange of information. Applicable data protection rules include the rules governing existing channels of international law enforcement cooperation should Member States wish to apply these channels to transfers under the Framework Decision.442 Moreover, it is noteworthy that the use of data that has been exchanged is governed by the law of the receiving state.443 Council of Europe initiatives (such as the 1981 Convention and the 1987 Recommendation), which were the legal instruments applicable in terms of personal data protection,444 have since been replaced by Directive (EU) 2016/680. The Framework Decision has the potential to boost the exchange of a wide range of personal data between national authorities. In doing so, it raises a number of questions concerning the legality and human rights implications of such exchanges, as the answer to the question of what happens to the personal data once it has been transmitted to another authority (and thus another jurisdiction) remains open. A central question in this context is whether the requesting authority will be able to obtain information from authorities in other Member States which it would not be able to obtain by their equivalent authorities in their own Member State (as there are discrepancies in the national authorities designated as competent authorities by Member States). Moreover, there is the danger that national authorities would circumvent limitations in their domestic law (eg, regarding the use of investigative techniques or coercive measures) by obtaining information by authorities in other Member States where the law does not provide for equivalent safeguards (a kind of information and intelligence forum shopping). Similar

438 An important issue for Member States has been to determine which cases qualify as urgent. In that respect, the Council endorsed a series of guidelines regarding the implementation of the Framework Decision, whereby it is explained that an urgent case can be understood to mean any situation during which the fact of obtaining information will prevent a risk of death or harm to persons or serious damage to property, result in, or terminate, a decision involving deprivation of liberty (where such a decision has to be taken within a short period of time), or prevent the loss of information that is important for the further stages of an investigation. See Council, Document 16870/08 (7 January 2007) 7. 439 Framework Decision 2006/960/JHA, art 4(1). If the requested authority is unable to respond within the deadline, it must provide reasons for this. See art 4(2). 440 ibid art 4(3). 441 ibid art 4(4). 442 ibid arts 8(1) and 6. 443 ibid art 8(2). 444 ibid. See also the provision on purpose limitation in art 8(3) and the possibility for the sending authority to impose conditions on the use of information in art 8(4).

536 Databases concerns arise with regard to data protection, with the Framework Decision adopting the standards of the receiving (and not the sending) state regarding the use of transferred data. The Framework Decision addresses some of these concerns by including caveats with regard to the use of coercive measures and the need for judicial authorisation. It also includes a general clause on the respect of fundamental rights.445 However, the issue of the consequences of treating foreign police authorities (subject to the law of another Member State) as equivalent to authorities of one’s own Member State remains. In the first years after its adoption, the Framework Decision had been implemented by almost two-thirds of the Member States, but only few of them used the mechanism frequently, whereas the majority did not use the Framework Decision on a regular basis. As illustrated in the Communication on a European Information Exchange Model (EIXM),446 the Swedish initiative had not reached its full potential, even though the underlying principle of the legislative instrument as regards the procedures in place or the strict time limits were already at that time implemented.447 The incomplete implementation and the modest use of the system were also indicated as issues by the Council, which further adopted an implementation report taking stock of the Commission’s findings.448 The Council found that the general standards for cross-border information exchange were already in place, notably in the form of bilateral or multilateral agreements, and the formalities prescribed in the Framework Decision were not preferred mainly because they have been considered complex and cumbersome.449 Since then, the situation has not improved drastically. Whereas all Member States have implemented the Framework Decision,450 its practical effectiveness remains problematic, with key areas of concerns being the compliance with time limits, as some Member States are persistently delayed, and the extent to which access to information takes place in an equivalent manner.451

C. The Prüm Framework In parallel to the efforts to enhance information exchange through the adoption of EU legislation, a number of Member States decided to boost police cooperation among

445 ibid art 1(7). This is very similar to the general clause introduced in the Framework Decision on the European Arrest Warrant. 446 Commission, ‘Strengthening law enforcement cooperation in the EU: the European Information Exchange Model (EIXM)’ (Communication) COM (2012) 735 final, 8. 447 See Commission, ‘Staff Working Paper Operation of the Council Framework Decision 2006/960/JHA of 18 December 2006 (“Swedish Initiative”)’ SEC (2011) 593 final. 448 Council, Document 15277/11 (14 October 2011). 449 Council, Document 13970/11 (13 September 2011); Document 15278/11 (14 October 2011); Document 14755/12 (12 October 2012). 450 See European Judicial Network, ‘Status of implementation: 2006/960/JHA: Council Framework Decision 2006/960/JHA of 18 December 2006 on simplifying the exchange of information and intelligence’, https:// www.ejn-crimjust.europa.eu/ejn/EJN_Library_StatusOfImpByCat.aspx?CategoryId=52. 451 Deloitte, ‘Study on the Implementation of the European Information Exchange Model (EIXM) for Strengthening Law Enforcement Cooperation’ (January 2015) 26–38. The Framework Decision was also evaluated in 2018, but the implementation report has not been released.

Decentralised Mechanisms of Data Exchange 537 them outside the EU framework.452 On 27 May 2005, seven EU Member States453 signed a Convention on the ‘stepping up of cross-border co-operation, particularly in combating terrorism, cross-border crime and illegal immigration’: the Prüm Convention.454 Like Schengen, the Prüm Convention was named after the town where it was signed. Like Schengen, it was a pioneering document, where a number of EU Member States decided to push ahead on an intergovernmental basis and forge closer cooperation in home affairs matters, presumably in an effort to address obstacles in cooperation resulting from the lack of trust in an EU of 25 members (at that time) and legislative paralysis in the light of the ‘frozen’ Constitution.455 The Convention contained farreaching provisions with significant consequences for the protection of civil liberties and fundamental rights. In the context of exchange of information, these included the establishment of national DNA analysis files and the automated search and comparison of DNA profiles and fingerprinting data.456 From the outset, it was stated that participation in their group was open to all EU Member States and that a proposal would be tabled in three years from the entry into force of the Convention, leading to its incorporation into the legal framework of the EU.457 Such an initiative happened much earlier, because the incorporation of the Prüm Treaty into the EC/EU legal order was one of the top priorities of the 2007 German EU presidency.458 In February 2007, the JHA Council agreed to integrate the majority of the parts of the Prüm Treaty relating to police and judicial cooperation in criminal matters into the EU legal framework.459 Evoking the perceived operational success of automatic information exchange brought about by the Prüm Treaty in the context of DNA data exchange between Germany and Austria, the Council noted that: [T]he special value of the Treaty lies in the substantially improved and efficiently organised procedures for the exchange of information. The states involved may now give one another automatic access to specific national databases. This amounts to a quantum leap in the crossborder sharing of information.460

452 Thierry Balzacq and Amelia Hadfield, ‘Differentiation and Trust: Prüm and the Institutional Design of EU Internal Security’ (2012) 47(4) Cooperation and Conflict 539. 453 These were: Belgium, Germany, Spain, France, Luxembourg, the Netherlands and Austria. 454 Council, Document 10900/05 (7 July 2005). 455 See Valsamis Mitsilegas, ‘What are the Main Obstacles to Police Co-operation in the EU?’ (Briefing Paper for European Parliament LIBE Committee, IP/C/LIBE/FWC/2005-24, 2006), reproduced in Didier Bigo and Anastassia Tsoukala (eds), Controlling Security (Centre d’études sur les conflits/L’Harmattan, 2008). 456 For an early analysis, see Thierry Balzacq et al, ‘Security and the Two-Level Game: The Treaty of Prum, the EU and the Management of Threats’ (CEPS Working Document No 234, 2006); Thierry Balzacq et al, ‘The Treaty of Prüm and EC Treaty: Two Competing Models for EU Internal Security’ in Thierry Balzacq and Sergio Carrera (eds), Security versus Freedom? A Challenge for Europe’s Future (Ashgate, 2006) 115–36. 457 See Mitsilegas (n 455); Victor Toom, ‘Cross-border Exchange and Comparison of Forensic DNA Data in the Context of the Prüm Decision’ (Study for the LIBE Committee, PE 604.971, 2018) 10; Barbara Prainsack and Victor Toom, ‘The Prüm Regime: Situated Dis/empowerment in Transnational DNA Profile Exchange’ (2010) 50(6) British Journal of Criminology 1117; Barbara Prainsack and Victor Toom, ‘Performing the Union: The Prüm Decision and the European Dream’ (2013) 44(1) Studies in History and Philosophy of Biological and Biomedical Sciences 71. 458 See also Daniela Kietz and Volker Perthes (eds), ‘The Potential of the Council Presidency: An Analysis of Germany’s Chairmanship of the EU, 2007’ (SWP Research Paper 1, January 2008). 459 Council, Document 5922/07 (15 February 2007) 7. 460 ibid 8.

538 Databases No fewer than 15 Member States tabled a proposal for a third pillar Decision incorporating the police cooperation aspects of Prüm into the EU legal framework.461 In August 2008, Council Decision 2008/615/JHA was published,462 along with an accompanying Decision (2008/616/JHA) on Prüm implementing measures463 (together referred to as ‘Prüm Decisions’). In the meantime, between 2007 and 2008, Bulgaria, Portugal, Sweden, Greece, Finland, Hungary, Italy, Romania, Slovakia and Slovenia ratified or acceded to the Convention. The Preamble of Decision 2008/615/JHA refers to the need to introduce procedures for promoting fast, efficient and inexpensive means of personal data exchange for the investigation of criminal offences, particularly terrorism and cross-border crime,464 ‘whereby Member States grant one another access rights to their automated DNA analysis files, automated dactyloscopic identification systems and vehicle registration data’.465 The text effectively mirrors the provisions of the Prüm Treaty.466 Member States must ensure the availability of DNA,467 fingerprint468 (constituting special categories of personal data)469 and vehicle registration data (VRD)470 from their national databases,471 and allow automated searches through designated national contact points (NPCs), who may compare these categories of data in individual cases and in compliance with the requesting Member State’s national law.472 In effect, Decision 2008/615/JHA obliges Member States to establish national databases containing these types of information,473 with the processing of personal data being subject to the national law applicable to the processing.474 Hence, the Prüm system constitutes a decentralised network for information exchange, composed of national databases connected to each other. 461 Initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Federal Republic of Germany, the Kingdom of Spain, the French Republic, the Grand Duchy of Luxembourg, the Kingdom of the Netherlands, the Republic of Austria, the Republic of Slovenia, the Slovak Republic, the Italian Republic, the Republic of Finland, the Portuguese Republic, Romania and the Kingdom of Sweden, with a view to adopting a Council Decision on the stepping up of cross-border cooperation, particularly in combating terrorism and crossborder crime. See Council, Document 7273/1/07 REV 1 (17 April 2007). 462 Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime [2008] OJ L210/1. 463 Council Decision 2008/616/JHA of 23 June 2008 on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime [2008] OJ L210/12. 464 Decision 2008/615/JHA, Recitals 4 and 8 respectively. 465 ibid, Recital 10. 466 For an overview, see House of Lords European Union Committee, ‘Prüm: An Effective Weapon against Terrorism and Crime?’ (18th Report, session 2006–07, HL Paper 90). 467 Decision 2008/615/JHA, art 2(2). By mutual consent, unidentified DNA profiles may also be compared with all DNA profiles from other national DNA databases (art 4) In ongoing investigations and where there is no DNA profile available for a particular individual present in the requested Member State, it is also possible that cellular material is collected and will become available (art 7). 468 ibid art 8. Interestingly, automated searching may take place in connection to both the prevention and investigation of criminal offences, whereas in the case of DNA data, such a search is prescribed for the investigation of criminal offences only. cf arts 2 and 8. 469 In line with art 10 of the Law Enforcement Directive. 470 Decision 2008/615/JHA, art 12. Such searches may involve data relating to owners or operators and to vehicles. 471 In specific the reference data, which are DNA profiles established from the non-coding part of DNA and a reference number. 472 Decision 2008/615/JHA, art 3(1). On national contact points, see arts 6, 11 and 15. 473 Toom (n 457) 11. 474 Decision 2008/615/JHA, art 2(1).

Decentralised Mechanisms of Data Exchange 539 In practice, police cooperation is divided into two steps, whereby as a first step, information relating to DNA, fingerprints and VRD may be automatically exchanged pursuant to the Prüm rules. Therefore, the automated exchange covers the search and comparison of data, the notification of a hit/no-hit and the supply of reference data only, so as to minimise the exchanged data. In case of a match (hit), traditional channels of mutual legal assistance, including the prescriptions of Framework Decision 2006/690/JHA, as discussed above, are activated, but these are not technically part of the Prüm regime.475 Thus, Member States may exchange further available personal data and other information, which is governed by the national law of the requested Member State.476 Furthermore, Decision 2008/615/JHA prescribes rules on the supply of personal and non-personal data in case of major events with a cross-border dimension (Chapter 3) and for the prevention of terrorism offences (Chapter 4).477 Rules on other forms of cooperation, such as joint operations478 or assistance in cases of mass gatherings, disasters and serious accidents,479 are also foreseen (Chapter 5). Finally, a series of data protection rules are laid down (Chapter 6): that the processing of personal data by the receiving Member State shall be permitted solely for the purposes for which the data have been supplied and any processing for other purposes must be subject to prior authorisation of the Member State administering the file, and subject only to the national law of the receiving Member State;480 rules concerning the accuracy, relevance and storage period of the data are also included, including the possibilities to correct or delete that data;481 and individual rights are prescribed.482 However, at the time of its adoption, the legal framework on data processing for law enforcement purposes was missing, as Framework Decision 2008/977/JHA had not yet been adopted.483 The impact of the Prüm Decisions on the rights to respect for private life and personal data protection, as well as on the relationship between the individual and the state, is significant. The Decisions effectively obliged Member States to establish DNA databases in the first place, which means that, due to the way in which the Prüm standards were inserted into EU law in a number of Member States, new DNA, fingerprint and vehicle registration databases were introduced through the back door, with virtually no domestic debate or scrutiny.484 Furthermore, Decision 2008/615/JHA calls for the availability of sensitive data if a hit is found and for automated searches of national databases containing special categories of data (sensitive data) by authorities of other 475 Toom (n 457) 11. 476 Decision 2008/615/JHA, art 5. 477 ibid arts 13–15. 478 ibid art 17. 479 ibid art 18. 480 ibid art 26(1). 481 ibid art 28. 482 ibid art 31. 483 Decision 2998/615/JHA refers to the Council of Europe Convention for the Protection of Individuals with regards to Automated Processing of Personal Data of 28 January 1981, and its Additional Protocol of 8 November 2001. 484 On this point, see Rocco Bellanova, ‘The “Prüm Process”: The Way Forward for EU Police Cooperation and Data Exchange?’ in Elspeth Guild and Florian Geyer (eds), Security versus Justice? Police and Judicial Cooperation in the European Union (Ashgate, 2008) 212; see also Christopher Walsch, ‘Europeanization and Democracy: Negotiating the Prüm Treaty and the Schengen III Agreement’ (2008) 45 Croatian Political Science Review 81.

540 Databases Member States.485 DNA and fingerprint searches in this context must be conducted in compliance with the law of the requesting Member State,486 which again brings about significant changes to the legal framework governing these sensitive matters in the requested Member State without debate or scrutiny. On the other hand, the Decision does contain a separate chapter with data protection provisions, as mentioned above, but beyond this, the mechanism of cooperation it introduces operates in an environment with rules that are far from clear and based largely on national legislation. It is noteworthy that Decision 2008/615/JHA does not specify what kind of data could be included in DNA or fingerprint databases, which has led to substantial discrepancies in national approaches, with many Member States storing data only of persons convicted of serious crimes, and others including data on a wide range of individuals, including suspects or unidentified human remains/deceased persons and missing persons.487 As a result, there may also be substantial differences on the reasons for collecting DNA data or fingerprints between national systems.488 A number of questions have arisen in this context, including whether this may lead to Member States extending the collection of personal sensitive data,489 and whether cooperation on that basis leads to the requesting Member State gathering sensitive data from databases in other countries which it would not be allowed to gather under its national law. However, states are bound as to which categories to allow other countries to launch queries and what restrictions are imposed on their own law enforcement bodies by their national legislation.490 Therefore, the aforementioned discrepancies in the categories of personal data stored in national databases do not allow reciprocity in launching automated searches. 485 For the protection of special categories of personal data, see S and Marper v UK (2009) 48 EHRR 50. 486 Decision 2008/615/JHA, arts 3(1) and 9(1) respectively. 487 See EDPS, ‘Opinion of the European Data Protection Supervisor on the Initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Federal Republic of Germany, the Kingdom of Spain, the French Republic, the Grand Duchy of Luxembourg, the Kingdom of the Netherlands, the Republic of Austria, the Republic of Slovenia, the Slovak Republic, the Italian Republic, the Republic of Finland, the Portuguese Republic, Romania and the Kingdom of Sweden, with a view to adopting a Council Decision on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime’ [2007] OJ C169 (hereinafter the ‘Opinion on Prüm’), para 37. For the most recent analysis, see Council, Document 5197/1/20 REV 1 (25 June 2020) 21. 488 See in this context the debate in the House of Lords, Hansard, 6 December 2007, columns 1894–1920. Lord Jopling, at the time of writing Chairman of the Home Affairs Sub-Committee of the EU Committee, noted in the debate that ‘if other states use the UK evidence, they are in danger of assuming that the people on the database could have been involved in serious crime; they have different national standards’ (column 1901). For a brief overview of the UK DNA-gathering system, see Gareth Crossman, ‘Nothing to Hide, Nothing to Fear?’ (2008) 22(1–2) International Review of Law Computers and Technology 115. For recent critical reports on the UK DNA databases, see the Ethics Group: National DNA Database, ‘1st Annual Report’ (April 2008); Citizens’ Report, ‘A Citizens’ Inquiry into the Forensic Use of DNA and the National DNA Database (July 2008). Both reports cautioned against the widespread and unqualified storage, use and access to DNA data, and were critical of the generalised or forcible inclusion of DNA data from innocent members of the public in national databases. 489 The EDPS read the proposal as requiring Member States to collect and store information, even if it is not available yet in the national jurisdiction. See EDPS (n 487) 4. In an attempt to alleviate concerns in this context, Jonathan Faull, the then Director of the Commission Directorate for Freedom, Security and Justice, stated in his evidence in the House of Lords European Union Committee: ‘We are not obliging Member States to build up DNA databases of innocent people just in case one day somebody else in another Member State might be interested in knowing about them’. See House of Lords European Union Committee (n 466) Q98. 490 In accordance with arts 3(1), 9(1) and 12(1) of Decision 2008/615/JHA, which contain a safeguard stipulating that automated searches may be conducted only in individual cases and in compliance with the national law of the requesting Member States.

Decentralised Mechanisms of Data Exchange 541 otwithstanding these very important issues and the changes that the Decision is N bound to bring about, scrutiny and debate on the issues concerned was extremely limited.491 In the first place, the Prüm Convention was negotiated largely in secret as an international treaty prior to it being submitted to national parliaments for ratification. Thereafter, it was presented as essentially a fait accompli to EU Member States and was negotiated under the former third pillar, and, under very tight deadlines492 at a speed that has not been justified.493 In terms of implementation, all Member States were expected to have implemented the Prüm Decisions in two phases: the deadline for transposition of the rules on the supply of information relating to major events and the prevention of terrorist offences and data protection was 26 August 2009, whereas in relation to provisions on the automated searching of DNA profiles, dactyloscopic data and VRD, the deadline was set for 26 August 2011.494 However, the practical implementation has been fraught with technical complications. With the Prüm Decisions becoming part of the EU acquis, it became mandatory for Member States to make data stored in national databases available to other Member States, which presupposed the existence of such databases at the national level, which was not always the case.495 Overall, the implementation process has been rather slow496 due to various factors primarily linked to financial and technical difficulties.497 Such implementation issues had even led the Commission to issue formal notices against several Member States (Croatia, Ireland and Italy, as well as Greece and Portugal) for failing to comply with the Prüm Decisions.498 By the end of 2020, the vast majority of Member States are operational and enable automated searches of DNA analysis files, fingerprint data and VRD. However, a few Member States have not yet become operational,499 whereas amongst the operational Member States, the degree of connectivity with databases of other Member States varies considerably.500 491 See the criticism in the House of Lords debate, in particular by the then Chairman of the Home Affairs Sub-Committee, Lord Wright of Richmond. House of Lords, Hansard, 6 December 2007, col 1895. 492 With Germany aiming to achieve agreement on the proposal within its presidency. See Kietz and Perthes (n 458). 493 The transfer of the Treaty to the EU framework seems to weaken national parliaments of Member States, which would have to ratify the Convention if it remained outside the EU framework. 494 Decision 2008/615/JHA, art 36(1). 495 A series of formal requirements should also be met: in particular, Member States must provide a series of declarations and notifications in relation to national contact points (NCPs) in accordance with arts 6(1), 11(1), 12(2), 15 and 16(3) of Decision 2008/615/JHA, as well as notification of the national data protection authorities in accordance with art 19 of Decision 2008/616/JHA. An evaluation report is then submitted to the Council, which must unanimously decide whether the conditions have been met after consultation of the Parliament. Afterwards, the Council can adopt the Implementing Decision that the Member State concerned can start the operational data exchange. 496 Council, Document 17761/11 (5 December 2011). For an appraisal see Chris Jones, ‘“Complex, Technologically Fraught and Expensive”: The Problematic Implementation of the Prüm Decision’ (Statewatch, 2012). For an overview, see Toom (n 457). 497 Council, Document 5197/1/20 REV 1 (n 487). 498 The latest information can be found in Commission, ‘Ninth progress report towards an effective and genuine Security Union’ (Report) COM (2017) 407 final. 499 In relation to DNA analysis files, Greece and Italy are not operational; in relation to fingerprint data, Greece, Italy and Croatia are not operational. As for vehicle registration data, Greece, Italy and the UK are not operational. See Council, Document 5197/1/20 REV 1 (n 487). For the case of the UK in particular, see Niovi Vavoula, ‘Police Information Exchange: The Future Developments Regarding Prüm and the API Directive’ (Study for the LIBE Committee of the European Parliament, PE 658.542, September 2020) 37–42. 500 For further information on implementation, see Vavoula (n 499) 18–25.

542 Databases Article 36(4) of Decision 2008/615/JHA foresees that following the implementation of the Prüm legal framework at the national level, the Commission is to provide recommendations for further development of the instrument. The initiative to reflect on the development of a next-generation Prüm (Prüm.ng) was launched in the Council Conclusions on the implementation of the Prüm Decisions 10 years after their adoption,501 with the Commission being invited to consider revising the Prüm Decisions with a view to broadening their scope and updating the necessary technical and legal requirements.502 The revision of the Prüm framework will enable the incorporation of updated data protection rules, in line with the current EU legal framework on personal data protection, particularly the Law Enforcement Directive. Furthermore, in the post-Lisbon Treaty era, a new-generation Prüm will be negotiated pursuant to the ordinary legislative procedure, and the legislative proposal will be scrutinised by the Parliament on an equal footing as the Council. A wide array of possible amendments are considered503 and the Commission has committed to proposing a revised Prüm framework as announced in its Communication on the EU Security Union Strategy, which was adopted on 24 July 2020.504 First, in order to rectify the fragmentary legal landscape in respect of the categories of data stored at the national level and enhance reciprocity in searches, it is expected that the material and personal scope of the Prüm Decisions will be expanded by allowing searching for missing persons and identifying deceased persons so as to create a level playing field across Member States.505 This amendment could be considered as Member States aiming to circumvent their restrictions imposed by national law, by exporting their national limitations to the EU level. This is notwithstanding the fact that searches on missing persons and unidentified human bodies/remains may not always be linked to the investigation of criminal offences and thus not be covered by the current Prüm scope. As a result, new purposes will have to be added to the revised Prüm framework, so that searches with the aim of locating missing persons and identifying human bodies/remains could take place, even if no direct link to a criminal investigation exists. Furthermore, by including missing persons, who may be vulnerable persons, that category of persons will be added alongside persons who have a criminal history or record, suspects of criminal activity and persons subject to investigation or prosecution.506 Therefore, additional safeguards will be required in relation to the retention of such data on missing persons and the authorities will be granted rights to launch searches.

501 Council, Document 11227/18 (17 July 2018). Before that, the Council called for the realisation of a European Forensic Science Area, ‘where routine forensic processes for the collection, processing, use and delivery of forensic data should be based on equivalent minimum forensic science standards’ and where forensic service providers should work on the basis of a common approach to implementation of these standards that fosters closer cooperation between them and the criminal justice systems. See Council, Document 17537/11 (1 December 2011) 4; see also Council, Document 10128/16 (13 June 2016), Document 14606/17 (22 November 2017) and Document 9081/2019 (17 May 2019). 502 Council, Document 11227/18 (n 501). 503 Commission, ‘Study on the feasibility of improving information exchange under the Prüm Decisions (May 2020). 504 Commission, ‘The EU Security Union Strategy’ (Communication) COM (2020) 605 final. 505 Commission (n 503) 21–24. 506 ibid 22.

Decentralised Mechanisms of Data Exchange 543 Second, with regard to the follow-up procedure after a hit, the differences between different forms of national legislation have led to operational inefficiencies, including lengthy follow-up procedures, using different channels of communication and without harmonisation of which datasets are to be supplied.507 Tensions may also arise in cases when after a mutual legal assistance (MLA) request, officers of different backgrounds and competencies are involved or different authorities may have custody of specific databases.508 In order to streamline the follow-up procedure and enable faster access to data, automaticity will be introduced so that a limited core dataset is provided by default in cases of ‘high-accuracy searches’ of fingerprint data only.509 After the minimum set is received, and only when necessary, Member States could request additional information on the suspect, which will follow traditional information exchange avenues. Apart from concerns as to the extent to which such reform will be useful, it is vital that automation will be reserved only in cases where the possibility of error remains very low and therefore the data compared are reliable.510 Perhaps the most controversial reform to Prüm will involve the addition of facial images, which constitute biometric data and thus a special category of personal data,511 so that law enforcement authorities shall be able to check images (for example, taken by surveillance cameras near crime scenes) of unknown perpetrators of criminal offences against the national reference image databases, as governed by national legislation. As with the DNA analysis files and fingerprint data, not all Member States currently hold a national central electronic image database with reference images or national Facial Recognition (FR) software.512 It is therefore highly likely that the next-generation Prüm framework will mandate Member States to set up a central electronic image database and FR software at the national level, as was the case with DNA and fingerprint databases. Data quality in FR technology is vital so as to minimise the risk of false matches, which may have important consequences for individuals, who may be harassed by the police because of incorrect matching, be subject to criminal investigation and even be subject to discriminatory practices by national authorities. However, the quality of certain images (eg, latent, wild or trace images of unidentified persons) will inherently be of lower quality.513 Furthermore, the size of national databases may

507 ibid 61. 508 Toom (n 457) 33; PIES, ‘PIES Project – 4000002150 – Final implementation report’ (2016) 28. It has been found that judicial and police authorities are called upon to cooperate whereby the former may be slower in their replies and more frugal in providing information requested. Furthermore, some Member States only exchange information in relation to certain criminal offences, often depending on their seriousness in terms of the penal framework. See Sara Matos, ‘Privacy and Data Protection in the Surveillance Society: The Case of the Prüm System’ (2019) 66 Journal of Forensic and Legal Medicine 155, 158. 509 Commission (n 503) 61–64. 510 Even in those cases, it may be useful to allow discretion for Member States to maintain manual authorisation, perhaps with a specific limited timeframe, in cases of concerns that the personal data in another Member State’s fingerprint database may not be trustworthy. In Opinion 1/15, ECLI:EU:C:2017:592, paras 172–74 (discussed below), the CJEU stressed that automated processing must be based on reliable, updated and relevant data, and that any individual measures that may have an adverse impact should not be based solely on automated processing. 511 Law Enforcement Directive, art 10. 512 Council, Document 13356/19 (30 October 2019, not publicly available) 5. 513 For more on this, see Vavoula (n 499) 31–34.

544 Databases also have an impact on accurate identification; the higher the amount of data which may be of insufficient quality, the higher the possibility of false matches. Another factor that may impact the accuracy of the results is the age of the facial image and there is a gradual increase in the possibility of a false match as the years since the capture of a facial image pass by.514 Finally, the inherent limitation of FR should also be underlined; though Prüm will not be used in surveillance activities by law enforcement authorities, the algorithms embedded in FR produce higher false positive matches in cases of black people, particularly of black women.515 Therefore, as research demonstrates, it may be the case that in investigations, people of colour may find themselves wrongly harassed by the police authorities in more cases than white people due to algorithm bias.516 Another potential development involves the inclusion of automated searches to biographic data, which will require the creation of index databases containing an extract of police records with pseudo-anonymised data. This idea echoes previous efforts since 2012 to set up a European Police Records Index System (EPRIS).517 However, open questions include the definition of what constitutes a police record, whether it is necessary to set up such national indexes (particularly in view of the work of Europol and possibilities offered by the Swedish Initiative), the amount of information included in the index and the purposes for which it may be used.518 In addition, questions as to whether certain Prüm queries could be made through the ESP under the interoperability framework are also prominent,519 as well as discussions on opening up Prüm to new actors, such as Europol or Interpol.520 The possibility of giving the agency a role in the Prüm system raises a series of issues, particularly the relationship of Europol with third countries either by entering data received by third countries521 or by transferring data retrieved from participating countries to third countries. As for Interpol, which is not bound by EU data protection law, its partners include countries outside the EU which safeguard personal data through their own legislations.522 It is noteworthy that no reforms seem to address concerns regarding the practical effectiveness of Prüm, given that following evaluation by national authorities, a number 514 Commission (n 503) 151. 515 Patrick Grother, Mei Ngan and Kayee Hanaoka, ‘Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects’ (National Institute of Standards and Technology, 2019) 63. See also Zach Campbell and Chris Jones, ‘Leaked Reports Show EU Police are Planning a Pan-European Network of Facial Recognition Databases’ (The Intercept, 21 February 2020), https://theintercept.com/2020/02/21/eu-facial-recognition-database. 516 National Institute for Standards and Technology (NIST), ‘Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects’ (2019). 517 Commission, ‘Study on possible ways to enhance efficiency in the exchange of police records between the Member States by setting up a European police records index system’ (October 2012). 518 In that respect, reference is made to Council, Document 11434/19 (6 September 2019) 7, https://www. statewatch.org/media/documents/news/2019/sep/eu-council-automation-data-exchange-national-11434-19. pdf. 519 Commission (n 503) 121–26. 520 ibid 129–32. See the roadmap to enhance information exchange, where the Council called for the examination of the possibility for Europol to become a partner in the Prüm framework with a view to enabling the cross-matching of DNA, fingerprints and vehicle registration data with third countries with which Europol has an operational agreement: Council, Document 9368/1/16 REV 1 (6 June 2016) 21. 521 ‘Europol: Plans Afoot to Legalise Unlawful Acts’ (Statewatch, 6 July 2020), https://www.statewatch.org/ news/2020/july/europol-plans-afoot-to-legalise-unlawful-acts. 522 Commission (n 503) 131.

Decentralised Mechanisms of Data Exchange 545 of matches (hits) are not used as evidence and there is no information on the number of convictions.523 Overall, the available information on the effectiveness of the Prüm regime is not objective or reliable enough to evaluate its effectiveness and, consequently, its proportionality, also in view of the significant resources that the operationalisation of Prüm has required. Finally, the reach of Prüm has expanded beyond its EU origins to the Western Balkans, which are potential candidate countries.524 In strengthening cooperation with the Western Balkans – one of the main priorities of the Austrian presidency in 2018 – the Police Cooperation Convention for Southeast Europe (PCC SEE) signed on 13 September 2018 a ‘Prüm Agreement for South-East Europe’ on the automated exchange of DNA, fingerprint and VRD. The first signatories included some EU Member States and third countries,525 and the agreement aims, on the one hand, to enhance cooperation years before all the non-EU contracting parties accede to the EU, and on the other hand, to contribute to EU accession efforts of those countries.526 Though the countries involved are in an accession trajectory, concerns have been raised as to whether such cooperation may take place without EU involvement. In October 2019, the Commission launched infringement procedures against Austria, Bulgaria, Hungary and Romania for signing the agreement in breach of EU exclusive competence in the area under Articles 3(2) TFEU, particularly because the exchange of such data between the Member States is covered by the Prüm Decisions.527 This agreement also bypasses the involvement of EU institutions in evaluating whether participating states are Prüm-ready as the process will have already taken place prior to the formal accession to the EU.

D. The Principle of Availability The principle of availability, first proclaimed in The Hague Programme (as mentioned above), as the guiding principle of exchange of information in criminal matters was further entrenched in Commission proposal for a Framework Decision tabled in 2005.528 The general principle of availability was established in Article 6, according to

523 Toom (n 457) 17. See also Michele Taverne and Tom Broeders, The Light’s at the End of the Funnel! Evaluating the Effectiveness of the Transnational Exchange of DNA Profiles between the Netherlands and Other Prüm Countries (Paris Legal Publishers, 2015). 524 Joint Action Plan on Counter-Terrorism for the Western Balkans (5 October 2018). 525 Albania, Bosnia and Herzegovina, Montenegro, North Macedonia, Moldova and Serbia. 526 Victor Toom, Rafaela Granja and Anika Ludwig, ‘The Prüm Decisions as an Aspirational Regime: Reviewing a Decade of Cross-Border Exchange and Comparison of Forensic DNA Data’ (2019) 41 Forensic Science International: Genetics 50. 527 Commission, ‘October Infringements Package: Key Decisions’ (13 October 2019) INF19/5950, https:// ec.europa.eu/commission/presscorner/detail/EN/INF_19_5950. 528 Commission, ‘Proposal for a Council Framework Decision on the exchange of information under the principle of availability’ COM (2005) 490 final (hereinafter the ‘Proposal on the exchange of information’). The same month also saw the publication of a report on availability by a ‘Friends of the Presidency’ group made up of national and Commission experts, and representatives of Europol and Eurojust. See Council, Document 13558/05 (24 October 2005). See also the follow-up document: Council, Document 5595/06 (25 January 2006). Both documents remain only partially accessible.

546 Databases which Member States must ensure that ‘information shall be provided to equivalent competent authorities of other Member States and Europol … in so far as these authorities need this information to fulfil their lawful tasks for the prevention, detection or investigation of criminal offences’ (emphasis added). The principle of availability was based on a maximal version of mutual recognition that could have far-reaching implications for both the protection of human rights and the legitimacy of EU action in the police field.529 It called for the provision of information to ‘equivalent’ authorities of other Member States almost exclusively on a ‘need to know basis’, with the exchange of information taking place on the basis of standard, pro-forma documents, and with very few grounds for refusal available to the requested authorities.530 Information exchange thus becomes almost automatic. This form of cooperation may have substantial implications for the protection of fundamental rights, in particular the right to respect for private life. As conceived by the Commission, the principle would apply without any harmonisation in Member States’ systems. Competent authorities potentially covered by the principle would be national authorities responsible for police and judicial cooperation in criminal matters, but also Europol.531 However, there are differences between the powers and mandate of national police and judicial authorities across the EU. The Commission proposal required a level of equivalence between such authorities, but equivalence was to be defined by a comitology procedure, thus evading full parliamentary scrutiny.532 National authorities (and Europol) were to be given, inter alia, online access to databases of their counterparts in other Member States533 and were obliged to provide information to their counterparts for the very broad purpose of preventing, detecting or investigating criminal offences.534 The proposed framework, the negotiations of which did not go very far, enabled very extensive access to national data by establishing a far-reaching legal obligation to provide information to the authorities of other Member States. If applied, the principle would ‘reconfigure the sociological norms regulating the practices among law enforcement authorities’.535 However, along with human rights concerns, such cooperation raised important constitutional questions regarding the extent of the legal obligation to provide information: can a national authority obtain, under the principle of availability, information that it would not be allowed to obtain under its national law?536

529 See Valsamis Mitsilegas, written evidence for House of Commons Home Affairs Committee, inquiry on EU Justice and Home Affairs, reproduced in House of Common, ‘Justice and Home Affairs Issues at European Union Level’ (3rd Report, session 2006–07, HC 76-II, Ev 146). 530 Commission (n 528) art 14. 531 ibid art 3(b), which refers to authorities covered by the first hyphen of art 29 TEU. 532 ibid art 5. Moreover, measures adopted under this procedure will be classified as ‘confidential’. 533 ibid art 9. Access would be given to databases to which the corresponding competent authorities have online access. 534 The Proposal also contains a provision on purpose limitation (art 7); information can be used for the prevention, detection or investigation of the criminal offence for which the information is provided. 535 Didier Bigo, ‘The Principle of Availability of Information’ (Briefing Note for European Parliament Civil Liberties Committee) reproduced in Didier Bigo and Anastasia Tsoukala (eds), Controlling Security (L’Harmattan and Centre d’Etudes sur les Conflits, 2008) 27. 536 Similar questions have arisen in the context of mutual recognition in judicial cooperation in criminal matters with regard to the European Arrest Warrant.

Decentralised Mechanisms of Data Exchange 547 Can the requested authority be obliged to collect or transfer information on behalf of the requesting authority, even by using coercive measures?537 These questions are similar to those raised by the Swedish initiative, but answers may be more complex in the light of the differences between the two approaches, both in terms of caveats and safeguards, and in terms of the degree of the obligations imposed: under the ‘Swedish’ Framework Decision, the requesting authority must justify and substantiate the request; under availability, the requested authority must provide information merely because it is available. A number of questions would also arise from the application of the principle to Europol, which seems to be treated in the same way as a national police authority.

E. Boosting the Exchange of Personal Data between National Authorities: Automaticity at What Cost? From the Swedish initiative to the incorporation of Prüm into EU law, it is evident that the trend in police cooperation in the EU has been to gradually overcome obstacles arising from differences in national laws on police powers and to boost the exchange of a wide range of personal data between national authorities, with a high degree of automaticity and with few questions asked. This approach has led to a number of questions with regard to both the legality of information exchange (in the light of the potential legal gaps that may arise during the interaction of different legal systems in the exchange of information) and fundamental rights, in particular the right to respect for private life and personal data protection. In the latter context, it is striking that the push for information exchange has effectively led to the call – with little domestic debate or scrutiny – to a number of Member States to establish databases for special categories of personal data. Furthermore, the lack of harmonised rules in the governance of national databases has resulted in the latest efforts to bring national approaches together taking place with a focus on the lowest common denominator, without scrutinising the necessity and proportionality of expanding the Prüm scope. As a result, it is expected that in the future, in the name of reciprocity, Member States shall be required to amend national legislations so that more categories of personal data are collected and stored in national databases. Besides, at the time of writing, a further push for maximising information exchange has been informed by technological evolution, with the implementation of facial recognition technology being at the forefront of these efforts. Be that as it may, the practical implementation reveals the complexity of these challenges and to a certain extent calls into question the mere existence of these instruments and the justification of the legality and fundamental rights concerns which have been raised.

537 According to art 2(2) of the Proposal on the exchange of information, requesting police authorities and Europol cannot ask for information to be obtained – with or without coercive measures – by the requested authority solely for the purposes of cooperation, but information already lawfully collected by the requested authority by coercive measures may be provided (even though these measures may not be lawful in the requesting state, something that would potentially infringe national constitutional provisions through the ‘back door’).

548 Databases

IV. The Privatisation of Information Exchange Another level of boosting the collection, analysis and exchange of personal data for criminal law purposes in the EU has been via the co-option of the private sector. This aspect of the privatisation of law enforcement consists of calling on private companies or professions to cooperate with state authorities in the fight against crime. This cooperation can take place in various forms: the collection of information and reporting of suspicious information to the authorities, as in the case of money laundering measures; the retention of data already collected by the private sector for business purposes, as in the case of the retention of metadata by telecommunications companies); the extension of the collection of data already collected for business purposes and their retention, as in the case of passenger name record (PNR) data; the preservation and transfer of electronic evidence data, such as emails, text massages, information on IP addresses, etc. These mechanisms reconfigure the relationship between the private and the public and lead to the mass collection and further processing of a wide range of personal data, which can then be repurposed and used by the state for law enforcement purposes.

A. Anti-money Laundering: Suspicious Transactions and the Financial Intelligence Units A major move to involve the private sector in cooperating with the state in the fight against crime has occurred in the field of AML law. Since their inception in the late 1980s and early 1990s, global AML initiatives have placed the private sector at the heart of their legal and regulatory framework. Highlighting money laundering as an evil sustaining security threats, such as drug trafficking, organised crime and lately terrorism, the public policy and legislative discourse has sought to demonise the private sector (and banks in particular, at least initially) for their potential involvement in the phenomenon, and translated the perceived moral obligation not to be associated with this evil with a legal obligation to positively and proactively assist the state in the fight against money laundering. This discourse has led globally (but also at the EU level) to legislation imposing of a wide range of duties on banks, the financial sector, and other professions and service providers – including lawyers – such as customer identification and record-keeping duties, but also, perhaps more importantly, duties to report to the authorities transactions they suspect are related to money laundering and lately terrorist financing as well. This has led to the proactive participation of the private sector in gathering information from everyday, largely ordinary transactions and passing them on to the national authorities – with considerable implications for private life, but also, in the case of the involvement of lawyers, for the right to a fair trial and for the administration of justice and the rule of law.538

538 For details on the development of the EU AML framework in this context, see Valsamis Mitsilegas, Money Laundering Counter-measures in the European Union: A New Paradigm of Security Governance versus Fundamental Legal Principles (Kluwer Law International, 2003).

The Privatisation of Information Exchange 549 However, EU legislation did not initially detail the authorities which would receive suspicious transaction reports from the private sector, with the first Money Laundering Directive merely referring to ‘authorities responsible for combating money laundering’.539 Partly because of the preventative nature of the AML regime and partly due to the lack of EU competence in criminal matters at the time,540 special bodies were set up for this role, known as Financial Intelligence Units (FIUs). Their aim would be to receive suspicious transaction reports, analyse them and, if necessary, disseminate the results of their analysis to national law enforcement authorities or their counterparts in the EU and beyond. No reference was made as to the cooperation of FIUs, and the Recommendations by the Financial Action Task Force (FATF) were also silent on the matter. The lack of specification in the First Money Laundering Directive as to the nature of FIUs has resulted in the development of different systems of suspicious transaction reporting in Member States, which reflect differences in the focus of the domestic AML framework, but also differences in the view of the relationship between the private sector and the state. National systems can be broadly categorised into three models: the police model, where suspicions are transmitted to a police/intelligence agency (such as the Serious Organised Crime Agency (SOCA) in the UK); the judicial model, where responsibility lies with the public prosecutor’s office; and the independent/administrative model, where financial institutions report suspicions to an independent unit or a unit based within a government department (such as the Ministry of Finance).541 Following the establishment of a national reporting system, it became increasingly obvious that this diversity in national models had the potential to hinder and complicate cooperation in the light of the different nature and legal regulation of these units; for example, police FIUs could not exchange information with administrative FIUs.542 Nonetheless, in the Tampere Conclusions of 1999, the European Council called for FIU cooperation regardless of the differences in their institutional model.543 In order to rectify this

539 Council Directive 91/308/EEC of 10 June 1991 on Prevention of the Use of the Financial System for the Purpose of Money Laundering [1991] OJ L166/77 (hereinafter the ‘First Money Laundering Directive’), art 6. 540 Commission, ‘First Commission’s report on the implementation of the Money Laundering Directive (91/308/EEC) to be submitted to the European Parliament and to the Council’ COM (95) 54 final, 13–14, 16 –17. 541 Most FIUs (21 in total) have been established under an administrative or police model. Five (Cyprus, Denmark, Greece, Hungary and the Netherlands) display characteristics from multiple models and are classified as hybrid, whereas only one (Luxembourg) belongs to the judicial-type category. See EU FIUs Platform, ‘Mapping Exercise and Gap Analysis on FIUs’ Powers and Obstacles for Obtaining and Exchanging Information’ (2016) 5–7. For an analysis of these models with national examples of such units, see Valsamis Mitsilegas, ‘New Forms of Transnational Policing: The Emergence of Financial Intelligence Units in the European Union and the Challenges for Human Rights – Part I’ (1999) 3(2) Journal of Money Laundering Control 147. See also Jean-François Thony, ‘Processing Financial Information in Money Laundering Matters: The Financial Intelligence Units’ (1996) 3 European Journal of Crime, Criminal Law and Criminal Justice 257. Mouzakiti notes that the fact that FIUs belong in the same model does not mean that significant operational differences do not exist. See Foivi Mouzakiti, ‘Cooperation between Financial Intelligence Units in the EU: Challenges for the Rights to Privacy and Data Protection’ in Katie Benson, Colin King and Clive Walker (eds), Assets, Crimes and the State: Innovation in 21st Century Legal Responses (Routledge, 2020) 38–51. 542 Commission, ‘Second Commission Report to the European Parliament and the Council on the Implementation of the Anti-Money Laundering Directive’ COM (1998) 401 final, 14–15. 543 See European Council, ‘Tampere European Council 15 and 16 October 1999 – Presidency Conclusions’, para 54.

550 Databases issue, Member States adopted a third pillar Decision in 2000 on cooperation between FIUs.544 The Decision called on each Member State to set up a ‘financial intelligence unit’, understood in accordance with the definition adopted in 1996 by a transgovernmental ad hoc network of countries and international organisations called ‘the Egmont Group’.545 The Decision aimed at boosting information exchange between national FIUs irrespective of their nature and stated that their performance must not be affected by their internal status, ‘regardless of whether they are administrative, law enforcement or judicial authorities’.546 Despite its reduced scope, this Decision governed the cooperation between FIUs for two decades. It also provided the incentive for the creation of FIU. net, a decentralised computer network aimed at facilitating the exchange of information between FIUs in the EU. Further developments with regard to FIUs in the EU took place with the adoption of the so-called Third Money Laundering Directive in 2005.547 The (first pillar) Directive included express provisions covering FIUs in line with Recommendations by the Financial Action Task Force (FATF) of 2003.548 In particular, Member States were asked to establish FIUs with specific tasks, which would be ‘responsible for receiving (and to the extent permitted, requesting), analysing and disseminating to the competent authorities, disclosures of information which concern potential money laundering, potential terrorist financing or are required by national legislation or regulation’.549 The FIUs were given maximum powers of access to national databases – Member States ensured that FIUs had access, directly or indirectly, on a timely basis, to the financial, administrative and law enforcement information that they required in order to properly fulfil their tasks.550 Moreover, suspicious transaction reporting was viewed within the specific context of FIUs, as the institutions and persons involved would send suspicions not to the ‘competent authorities’ in general, but to the FIU specifically.551 This also applied to the case of legal professionals, notwithstanding the fact that the Second Money Laundering Directive of 2001, which was repealed and replaced by the third Directive, allowed Member States to make provisions for suspicious transactions to be transmitted to self-regulatory

544 Council Decision 2000/642/JHA of 17 October 2000 concerning arrangements for cooperation between financial intelligence units of the Member States in respect of exchanging information [2000] OJ L271/4. Commission, ‘The Implementation of the Council Decision of 17 October 2000 Concerning Arrangements for Cooperation between Financial Intelligence Units of the Member States in Respect of Exchanging Information (2000/642/JHA)’ (Report) COM (2007) 827 final, 1. 545 According to this definition, an FIU is ‘a central, national unit which, in order to combat money laundering, is responsible for receiving (and to the extent permitted, requesting), analysing and disseminating to the competent authorities, disclosures of financial information which concern suspected proceeds of crime or are required by national legislation or regulation’. On the Egmont Group, see William Gilmore, Dirty Money: The Evolution of Money Laundering Countermeasures, 3rd edn (Council of Europe Publishing, 2004) 79–88; Mitsilegas (n 541) 155–56. 546 Decision 2000/642/JHA, art 3. See Mitsilegas (n 541) 176–79. 547 Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing [2005] OJ L309/15 (hereinafter the ‘Third Money Laundering Directive’). 548 FATF, ‘The Forty Recommendations’ (2003), Recommendations 13, 26, 31 and Interpretative Note to Recommendation 26. 549 Third Money Laundering Directive, art 21(2). 550 ibid art 21(3). 551 ibid art 22.

The Privatisation of Information Exchange 551 bodies (eg, bar associations) instead of the ‘competent authorities’.552 The Third Money Laundering Directive continued to allow for this option, but these designated bodies would in such cases ‘forward the information to the FIU promptly and unfiltered’,553 thus challenging the independence of lawyers.554 Nonetheless, cooperation among FIUs was not regulated and Article 38 of the Third Money Laundering Directive merely called upon the Commission to facilitate the coordination efforts of FIUs. Information exchanges between FIUs continued to suffer from numerous shortcomings,555 with AG Bot observing in his Opinion on the Jyske Bank Gibraltar case that the rules remained ‘minimal in nature’ and allowed Member States ‘a significant degree of discretion as regards the extent of their cooperation’.556 As a response to repeated calls at the EU level for regulating FIUs and the cooperation thereof, and in line with the FATF Recommendations in 2012,557 the Fourth Money Laundering Directive put forward a series of detailed rules.558 The Directive referred to ‘operationally independent and autonomous’ FIUs559 empowered to make a decision as to whether to conduct the analysis or dissemination of information.560 The Fourth Money Laundering Directive mandated that FIUs were obliged to produce feedback as to how they made use of the information provided, and the outcome of the investigations or inspections performed on the basis of that information.561 Thus, elements of transparency and accountability were inserted into the powers of FIUs. Furthermore, the provisions on FIU cooperation underwent considerable refurbishment. The Fourth

552 Directive 2001/97/EC of the European Parliament and of the Council of 4 December 2001 amending Council Directive 91/308/EEC on prevention of the use of the financial system for the purpose of money laundering [2001] OJ L344/76 (hereinafter the ‘Second Money Laundering Directive’). 553 Third Money Laundering Directive, art 23(1). 554 For details, see Valsamis Mitsilegas and Bill Gilmore, ‘The EU Legislative Framework against Money Laundering and Terrorist Finance: A Critical Analysis in the Light of Evolving Global Standards’ (2007) 56 International and Comparative Law Quarterly 119, 129. 555 Commission, ‘The application of Directive 2005/60/EC on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing’ (Report) COM (2012) 168 final, 11. 556 Case C-212/11, Jyske Bank Gibraltar Ltd v Administración del Estado ECLI:EU:C:2012:607, Opinion of AG Bot, paras 63–70. See Thomas Incalza, ‘National Anti-money Laundering Legislation in a Unified Europe: Jyske’ (2014) 51 CML Rev 1829. 557 FATF Recommendations, ‘Interpretive Note to Recommendation 29 (Financial Intelligence Units)’ (2012). 558 Directive (EU) 2015/849 of the European Parliament and of the Council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (Text with EEA relevance) [2015] OJ L141/73 (hereinafter the ‘Fourth Money Laundering Directive’). For an analysis, see Valsamis Mitsilegas and Niovi Vavoula, ‘The Evolving EU Anti-money Laundering Regime: Challenges for Fundamental Rights and the Rule of Law’ (2016) 23(2) Maastricht Journal of European & Comparative Law 261. 559 Fourth Money Laundering Directive, Recital 37 and art 32(3). An operationally independent and autonomous FIU is understood as the unit that ‘has the authority and capacity to carry out its functions freely, including the autonomous decision to analyse, request and disseminate specific information’. 560 Council, Document 16775/13 (22 November 2013) 44. However, the EU legislator added two circumstances under which FIUs will not be obliged to comply with the request for information: (a) where there are objective grounds for assuming that the provision of such information would have a negative effect on ongoing investigations or analyses; or (b) in exceptional circumstances, where disclosure of the information would be clearly disproportionate to the legitimate interests of a natural or legal person or irrelevant with regard to the purposes for which it has been requested. 561 Fourth Money Laundering Directive, art 32(6).

552 Databases Money Laundering Directive called for FIU cooperation ‘to the greatest extent possible’, institutional model aside.562 FIU cooperation was indeed underpinned by maximised information exchange subject to limited restrictions.563 In particular, the Fourth Money Laundering Directive called on Member States to ensure that their FIUs exchange information ‘spontaneously or upon request, even if the type of predicate offences that may be involved is not identified at the time of the exchange’.564 As tax crimes were expressly included in the list of predicate offences, it was noted that the existence of different national definitions of tax crimes should not create obstacles to the exchange of information between FIUs.565 When responding to requests from other units, FIUs were enabled to use the whole range of their available powers that they would normally employ domestically for receiving and analysing information.566 This enables the FIUs, for example, to contact a national bank and request an individual’s financial records or access domestic databases in order to respond to a counterpart’s request before an FIU activates its domestic powers on their behalf.567 In that respect, it has been suggested that FIUs ‘may go against the principle of “mutual recognition” of suspicions’568 and whereas some EU FIUs require ‘adequately motivated requests’, they nonetheless do not challenge their counterparts’ suspicion.569 A key issue in this respect is the threshold applicable for a counterpart’s request for information – is corroborated suspicion necessary to justify a request and what is the FIU’s leeway to assess the counterpart’s suspicion?570 The FIU network became all the more interconnected;571 on the one hand, FIUs were obliged to forward suspicious transaction reports that concern another Member State to its respective FIU.572 On the other hand, the Directive formally recognised the EU FIUs Platform,573 an informal network of FIUs that promotes their cooperation, and referred to FIU.net574 by calling on Member States to ensure that their FIUs cooperate in the application of technologies that allow them to ‘match their data with that of other FIUs in an anonymous way’.575 The Directive did impose certain limits to FIUs cooperation. In line with the purpose limitation principle, information must be shared only for the purposes of processing

562 Fourth Money Laundering Directive, art 52. 563 Mouzakiti (n 541). 564 Fourth Money Laundering Directive, art 53(1). See also János Böszörmenyi and Erich Schweighofer, ‘A Review of Tools to Comply with the Fourth EU Anti-Money Laundering Directive’ (2015) 29(1) International Review of Law, Computers & Technology 63, 69–71. 565 Fourth Money Laundering Directive, art 57. 566 ibid art 53(2). 567 Foivi Mouzakiti, ‘Cooperation between Financial Intelligence Units in the European Union: Stuck in the Middle between the General Data Protection Regulation and the Police Data Protection Directive’ (2020) 11(3) New Journal of European Criminal Law 351, 358. 568 EU FIUs Platform (n 541) 170–71. 569 ibid. 570 Mouzakiti (n 567) 358–59. 571 ibid 368–69. 572 Fourth Money Laundering Directive, art 53(1). See EU FIUs Platform (n 541) 171–75. 573 Fourth Money Laundering Directive, art 51. 574 There is no central database and no central storage of data. Instead, all data connected to FIU.net are stored at an FIU.net database located in the premises of individual FIU. See Mouzakiti (n 567) 360. On the host organisation of FIU.net and the concerns of having FIU.net hosted by Europol, see ibid 370–73. 575 Fourth Money Laundering Directive, arts 53(1) and 56(2).

The Privatisation of Information Exchange 553 or analysis by the FIU.576 Furthermore, an FIU may refuse to exchange information with another unit, but only in exceptional circumstances, when the exchange could be contrary to fundamental principles of its national law.577 Moreover, the transmitting FIU may impose restrictions and conditions for the use of the information it provides.578 Further dissemination of information by the receiving FIU to any other authority, agency or department, or any use of information for purposes beyond those for which exchange of information was originally approved, is subject to the prior consent of the transmitting FIU. That said, the dissemination of information must also take place ‘to the largest extent possible’ with limited circumstances explicitly circumscribed in the Directive justifying the refusal to provide such consent.579 Just a few months after the adoption of the fourth Money Laundering Directive in 2015 and whilst the implementation process was still ongoing, the terrorist events throughout the EU coupled with disclosures on deficiencies in the global financial system (the ‘Panama Papers’) led to increased calls for further amending the rules on FIUs.580 The Council invited the Commission to present proposals to ‘strengthen, harmonise and improve the powers of, and the cooperation between … FIUs, notably through the proper embedment of the FIU.net network for information exchange in Europol’.581 A proposal for a Fifth Money Laundering Directive was adopted on 5 July 2016582 and the final text was published on 29 July 2018.583 In line with commitments undertaken in the European Agenda on Security584 and the latest international standards,585 576 ibid arts 53, 54 and 55. See Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [2016] OJ L119/1, art 5(1)(b). 577 Fourth Money Laundering Directive, art 53(3). 578 ibid art 54. 579 ibid art 55(2). A refusal is only justified if the dissemination would: (a) fall beyond the scope of application of its AML and counter-terrorist financing provisions; (b) could lead to impairment of a criminal investigation; (c) would be clearly disproportionate to the legitimate interests of a natural or legal person or the Member State of the requested FIU; or (d) would otherwise not be in accordance with fundamental principles of national law of that Member State. 580 Commission, ‘Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directive 2009/101/EC’ COM (2016) 450 final. 581 Council, Document 14382/15 (20 November 2015) 6; Commission, ‘Action Plan for Strengthening the Fight against Terrorist Financing’ (Communication) COM (2016) 50 final. 582 Commission, ‘Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directive 2009/101/EC’ COM (2016) 450 final; Commission, ‘Impact Assessment Accompanying the Document Proposal for a Directive of the European Parliament and the Council amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directive 2009/101/EC’ (Staff Working Document) SWD (2016) 223 final, 8. 583 Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU [2018] OJ L156/43 (hereinafter the ‘Fifth Money Laundering Directive’). 584 Commission (n 281). 585 See criterion 29.3 in the FATF methodology for assessing technical compliance with the FATF recommendations and the effectiveness of AML/CFT systems as agreed in October 2015: ‘In the context of its analysis function, the FIUs should be able to obtain from any reporting entity additional information relating to a suspicion of ML/TF. This does not include indiscriminate requests for information to reporting entities in the context of the FIU’s analysis (eg “fishing expeditions”)’.

554 Databases the Directive enhanced the powers of FIUs, which may obtain additional information from any obliged entity not only on the basis of a prior suspicious transaction report sent to the FIU, but also through other means, such as the FIU’s own analysis, intelligence provided by competent authorities or information held by another FIU. Therefore, additional information may be transferred even without a prior report needing to be made.586 The FIUs have access ‘in an immediate and unfiltered manner’ to more information from centralised bank and payment account registers or data retrieval systems that Member States are required to establish.587 Thus, FIUs gradually transform from a suspicions-based to a more intelligence-based disclosure system. As for FIU cooperation, although formally the rules did not stand in the way of FIUs to exchange information, a key shortcoming involved the divergent definitions of predicate offences at the national level.588 In that respect, the Directive clarified that differences in the definition of associate predicate offences, or the lack of their identification or reference to such offences should not constitute an obstacle to the exchange (and use) of information between FIUs and to its distribution to law enforcement.589 Amidst these developments, the FIU platform conducted a study of the obstacles to FIUs’ access to and exchange of information,590 which led the Commission to adopt a proposal in 2018 that sought to, inter alia, facilitate FIU cooperation.591 Directive 2019/1153 laying down rules on facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences592 was adopted in June 2019 and repealed the 2000 Decision. Interestingly, the legal basis of the Directive is Article 87(2) TFEU, which enables the adoption of measures regarding the collection, storage and exchange of information and common investigative techniques within the framework of police cooperation, though not all FIUs adhere to the police model (as mentioned above).593 Directive 2019/1153 has complemented the existing rules on FIUs as regards the exchange of information with competent authorities and their in-between cooperation. Rules on cooperation between designated national authorities competent for the prevention, detection, investigation or prosecution of criminal offences and FIUs.594 In particular, every FIU is required to cooperate with the designated competent authorities of their respective Member State and to be able to reply, in a timely manner, to reasoned requests for financial information or financial analysis, where that is necessary on a case-by-case basis and where the 586 Fifth Money Laundering Directive, Recital 17. 587 ibid art 1(19). 588 Commission, ‘Improving cooperation between EU Financial Intelligence Units’ (Staff Working Document) SWD (2017) 275 final, 10. 589 Fifth Money Laundering Directive, Recital 19, art 1(33), (35) and (36). 590 EU FIUs Platform (n 541). 591 Commission, ‘Proposal for a Directive of the European Parliament and of the Council laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences and repealing Council Decision 2000/642/JHA’ COM (2018) 213 final. 592 Directive (EU) 2019/1153 of the European Parliament and of the Council of 20 June 2019 laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences, and repealing Council Decision 2000/642/JHA [2019] OJ L1986/122. 593 Mouzakiti (n 567) 356–57; Commission, ‘Impact Assessment accompanying the Proposal for a Directive of the European Parliament and of the Council laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences and repealing Council Decision 2000/642/JHA’ (Staff Working Document) SWD (2018) 115 final, 24. 594 Directive 2019/1153, art 3.

The Privatisation of Information Exchange 555 request is motivated by concerns relating to the prevention, detection, investigation or prosecution of serious criminal offences.595 According to Recital 11 of the Directive, the designated competent authorities may include tax authorities or anti-corruption authorities, but the scope of the Directive does not cover their administrative investigations. The FIU is not obliged to comply if such information will negatively impact ongoing investigations or analyses, or in exceptional circumstances where disclosure of the information would be clearly disproportionate to the legitimate interests of a natural or legal person or irrelevant with regard to the purposes for which it has been requested.596 The designated competent authorities may process the financial information and financial analysis received from the FIU for the specific purposes of preventing, detecting, investigating or prosecuting serious criminal offences other than the purposes for which personal data are collected.597 Furthermore, in addition to the prescriptions of the Fourth Money Laundering Directive, the designated competent authorities must reply in a timely manner to requests for information made by the national FIU in relation to money laundering, associate predicate offences and terrorist financing.598 A key novelty has been that in exceptional and urgent cases, FIUs are entitled to exchange financial information or financial analysis that may be relevant for the processing or analysis of information relating to terrorism or organised crime associated with terrorism.599 These offences, which are not further specified in the Directive, fall beyond the scope of the tasks and mandate entrusted to FIUs.600 As such, it seems that the operation of FIUs and their flexible rules on information exchange progressively make their way into criminal offences outside their traditional forum of fighting money laundering and terrorist financing, as stipulated in the Fourth Money Laundering Directive.601 This development has significant implications as it bypasses the purpose limitation principle, and is testament to the growing trend of expanding the powers of EU and/or national agencies and bodies whilst maximising the exploiting potential of the information collected. In addition to rules concerning the functioning and cooperation of FIUs amongst themselves and with national authorities, Directive 2019/1153 has allowed national designated authorities to have direct access to the centralised bank registers or data retrieval systems, which were established pursuant to the prescriptions of the Fifth Money Laundering Directive.602 This development is attributed to the fact that in most Member States, authorities do not have such access and usually request the information either via blanket requests sent to all financial institutions in their Member State or, if they have been granted indirect access, via a request to an intermediary. These authorities

595 ibid art 7(1). 596 ibid art 7(2). 597 ibid art 7(4). 598 ibid art 8. 599 ibid art 9(1). 600 See statements by Germany in Council, Document 9313/19 ADD 1 REV 2 (7 June 2019). See also the statements by the Commission and the Parliament claiming that they should have covered all serious criminals offences in Council, Document 9113/19 ADD 3 (7 June 2019). 601 Fourth Money Laundering Directive, art 53(1). 602 Directive 2019/1153, arts 4–6.

556 Databases may have access and search bank account information only on a case-by-case basis,603 albeit without the elaboration of further conditions justifying the interference with the rights to privacy and personal data protection (eg, that the case is well-founded). As for Europol, it is foreseen that national competent authorities and Europol must respond to duly justified requests relating to bank account information made by Europol on a case-by-case basis within the limits of its responsibilities and for the performance of its tasks.604 Finally, the Directive encompasses a series of data protection safeguards, particularly in relation to sensitive information,605 the maintenance of records of information exchanges606 and the restriction of data subjects’ access rights.607 As regards the latter, Article 18 stipulated that Member States may adopt legislative measures restricting, in whole or in part, individuals’ right of access to personal data relating to them that are processed.608 This flexibility to Member States may lead to divergent implementation at the national level and may prevent individuals from exercising their rights under data protection law. The challenges for privacy and personal data protection posed by the aforementioned legal framework cannot be overstressed. A wide range of everyday information is transferred by a broad array of private sector companies and professionals to FIUs and now national designated authorities. Safeguards that have been introduced, such as the requirement to transmit suspicious transaction reports to an independent filtering authority, the FIU, rather than to the police, recognising that the information provided may reflect innocent everyday behaviour and not be linked to crime, are progressively undermined by the rules on FIU cooperation, which must take place as much as possible, regardless of their nature and irrespective of differences in criminal legislations. The new rules established by Directive 2019/1153 further expand the surveillance powers of the state over financial activities by giving access to national authorities to central bank registries that Member States were obliged to set up under the Fourth Money Laundering Directive in connection to a serious criminal offence. Thus, surveillance is progressively moving beyond the traditional AML context to encompass all serious crimes. The existence of diverse institutional models based on which FIUs operate also constitutes a major challenge. On the one hand, viewing all FIU activities as relating to criminal law may disregard efforts in a number of EU Member States to leave FIUs as far as possible outside the criminal justice system – for instance, by establishing independent authorities as FIUs. On the other hand, the criminal law purpose of FIU data exchange seems hard to deny and is reinforced by the approach of both the Fourth Money Laundering Directive and Directive 2019/1153 to facilitate the exchange of information between FIUs regardless of their nature and status. The issue has been

603 ibid art 5(1). 604 ibid arts 11–12. 605 ibid art 16. 606 ibid art 17. 607 ibid art 18. 608 See EDPS, ‘Formal comments of the EDPS on the Proposal for a Directive of the European Parliament and of the Council laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences’ (10 September 2018).

The Privatisation of Information Exchange 557 i nextricably related to the legality of the adoption of criminal law AML standards under the first pillar,609 and the adoption of Directive 2019/1153 under a criminal law legal basis demonstrates that the problem remains. In the case of FIUs of an administrative nature, the body processing suspicious transaction reports differs from that investigating based on information in these reports, and therefore the applicable data protection safeguards must differ as well.610 In that respect, the General Data Protection Regulation 2016/679 (GDPR) is applicable during the analysis by the FIU to determine whether a report merits further investigation, whereas the Police Directive is the data protection framework in the event that a reported suspicious transaction is substantiated by the FIU.611 As has been pointed out, in cases of police FIUs, the distinction between examining reports and criminal investigations is blurred, in breach of the AML legal framework.612 The applicability of different data protection rules is also reflected in the data protection safeguards exchange of information among FIUs. On the one hand, the Money Laundering Directives do not provide a clear answer in that respect.613 On the other hand, though the Commission refers to the applicability of the GDPR, viewing FIUs ‘as a public administration’,614 not all FIUs abide by the same data protection instrument and most FIUs apply the Law Enforcement Directive or both instruments.615 The privacy and data protection concerns raised by the application of unequal data protection rules are important, as it may be the case that personal data become subject to lower safeguards after their transfer. The evolution of the AML legal framework is bound to continue. Of particular interest is that Recital 22 of Directive 2019/1153 called on the Commission to assess ‘in the near future’ whether the establishment of a coordination and support mechanism, namely an overarching ‘EU FIU’, would be appropriate so as to further strengthen the cooperation of FIUs. The Action Plan ‘for a comprehensive Union policy on preventing money laundering and terrorist financing’ of 7 May 2020 called for the establishment of an FIU coordination and support mechanism at the EU level to remedy weaknesses such as the limited information exchange between FIUs and other competent authorities (eg, customs authorities).616 On 20 July 2021, the Commission adopted a legislative package comprising four legislative proposals, one of which concerns the establishment of an Authority for Anti-Money Laundering and Countering the Financing of Terrorism.617

609 On the debate regarding money laundering offences, see ch 2. 610 Mouzakiti, (n 567). See Mitsilegas and Vavoula (n 558) 261. 611 Prior to the adoption of the Directive, the application of EU secondary law was not possible since the Framework Decision applied only in cases of cross-border processing of personal data; see below. 612 Mouzakiti (n 567). 613 See Fourth Money Laundering Directive, Recital 42 and art 41. 614 EU FIUs Platform, ‘Minutes of the 35th Meeting of the EU FIUs Platform’ (8 June 2018). See also Commission, ‘Report from the Commission to the European Parliament and the Council – Assessing the Framework for Cooperation between Financial Intelligence Units’ (24 July/2019) COM (2019) 371 final, 12. 615 Mouzakiti (n 567) 364–65. 616 Commission, ‘Action Plan for a comprehensive Union policy on preventing money laundering and terrorist financing’ (Communication) C(2020) 2800 final. For an analysis, see EDPS, ‘Opinion 5/2020 on the European Commission’s action plan for a comprehensive Union policy on preventing money laundering and terrorism financing’ (23 July 2020). 617 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council establishing the Authority for Anti-money Laundering and Countering the Financing of Terrorism and amending R egulations

558 Databases With respect to FIUs in particular, the Authority shall play a significant role in the conduct of joint analyses by FIUs of certain cross-border suspicious transactions and activities. Furthermore, it shall make available to FIUs IT and AI services and tools for secure information sharing, including through the hosting of FIU.net.

B. Retention of Electronic Communication Metadata Another instance where the private sector has been called upon to assist in the fight against terrorism and serious crimes concerns the retention of electronic communications data. The interest has not been limited to data relating to the content of communications, but extended to so-called metadata, that is, data about the location (source and destination), date, time and duration, as well as data to identify the type of communication and equipment used and unsuccessful call attempts; in other words, this is ‘data about data’. Directive/2002/58/EC (hereinafter the ‘e-Privacy Directive’), which applied data protection provisions specifically to the telecommunications sector,618 provided for the erasure of electronic communications data.619 At the same time, calls proliferated to make use of such data if retained for a limited time by the private sector.620 These calls intensified in the aftermath of the Madrid bombings in 2004, when on 25 March 2004 the European Council issued the Declaration on Combating Terrorism instructing the Council, among other things, to examine proposals for establishing rules on the retention of communications traffic data by service providers.621 Shortly afterwards, a third pillar Framework Decision on data retention was tabled at the initiative of four Member States (France, Ireland, Sweden and the UK).622 The proposal justified the bulk retention as follows: The preservation of specific data relating to specific individuals in specific cases is not sufficient … In investigations, it may not be possible to identify the data required or the individual involved until many months or years after the original communication. It is therefore necessary to retain certain types of data, which are already processed and stored for billing commercial, or any other legitimate purposes, for a certain additional period of time

(EU) No 1093/2010, (EU) 1094/2010, (EU) 1095/2010’ COM (2021) 421 final. The other proposals are: ‘Proposal for a Directive of the European Parliament and of the Council on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and repealing Directive (EU) 2015/849’ COM (2021) 423 final; ‘Proposal for a Regulation of the European Parliament and of the Council on information accompanying transfers of funds and certain crypto-assets (recast)’ COM (2021) 422 final; ‘Proposal for a Regulation of the European Parliament and of the Council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing’ COM (2021) 420 final. 618 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) [2002] OJ L201/37. 619 According to art 6(1) of the Directive, traffic data must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication. 620 See Council, Document 15691/02 (Presse 404) (8 January 2003), The Council called in particular for the approximation of data retention rules (para 7). 621 European Council (n 212) 4. 622 Council, Document 8958/04 (28 April 2004).

The Privatisation of Information Exchange 559 in anticipation that they might be required for a future criminal investigation or judicial proceedings. (Emphasis added)623

This resulted in difficult and slow negotiations, leading to the JHA Council – this time responding to the London bombings in July 2005 – to state that it will agree on the Framework Decision on data retention by October 2005.624 Negotiations were subsequently prioritised and speeded up by the then UK presidency of the EU of the second half of 2005. In an attempt to address the difficulty in reaching agreement by unanimity in the third pillar, the proposal was relaunched as a first pillar Directive in September 2005.625 The majority voting required in the Council under the first pillar may have facilitated agreement on the Directive, which was formally adopted under an Article 95 EC (internal market) legal basis (now Article 114 TFEU) in April 2006.626 In a nutshell, by derogation from Directive 2002/58/EC,627 Directive 2006/24/EC (hereinafter the ‘Data Retention Directive’) obliged the providers of publicly available electronic communications services or of public communications networks to retain various types of telecommunication data by all individuals within the EU. The aim of the retention was ‘to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime’,628 as defined by each Member State in its national law. The Directive applied to traffic and location data on both legal entities and natural persons, but not to the content of electronic communications.629 Retention periods would vary between six months and two years,630 and even the maximum length could be extended by Member States facing particular circumstances.631 This provision may reflect disagreements in the negotiation process and was far from providing a harmonised EU standard.632 Moreover, the retention period could be extended by Member States ‘facing particular circumstances that warrant an extension’.633 Whereas the Directive obliged service providers to retain telecommunications data, the modalities of law enforcement access to the data were to be determined through

623 ibid Recital 6. 624 Council, Document 11116/05 (20 July 2005) para 4. 625 Commission, ‘Proposal for a Directive of the European Parliament and of the Council on the retention of data processed in connection with the provision of public electronic communication services and amending Directive 2002/58/EC’ COM (2005) 438 final. 626 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services of public communications networks and amending Directive 2002/58/EC [2006] OJ L105/54 (hereinafter the ‘Data Retention Directive’). On the negotiations and content of the Directive, see Francesca Bignami, ‘Protecting Privacy against the Police in the European Union: The Data Retention Directive’ (Duke Law School Science, Technology and Innovation Research Paper Series, Research Paper No 13, January 2007). 627 Data Retention Directive, art 3(1). 628 ibid art 1(1). 629 ibid art 1(2); see art 5(2). The definition of traffic and location data was with reference to Directive 2002/58/EC; see arts 2(b) and (2(c). 630 Data Retention Directive, art 6. 631 ibid art 12(1). 632 In its report, the House of Lords European Union Committee characterises the degree of approximation involved as ‘half-hearted at best’. See House of Lords European Union Committee, ‘After Madrid: The EU’s Response to Terrorism’ (5th Report, session 2004–05, March 2005) 18. 633 Data Retention Directive, art 12(1).

560 Databases implementation at the national level,634 with the Directive merely stating that access was limited ‘only to the competent national authorities in specific cases and in accordance with national law’.635 Specific provisions on data protection636 (including a provision on the designation of supervisory authorities by Member States),637 remedies,638 liability and penalties for non-compliance were also included in the Directive, all largely defined under national law.639

i. Constitutional Concerns at the National Level The Data Retention Directive introduced a paradigm of pre-emptive, privatised and generalised surveillance on the basis of the indiscriminate collection and retention of data relating to everyday life, raising a number of questions on the impact of this paradigm on fundamental rights such as the right to respect for private life, personal data protection and freedom of expression, as well as on broader issues of citizenship and democracy.640 A number of these issues were raised by national courts in their scrutiny of the implementation of the Directive in their respective national legal orders, with a number of these courts declaring the implementation of the Data Retention Directive to be unconstitutional.641 The adverse impact of pre-emptive mass surveillance on the relationship between the individual and the state in a democratic society was a central issue. According to the German Constitutional Court: A preventive general retention of all telecommunications traffic data … is, among other reasons, also to be considered as such heavy infringement because it can evoke a sense of being watched permanently … The individual does not know which state official knows what about him or her, but the individual does know that it is very possible that the official does know a lot, possibly also highly intimate matters about him or her. (Emphasis added)642

634 For a detailed overview of the Directive, see Patrick Breyer, ‘Telecommunications Data Retention and Human Rights: The Compatibility of Blanket Traffic Data Retention with the ECHR’ (2005) 11 European Law Journal 365; Francesca Bignami, ‘Privacy and Law Enforcement in the European Union: The Data Retention Directive’ (2007) 8 Chicago Journal of International Law 233; Ian Brown, ‘Communications Data Retention in an Evolving Internet’ (2010) 19 International Journal of Law and Information Technology 95; Theodore Konstadinides, ‘Mass Surveillance and Data Protection in EU Law: The Data Retention Directive Saga’ in Maria Bergström and Anna Jonsson Cornell (eds), European Police and Criminal Law Cooperation (Hart Publishing, 2014) 69–84. 635 Data Retention Directive, art 4. 636 ibid arts 7–9. 637 ibid art 9. 638 ibid art 13. According to art 13(1), it is left to Member States to designate and include judicial remedies. 639 ibid art 13. 640 Valsamis Mitsilegas. ‘The Value of Privacy in an Era of Security: Embedding Constitutional Limits on Pre-emptive Surveillance’ (2014) 8(1) International Political Sociology 104. 641 Theodore Konstadinides, ‘Destroying Democracy on the Ground of Defending it? The Data Retention Directive, the Surveillance State and Our Constitutional Ecosystem’ (2011) 36 European Law Review 722; Anna Vedaschi and Valerio Lubello, ‘Data Retention and its Implications for the Fundamental Right to Privacy. A European Perspective’ (2015) 20 Tilburg Law Review 14. 642 Decision 1 BvR 256/08, 1 BvR 263/08, 1BvR 586/08 of the German Constitutional Court (2 March 2010), para 214. For further analyses, see Katja de Vries, Rocco Bellanova and Paul de Hert, ‘Proportionality Overrides Unlimited Surveillance: The German Constitutional Court Judgment on Data Retention’ (CEPS, May 2010); Christian DeSimone, ‘Pitting Karlsruhe against Luxembourg? German Data Protection and the Contested Implementation of the EU Data Retention Directive’ (2010) 11 German Law Journal 291.

The Privatisation of Information Exchange 561 Similar concerns were raised by the Romanian Constitutional Court in its judgment on the law transposing the Data Retention Directive in Romania,643 which noted that data retention involves all individuals: [R]egardless of whether they have committed penal crimes or not or whether they are the subject of a penal investigation or not, which is likely to overturn the presumption of innocence and to transform a priori all users of electronic communication services or public communication networks into people susceptible of committing terrorism crimes or other serious crimes.644

According to the Romanian Constitutional Court, continuous data retention generates legitimate suspicions about the state’s respect for its citizens’ privacy and about the perpetration of abuses by the state. Furthermore, the blanket retention of data was deemed disproportionate by nature irrespective of its subsequent use.645 Consequently, the Court annulled the transposing law in its entirety for violating a series of rights entrenched in the national Constitution, namely the right to privacy, inviolability of domicile, secrecy of communications and the right to free development of human personality. Furthermore, the Bulgarian Constitutional Court declared the unconstitutionality of the legislation transposing the Data Retention Directive at least in part, due to lack of privacy guarantees and the lack of sufficient limitations concerning access to the retained data.646 Moreover, the Cypriot Constitutional Court considered the transposition provisions to violate both privacy and the secrecy of communications.647 As for the Czech Constitutional Court, it expressed its doubts as to whether an instrument of global and preventive retention of metadata on almost all electronic communications may be deemed necessary and adequate in view of the intensity of the intervention to the private sphere of an indefinite number of persons.648 In these rulings, courts have criticised the extension of state power by ruling against the retention of personal data, regardless of any subsequent processing of the data. National courts have addressed the erosion of citizenship and trust such retention involves, and have highlighted the importance of privacy as underpinning the exercise of other fundamental rights.

643 Law 298/2008. 644 Decision No 1258 of 8 October 2009 (unofficial translation by Bogdan Manolea and Anca Argesiu), www. legi-internet.ro/fileadmin/editor_folder/pdf/decisionconstitutional-court-romania-data-retention.pdf. For an analysis, see Cian Murphy, ‘Romanian Constitutional Court, Decision No 1258 of 8 October 2009 Regarding the Unconstitutionality Exception of the Provisions of Law No 298/2008 Regarding the Retention of the Data Generated or Processed by the Public Electronic Communications Service Providers, as Well as for the Modification of Law No 506/2004 Regarding the Personal Data Processing and Protection of Private Life in the Field of Electronic Communication Area’ (2010) 47 CML Rev 933. 645 In particular, what the Court found unconstitutional was ‘the legal obligation with a continuous character, generally applicable, of data retention. This operation equally addresses all the law subjects, regardless of whether they have committed penal crimes or not or whether they are the subject of a penal investigation or not, which is likely to overturn the presumption of innocence and to transform a priori all users of electronic communication services or public communications networks into people suspected of committing terrorism crimes or other serious crimes’ (emphasis added). 646 European Digital Rights, ‘Bulgarian Court Annuls a Vague Article of the Data Retention Law’ (Digital Civil Rights in Europe, 17 December 2008), http://history.edri.org/edri-gram/number6.24/ bulgarian-administrative-case-data-retention. 647 For an analysis, see Christiana Markou, ‘The Cyprus and Other EU Court Rulings on Data Retention: The Directive as a Privacy Bomb’ (2012) 28 Computer Law & Security Review 468. 648 2011/03/22 Pl. ÚS 24/10, www.concourt.cz/clanek/pl-24-10.

562 Databases By focusing on the individual and adopting a holistic approach to protection, the judiciary managed to develop privacy into a meaningful constitutional safeguard against pre-emptive surveillance.649

ii. The EU Inter-pillar Litigation (Ireland v European Parliament and Council) Unsurprisingly, the Data Retention Directive generated significant controversy. In 2006, it was challenged before the Luxembourg Court on legal basis grounds, but survived the judgment.650 The Court accepted that the internal market legal basis was the correct one, as the instrument enabled the elimination of obstacles in the internal market, even though the ultimate purpose of data retention was to facilitate police action.651 The crucial point in its assessment was the fact that Directive did not govern access by law enforcement authorities.652 Nevertheless, that Court inserted a small caveat – it explicitly mentioned that it had not approved the compatibility of data retention with the fundamental right to privacy.653 As Boehm has rightly pointed out, the Court drew a line between the retention and the storing of the data, and its subsequent use and access.654 Against this arguably heated background, an ongoing debate has emerged leading to the development of an ongoing judicial dialogue between national courts and the CJEU on the legality and compatibility with EU law of the Data Retention Directive and national legislation on data retention.655 At the time of writing, a series of judgments have been released in this context, which are examined in turn below.

iii. Digital Rights Ireland: The Prohibition of Generalised and Indiscriminate Surveillance The landmark case concerning the interpretation of the Data Retention Directive by the CJEU has been Digital Rights Ireland,656 where the Court was called to rule on two requests for preliminary rulings; one emanating from Digital Rights Ireland, an NGO that challenged before the Irish High Court the compatibility of the Irish implementing law with fundamental rights, and a second stemming from a ‘class action’ brought

649 Mitsilegas (n 640). 650 Case C-301/06, Ireland v European Parliament and Council of the European Union (2009) ECR I-593. 651 ibid paras 63–64. 652 ibid para 80. 653 ibid para 57. 654 Boehm (n 10) 113. For an analysis of the judgment, see Esther Herlin-Karnell, ‘Annotation of Ireland v Parliament and Council’ (2009) 46 CML Rev 1667; Theodore Konstadinides, ‘Wavering between Centres of Gravity: Comment on Ireland v Parliament and Council’ (2010) 35 European Law Review 88; Cian Murphy, ‘Fundamental Rights and Security: The Difficult Position of the European Judiciary’ (2010) 16 European Public Law 289. 655 For an early analysis, see Ludovica Benedizione and Eleonora Paris, ‘Preliminary Reference and Dialogue between Courts as Tools for Reflection on the EU System of Multilevel Protection of Rights: The Case of the Data Retention Directive’ (2015) 16 German Law Journal 1727. 656 Digital Rights Ireland (n 245).

The Privatisation of Information Exchange 563 before the Austrian Constitutional Court by more than 11,000 Austrian citizens against parts of the Austrian transposing legislation. Both referring courts inquired into the validity of some provisions of the Directive in light of the rights to respect for private life and the protection of personal data, as well as the freedom of expression. From the outset, the CJEU – in its most authoritative configuration, the Grand Chamber, observed that the data retained made it possible to know the identity of the person, with whom the data subject had communicated, and the form, time, place and frequency of communications.657 In the Court’s view, this dataset ‘taken as a whole’: [M]ay allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them.658

Having made this remark and echoing the comments made by the national constitutional courts, the Court found no difficulty in asserting that the retention of telecommunication data amounted to an interference with Articles 7 and 8 of the Charter on the right to respect for private life and protection of personal data.659 It recalled that the existence of an interference is not affected by the sensitivity of the information on the private lives, or a possible inconvenience in any way of the persons concerned.660 Furthermore, it contended that access by the competent national authorities to the data constitutes a separate interference with privacy.661 The next step for the Court was to declare that the interference is wide-ranging and thus must be considered to be particularly serious.662 This proposition was based on the fact that there is no requirement for the service providers to store the data to be retained within the territory of a Member State, under the jurisdiction of a Member State – a fact which considerably increases the risk that such data may be accessible or disclosed in breach of privacy standards.663 Furthermore, in line with the AG’s view, the Grand Chamber found that the retention and subsequent use without the subscriber or registered user being informed ‘is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance’.664 657 ibid para 26. 658 ibid para 27. AG Cruz Villalón eloquently pointed out in this respect: ‘There are, however, data which are in a sense more than personal. These are data which, qualitatively, relate essentially to private life, to the confidentiality of private life, including intimacy. In such cases, the issue raised by personal data commences, so to speak, further ‘upstream’. The issue which arises in such cases is not yet that of the guarantees relating to data processing but, at an earlier stage, that of the data as such, that is to say, the fact that it has been possible to record the circumstances of a person’s private life in the form of data, data which can consequently be subject to information processing.’ Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others (C–293/12) and Kärntner Landesregierung and Others (C–594/12), ECLI:EU:C:2014:238, Opinion of AG Cruz Villalón delivered on 12 December 2013, para 65. 659 ibid paras 32–36. 660 ibid para 33. 661 ibid para 35. This is in line with the case law of the ECtHR in Leander v Sweden (1987) 9 EHRR 433; Rotaru v Romania (2000) 8 BHRC 43; and Weber and Saravia v Germany (2000) 8 BHRC 43. 662 Digital Rights Ireland (n 245) para 37. 663 ibid, Opinion of AG Cruz Villalón, paras 77 and 80. 664 ibid para 37. The AG’s views are enlightening in this regard. He found that the collection and retention in huge databases of large quantities of everyday telecommunication data established the conditions of surveillance. Although carried out only retrospectively when the data are used, the collection and retention

564 Databases The Court then proceeded to summarily dismiss the argument that the interference does not respect the essence of privacy and data protection. With regard to the former, it pointed out that the obligation imposed by the Data Retention Directive does not permit the acquisition of knowledge of the content of the electronic communications per se.665 As for the right to personal data protection, the Court observed that the Directive requires the respect of certain data protection and data security principles.666 This narrow perception of the essence of the rights in question has been rightly criticised as ‘hierarchical and formalistic’, drawing an artificial distinction between content data and metadata,667 because it disregarded the fact that even metadata may reveal as much about someone’s personal circumstances as the interception of communications content, whereas a long retention period may enable the construction of ‘rich longitudinal metadata about a person’s activities over an extended period’.668 Besides, ‘data security’ does not form part of the right to data protection as enshrined in Article 8 of the Charter.669 Refraining from finding that mass data retention violates the essence of the rights to privacy and data protection was a missed opportunity which ‘would have sent the strongest message on the need to preserve liberty in the face of generalised surveillance on the basis of the very retention of personal data and would reiterate the need to uphold EU values not only externally,670 but also internally’.671 The Court equally found that the measure in question genuinely satisfied an objective of general interest – that is, public security.672 In this respect, it highlighted Article 6 of the Charter, which sets out the right of any person not only to liberty, but also to security.673 The heart of the ruling is the proportionality test conducted under the requirements of Article 52(1) of the Charter. The Court used the principle by reference to its development in EU law,674 as well as by reference to the case law of the ECtHR.675 constituted a permanent threat to privacy throughout their retention period (para 72). Furthermore, in his view, ‘the vague feeling of surveillance’ might influence the right to freedom of expression and information (para 52). His finding is in line with the views of the Romanian Constitutional Court. 665 ibid para 39. 666 ibid para 40. 667 Maja Brkan, ‘The Essence of the Fundamental Rights to Privacy and Data Protection: Finding the Way through the Maze of the CJEU’s Constitutional Reasoning’ (2019) 20 German Law Journal 864. This distinction was later dropped in Tele2 and Watson; see below. 668 Marie-Pierre Granger and Kristina Irion, ‘The Court of Justice and the Data Retention Directive in Digital Rights Ireland: Telling off the EU Legislator and Teaching a Lesson in Privacy and Data Protection’ (2014) 39(6) European Law Review 834, 847. 669 Brkan (n 667) 878; Orla Lynskey, The Foundations of EU Data Protection Law (Oxford University Press, 2015) 172. 670 The Court found that there was interference with the essence of rights in Case C-362/14, Maximilian Schrems v Data Protection Commissioner ECLI:EU:C:2015:650 (hereinafter Schrems 1) on the ground that the case involved the content of communications. 671 Valsamis Mitsilegas, ‘The Privatisation of Surveillance in the Digital Age’ in Valsamis Mitsilegas and Niovi Vavoula (eds), Surveillance and Privacy in the Digital Age: European, Transatlantic and Global Perspectives (Hart Publishing, 2021) 101–157, 111. 672 Digital Rights Ireland (n 245) paras 41–42. 673 ibid para 42. This is a flawed approach that was corrected in La Quadrature du Net and Others; see below. 674 According to the settled case law of the Court, the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives. See, for example, Case C-343/09, Afton Chemical, EU:C:2010:419, para 45; Joined Cases C-92/09 and C-93/09, Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen, EU:C:2010:662, para 74. 675 Reference was made to S and Marper v UK (2009) 48 EHRR 50 (para 55).

The Privatisation of Information Exchange 565 The Grand Chamber noted that the discretion the EU legislator enjoyed is dependent upon a number of factors, such as the area concerned, the nature of the right in question, the nature and seriousness of the interference, and the object pursued by the interference.676 It then declared that this discretion was reduced and therefore its review of that discretion should be strict in view of ‘the important role played by the protection of personal data in the light of the fundamental right to respect for private life’ and the extent and seriousness of the interference.677 The appropriateness of telecommunications data retention was not called into question. The Court held that due to the growing importance of means of electronic communication, the retained data allow the competent prosecutorial authorities to have additional opportunities to shed light on serious crime and therefore are a ‘valuable tool’ for criminal investigations.678 However, in relation to the proportionality of retention, the Grand Chamber enumerated a series of loopholes and inadequacies of the legislation by taking into consideration arguments raised by the national constitutional courts.679 A close examination of the judgment reveals four areas touched upon by the Court: the personal scope of the Directive; the modalities of access and subsequent use of the data; the retention period; and data security. Starting with the personal scope of the Data Retention Directive, it pointed out that it involves all traffic data and applies to all means of electronic communication. As a result, it concluded that in practice, it affects the entirety of the European population.680 In addition, the Directive covers, in a generalised manner, all persons and all means of electronic communication, as well as traffic data without any differentiation, limitation, or exception being made.681 The Court exposed the absence of any relationship between the huge amount of retained data and persons likely to be involved in committing serious crimes. There was no requirement that the persons are even indirectly in a situation that is liable to give rise to criminal prosecutions. Instead, the Directive was applicable even to persons against whom there is no evidence that their conduct may be linked, even remotely or indirectly, to serious crime. Furthermore, the Directive did not include any exception concerning those persons whose communications are subject to professional secrecy, such as lawyers.682 Moreover, it contained no rules restricting the retention to: (i) data pertaining to a particular time period, and/or a particular geographical zone, and/or to a circle of particular persons likely to be involved, in one way or another, in a serious crime; or (ii) to persons who could, for other reasons, contribute, by the retention of their data, to the prevention, detection or prosecution of serious offences.683 The issue of access to the data by law enforcement authorities and their subsequent use was also thoroughly scrutinised. In this regard, the Grand Chamber was dissatisfied with the absence of any objective criterion determining the limits of the access

676 ibid

para 47. para 48. 678 ibid para 49. 679 Vedaschi and Lubello (n 641) 25. 680 S and Marper v UK (n 675) para 56. 681 ibid para 57. 682 ibid para 58. 683 ibid para 59. 677 ibid

566 Databases and their subsequent use, as well as the lack of substantive and procedural conditions concerning this access. In particular, it made reference to the fact that there is no explicit rule asserting the access to, and use of, data involved merely the prevention, detection or prosecution of serious offences. To these deficiencies, it added the lack of definition of what constitutes a serious crime.684 Moreover, no rules delimiting the number of persons authorised to access, and subsequently use, the data to what is strictly necessary on the basis of the objective were included.685 Importantly, it set the threshold particularly high by requiring that prior to access by the competent national agencies, the conditions of access must be reviewed: [B]y a court or by an independent administrative body whose decision seeks to limit access to the data and their use to what is strictly necessary for the purpose of attaining the objective pursued. (Emphasis added)686

The next issue related to the retention period, where it was noted that the prescribed retention period of at least six months did not differentiate between the distinct categories of data on the basis of their possible usefulness for the purposes of the objective pursued or according to the persons concerned.687 Furthermore, given the fluctuating retention period due to national transposition, no remark was made that its determination at the national level must be based on objective criteria in order to ensure that it is limited to what is strictly necessary.688 Already at this stage, the Court had provided a first set of criteria that the EU legislator had failed to meet, leading it to conclude that the Data Retention Directive ‘entails a wide-ranging and particularly serious interference … without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary’.689 However, the Court’s assessment did not end there. A second set of rules specifically involving data security, ‘as required by Article 8 of the Charter’,690 was provided. In this regard, it was submitted that the Directive did not provide for sufficient safeguards against the risk of abuse and against any unlawful access and use of that data.691 In particular, the Directive lacked rules particularly adjusted to take into account: (i) the vast quantity of data whose retention is required by that Directive; (ii) the sensitive nature of that data; and (iii) the risk of unlawful access to that data. Furthermore, the Directive did not require the enforcement of technical and organisational measures that would ensure a particularly high level of protection and security, but permitted providers to take into consideration economic interests when setting the level of security.692 Moreover, the irreversible destruction of data after the retention period had expired was not ensured, as there was no obligation that the data would be retained within the EU.693 The final point of concern related to the existence

684 ibid 685 ibid

686 ibid. 687 ibid

paras 60–61. para 62.

para 63. para 64. para 65. 690 ibid para 66. 691 ibid. 692 ibid para 67. 693 ibid paras 67–68. 688 ibid 689 ibid

The Privatisation of Information Exchange 567 of independent supervision, which was indeed explicitly mandated by Article 8(3) of the Charter, but was not expressly required by the Directive.694 Based on the above, the Court annulled the Directive with immediate effect. Undoubtedly, Digital Rights Ireland marked ‘a constitutional moment in striking a balance between fundamental rights and security in the digital age’.695 In an era of proliferation of surveillance practices via the collection and further processing of a wide range of data, including sensitive data, the CJEU stepped into the surveillance turmoil and released a judgment that was a ‘decisive move towards using privacy to limit pre-emptive surveillance’.696 The Court expressly rejected pre-emptive surveillance on the basis of the generalised, undifferentiated retention of personal data by telecommunication providers without the establishment of concrete and specific links to serious crime and without appropriate safeguards.697 A central issue that influenced the Court’s conclusions was that the retention involved a very large number of persons (even indefinite) – practically the entire European population – a priori unsuspected of any criminal offence.698 It is this indiscriminate character of surveillance that made the interference fundamentally disproportionate, and thus unlawful,699 even though that indiscriminate character of the retention was central in adopting the measure in the first place.700 Furthermore, highlighting the element of surveillance could be understood as the Court advancing the view that such a serious interference has an adverse effect upon the overall relationship of trust between the individual and the state.701 Though the stated objective of the Data Retention Directive was market harmonisation, the Court rightly focused on the ‘material objective’ – the prevention of crime – and the impact 694 ibid para 68. 695 Tuomas Ojanen, ‘Privacy is More Than Just a Seven-Letter Word: The Court of Justice of the European Union Sets Constitutional Limits on Mass Surveillance’ (2014) 10(3) European Constitutional Law Review 518, 539. Peers enthusiastically considered the judgment as a ‘foundational moment’ in EU constitutionalism; see Steve Peers, ‘The Data Retention Judgment: The CJEU Prohibits Mass Surveillance” (EU Law Analysis, 8 April 2014), http://eulawanalysis.blogspot.hu/2014/04/the-data-retention-judgment-cjeu.html. 696 Valsamis Mitsilegas, ‘The Transformation of Privacy in an Era of Pre-emptive Surveillance’ (2015) 20 Tilburg Law Review 34. See also Elspeth Guild and Sergio Carrera, ‘The Political and Judicial Life of Metadata: Digital Rights Ireland and the Trail of the Data Retention Directive’ (CEPS Paper in Liberty and Security No 65, May 2014); Orla Lynskey, ‘The Data Retention Directive is Incompatible with the Rights to Privacy and Data Protection and is Invalid in its Entirety: Digital Rights Ireland’ (2014) 51(6) CML Rev 1789; Judith Rauhofer and Daithi Mac Sithigh, ‘The Data Retention Directive Never Existed’ (2014) 11(1) SCRIPT-ed, http://script-ed.org/wp-content/uploads/2014/04/macsithigh.pdf. 697 As noted by Council Legal Advice Service, ‘the Court will not satisfy itself with anything less than a strict assessment of the proportionality of measures that constitute serious restrictions to fundamental rights, however legitimate the objectives pursued by the EU legislature. It also indicates that such measures do not stand a serious chance of passing the legality test unless they are accompanied by adequate safeguards in order to ensure that any serious restriction of fundamental rights is circumscribed to what is strictly necessary and is decided in the framework of guarantees forming part of Union legislation instead of being left to the legislation of Member States’. Council, Document 9009/14 (5 May 2014) 8. 698 Federico Fabbrini, ‘Human Rights in the Digital Age: The European Court of Justice Ruling in the Data Retention Case and its Lessons for Privacy and Surveillance in the United States’ (2015) 28 Harvard Human Rights Journal 65, 86. 699 See Hielke Hijmans, ‘The European Union as a Constitutional Guardian of Internet Privacy and Data Protection: The Story of Article 16 TFEU’, DPhil thesis, University of Amsterdam and Vrije Universiteit Brussel, 2016, 220. 700 Commission, ‘Evaluation Report on the Data Retention Directive (Directive 2006/24/EC)’ COM (2011) 225 final, para 3.3. 701 Ojanen (n 695) 536.

568 Databases of the Directive on fundamental rights.702 Otherwise, an artificial division of the two issues would disregard the actual impact of the Directive. It is true that the Grand Chamber did not totally overrule mandatory data retention and it was implied that some form of data retention may be compatible with fundamental rights. However, it stepped up and defined a series of strictly circumscribed criteria that need to be taken into consideration by the EU legislature. These points can be largely inferred from the flaws of the Data Retention Directive that triggered its invalidation. In this sense, the Court established a form of dialogue between itself and the EU legislator in which the Court not only annulled a legal instrument, but also provided instructions regarding the design of valid data retention schemes that are respectful of fundamental rights whilst accomplishing its stated aim. Overall, the judgment underlined the role of the CJEU as a form of a constitutional court, whereby the review of fundamental rights by strictly scrutinising EU legislative measures becomes a central function. This constitutional role suggests a balancing between the powers of the EU and the Member States, and developing principles of judicial review. The emphasis of the Court on the right to respect for private in dealing with mass surveillance and large-scale data retention and access is welcome in terms of allowing a holistic assessment of the impact of surveillance on the individual, which could be lost if assessment were based exclusively on data protection rules.703 Furthermore, by placing such limits on generalised surveillance, the Grand Chamber fostered a concept of privacy intertwined with the values of personal autonomy, whereby individuals must be left to pursue their everyday activities, such as their personal communication, away from state intervention, unless there is suspicion of wrongdoing, and thus enjoy a certain degree of autonomy in their contemporary living that allows for self-development.704

iv. National Data Retention Schemes under Scrutiny: Tele2 Sverige and Watson The invalidation of the Data Retention Directive generated legal chaos at the national level, as data retention had been viewed as a key counter-terrorism and security tool and Member States had put in place data retention obligations in fulfilment of the Directive.705 In the aftermath of the judgment and with the Commission refraining

702 For this criticism, see Orla Lynskey, ‘Joined Cases C-293/12 and 594/12 Digital Rights Ireland and Seitlinger and Others: The Good, the Bad and the Ugly’ (European Law Blog, 8 April 2014), europeanlawblog. eu/2014/04/08/joined-cases-c-29312-and-59412-digital-rights-ireland-and-seitlinger-and-others-the-goodthe-bad-and-the-ugly. For the contrary view, see Mitsilegas (n 673). 703 Mitsilegas (n 640); Mitsilegas (n 696). 704 See also Andrew Roberts, ‘Privacy, Data Retention and Domination: Digital Rights Ireland v Minister for Communications’ (2015) 78(3) Modern Law Review 535. 705 Niklas Vainio and Samuli Miettinen, ‘Telecommunications Data Retention after Digital Rights Ireland: Legislative and Judicial Reactions in the Member States’ (2015) 23 International Journal of Law and I nformation Technology 290; Xavier Tracol, ‘Legislative Genesis and Judicial Death of a Directive; The European Court of Justice Invalidated the Data Retention Directive (2006/24/EC) Thereby Creating a Sustained Period of Legal Uncertainty about the Validity of National Laws which Enacted it’ (2014) 30(6) Computer Law and Security Review 736.

The Privatisation of Information Exchange 569 from tabling replacement legislation, numerous Member States continued to apply national legislation on data retention or introduced new forms of legislation.706 National retention schemes concerning telecommunications data could be legally based on the e-Privacy Directive, particularly its Article 15, which allows for the adoption of data retention legislation by Member States and prescribes for restrictions to certain rights when necessary for purposes such as national security and the prevention, investigation, detection and prosecution of criminal offences. However, certain Member States were confronted with the question of whether EU law applied in the first place, in the absence of specific secondary EU law on data retention, and whether these obligations were compatible with the e-Privacy Directive, as well as the rights to privacy and data protection. The CJEU addressed these issues in responding to two requests from preliminary rulings from Swedish and UK courts in its judgment in the joint cases of Tele2 and Watson,707 both of which essentially enquired whether a general obligation to retain telecommunication data is precluded by EU law and, if not, which safeguards must be in place and what circumstances must be taken into account. The cases involved two slightly different sets of facts. The first case arose from the dispute between Tele2 Sverige, a Swedish telecommunications company, and the Swedish Post and Telecommunications Authority (PTA). A day after the Digital Rights Ireland judgment was released, Tele2 Sverige informed PTA that it would cease to retain data under the relevant provisions of Swedish law and would delete the data retained until then. The PTA found that the company was in breach of domestic data retention law and ordered the retention of traffic and location data in relation to its subscribers and registered users, but the company challenged that decision. It has been argued that the decision by Tele2 Sverige was prompted, inter alia, by market considerations, namely to place emphasis on safeguarding the integrity of customer data in a highly competitive market.708 The second case stemmed from domestic litigation concerning the compatibility of the UK Data Retention and Investigatory Powers Act 2014 (DRIPA) with EU law. Section 1(1) of the DRIPA empowered the UK Home Secretary to adopt, without any prior authorisation from a court or an independent administrative body, a general regime requiring public telecommunications operators to retain all metadata data relating to any postal or telecommunications service for a maximum period of 12 months if they considered that such a requirement is necessary and proportionate to achieve the purposes stated in the UK legislation.709 Against this background, the Court first established the applicability of EU law by placing its assessment on national law within the framework of compliance with the e-Privacy Directive, to which the Data Retention Directive introduced a series of derogations.710 But even if EU law would in principle be applicable in this context, the

706 Anna Vedaschi, ‘Privacy versus Security: Regulating Data Collection and Retention in Europe’ in Benjamin J Goold and Liora Lazarus (eds), Security and Human Rights, 2nd edn (Hart Publishing, 2019) 275–96. 707 Tele2 (n 245). 708 Ian Cameron, ‘Balancing Data Protection and Law Enforcement Needs: Tele2 Sverige and Watson’ (2017) 54 CML Rev 1467, 1471. 709 Tele2 (n 245) para 55. 710 Data Retention Directive, art 3(1).

570 Databases CJEU had to tackle the argument that national legislation fell outside the scope of the e-Privacy Directive, as its Article 1(3) mentions that the Directive excluded ‘activities concerning public security, defence, State security … and the activities of the State in areas of criminal law’, thus generating confusion as to the scope of the Directive.711 Furthermore, Article 15 allowed states to restrict its provisions, including via the adoption of data retention measures, to achieve crime control and security objectives which substantially overlapped with those stated in Article 1(3).712 These arguments were not successful. The Grand Chamber noted that the measures referred to in Article 15 did fall within the scope of the e-Privacy Directive, as otherwise the article would be deprived of any purpose.713 In establishing the applicability of the Directive, the Court focused on the activities of private providers governed by Article 15714 and on the processing of personal data involved in this context. The Court stressed that the scope of the e-Privacy Directive extended to legislative measures requiring providers to retain traffic and location data, since to do so necessarily involves the processing, by those providers, of personal data.715 Retention of data was linked with access to that data ‘by treating retention and access as a continuum of activity’;716 indeed, in the Court’s view, the scope of the Directive extended to measures regulating access of the national authorities to the data retained by the telecommunications providers.717 This is because the data were only retained for the purpose of access by its competent national authorities.718 This holistic approach enabled the Court to bring national retention schemes within the realm of EU law and its scrutiny. Moving on to the substantive analysis on the compatibility of national data retention requirements with EU law, Tele2 built on the findings in Digital Rights Ireland. The impact of data retention on freedom of expression was emphasised and that right was placed on an equal footing as the rights to private life and data protection.719 In its subsequent scrutiny, the Court considered the compatibility of national data retention measures with all three rights720 and, as in Digital Rights Ireland, it proceeded to a joint proportionality assessment. It observed that the national legislations stipulated general and indiscriminate retention of all subscribers and registered users relating to all means of electronic communication and data were retained ‘systematically and continuously, with no exceptions’.721 Drawing from Digital Rights Ireland, the Grand Chamber

711 Tele2 (n 245) para 69. 712 ibid paras 71–72. 713 ibid para 73. 714 ibid para 74. 715 ibid para 75. 716 Mitsilegas (n 671). 717 Tele2 (n 245) para 76. 718 ibid para 79. See also para 80: That interpretation is confirmed by art 15(1b) of the e-Privacy Directive, which provides that providers are to establish internal procedures for responding to requests for access to users’ personal data, based on provisions of national law adopted pursuant to art 15(1) of that Directive. 719 ibid paras 92–93. According to the Court, freedom of expression ‘constitutes one of the essential foundations of a pluralist, democratic society, and is one of the values on which, under Article 2 TEU, the Union is founded’. This plea was raised ex officio and it is notable that no such references are found in Digital Rights Ireland. 720 ibid paras 101, 107 and 125. 721 ibid para 97.

The Privatisation of Information Exchange 571 confirmed the impact of retention schemes on subscribers and users of communication services,722 and went a step further by stressing that as a result, a profile of the individuals concerned may be established on the basis of information that was remarkably considered ‘no less sensitive than the actual content of communications’.723 Be that as it may, the Grand Chamber missed another opportunity to engage with the question of the impact of the mass retention of metadata with the essence of fundamental rights.724 Continuing with its proportionality assessment, the Court largely followed the same route as in Digital Rights Ireland. It was reiterated that general and indiscriminate data retention legislation entails a particularly serious interference with the rights to privacy and data protection, and that the user concerned was, as a result, likely to feel that their private lives are under constant surveillance.725 As for freedom of expression, the Court took the view that individuals may be affected in using means of electronic communication.726 Given the seriousness of the interference with the aforementioned rights, only the objective of fighting serious crime could justify national retention schemes.727 Nonetheless, the Court made it clear that this objective cannot in itself justify the pronouncement that the general and indiscriminate retention of all traffic and location data is necessary for the fight against crime.728 The Court opined that the effect of national legislation was that the retention of traffic and location data was the rule, whereas the system put in place by the e-Privacy Directive required the retention of data to be an exception.729 The Court then pointed out that the national retention scheme applied to persons whose conduct may have no link, even an indirect or remote one, to serious criminal offences and to persons whose communications are subject to the obligation of professional secrecy.730 As a result, the national legislation exceeded the limits of what is strictly necessary and justified.731 Perhaps because a second ruling against mass surveillance would be badly received by law enforcement and government circles, the Court 722 ibid paras 98–99. 723 ibid para 99. See Xavier Tracol, ‘The Judgment of the Grand Chamber Dated 21 December 2016 in the Two Joint Tele2 Sverige and Watson Cases: The Need for a Harmonised Legal Framework on the Retention of Data at EU Level’ (2017) 33(4) Computer Law & Security Review 541. See also Joined Cases C-203/15 and C-698/15, Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v Tom Watson, Peter Brice, Geoffrey Lewis, Opinion of AG Saugmandsgaard Øe delivered on 19 July 2016, paras 254–259. The AG noted that the risks associated with the retention of and access to metadata may be as great or even greater than those arising from access to content data as metadata ‘facilitate the almost instantaneous cataloguing of entire populations, something which the content of communications does not’ (emphasis added). Though the Court directly referred to the AG’s view, it still did not drop the distinction. Brkan ((n 667) 874) considers this as inconsistent approach. 724 Tele2 (n 245) para 101. 725 ibid para 100. See also the Opinion of AG Saugmandsgaard Øe (para 260), who noted that there is nothing theoretical about the risks of abusive or illegal access to retained data and that the risk of abusive access on the part of the competent authorities must be put in the context of the extremely high number of requests for access to which reference has been made in the observations submitted to the Court. Insofar as the Swedish regime is concerned, Tele2 Sverige stated that it was receiving approximately 10,000 requests monthly. 726 ibid para 101. 727 ibid para 102. 728 ibid para 103. 729 ibid para 104. 730 ibid para 105. 731 ibid para 107.

572 Databases was mindful to allow Member States leeway to undertake targeted retention of traffic and location data as a preventive measure for fighting serious crime.732 Nonetheless, such legislation must be limited to what is strictly necessary in terms of the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted.733 The Court put forward three main criteria aiming to set parameters and limits on preventive data retention. First, national legislation must set out clear and precise rules governing the scope and application, and imposing minimum safeguards, so that the persons whose data have been retained have sufficient guarantees for the protection of their personal data against the risk of misuse.734 In particular, the circumstances and conditions for adopting such a preventive measure,735 as well as the conditions for authorising the retention of telecommunications data, must be laid down.736 Second, the retention of data must nonetheless meet objective criteria that link the objective to be pursued with the data to be retained. In particular, the conditions must actually demonstrate that the extent of the measure and the public affected are in practice circumscribed.737 Third, national legislation must be based on objective evidence that enable the identification of a public whose data are likely to reveal a link (or at least an indirect one) with serious criminal offences, and to contribute in one way or another to fighting serious crime or to preventing a serious risk to public security. Such limits may be set by using a geographical criterion where the competent national authorities consider, on the basis of objective evidence, that there exists, in one or more geographical areas, a high risk of preparation for or commission of such offences.738 The Court went on to discuss other substantive elements that must be included in any national legislation on data retention regarding the procedure of access to retained data. Though the Court applied Digital Rights Ireland, Tele2 contains important additions and clarifications. In particular, the Court reiterated that due to the seriousness of the interference with privacy and data protection, only the objective of fighting serious crime is capable of justifying access to the retained data.739 Furthermore, the conditions of access to the retained data by competent national authorities must be set out in a legally binding manner under domestic law.740 As a general rule, access may be granted in relation to the objective of fighting crime only to the data of individuals suspected of planning, committing or having committed a serious crime, or of being implicated in one way or another in such a crime.741 In any case, unless there is a case of validly established urgency, the conditions of access must be validated by a court or by an independent administrative body, and the decision of that court or body should be made following a reasoned request by those authorities.742 Moreover, once there would be no

732 ibid

para 108.

734 ibid

para 109.

736 ibid

para 110.

733 ibid. 735 ibid. 737 ibid. 738 ibid

para 111. para 115. 740 ibid paras 116–17. 741 ibid para 119. See by analogy Zakharov v Russia (n 242) para 260. 742 Tele2 (n 245) para 120. See Szabó and Vissy v Hungary, App No 37138/14, Judgment of 12 January 2016. 739 ibid

The Privatisation of Information Exchange 573 danger to the investigation by so doing, individuals affected should be notified in order for them to be given the possibility to exercise their right to a legal remedy.743 On the issue of data security, the Court took note of the quantity and sensitivity of data as well as the risk of unlawful access to it to suggest that a high level of security measures that would be ensured via the retention within the EU and for the irreversible destruction of the data at the end of the data retention period.744 Finally, the Court highlighted as a separate obligation the need to review the compliance with data protection standards by an independent authority, which in accordance with Article 8(3) of the Charter constitutes an essential element of data protection.745 Tele2 and Watson has considerable constitutional significance. Despite the backlash by law enforcement authorities and governments to Digital Rights Ireland and the insistence by Member States to maintain national data retention schemes, the Grand Chamber upheld its pronouncements and emphatically rejected mass surveillance in the form of blanket data retention regimes, and found them incompatible with EU law.746 In turn, evidence-based, targeted surveillance may be lawful as long as a series of conditions are fulfilled and subject to clear rules enshrined in national law.747 The idea supported here is that what is permissible is the retention of data on the basis of justified suspicion and not justifying suspicion ex post on the basis of the analysis of retained data.748 Furthermore, in an important affirmation of the autonomy of EU law,749 the Court stated that its benchmark for fundamental rights assessment is exclusively the Charter, and not the ECHR, which may provide a less extensive level of protection.750 A key issue is whether the geographical criteria mentioned in the judgment could potentially lead to disproportionate generalised and indiscriminate surveillance and profiling by requiring the retention of telecommunications data of the entire population in a particular area.751 A series of ethical and social issues of such profiling may be raised; hence, the Court suggested that such profiling would need to be strictly evidencebased.752 Finally, it is regrettable the Court refrained from further elaborating on what constitutes a proportionate retention period, presumably because the analysis in Digital Rights Ireland provided sufficient guidelines for Member States. 743 Tele2 (n 245) para 121. 744 ibid para 122. 745 ibid para 123. 746 Compare with the Opinion of AG Saugmandsgaard Øe, who refrained from declaring such measures as unlawful (ibid para 116). 747 According to Cameron, ‘removing a general duty of retention thus severely undermines the investigative ability of the police and intelligence services and targeted data retention cannot satisfactorily replace a general duty of retention’. See Cameron (n 708) 1483. 748 Lorna Woods, ‘Data Retention and National Law: The ECJ Ruling in Joined Cases C-203/15 and C-698/15 Tele2 and Watson (Grand Chamber)’ (EU Law Analysis, 21 December 2016), http://eulawanalysis.blogspot. gr/2016/12/data-retention-and-national-law-ecj.html. 749 Mitsilegas (n 671). 750 Tele2 (n 245) paras 126–28. The interpretation of Directive 2002/58 must be undertaken solely in the light of the fundamental rights guaranteed by the Charter (para 128). 751 ibid para 118. See also Matthew White, ‘A Threat to Human Rights? The New e-Privacy Regulation and Some Thoughts on Tele2 and Watson’ (EU Law Analysis, 10 January 2017), http://eulawanalysis.blogspot. gr/2017/01/a-threat-to-human-rights-new-e-privacy.html. 752 Tele2 (n 245) para 111. See Orla Lynskey, ‘Tele2 Sverige AB and Watson et al: Continuity and Radical Change’ (EU Law Analysis, 12 January 2017), https://europeanlawblog.eu/2017/01/12/tele2-sverige-ab-andwatson-et-al-continuity-and-radical-change.

574 Databases

v. Ministerio Fiscal Both Digital Rights Ireland and Tele2 and Watson clarified that retention schemes may be justified only in cases involving terrorist offences and serious crimes. The question of how to circumscribe the scope of the term ‘serious crimes’ was dealt with in Ministerio Fiscal.753 The facts of the case involved the investigation of a robbery during which the victim’s wallet and mobile phone were stolen. In efforts to identify the new phone number associated with the stolen phone, as well as the details of the owners or users of that number, a request to the investigating magistrate was submitted, but it was refused because under Spanish law, access to such information was limited to serious crime, which was not the case here. On appeal, two questions related to the interpretation of Article 15(1) of the e-Privacy Directive on the criteria to determine the seriousness of an offence. The Court essentially examined whether, and to what extent, the objective pursued by the national legislation is capable of justifying the access of the public authorities, such as the police, to the data.754 In that respect, the Court agreed with the AG that such access would constitute an interference, even if such interference is not serious and the data involved are not sensitive, or whether the persons concerned have been inconvenienced in any way.755 The Court noted that the list of objectives laid down in Article 15 of the Directive is exhaustive; therefore, the need for access by national authorities must genuinely and strictly correspond to one of those objectives.756 However, Article 15 does not limit access to the fight against serious crime; rather, it refers to criminal offences generally.757 By contrast, when the interference that such access entails is not serious, access may be justified by the objective of preventing, investigating, detecting and prosecuting criminal offences more generally.758 Thus, the Court reformulated the issue at stake in order to determine whether the interference in this case was ‘serious’. In that respect, it took note of three considerations: (a) that the sole purpose of the police request was to identify the owners of SIM cards activated over a period of 12 days, and thus in a specific period;759 (b) that the request sought access only to the telephone numbers corresponding those SIM cards and the data relating to the identity of the owners, such as their surnames, forenames and, if need be, addresses; (c) that the data accessed did not concern the communications carried out with the stolen mobile telephone or its location.760 Since the data sought related only to a short period of time and could not be cross-referenced with other data, precise conclusions regarding the private lives of the persons in issue could not be drawn. Therefore, this was not a serious interference with the individuals’ privacy.761 The importance of Ministerio Fiscal is threefold; first, in line with Tele2 and Watson, the Court confirmed that in the absence of a legal framework replacing the invalidated Data Retention Directive, it has the jurisdiction to rule on cases involving data

753 Case

C-207/16, Ministerio Fiscal, ECLI:EU:C:2018:788. para 49. 755 ibid para 51. 756 ibid para 52. 757 ibid para 53. 758 ibid para 57. 759 ibid para 60. 760 ibid para 59. 761 ibid para 60. 754 ibid

The Privatisation of Information Exchange 575 retention schemes derogating from Article 15 of the e-Privacy Directive. Second, the Court found that there may be different levels of limitations to the rights of private life and protection of personal data that require additional or fewer justifications. In the present case, the fact that the categories of personal data accessed were limited, the retention was targeted towards a specific group of individuals, related to a limited period of time and with the specific objective of identification were central in determining that the interference was limited. As a result, the Court also opened the door to communications surveillance in cases relating to less serious crimes or even misdemeanours, with the judgment confirming that access to electronic data is also allowed in lesser cases, although such access would involve fewer and less sensitive data and only for a restricted period of time.762 The findings of Digital Rights Ireland and Tele2 and Watson remain applicable to location and traffic data, but not to subscriber data.763 As has been pointed out, there may be a danger that this may be read as saying that national laws should allow such access.764 Furthermore, the scope of the judgment is limited to conditions governing the access to personal data and does not involve their retention. As such, there seems to be a contradiction with Tele2 and Watson as regards the initial stage of retaining the data, as in that judgment, the Court made it clear that the targeted retention of and access to data may only be permitted in cases involving serious crimes765 because the targeted data retention requirement in itself constitutes a serious interference with fundamental rights that can only be justified by the objective of fighting serious crime.766 Ministerio Fiscal seems to suggest that if access is sought only in relation to a small portion of the retained data, access to that data does not constitute a serious interference, even if the data are only available in the first place because of a targeted data retention order that can only be justified by the objective of fighting serious crime.767 This is arguably a violation of the purpose limitation principle of data protection law.768 Regrettably, both the AG769 and the Court shied away from the actual questions posed by the referring court – the scope of the term ‘serious crime’ and of whether this term constitutes an autonomous concept of EU law.

vi. The ‘National Security’ Card: Privacy International and La Quadrature du Net and Others The conflict between the CJEU’s approach on the limits to mass surveillance of telecommunications metadata and Member States’ desires to maintain national retention 762 Hielke Hijmans, ‘Data Protection and Surveillance: The Perspective of EU Law’ in Mitsilegas and Vavoula (n 671) 235–53. 763 Council, Document 14319/18 (23 November 2018). 764 Lorna Woods, ‘Mobile Phone Theft and EU e-Privacy Law: The CJEU Clarifies Police Powers’ (EU Law Analysis, 4 October 2018), http://eulawanalysis.blogspot.com/2018/10/mobile-phone-theft-and-eueprivacy-law.html. 765 Ministerio Fiscal (n 753) paras 108–11. 766 ibid para 115. 767 IT-Pol and EDRi, ‘CJEU Introduces New Criteria for Law Enforcement to Access to Data (EDRI, 24 October 2018), https://edri.org/cjeu-introduces-new-criteria-for-law-enforcement-to-access-to-data. 768 ibid. 769 Case C-207/16, Ministerio Fiscal, ECLI:EU:C:2018:300, Opinion of AG Saugmandsgaard Øe delivered on 3 May 2018, para 100.

576 Databases schemes was not resolved after Tele2 and Watson. More cases have reached the Court on the compatibility of UK, French and Belgian data retention laws with EU law and on 6 October 2020, two judgments were delivered.770 Privacy International concerned a preliminary reference from the UK NGO Privacy International that brought an action against the British security and intelligence agencies, questioning the legality of the acquisition and use of bulk communication data by agencies like GCHQ, MI5 and MI6.771 The referring court was unsure about the applicability of EU law, given that in accordance with Article 4 TEU, national security falls outside of the scope of EU law. Furthermore, the judgment in La Quadrature du Net and Others772 stemmed from preliminary references from the French Council of State and the Belgian Constitutional Court in disputes between the French and Belgian governments respectively and numerous organisations that questioned the legality of the respective data retention regimes In all these cases, a key feature should be noted: the efforts by Member States to exclude national law from the scope of EU law under the national security exception. To the disappointment of the referring courts and the intervening Member States, in Privacy International, the Grand Chamber upheld the applicability of EU law in these cases and rejected the argument that the national security exception applied. The Court stressed that the exclusion from the scope of the e-Privacy Directive in Article 1(3) concerned ‘activities of the State or of State authorities and are unrelated to fields in which individuals are active’,773 whereas Article 3 stipulates that the Directive regulated the activities of communications service providers.774 In turn, the legislative measures permissible under Article 15 regulate the activities of those providers and therefore these cannot be regarded as characteristic activities of states.775 Therefore, in line with AG Campos Sánchez-Bordona’s Opinion and Tele2 and Watson, the Court confirmed that the ‘activities of the State’ under Article 1(3) did not cover legislation under Article 15, which would otherwise be deprived from its effect.776 Article 4 TEU did not alter this conclusion; what mattered was that the communications providers processed the data. In a narrow interpretation of the national security exception,777 the Court contrasted activities where Member States directly implement measures that derogate from that article, which are outside the scope of the Directive,778 from activities 770 This section is based on Elspeth Guild, Elif Mendos Kuşkonmaz, Valsamis Mitsilegas and Niovi Vavoula, ‘Data Retention and the Future of Large-Scale Surveillance: The Evolution and Contestation of Judicial Benchmarks (2021) European Law Journal (forthcoming). 771 Case C-623/17, Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others, ECLI:EU:C:2020:790. 772 Joined Cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v Premier Ministre and Others, ECLI:EU:C:2020:791. 773 Privacy International (n 771) para 35. 774 ibid para 36. 775 ibid. 776 Case C-623/17, Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others, ECLI:EU:C:2020:5, Opinion of AG Campos Sánchez-Bordona delivered on 15 January 2020, paras 24–39. 777 This approach was in line with the Opinion of AG Campos Sánchez-Bordona, according to whom those public authority activities must necessarily be defined narrowly so as not to deprive EU privacy law of its effect, and the notion of national security cannot be extended to other sectors of public life that are, to varying degrees, related to it (para 34). ibid paras 80, 89. 778 Privacy International (n 771) para 46.

The Privatisation of Information Exchange 577 r elying on imposing processing obligations on providers of electronic communications services, which were governed by EU law.779 In turn, the e-Privacy Directive does not apply to activities that are intended to safeguard national security and are undertaken by the public authorities themselves, without requiring the cooperation of private individuals and, therefore, ‘without imposing on them obligations in the management of businesses’ (emphasis added).780 By rejecting the national security exception card and asserting the applicability of EU law, the CJEU was able to assess the compatibility of the legislations in question with the Charter rights. In Privacy International, the CJEU largely followed the same approach that had been followed in Tele2 and Watson in finding that the transmission of data to security and intelligence services constitutes a particularly serious interference with the rights to respect for private life, protection of personal data and freedom of expression.781 Importantly, it constitutes a breach of confidentiality in a general and indiscriminate way, having the effect of making the exception to the obligation to ensure the confidentiality of data the rule, whereas the e-Privacy Directive requires that that exception remains an exception.782 The Court further stressed that given the quantity of data at issue, their mere retention entails a risk of abuse and unlawful access.783 It distinguished between safeguarding national security and public security as purposes for data retention, with the former viewed as capable of justifying more intrusive measures than may be justified by other objectives.784 However, the Court unequivocally confirmed that commercial operators are not allowed to disclose traffic data and location data to the security and intelligence agencies by means of general and indiscriminate transmission. Whereas Privacy International did not add too much on the data retention powers of Member States, it did hint at a more nuanced approach to this matter. La Quadrature du Net and Others is much more elaborate in this respect. Looking into the various objectives for which retention of telecommunications traffic and location data were retained, one may discern three clusters of public interest objectives, each of which corresponds to a different degree of threat in terms of their nature and seriousness, which may thus satisfy different sets of retention activities. La Quadrature du Net and Others has thus provided different thresholds of protection depending on the public interest at stake – national security, including the prevention of terrorism, the fight against serious crime or the prosecution and punishment of less serious offences785 – enabling a gradation of legislative measures on data retention. 779 ibid para 48. The ECtHR concluded in a very similar case, Big Brother Watch and Others v UK, that the bulk interception of communications by intelligence agencies is per se acceptable (para 314). However, at the time of writing, the case is under re-examination by the Grand Chamber and therefore it remains to be seen whether the Strasbourg Court will follow the same approach. See Big Brother Watch and Others v UK, App Nos 58170/13, 62322/14 and 24960/15, Judgment of 13 September 2018, 780 Privacy International (n 771) para 79. 781 ibid paras 70–72. 782 ibid para 69. 783 ibid para 73. 784 ibid para 75. 785 Lorna Woods, ‘When is Mass Surveillance Justified? The CJEU Clarifies the Law in Privacy International and Other Cases’ (EU Law Analysis, 7 October 2020), http://eulawanalysis.blogspot.com/2020/10/when-ismass-surveillance-justified.html.

578 Databases In particular, the Court looked at the objective of national security, which in its view: [C]orresponds to the primary interest in protecting the essential functions of the State and the fundamental interests of society and encompasses the prevention and punishment of activities capable of seriously destabilising the fundamental constitutional, political, economic and social structures of a country and, in particular, of directly threatening society, the population or the State itself, such as terrorist activities.786

This objective is different from the objectives of combating crime in general, even serious crime, and of safeguarding public security, as threats to national security are distinguished in terms of their nature and particular seriousness from the general risk that tensions or disturbances, even of a serious nature, affecting public security will arise.787 Therefore, whereas the objectives of public security and fighting serious crime cannot justify mass data retention, as per Digital Rights Ireland and Tele2 and Watson, safeguarding national security may justify more serious interferences, such as general and indiscriminate preventive retention of traffic and location metadata.788 However, such preventive retention on all users of electronic communications systems is permitted only if certain conditions are fulfilled: (a) mass retention is for a limited period of time; (b) there are sufficiently solid grounds for considering that the Member State is confronted with a serious threat to national security, which is shown to be genuine and present or foreseeable.789 The time-limited character of retention is crucial; the Court contends that due to the ongoing nature of a threat to national security, renewing the instructions to telecommunications providers to retain data is possible for a ‘foreseeable period of time’.790 Furthermore, data retention cannot be systematic in nature and must be subject to limitations and strict safeguards against the risk of abuse.791 In addition, the instruction to communications providers to retain data must be subject to effective review, either by a court or by an independent administrative body whose decision is binding, so as to verify that one of those situations exists and that the conditions and safeguards which must be laid down are observed.792 Another novelty of the judgment is that the objective of safeguarding national security, ‘particularly to prevent terrorism’ – and thus not excluding other instances – justifies automated analysis of traffic and location data, which involves general and indiscriminate processing of that data by public authorities, subject to specific safeguards.793 The second level in the hierarchy of objectives includes combating serious crime, preventing ‘serious threats’ or ‘serious attacks’ on public security, and a fortiori national security. In line with the Court’s findings in Digital Rights Ireland and Tele2 and Watson, the e-Privacy Directive and the Charter do not preclude measures of targeted retention of traffic and location data only, which nonetheless also entail a ‘particularly s erious

786 La

Quadrature du Net and Others (n 772) para 135. para 136. 788 ibid. 789 ibid para 137. 790 ibid para 138. 791 ibid. 792 ibid para 139. 793 These safeguards mainly derive from Opinion 1/15 (n 510). 787 ibid

The Privatisation of Information Exchange 579 interference’ with the rights to privacy, protection of personal data and freedom of expression.794 The Court provided further guidelines on how to interpret the term ‘targeted surveillance’; individuals affected must be identified in advance, on the basis of objective evidence, as posing a threat to public or national security.795 As mentioned in Tele2 and Watson, the instruction for targeted surveillance may also be based on a geographical criterion and the areas may include places with a high incidence of serious crime, places that are particularly vulnerable to the commission of serious criminal offences, such as places or infrastructure which regularly receive a very high volume of visitors, or strategic locations, such as airports, stations or tollbooth areas.796 Whereas preventive general and indiscriminate retention of traffic and location data in relation to serious crime, the prevention of serious threats to public security and national security is prohibited, in a deviation from previous case law, the CJEU provided an exception in relation to IP addresses, which in its view constitute traffic data. In particular, the Court found that their retention – relating to the source of communication and not its recipient – is less sensitive than the other traffic data, as they do not disclose any information about third parties who were in contact with the person who made the communications.797 That said, IP addresses may be used for tracking an internet user’s complete clickstream; hence, their entire online activity that facilitates the construction of a detailed profile of the user may be deduced.798 Therefore, the retention and analysis of that type of data constitutes a serious – but not a particularly serious – interference with the rights of privacy and protection of personal data.799 In balancing those rights with the needs of law enforcement, the Court considered that in cases of offences committed online, such as those concerning particularly serious child pornography offences,800 the IP addresses might be the only means of investigation to identify the person to whom that address was assigned when the offence was committed.801 As a result, a more nuanced approach was preferred to permit the general and indiscriminate retention of IP addresses of all persons who own terminal equipment permitting access to the internet without at first sight any connection to the objectives pursued and without being suspected of serious crimes. The retention period must not exceed what is strictly necessary in light of the objective pursued, and substantive and procedural conditions regulating the use of that data must be foreseen.802 Elsewhere in the judgment, the Court went on to further affirm that the expedited retention of traffic and location data processed and stored by service providers for a specified period of time is permissible in order to combat serious crime and safeguard national security.803 Such expedited retention may take place in situations where 794 La Quadrature du Net and Others (n 772) para 146. 795 ibid para 149. 796 ibid para 150. 797 ibid para 152. 798 ibid para 153. 799 ibid. 800 Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA [2011] OJ L335/1. 801 La Quadrature du Net and Others (n 772) para 154. 802 ibid para 156. 803 ibid para 164.

580 Databases it becomes necessary to retain the data beyond statutory data retention periods so as to shed light on serious criminal offences or attacks on national security, when the offences or attacks have already been established, or if their existence may reasonably be suspected.804 Specific safeguards must exist here as well; expedited retention must be ordered by a decision subject to effective judicial review805 and may not only involve the suspected perpetrators of the offence in question, but may extend to the victim, their social or professional circle, or even specified geographical areas, such as the place where the offence was committed or prepared.806 In addition, access to the retained data for prosecuting and punishing an ordinary criminal offence may in no event be granted where the retention of such data has been justified by the objective of combating serious crime or safeguarding national security.807 As for the retention of real-time traffic and location data, this also constitutes a particularly serious interference with the rights to privacy, data protection and freedom of expression, ‘since that data provides the competent national authorities with a means of accurately and permanently tracking the movements of users of mobile telephones’.808 As a result, the data must be considered as ‘particularly sensitive’ because the monitoring is ‘virtually total’.809 Therefore, such retention may be justified for the purpose of the prevention of terrorism only in respect of persons for whom there is a valid reason to suspect that they are involved in terrorist activities.810 The measure authorising real-time collection be subject to a prior review carried out either by a court or by an independent administrative body whose decision is binding.811 The Court notes that in urgent cases, the review should take place within a short time.812 Under the third level of public interest objectives, the objective of preventing, investigating, detecting and prosecuting criminal offences (irrespective of their seriousness) and safeguarding public security are included. In that respect, the Court reiterated its pronouncements in Ministerio Fiscal that general and indiscriminate retention of subscriber information – in the Court’s words, data about ‘civil identity’ – is permitted. This is because such information does not make it possible to ascertain the date, time, duration and recipients of the communications made, the locations where those communications took place or their frequency with specific people in a given period.813 As a result, no information is shared on the communications sent and,

804 ibid para 161. 805 ibid para 163. This is in line with the Council of Europe’s Convention on Cybercrime of 23 November 2001 (European Treaty Series – No 185), art 16 of which stipulates that the parties to that convention are to adopt such legislative measures as may be necessary to enable their competent authorities to order or similarly obtain the expedited preservation of traffic data that have been stored by means of a computer system, in particular where there are grounds to believe that that data are particularly vulnerable to loss or modification. 806 ibid para 165. 807 ibid para 166. 808 ibid para 187. 809 ibid. See Ben Faiza v France [2018] ECHR 153, para 74. 810 La Quadrature du Net and Others (n 772) para 188. Otherwise, the pronouncements of Tele2 (n 245) will apply, and objective evidence is required so that it can be deduced that that data might, in a specific case, make an effective contribution to combating terrorism. 811 La Quadrature du Net and Others (n 772) para 189. 812 ibid. 813 ibid para 157.

The Privatisation of Information Exchange 581 consequently, on the users’ private lives,814 and therefore this interference does not qualify as serious. La Quadrature du Net and Others has provided a handy codification of previous case law, as well as important clarifications and qualifications as regards the powers of states to conduct generalised and indiscriminate or targeted surveillance of electronic communications data. These judgments should be seen as a culmination of efforts on behalf of the CJEU to reach a compromise and strike a new balance between fundamental rights and the (loud and clear) desire of the Member States to uphold data retention schemes in favour of the latter. In order to address criticisms against its previous approach, the Court opened the door of mass surveillance to security and intelligence services, including in its most intrusive forms, namely automated analysis and real-time collection.815 This flexibility is even extended to the admissibility of unlawfully collected evidence; after all, even if national data retention laws violate EU law, national courts are given the discretion to accept such retained data as evidence in criminal proceedings, as the admissibility of evidence will largely depend on the national procedural rules.816 As a result, the judgment may be seen as primarily a victory for the law enforcement community, the surveillance powers of which have been significantly expanded. The last issue explored by the Grand Chamber concerned the admissibility in criminal proceedings of evidence obtained pursuant to national data retention schemes that violate EU law and the possibility of delimiting the temporal effects of a declaration of such illegality. The Court took note of the risk of breach of the adversarial principle and therefore the right to a fair trial entailed by the admissibility of such information, and held that in light of the principle of effectiveness, national criminal courts must disregard such information where the affected persons are not in a position to comment effectively on that information and that evidence pertaining to a field of which the judges have no knowledge and are likely to have a preponderant influence on the findings of fact.817 The isolation of IP addresses from other types of traffic data is another important expansion of surveillance powers. The finding that IP addresses are part of traffic data is interesting, as in Member States, an IP address, a port number for dynamic IP addresses and subscriber identification module (SIM) and device identification numbers (eg, international mobile subscriber identity (IMSI) or international mobile equipment identity (IMEI)) are deemed either to be subscriber data or traffic data.818 If the Court had considered IP addresses as falling within the category of subscriber data, then the pronouncements in Ministerio Fiscal would apply and mass retention would be possible.

814 ibid. 815 Juraj Sajfert, ‘Bulk Data Interception/Retention Judgments of the CJEU: A Victory and a Defeat for Privacy’ (EU Law Blog, 26 October 2020), https://europeanlawblog.eu/2020/10/26/bulk-data-interceptionretention-judgments-of-the-cjeu-a-victory-and-a-defeat-for-privacy. 816 ibid. 817 La Quadrature du Net and Others (n 772) paras 226–27. 818 Commission, ‘Study on the retention of electronic communications non-content data for lawenforcement purposes’ (2020), https://op.europa.eu/en/publication-detail/-/publication/081c7f15-39d3-11ebb27b-01aa75ed71al.,

582 Databases Therefore, it may be speculated that the ambiguity in categorising IP addresses at the national level led the Court to isolate that type of metadata from traffic data and permit their general and indiscriminate retention. Further questions are raised as to whether La Quadrature du Net and Others has in fact given Member States carte blanche to issue time-limited but renewable general and indiscriminate data retention instructions for the objective of safeguarding national security, on the basis of an ongoing specific threat.819 Another related concern involves the Court’s silence on the conditions of access to traffic and location data generally and indiscriminately retained for the objective of national security: if the conditions of access are taken from Tele2 and Watson, then by combining the conditions for general and indiscriminate data retention from La Quadrature du Net and Others and the conditions for access from Tele2 and Watson, Member States could first demonstrate and specify a threat to national security, then order the general and indiscriminate retention of traffic and location data, and finally allow access to such retained data to law enforcement authorities for the purpose of fighting serious crime.820 This is a particularly worrying scenario, but one must not forget that not any threat to national security reaches the threshold to justify bulk retention, and the requirement for prior review by a judicial or another independent authority is meant to prevent possible abuses in this respect. Importantly, in its analysis on the expedited retention of data, the Court was mindful to clarify that access to traffic and location data may in principle be justified only by the public interest objective for which providers were ordered to retain that data. Consequently, access to data for purposes relating to an ordinary offence may in no event be granted where the retention has been justified by the objective of combating serious crime or safeguarding national security.821 An application by analogy of this line of argumentation points to the direction that a ‘mix-and-match’ approach, whereby access to retained data concerns objectives of a different, less serious degree, as per the classification earlier, will be unlawful. Such an expansive interpretation of the Court’s approach would negate previous case law, even though that same case law has been relied upon and there is no indication of the Court backing down from that line of thinking. The argument that the Court’s approach has been built around and largely in line – albeit with certain nuances – of its previous case law. That said, it is acknowledged that a clear distinction between the classification of the different public interest objectives may not always be an easy task. In any case, support for such a reading does not seem to be widespread, as the judgments have not been received with enthusiasm by the Member States; on the contrary, Member States continue to try to find loopholes to circumvent the Court’s findings, even though at first sight, national courts seem to have followed them.822 A cautious and restrictive interpretation of the findings of the Court is instead supported by a close reading of its latest judgment on the data retention saga.

819 Sajfert (n 815). 820 ibid. 821 La Quadrature du Net and Others (n 772) para 166. 822 See ‘EU: Data Retention: Council Presidency Tells National Ministers That “a Solution is Necessary"’ (Statewatch, 8 March 2021), https://www.statewatch.org/news/2021/march/eu-data-retention-councilpresidency-tells-national-ministers-that-a-solution-is-necessary.

The Privatisation of Information Exchange 583 In HK v Prokuratuur, the Court was called upon to reply to queries regarding the access to electronic communications data by law enforcement authorities and their use in criminal proceedings. The Court found that access for the purposes of the prevention, investigation, detection and prosecution of criminal offences to a set of traffic or location data that are liable to provide information regarding the communications made by a user of a means of electronic communication, or the location of the terminal equipment, and thus to allow precise conclusions to be drawn concerning their private life, is only permitted in relation serious crimes. Consequently, any attempt to disassociate retention from access is destined to fail the legality test. Contrary to the Opinion of the AG on this matter,823 further considerations and criteria such as the length of the period for which access to those data is sought and the quantity or nature of the data available in respect of such a period are irrelevant in this assessment.824 This was not the final episode of the data retention saga. An indicative development in terms of state concerns over the fundamental rights limitations imposed by the CJEU on generalised surveillance has been the recent litigation before the French Conseil d’État.825 There, the French government argued against the applicability of the CJEU rulings at the national level by playing the constitutional identity card, arguing that security considerations are integral to the French constitutional identity which trumps the applicability of EU law. In its response, the Conseil d’État found that in the event that the application of a European legal instrument, as interpreted by the CJEU, would have the effect of depriving one of the constitutional requirements in question of effective guarantees, which will not benefit under EU law from equivalent protection, the administrative judge must set it aside to the strict extent that respect for the Constitution so requires.826 The Conseil d’État accepted the link between national data retention mechanisms and the protection of national security,827 but did not declare EU law invalid or inapplicable. Rather, it attempted to set the parameters and limits of the national data retention schemes by a security-driven interpretation of the case law of the CJEU. In this manner, the Conseil d’État avoided a direct clash with the CJEU and at the same time used the case law of the CJEU to broadly interpret the powers of the executive to retain personal data in a generalised manner and thus to support the French government’s security agenda. The pronouncements of the CJEU are also central in relation to the negotiations for the adopted of an e-Privacy Regulation828 which will replace Directive 2002/58/ EC. The Commission proposal left this matter outside its scope, so that Member States

823 Case C-746/18, HK v Prokuratuur, ECLI:EU:C:2020:18, Opinion of AG Pitruzella delivered on 21 January 2020. 824 Case C-746/18, HK v Prokuratuur, ECLI:EU:C:2021:152, para 35. 825 Conseil d’État, Judgment of 21 April 2021, Decision No 393099. 826 For a more EU-friendly analysis of the judgment, see Jacques Ziller, ‘The Conseil d’Etat Refuses to Follow the Pied Piper of Karlsruhe’ (Verfassungsblog, 24 April 2021), https://verfassungsblog.de/the-conseildetat-refuses-to-follow-the-pied-piper-of-karlsruhe. 827 Conseil d’État (n 825) paras 21–26. 828 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)’ COM (2017) 10 final.

584 Databases would be free to keep or create national data retention laws.829 However, during negotiations, a new Article 7(2a) was added to the draft e-Privacy Regulation, which would provide that: Union or national law may impose an obligation on the providers of the electronic communication services to retain metadata for a longer period of time, where such an obligation respects the essence of the fundamental rights and freedoms and is a necessary, appropriate and proportionate measure in a democratic society to safeguard the prevention, investigation, detection or prosecution of criminal offences.830

In addition, Article 7(4) provides that: Union or Member State law may provide that the electronic communications metadata is retained, including under any retention measure that respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society, in order to safeguard the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the safeguarding against and the prevention of threats to public security, for a limited period. The duration of the retention may be extended if threats to public security of the Union or of a Member State persist.831

Essentially, the negotiations within the Council have been a battlefield between, on the one hand, efforts to enhance privacy safeguards and, on the other hand, attempts to enable mass surveillance and transform the e-Privacy Regulation into a ‘surveillance toolkit’, with Article 7(4) essentially signifying that the latter side ‘got its way’.832 On 9 March 2021, the European Data Protection Board (EDPB) issued Statement 03/2021 on the e-Privacy Regulation.833 The EDPB reiterated the need that legislative measures requiring providers of electronic communications services to retain electronic communication data have to comply with the ECHR, the Charter and the relevant CJEU case law. It stressed that: [P]roviding a legal basis for anything else than targeted retention … is not allowed under the Charter, and would anyhow need to be subject to strict temporal and material limitations as well as review by a Court or by an independent authority.834

As the negotiations with the European Parliament are underway, it remains to be seen how this issue can be resolved so that the pronouncements of the CJEU do not become a dead letter for the sake of retaining national mass surveillance regimes.

829 For the Member States’ dissatisfaction, see Council, Document 6358/19 (14 February 2019) 2. For an analysis, see Xavier Tracol, ‘The Two Judgments of the European Court of Justice in the Four Cases of Privacy International, La Quadrature du Net and Others, French Data Network and Others and Ordre des Barreaux francophones et germanophone and Others: The Grand Chamber is Trying Hard to Square the Circle of Data Retention’ (2021) Computer Law & Security Review, 1, 12. 830 ibid 5. 831 ibid 59. 832 ‘France “Got its Way” as Portugal Ends e-Privacy Deadlock’ (Euobserver, 12 February 2021), https:// euobserver.com/science/150904. 833 EDPB, ‘Statement 03/2021 on the e-Privacy Regulation’ (9 March 2021), https://edpb.europa.eu/ our-work-tools/our-documents/statements/statement-032021-eprivacy-regulation_en. 834 ibid 2.

The Privatisation of Information Exchange 585 In the meantime, more preliminary references wait to be litigated,835 including questions by national courts which appear sceptical of the CJEU stance.836 The ECtHR has also litigated on the matter in Big Brother Watch and Centrum för Rättvisa837 on legal challenges against bulk interception of communications in the UK and Sweden, respectively. The conflict on the lawfulness of generalised data retention will continue.

C. Passenger Data Another example where the private sector has been called to actively cooperate with national authorities in the fight against terrorism and serious crimes involves the transfer of PNR data by air carriers. PNR data constitute records of each passenger’s travel arrangements and contain the information necessary for air carriers to manage flight reservations and check-in systems. Under this umbrella definition, a broad array of data may be included: from information on name, passport, means of payment, travel arrangements and contact details to dietary requirements, seating, no show and requests for special assistance. PNR can contain as many as 60 data fields or separate pieces of information.838 Requirements on airlines to transfer such data to the US Department of Homeland Security for all flights to or via the US were introduced post-9/11 by US law. The requirement for EU-based airlines to comply with US law (notwithstanding the potential conflict with EU and national data protection and constitutional law) led to the negotiation and conclusion of a series of agreements between the EC initially and then the EU, on the one hand, and the US, on the other, allowing the transfer of PNR data to the US and stipulating that the US offer an adequate level of data protection. All these agreements have been met with concerns and strong criticism by the European Parliament, EU data protection bodies and civil society, on the grounds that by collecting and transmitting to domestic authorities a wide range of everyday information, which may lead to profiling of individuals, they fall foul of EU privacy and data protection standards. Allowing the transfer of a wide range of personal data relating to everyday legitimate activities in bulk to the US, which will then be subject to automated 835 Case C-794/19, Federal Republic of Germany v Telekom Deutschland GmbH; Case C-140/20, GD v Commissioner of the Garda Síochána, Minister for Communications, Energy and Natural Resources, Attorney General. 836 For example, see the Irish Supreme Court in the case of Dwyer (Record No 2019/18), where it is noted that ‘the precise extent to which such matters may have such an effect on citizens may well vary from Member State to Member State, not least because of the different experiences within Member States of pervasive scrutiny on the part of police authorities’ (para 6.17). 837 Big Brother Watch and Others v UK (n 779); Centrum för Rättvisa v Sweden, App No 35252/08 (25 May 2021). For commentary, see Juraj Sajfert, ‘The Big Brother Watch and Centrum för Rättvisa Judgments of the Grand Chamber of the European Court of Human Rights: The Altamont of Privacy?’ (European Law Blog, 8 June 2021), https://europeanlawblog.eu/2021/06/08/big-brother-watch-andcentrum-for-rattvisa-judgments-of-the-grand-chamber-of-the-european-court-of-human-rightsaltamont-of-privacy; Nora Ni Loideain, ‘Not So Grand: The Big Brother Watch ECtHR Grand C hamber Judgment’ (Information Law and Policy Centre, 28 May 2021), https://infolawcentre.blogs.sas.ac.uk/2021/05/28/ not-so-grand-the-big-brother-watch-ecthr-grand-chamber-judgment. 838 House of Lords European Union Committee, ‘The EU/US Passenger Name Record (PNR) Agreement’ (21st Report, session 2006–7) 9.

586 Databases rocessing on the basis of profiling has been a central consideration in that respect. p However, the conclusion of PNR agreements between the EU and third countries is progressively becoming more widespread; similar agreements have been concluded with Canada839 and Australia840 respectively, and discussions on agreements with Mexico and Japan are in place.841 PNR data transfers are a modern way of monitoring the movement of passengers; nevertheless, they blur the distinction between traditional immigration control at the border or extraterritorially and preventive justice and law enforcement. Furthermore, they establish a system of surveillance of all passengers, citizens and foreigners alike. The significant challenges to fundamental rights, namely privacy and the protection of personal data, have been examined by the CJEU in Opinion 1/15, in which it ruled against the conclusion of the EU-Canada Agreement due to poor data protection safeguards.842 This case arose in the aftermath of Digital Rights Ireland, when the European Parliament requested the Opinion of the Luxembourg Court on the conclusion of a new EU-Canada PNR Agreement. On 26 July 2017, the Court opined that the EU-Canada PNR Agreement was incompatible with the Charter rights and therefore it could not be concluded in its intended form. In reaching that conclusion, the Grand Chamber followed the same approach as in Digital Rights Ireland and Tele2 and Watson. On the legal basis, it found that the Council Decision on the conclusion, on behalf of the EU, of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data, must be based jointly on Article 16(2) TFEU and Article 87(2)(a) TFEU.843 Recognising the PNR agreement as an ‘intelligence tool’, the Court found that taken as a whole, PNR data may, inter alia, reveal a complete travel itinerary, travel habits, relationships existing between air passengers and the financial situation of air passengers, their dietary habits or state of health, and may even provide sensitive information about them.844 Whilst not altogether dismissing the transfer and processing of PNR data for preventing and combating terrorism or serious offences, the Court applied a strict proportionality test as regards the modalities of PNR data processing and called for increased safeguards: the precision of the categories of data transferred;845 the prohibition of the transfer of sensitive data;846 the need for 839 Agreement between the European Community and the Government of Canada on the processing of Advance Passenger Information and Passenger Name Record data [2006] OJ L270/344. 840 Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Australian Customs and Border Protection Service [2012] OJ L186/2. 841 As regards Japan, the Council authorised the opening of negotiations. See Council, Document 5378/20 (4 February 2020). Saudi Arabia, Qatar, the Republic of Korea and New Zealand are considering using PNR data for law enforcement purposes, and have requested or are expected to request entering into bilateral agreements with the EU. See Council, Document 10838/15 (14 July 2015). 842 Opinion 1/15 (n 510). The first Agreement (n 839) expired in September 2009. A new Agreement was signed on 25 June 2014. The Council then sought approval from the European Parliament, which adopted a resolution seeking an opinion from the CJEU pursuant to art 218(11) TFEU. In Opinion 1/15, the Court found that: ‘The Council Decision on the conclusion, on behalf of the Union, of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data must be based jointly on Article 16(2) TFEU and Article 87(2)(a) TFEU’ (para 104). See also chs 1 and 9. 843 ibid para 104. For the broader analysis of legal basis disputes in EU criminal law, see ch 1. See also the data retention legal basis dispute earlier in this chapter. 844 ibid para 128. 845 ibid para 163. 846 ibid para 167.

The Privatisation of Information Exchange 587 pre-determined models and criteria for automated processing;847 the need to process PNR data on a case-by-case basis so as to ‘ensure the oversight or accountability of the public administration’ and to ‘comply with the subpoena or warrant issues, or an order made, by a court’;848 the need for prior review of an access request by a court or an administrative body;849 and the proportionality of retention periods. As regards the latter issue, the Court made a distinction between the retention and use of PNR data before the arrival of passengers, during their stay in Canada and after their departure. Viewing the PNR system as one that ‘facilitates security checks and border control checks’,850 it found that the retention of data up to the departure from Canada is proportionate in relation to all air passengers.851 Furthermore, during the stay of passengers who have been admitted entry in Canada, the use of their data must be based on new circumstances justifying that use, in particular ‘substantive and procedural conditions governing that use in order … to protect that data against the risk of abuse’.852 In that respect, the Court affirmed that objective evidence is required that the PNR data may have an effective contribution to the combating terrorist offences and other serious crimes.853 As for the retention of PNR data after the departure of passengers from Canada, it opined that passengers subjected to entry and exit checks should be regarded as ‘not presenting, in principle, a risk’ for terrorism and serious crime;854 therefore, once they have left, there would appear to be no connection – even a merely indirect one – between their PNR data and the objective pursued by the envisaged agreement which would justify that data being retained.855 As such, the continued storage of all air passengers’ data after departure is disproportionate and only in specific cases, where ‘objective evidence is identified from which it may be inferred that certain air passengers may present a risk in terms of the fight against terrorism and serious transnational crime even after their departure from Canada, it seems permissible to store their PNR data beyond their stay in Canada’.856 In such cases, a five-year retention period does not exceed the limits of what is strictly necessary, but prior review by a court or an independent administrative authority is required.857 Whilst Opinion 1/15 was still pending, another brick in the surveillance wall built by processing PNR data came from the EU legislature through the development of a similar system to process EU air travel data, both in connection with flights from the EU to third countries and intra-EU flights. The background of that initiative is the following: the setting up of a PNR system at the EU level has been contemplated since 2004, although only a handful of Member States, including the UK, operated domestic PNR systems. In this context, the first proposal for a Framework Decision

847 ibid

para 168. para 181. paras 201–03. 850 ibid para 197. 851 ibid. 852 ibid para 200. 853 ibid para 201. 854 ibid para 204. 855 ibid para 205. 856 ibid para 207. 857 ibid para 209. 848 ibid 849 ibid

588 Databases was tabled in 2007,858 where the Commission claimed that the proposal was a result of the ‘policy-learning’ from the then PNR Agreements with the US and Canada, as well as the development of pilot projects in the UK.859 It must be noted that a system requiring airlines to transmit passenger data had already been in place on the basis of the 2004 Directive on the transfer of Advanced Passenger Information (API) from airlines to the border authorities of Member States.860 The principal objective of the API Directive is to improve border control and combat irregular migration, and for this purpose, it requires the transfer of limited categories of data largely found in one’s travel documents.861 However, the Directive permits the use of API data for law enforcement purposes when the use of such data is authorised by national law, but implementation of this option is at the discretion of Member States.862 Therefore, one could question the necessity and added value of an essentially similar system in the third pillar. Mindful of this criticism, the Commission attempted to distinguish between the two initiatives noting that: For the purposes of the fight against terrorism and organised crime, the information contained in the API data would be sufficient only for identifying known terrorists and criminals by using alert systems. API data are official data, as they stem from passports, and sufficiently accurate as to the identity of a person. On the other hand, PNR data contains more data elements and are available in advance of API data. Such data elements are a very important tool for carrying out risk assessments of the persons, for obtaining intelligence and for making associations between known and unknown people.863

From this passage, it is clear that the Commission adopted an intelligence-led model of border controls with an emphasis on risk assessment and profiling, based on the collection of a wide range of personal data at the earliest possible stage. From the limited categories of passport data to be transmitted prior to departure under the API Directive, the Proposal marked a bold move towards the transfer of a wide range of information relating to air passengers at a considerably earlier stage. Furthermore, the transfer of PNR data was viewed as necessary not only for border controls/immigration, but also for broader counter-terrorism and security purposes. Until the entry into force of the Lisbon Treaty, no agreement was reached. A revised proposal was released in 2011,864 essentially mimicking the EU-US PNR model, at least as regards the types of data to be processed and the focus on assessing the risks attached to passengers as a means of preventing terrorist attacks or other serious crimes. 858 Commission,’ Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for Law Enforcement Purposes’ COM (2007) 654 final (hereinafter the ‘PNR Proposal’). 859 ibid 2. 860 Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data [2004] OJ L261/24. On the API Directive, see Valsamis Mitsilegas, ‘Contrôle des étrangers, des passagers, des citoyens: Surveillance et anti-terrorisme’ (2005) 58 Cultures et Conflits, 155; see also House of Lords European Union Committee, ‘Fighting Illegal Immigration: Should Carriers Carry the Burden?’ (5th Report, session 2003–04, HL Paper 29). 861 API Directive, art 1. 862 ibid art 6(1), last subparagraph. 863 PNR Proposal (n 858) 3. 864 Commission, Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, COM (2011) 32 final.

The Privatisation of Information Exchange 589 In comparison to the proposed Framework Decision, it constituted an improvement – for instance, it provided for a reduced retention period and prohibited the processing of sensitive data – but it was met with great scepticism by a number of EU actors, including the EDPS865 and the Fundamental Rights Agency,866 which argued that it failed to respect the principles of necessity and proportionality. In April 2013, the European Parliament postponed the voting on fundamental rights grounds, but following the Charlie Hebdo attacks in France, the EU PNR project was resurrected. In February 2015, the European Parliament re-opened the dossier and committed to reaching an agreement by the end of 2015.867 Then, in the extraordinary JHA Council meeting of 20 November 2015, immediately after the terrorist attacks in Paris, the Council reiterated ‘the urgency and priority to finalise an ambitious EU PNR before the end of 2015’.868 After speedy negotiations due to the urgency attached to the dossier, the EU PNR D irective was published in May 2016869 with an implementation deadline of May 2018.870 The Directive has placed a duty on airline carriers operating international flights between the EU and third countries to forward PNR data of all passengers to Passenger Information Units (PIUs) established at the domestic level for this purpose, under structures similar to those found in FIUs. Member States have been given the d iscretion to extend the regime set out in the Directive to intra-EU flights, even to selected ones.871 Unsurprisingly, all participating states but one have made use of their discretion, including Ireland and the UK, which expressed their wish to participate in the instrument.872 Once transmitted, the data are stored and analysed by the national PIU so as to identify persons who were previously unsuspected of involvement in terrorism or serious crime873 and require further examination by competent authorities in relation to those offences listed in Annex II of the Directive. The analysis by PIUs entails a risk assessment of all passengers prior to their travel on the basis of pre-determined criteria to be decided by the respective PIU and possibly involving cross-checking with 865 EDPS, ‘Opinion of the European Data Protection Supervisor on the Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime’ https://edps.europa.eu/sites/edp/ files/publication/11-03-25_pnr_en.pdf. 866 Fundamental Rights Agency, ‘Opinion 1/2011 of the European Union Agency for Fundamental Rights on the Proposal for a Directive on the use of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (COM (2011) 32 final)’ (14 June 2011). 867 European Parliament, ‘Draft Report on the proposal for a directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (COM (2011)0032 – C7-0039/2011 –2011/0023(COD))’ (17 February 2015). 868 Council, Document 14382/15 (20 November 2015). 869 Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime [2016] OJ L119/132 (hereinafter the ‘EU PNR Directive’). 870 The Commission has launched infringement procedures against Spain for failing to communicate the adoption of national legislation which fully transposes the Directive. See Commission, ‘Review of Directive 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime’ (Report) COM (2020) 305 final, 5 (hereinafter ‘Evaluation of the EU PNR Directive’). 871 EU PNR Directive, art 2. 872 Council, Document 8016/11 (28 March 2011); Document 9103/11 (15 April 2011). 873 EU PNR Directive, Recital 7.

590 Databases existing blacklists. The data transferred is thus used to identify specific behavioural patterns and make associations between known and unknown persons. Furthermore, the PIUs have to respond to requests by national authorities to access the data on a case-by-case basis and subject to sufficient indication. Nevertheless, processing should not take place on the basis of sensitive data revealing on race, ethnic origin, religion or belief, political or any other opinion, trade union membership, health, or sexual life.874 The initial retention period is six months, after which PNR data will be depersonalised, meaning that the PIU is entrusted with the task of masking out the names, address and contact information, payment information, frequent flyer information, general remarks and all API data.875 They may still be used for criminal law purposes under ‘very strict and limited conditions’876 – that is, if so permitted by a judicial authority or another national authority competent to review whether the conditions have been met and subject to information and ex post review by the Data Protection Office (DPO) of the PIU.877 Finally, a DPO will be appointed in each PIU in order to monitor the processing of PNR data.878 The challenges of the EU PNR system for the protection of privacy, data protection and citizenship rights are acute. The Directive allows the systematic, transfer, storage and further processing of a wide range of personal data of all air passengers travelling either within the EU or from the EU to third countries. Though this arrangement may not qualify as generalised and indiscriminate surveillance, it is clear that it impacts on millions of travellers.879 The involvement of the private sector in the fight against terrorism and serious criminality intensifies, particularly if one takes into account that the duties of air carriers may be extended in the future to non-carrier economic operators (eg, travel agencies).880 In addition, the inclusion of intra-EU flights within the scope of the Directive significantly expands the reach of surveillance. Indeed, back in 2011, it was noted that intra-EU flights represent the majority of EU flights (42 per cent), followed by international flights (36 per cent), and only 22 per cent of flights operate within a single Member State.881 In this framework, the movement of the vast majority of travellers, including EU citizens, is placed under constant monitoring, despite the fact that they are a priori innocent and not suspected of any criminal offence. The operation of the PNR scheme signifies the reversal of the presumption of innocence, whereby everyone is deemed to be a potential security risk, thus necessitating their examination in order to confirm or rebut this presumption. Besides, there is no differentiation between risky flights and non-risky ones. Furthermore, the risk assessment takes place in an unlimited and highly obscure manner; while it is explained that sensitive data must not be processed, the Directive 874 ibid art 6(4). 875 ibid art 12. 876 ibid Recital 25. 877 ibid art 12(3). 878 ibid art 5. 879 Opinion 1/15 (n 510) para 187, which reads as follows: ‘[T]he exclusion of certain categories of persons, or of certain areas of origin, would be liable to prevent the achievement of the objective of automated processing of PNR data, namely identifying, through verification of that data, persons liable to present a risk to public security from amongst all air passengers, and make it possible for that verification to be circumvented.’ 880 EU PNR Directive, Recital 33 and art 19. 881 Council, Document 8016/11 (n 872).

The Privatisation of Information Exchange 591 fails to prescribe comprehensively and in detail how the data is analysed. The underlying rationale is the profiling of all passengers and the identifying of behavioural patterns in a probabilistic logic, but nowhere in the Directive is it indicated that this is indeed the case. In Opinion 1/15, the CJEU marked the role of pre-determined models and criteria in assessing ‘unverified personal data’ and highlighted the margin of error in such automated processing.882 The Court further called for those criteria to be ‘specific and reliable’ so that it would be possible ‘to arrive at results targeting individuals who may be under a reasonable suspicion’.883 In that respect, the EU PNR Directive does not prescribe with precision the manner in which PIUs must process travel data. It is merely stated that databases ‘relevant for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime’ may be consulted, without further specification as to which these are.884 For instance, a possible routine examination of the databases storing asylum seekers’ fingerprints or visa applicants’ data will frustrate their legal framework, resulting in a domino effect of multiple function creeps. As for the predetermined criteria, these ‘must be targeted, proportionate and specific’, but leeway is given to national PIUs to determine and review them in cooperation with national law enforcement authorities. With the exception of the role of the DPO, no further guidelines have been prescribed. Furthermore, the wording on certain categories of data transferred from air carriers to PIUs is not clear and precise enough. Where information to be transmitted is listed only by way of example, through the use of the term ‘including’, there is no limitation on the nature and scope of the information.885 Moreover, as regards the offences covered by the scope of the Directive, although Annex II sets out a list in this regard, PNR data could still be used for other offences, including minor ones, when these are detected in the course of an enforcement action further to the initial processing.886 As for the period for which the data will be retained, the distinction of the retention and use of PNR data before the arrival of air travellers, during their stay and after their departure, as per the pronouncements of Opinion 1/15, is missing. During the first six months of retention, the data are unmasked and there are no specific limitations on their use. Unmasking throughout the remainder of the retention period is possible, provided that it is ‘reasonably believed that it is necessary’,887 which points to a lower threshold than that in Opinion 1/15 and may lead to generalised consultation by the law enforcement authorities. Importantly, the Court has made clear that the continued storage of all air passengers’ data after departure is disproportionate in any case. The momentum for surveillance of mobility through PNR data is higher than ever.888 At the time of writing, the PNR framework is under scrutiny by the CJEU; the Belgian

882 Opinion 1/15 (n 510) para 169. 883 ibid para 172. 884 EU PNR Directive, art 6(3). 885 Opinion 1/15 (n 510) paras 155–63. 886 Vavoula (n 141). 887 EU PNR Directive, art 12(3). 888 For example, in December 2017, the UN adopted Security Council Resolution 2396 requiring all UN states to develop the capability to collect, process and analyse PNR data, and to ensure PNR data are used by and shared with all their competent national authorities. Furthermore, in June 2020, the International Civil Aviation Organization (ICAO) adopted new PNR standards.

592 Databases Constitutional Court submitted before the Court a series of questions for preliminary ruling regarding the compatibility of the Directive with the rights to respect for private life and protection of personal data.889 On 20 January 2020, another request for reference ruling was filed by the District Court of Cologne.890 In light of the above, the outcome of these cases is eagerly awaited. In the meantime, the implementation of the Directive has undergone evaluation, where its added value has been praised in terms of identifying potential terrorists or persons involved in other serious criminal activities, arresting persons previously unknown to the police services, or by examining passengers who would not have been checked otherwise.891 In the meantime, calls to further develop the PNR system in different directions have proliferated; for example, by implementing the interoperability framework between PIUs and information systems,892 widening the material scope of the PNR Directive to cover other transport forms other than air (maritime, railway and road traffic data),893 and expanding its purposes to public health and preventing the spread of infectious diseases, for example, by facilitating contact tracing as regards persons who have been sitting near an infected passenger. This issue has gained prominence following the COVID-19 pandemic, with Member States indicating that there is a need to allow the use of PNR data to tackle such health-related emergencies. The normalisation of emergency circumstances in this context is crucial. Questions about the cooperation between PIUs similar to those raised earlier in relation to FIUs will also have to be addressed.894 Finally, in view of the forthcoming revision of the API Directive – following its own evaluation895 – it appears that the aforementioned developments will first find their way through that context, not least because API data are more reliable than PNR.

D. Electronic Evidence The latest development in the co-option of the private sector in information exchange involves the transfer of electronic evidence from the service providers directly to the national authorities of another Member State. Electronic evidence may encompass a wide range of information in digital form, such as text messages, metadata embedded in documents, access log files from a service provider, information regarding sent and received emails, information about IP addresses associated with downloads or information provided through malware.896 Cross-border exchanges of electronic evidence are indispensable in criminal investigations involving more than one jurisdiction. Under the current legal framework, a cross-border request for data sought in criminal proceedings

889 Case C-817/19, ASBL ‘Ligue des Droits Humains’ (pending). 890 Case C-222/20, Bundesrepublik Deutschland (pending). 891 Evaluation of the EU PNR Directive (n 870) 6–7. 892 Council, Document 5505/19 (18 February 2019). 893 Council, Document 6300/19 (15 February 2019) 12, https://www.statewatch.org/news/2019/jul/eu-councilpnr-policy-debate-6300-19.pdf. 894 Evaluation of the EU PNR Directive (n 870) 9. 895 Commission (n 340). 896 Sabine Gless and Pauline Pfirter, ‘Cross-border Access and Exchange of Digital Evidence: Cloud Computing Challenges to Individual Rights and the Rule of Law’ in Mitsilegas and Vavoula (n 671) 5–26.

The Privatisation of Information Exchange 593 is facilitated via the European Investigation Order (EIO),897 which is issued and executed based on the principle of mutual recognition of judicial decisions. In cases where such cross-jurisdictional demands for electronic information concern EU Member States that do not participate to the EIO Directive (such as Ireland or Denmark) or third countries (such as the US or Japan), Member States resort to Mutual Legal Assistance Treaties (MLATs). Both the EIO Directive and the MLATs operate on the basis of direct communication between domestic authorities, with a view to ensuring compliance with fundamental rights, particularly the rights to privacy and protection of personal data, as well as adherence to the rule of law.898 The ex ante involvement of independent judicial authorities in both the issuing and the executing countries is central in this respect. Nevertheless, the intervention of judicial authorities has increasingly been deemed to be an obstacle to law enforcement as traditional avenues are too slow;899 certain internetbased service providers operate across several Member States or even worldwide, but without having their headquarters or an establishment in countries whose law enforcement authorities seek their assistance.900 As a result, cross-border requests for data may concern individuals who are nationals of the issuing country and the only factor linking a criminal investigation to another country is the location of the data, or the place of establishment of the service provider holding it.901 In light of the above, the idea of designing a novel avenue for obtaining access to electronic evidence has arisen, whereby national authorities would be allowed to directly request electronic evidence from private companies abroad, thus allowing the unilateral and extraterritorial exercise of criminal jurisdiction. In the 2015 European Agenda on Security, the Commission stressed the need for gathering electronic evidence in real time from other jurisdictions on issues like owners of IP addresses or other forms of e-evidence, and ensuring its admissibility in court.902 Then, in its Conclusions on improving criminal justice in cyberspace of 9 June 2016, the Council stressed the importance of electronic evidence in criminal proceedings in all types of crimes and called on the Commission to develop a legal framework with the aim of ‘improving criminal justice in cyberspace’.903 A non-paper by the Commission in May 2017 contained a number of practical measures to improve cross-border access to e-evidence, concluding that there was need for legislative action regarding the direct cooperation with service providers.904 This conclusion was supported by many Member 897 Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters [2014] OJ L130/1 (hereinafter the ‘EIO Directive’). 898 Sergio Carrera, Gloria González Fuster, Elspeth Guild and Valsamis Mitsilegas, ‘Access to Electronic Data by Third-Country Law Enforcement Authorities’ (CEPS, 2015). 899 As regards the EIO, see Council, Document 8707/16 (13 May 2016). For the MLATs, see, among others, Neil Boister and Robert J Currie (eds), Routledge Handbook of Transnational Criminal Law (Routledge, 2015). 900 Katalin Ligeti and Gavin Robinson, ‘Sword, Shield and Cloud: Toward a European System of PublicPrivate Orders for Electronic Evidence in Criminal Matters?’ in Mitsilegas and Vavoula (n 671) 27–70. 901 For cases at the national level where service providers refused to cooperate, see Court of Cassation of Belgium, No P.13.2082.N, Judgment of 1 December 2015 (Yahoo! case); Court of First Instance Antwerp (Belgium), ME20.F1.105151-12, Judgment of 27 October 2016 (Skype case) (in Dutch). 902 Commission (n 281) 19. 903 Council, ‘Conclusions on improving criminal justice in cyberspace’ (9 June 2016). 904 Commission, ‘Improving cross-border access to electronic evidence: findings from the expert process and suggested way forward’ (22 May 2017), https://ec.europa.eu/home-affairs/sites/homeaffairs/files/docs/ pages/20170522_non-paper_electronic_evidence_en.pdf.

594 Databases States in the Council meeting of 8–9 June 2017.905 The EU approach must be placed in the broader context of similar efforts at the other side of the Atlantic, where the US Congress passed the Clarifying Lawful Overseas Use of Data Act (CLOUD Act),906 an amendment to the Stored Communications Act of 1986907 that requires a company subject to US jurisdiction ‘to produce data the company controls, regardless of where it is stored at any point in time’. The CLOUD Act further encompasses the possibility for the US to conclude executive agreements that would allow law enforcement authorities from third countries to obtain non-US citizens’ data, including content data, directly from private companies falling under US jurisdiction.908 In April 2018, the Commission presented a package comprising of two legislative proposals on cross-border access to electronic evidence (hereinafter the ‘e-evidence proposals’).909 On the one hand, the proposed Regulation, based on Article 82(1) TFEU, establishes two new instruments: a European Production Order Certificate (EPOC) and a European Preservation Order Certificate (EPOC-PR). The former is defined as ‘a binding decision by an issuing authority of a Member State compelling a service provider offering services in the Union and established or represented in another Member State, to produce electronic evidence’.910 The latter is ‘a binding decision by an issuing authority of a Member State compelling a service provider offering services in the Union and established or represented in another Member State, to preserve electronic evidence in view of a subsequent request for production’.911 On the other hand, the proposed Directive, based on Articles 53 and 62 TFEU, obliges Member States to provide for a framework ensuring that there is a known and empowered legal representative of a service provider to whom the order may be addressed. The proposed Regulation distinguishes among different categories of data that may be obtained, which must already be stored at the time of receipt of the EPOC or the EPOC-PR, and may constitute electronic evidence:912 subscriber data, access data, transactional data – the three categories commonly referred to jointly as ‘non-content data’ – and content data.913 In terms of sensitivity, subscriber and access data are grouped together as less intrusive, whereas the intrusiveness of transactional and content data is deemed to be more significant.914 This distinction is important for two reasons; first,

905 Council, Document 10136/17 (8–9 June 2017). 906 Clarifying Lawful Overseas Use of Data (CLOUD) Act, HR 1625, 115th Cong div V. 907 Stored Communications Act, Pub L 99–508, tit II, 100 Stat 1848, 1860–68 (1986). 908 For an analysis, see, among others, Jennifer Daskal, ‘The Opening Salvo: The CLOUD Act, E-evidence Proposals, and EU-US Discussions Regarding Law Enforcement Access to Data across Borders’ in Francesca Bignami (ed), EU Law in Populist Times: Crises and Prospects (Cambridge University Press, 2019); Jennifer Daskal, ‘Unpacking the CLOUD Act’ (2018) 4 Eucrim 220; Jennifer Daskal, ‘Microsoft Ireland, the CLOUD Act, and International Lawmaking 2.0’ (2018) Stanford Law Review, https://www.stanfordlawreview.org/ online/microsoft-ireland-cloud-act-international-lawmaking-2-0. 909 Commission, ‘Proposal for a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters’ COM (2018) 225 final (hereinafter the ‘Proposal for e-evidence Regulation’); Commission, ‘Proposal for a Directive laying down harmonized rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings’ COM (2018) 226 final. 910 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) art 2(1). 911 ibid art 2(2). 912 Thus, no future surveillance is allowed. 913 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) arts 2(7)–2(10) 914 ibid 14–15.

The Privatisation of Information Exchange 595 in relation to the latter group of data, the use of orders is limited to specific categories of offences;915 and, second, the prosecutor is excluded from the list of competent authorities that may issue or validate an EPOC.916 In turn, an EPOC or an EPOCPR for subscriber and access data may be issued by a judge, a court, an investigating judge or a prosecutor917 or ‘any other competent authority as defined by the issuing State which, in the specific case, is acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law’.918 In such cases, both types of orders must be validated by the same authorities enabled to issue them within their range of competences. However, the difference between access data and transactional data may not be easy to grapple.919 Besides, as mentioned above, metadata, such as traffic and location data, provide the means for establishing a profile of the individuals in question, and therefore such information is no less sensitive than the actual content of communications. Be that as it may, the novelty of the e-evidence proposals is that the orders are directly addressed to service providers established or represented in another Member State.920 These may be providers of electronic communication services, information society services (such as social networks, online marketplaces and other hosting service providers) and providers of internet infrastructure, such as IP address and domain name registries.921 Nevertheless, the personal scope is not clearly outlined.922 The orders may be issued only for criminal proceedings, which include the pre-trial and the trial phases,923 subject to the principles of necessity and proportionality.924 In an attempt to compensate for depriving individuals of a control mechanism in the executing 915 According to art 5, an Order for producing subscriber or access data may involve any criminal offence, whereas the Order for producing transactional or content data may only be issued for criminal offences punishable in the issuing state by a custodial sentence of a maximum of at least three years or for a series of specific crimes (see below). 916 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) art 4(2). Tozla points out that it may happen that a prosecutor might be in the position to issue an EPOC-PR for content data at the European level, while they would not be able to do so in a purely domestic context. Prosecutors can also be entitled to ask for transactional and content data, but with the necessary authorisation and conferral of powers, which are at the discretion of the national legislator (like any other competent authority). See Stanislaw Tozla, ‘The European Commission’s Proposal on Cross-border Access to e-Evidence’ (2018) 4 Eucrim 212. 917 On the requirement of the independence of the issuing judicial authority, see Joined Cases C-509/18, PF, C-508/18, OG and C082/19 PPU, PI, ECLI:EU:C:2019:456. 918 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) arts 4(2) and (3). 919 Martin Böse, ‘An Assessment of the Commission’s Proposals on Electronic Evidence’ (Study for the European Parliament, 2018) 20. 920 Mere accessibility of the service from the EU territory is not sufficient. See Tozla (n 916). 921 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) art 2(3). 922 Vanessa Franssen, ‘The European Commission’s e-Evidence Proposal: Toward an EU-Wide Obligation for Service Providers to Cooperate with Law Enforcement? (EU Law Blog, 12 October 2018), https:// europeanlawblog.eu/2018/10/12/the-european-commissions-e-evidence-proposal-toward-an-eu-wide-obligation-for-service-providers-to-cooperate-with-law-enforcement. Ligeti and Robinson take the view that an alternative approach might have been to use an open-ended, relatively technologically-neutral definition such as ‘digital service provider’ and to temper the danger of over-inclusion with limits such as those in the recent German Netzwerkdurchsetzungsgesetz (NetzDG): a 48-hour disclosure rule only applies to social media providers with more than two million registered users in Germany. See Ligeti and Robinson (n 900). 923 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) art 3(2). 924 The EPOC must be necessary and proportionate for the purpose of the criminal proceedings in question (art 5(2)). By contrast, the EPOC-PR must be necessary and proportionate to prevent the removal, deletion or alteration of data in view of a subsequent mutual legal assistance request, an EIO or an EPOC (art 6 (2)).

596 Databases Member State,925 there are two additional conditions in connection to the issuing of an EPOC. First, a similar measure must be available for the same criminal offence in a comparable domestic situation.926 Second, the issuing of an EPOC concerning subscriber or access data is allowed for any criminal offence, whereas in relation to transactional or content data, it is limited to two types of offences: (a) offences punishable in the issuing state by a custodial sentence of a maximum of at least three years;927 and (b) certain criminal offences, irrespective of their punishment928 (fraud and counterfeiting of noncash means of payment,929 sexual abuse and sexual exploitation of children and child pornography,930 attacks against information systems,931 and terrorism).932 However, with the exception of harmonised offences, there is no requirement for double criminality. The service providers must respond within 10 days or in cases of emergency within six hours,933 in principle without the intervention by an authority in the Member State where the service provider offers its services, or is established or represented (the host Member State). Service providers are entrusted with the task of checking the specificities of the orders themselves without the involvement of a competent authority in the Member State hosting the service provider in question. The proposed Regulation prescribes specific rules on responsibilities in cases where further information is required by the service provider934 or other issues arise, such as problems with the certificate itself; or where the data has been deleted, problems due to force majeure or de facto impossibility of complying; or where the target is not a customer of the addressee.935 In addition to technical impossibility or practical difficulty of compliance with an order, the service providers may refuse to cooperate based on three additional grounds: orders which are ‘manifestly abusive’, manifest non-compliance with the Charter936

925 Böse (n 919) 21–22. 926 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) art 5(2). 927 ibid art 5(4)(a). 928 ibid art 5(4)(b). 929 Council Framework Decision 2001/413/JHA of 28 May 2001 combating fraud and counterfeiting of non-cash means of payment [2001] OJ L149/1, arts 3–5. 930 Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA [2011] OJ L335/1, arts 3–7. 931 Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA [2013] OJ L218/8, arts 3–8. 932 Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA [2017] OJ L88/6, arts 3–12, 14. 933 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) art 9(1). 934 ibid arts 9(3) and 10(4). 935 ibid arts 9(4) and 10(5). 936 The grounds relating to a manifestly abusive order or an order manifestly violating the Charter concern an EPOC only; see ibid art 9(5). For criticism, see Elodie Sellier and Anne Weyembergh, ‘Criminal Procedural Laws across the European Union: A Comparative Analysis of Selected Main Differences and the Impact They Have over the Development of EU Legislation’ (Study for the European Parliament, 2018) 30. See also Tozla (n 927). During the negotiations, the Council deleted the Charter and ‘abusive’ grounds for refusal by service providers from the text, and introduced a new, qualified provision on the systematic notification of the competent authority in the ‘enforcing State’ where an order concerns the content data of non-residents, which is discussed below. See Council, Document 10206/19 (11 June 2019).

The Privatisation of Information Exchange 597 and conflicting obligations in third country law. If for any ‘other’ reason the service provider does not provide the requested data, it must explain the reasons for this.937 In cases where the service provider does not comply with the order and the reasons provided are not accepted by the issuing authority, the order may be transferred to the enforcement authority in the host Member State.938 If the service provider refuses to comply with the EPOC or the EPOC-PR without giving a reason, the competent authorities of the host Member State should step in and ensure compliance in accordance with national law.939 The proposed Regulation deals with conflicting legal obligations stemming from third-country law,940 or immunities or privileges applicable in the host Member State.941 In particular, in the event that the service provider considers that compliance with the EPOC would conflict with the applicable laws of a third country, two separate review procedures are foreseen. The first procedure involves conflicting obligations based on the protection of fundamental rights of individuals or fundamental interests of a third country relating to national security or defence. In such cases, the issuing authority will have to request a review by the competent court within that Member State. If the court believes that there is a conflict, it is obliged to transmit all relevant factual and legal information on the case, including its assessment, to the central authorities in the third country concerned. The third country is then entitled to object to the order within a maximum of 35 days, in which case the court shall lift the order.942 The second procedure concerns conflicting obligations based on ‘other grounds’. Here the competent court is given discretion; there is no obligation to notify the authorities of the third state of a potential conflict of laws and no obligation to dismiss the order if it concludes that there is such a conflict of laws.943 It is expressly stated that the conflict cannot be based solely on the lack of a similar procedure in the third country or on the fact that the data is stored in that country.944 Notably, in both review procedures, no distinction is made between EU and non-EU countries.945 The possibilities offered to affected third countries to exercise their protective functions in relation with human rights and to protect their own state interests by objecting to the execution of an order are particularly problematic.946 In essence, the proposed Regulation results in the re-distribution of the protection functions in favour of the issuing Member State.947 Furthermore, this 937 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) arts 9(5), 10(6) and 14. 938 ibid art 14. By sending the request to the host Member State, the procedure returns to the form of a more traditional mutual recognition procedure. 939 ibid art 14(1) and (2). 940 ibid arts 15–16. 941 ibid art 18. 942 ibid art 15. 943 ibid art 16. During the negotiations, Member States proposed a single review mechanism mirroring the rules on art 16, abolishing the obligation to inform the third country concerned and the discretion to dismiss the order. This significantly waters down the Commission proposal. See Theodore Christakis, ‘E-Evidence in the EU Council: The Key Issue of When One Member State Can Review the Requests from Another’ (Cross-Border Data Forum, 1 October 2018), https://www.crossborderdataforum.org/e-evidence-in-the-eucouncil-the-key-issue-of-when-one-member-state-can-review-the-requests-from-another. See also Council, Document 12113/1/18 (17 October 2018), www.statewatch.org/news/2018/oct/e-evidence-council.htm. 944 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) art 15(2). 945 Christakis (n 943). 946 See Council, Document 10470/18 REV 1 (28 June 2018). 947 Böse (n 919) 41–42.

598 Databases nderstanding of mutual trust is at odds with growing concerns regarding the protection u of human rights and the upholding of the rule of law in certain Member States. Thus, it is difficult to foresee how Member States would renounce their protective functions, given that their own domestic systems offer more human rights safeguards than those of some other Member States issuing EPOCs.948 Crucially, entrusting the issuing state with the task of effectively protecting the fundamental interests of other Member States, the immunities and privileges existing in their legal systems or the fundamental human rights of their citizens may prove a difficult task in practice. It is difficult to conceive that the issuing state and its competent courts would prioritise any foreign interests over its own.949 In order to reconcile the divergent views put forward regarding the involvement of the host Member State,950 a notification procedure has been proposed instead,951 whereby the competent authority in the host Member State would be notified simultaneously with the submission of orders to service providers and would be allowed to review and object to the enforcement of the order.952 It has been suggested that this procedure will ensure greater protection for individuals who may be able to challenge both the decisions of the authorities of the issuing Member State and the decisions of the EPOC of the authorities of the host Member State.953 The objection of the latter could prevent the service provider from handing over the data to the issuing authority or, if the data have already been produced, would prohibit the prosecuting authorities of the issuing Member State from using the data as evidence. However, notification is limited to (i) EPOCs only, concerning (ii) content data only, where (iii) the issuing authority has reasonable grounds to believe that the person whose data is sought is not residing on its own territory and (iv) does not have a suspensive effect.954 Importantly, the room for manoeuvre is limited; the notified authority may inform the issuing authority of circumstances relating to immunities or privileges under its law, to rules on determination and limitation of criminal liability relating to freedom of press and freedom of expression in other media, or potential impact on fundamental interests such as national security and defence with no power to object.955 This alternative suggestion – that is strongly reminiscent of the operation of the EIO – raises concerns as to whether a whole new instrument is necessary.956 Finally, the proposed Regulation foresees remedies for suspects, accused persons and other persons whose data were obtained, which are to be provided by national law.957

948 Christakis (n 943). 949 ibid. 950 See Council, Document 10470/18 REV 1 (n 946); Council, Document 12856/18 (4 October 2018). 951 See Council, Document 12856/18 (n 950). 952 See Council, Document 10470/18 REV 1 (n 946). 953 Christakis (n 943). 954 Council, Document 10602/19 (21 June 2019) art 7a. The European Parliament Rapporteur has referred to a ‘meaningful’ notification, which includes the right to refuse to recognise data orders – and this in relation to all types of data – on the basis of grounds for non-recognition or non-execution set out in a new art 10. These grounds are drawn from art 11 of the EIO Directive. See European Parliament, ‘Draft Report on the proposal for a regulation of the European Parliament and of the Council on European Production Orders for electronic evidence in criminal matters’ (24 October 2019). 955 Ligeti and Robinson (n 900). 956 Böse (n 919) 47–48; Franssen (n 922). 957 Commission, ‘Proposal for e-Evidence Regulation’ (n 909) art 17.

The Privatisation of Information Exchange 599 The right to an effective remedy shall be exercised before a court in the issuing state and must offer the possibility to challenge the legality of the measure, including its necessity and proportionality. The issuing authority is also responsible for informing the interested persons about that right. Within this framework, these persons should be able to address issues of violation of the Charter or the abuse of the order. These rules are also not satisfactory: first, the recognition and execution of the request by the service provider cannot be challenged by the person whose data is at stake;958 second, such rights are not extended in cases of EPOC-PRs; and, third, the choice of challenging the decision only in the issuing Member State may prove to be insufficient, particularly in cases where the person concerned does not reside in the same country as the authorities issuing the order. Overall, the proposed mechanism marks a significant deviation from traditional cross-border cooperation based on the consent of the Member State where the data are stored and the principle of mutual recognition. By obliging service providers to produce and/or preserve requested data, prior recognition by the Member State in the territory of which the data are stored is no longer required. A central point of concern involves the legal basis of the Regulation – Article 82(1) TFEU on judicial cooperation in criminal matters on the basis of the mutual recognition principle, particularly paragraphs (a) and (d).959 Whilst the proposals provide a ‘new dimension of mutual recognition’,960 Article 82(1)(d) seems inappropriate in view of the lack of direct contact and intervention by the authorities of the Member State where the service provider is established.961 As for Article 82(1)(a), the proposed rules suggest that the judicial decisions of one Member State are recognised throughout the EU,962 which deviates from the traditional understanding of mutual recognition in

958 Sellier and Weyembergh (n 936) 43. 959 These read as follows: ‘1. Judicial cooperation in criminal matters in the Union shall be based on the principle of mutual recognition of judgments and judicial decisions … The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall adopt measures to: (a) lay down rules and procedures for ensuring recognition throughout the Union of all forms of judgments and judicial decisions; … (d) facilitate cooperation between judicial or equivalent authorities of the Member States in relation to proceedings in criminal matters and the enforcement of decisions.’ 960 Commission, ‘Commission Staff Working Document – Impact Assessment Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters and Proposal for a Directive of the European Parliament and of the Council laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings’ SWD (2018) 118 final, 37. 961 Although in a different context, some parallels may be drawn with Opinion 1/15 (n 510) on the draft EU-Canada PNR Agreement. The Court ruled that the involvement of non-judicial authorities questioned the legality of art 82(1) TFEU as the appropriate legal basis for concluding the EU-Canada PNR Agreement, as it did not contribute to facilitating cooperation between judicial authorities, but rather was meant to combat terrorism and serious transnational crime, while safeguarding the rights to privacy and protection of personal data. On drawing an analogy in the case of the e-Evidence proposals, see Sergio Carrera and Valsamis Mitsilegas, ‘Constitutionalising the Security Union: Effectiveness, Rule of Law and Rights on Countering Terrorism and Crime’ (CEPS, 2017), https://www.ceps.eu/wp-content/uploads/2017/11/ConstitutionalisingSecurityUnion.pdf; see also Sellier and Weyembergh (n 936) 31. Ligeti and Robinson (n 900) point out that although in both settings cross-border public-to-private data transfers are at stake, in the PNR setting, a ‘police cooperation’ mechanism agreed with a third state envisages broad, systematic transfers, whilst in the e-evidence setting, the ‘judicial cooperation’ mechanism would take the form of EU legislation providing for targeted provision of data within the framework of criminal investigations and proceedings. 962 Franssen (n 922).

600 Databases criminal matters.963 This paradigm shirt essentially entails the delegation of fundamental rights scrutiny to the private sector and the privatisation of mutual trust964 in the name of automaticity. Indeed, service providers are placed under the duty to assess compliance with fundamental rights under the Charter, even though such responsibility lies with the Member States and the EU institutions. Furthermore, companies are seemingly put on the same level as a court or a state, even though companies do not have legal obligations similar to those of states to respect and defend the fundamental rights of individuals.965 Such assessment may not always be easy, as the certificate embodying the order will not contain a necessity and proportionality assessment.966 The tight deadlines within which the service providers must operate may also not make it feasible for them to conduct a meaningful check. Therefore, an enormous onus is placed upon service providers to provide effective remedies for individuals and protect their fundamental rights. With the notification mechanism not providing sufficient safeguards amidst strong concerns regarding the re-balancing of the relationship between the private sector and law enforcement, it remains to be seen what the final text of the e-evidence proposals will be.

E. Privatisation, Everyday Information and Profiling It is thus clear that the private sector has been increasingly obliged to gather, store and transfer a wide range of personal data from customers. All the forms of private sector involvement analysed in this section have one distinguishing common feature: they all involve different form of processing, be it collection, storage and transfer to state authorities of vast categories of personal data linked with ordinary, everyday and mostly legitimate activity. The exchange of personal data in this context is thus qualitatively different from data already included in criminal law databases, with the emphasis here being on prevention and suspicion, and the potential for profiling of individuals being evident. In this context, it is not always clear to determine where responsibility lies – does it lie with the private sector or with the state? This question is inextricably linked to the question of the reach of the criminal law sphere: by collecting information for law enforcement purposes on their customers, do banks, telecommunications companies or airlines operate within the criminal law/justice system? The answer to this question will determine not only responsibility but also safeguards for both companies and customers.

963 However, this is possible in civil matters. See ibid. 964 Valsamis Mitsilegas, ‘The Privatisation of Mutual Trust in Europe’s Area of Criminal Justice: The Case of e-Evidence’ (2018) 25(3) Maastricht Journal of European and Comparative Law 263. See EDRI, ‘EU “e-Evidence” Proposals Turn Service Providers into Judicial Authorities’ (EDRI, 17 April 2018), https://edri.org/ eu-e-evidence-proposals-turn-service-providers-into-judicial-authorities. See also EuroISPA, ‘E-Evidence Proposal: EuroISPA Criticises the Privatisation of Law Enforcement’ (EuroISPA, 17 April 2018), www. euroispa.org/e-evidence-proposal-euroispa-criticises-privatisation-law-enforcement. For a more modest approach, see the Opinion of the European Economic and Social Committee in Council, Document 11533/18 (2 August 2018). 965 EDRI (n 964). 966 Franssen (n 922).

Privacy and Protection of Personal Data in the Post-Lisbon Era 601

V. Privacy and Protection of Personal Data in the Post-Lisbon Era A. Data Protection: Horizontal Instruments For years, the proliferation of mechanisms for the collection, storage, processing and exchange of personal data in the EU was not accompanied by a coherent framework for the protection of personal data due to the lack of a horizontal EU legal instrument in force governing personal data protection in the (former) third pillar. The 1995 Data Protection Directive, the horizontal instrument which governed first pillar activities,967 now replaced by the GDPR, explicitly excluded its application to activities falling within the third pillar, leading to fragmentary data protection arrangements. In particular, each legal instrument involving the processing of personal data either establishing EU Agencies (such as Europol), centralised databases (such as SIS II) or cooperation mechanisms (such as Prüm) contained its own sector-specific data protection safeguards. In terms of substantive data protection, these instruments contain in general specific provisions on data protection principles (such as the principle of purpose limitation) and rules on matters such as access rights, retention period and data security. In terms of supervision, different databases have had different supervisory arrangements ranging from system-specific joint supervisory bodies or authorities to the more recent swift to supervision by the EDPS.968 The lack of a horizontal data protection instrument that would govern the processing of personal data in the law enforcement context was first addressed by Framework Decision 2009/877/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters.969 The negotiations for its adoption proved lengthy and controversial, with a number of attempts to water down the text and a number of amendments being tabled.970 The Framework Decision regulated the exchange of personal data solely within the framework of police and judicial cooperation, thus leaving domestic data processing outside of its scope.971 Most of the provisions were meant to mirror the data protection safeguards set out in the Data Protection Directive, provisions on matters such as data protection principles,972 data quality,973 data retention,974 data processing,975 transmission to third states or bodies976 967 Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31, art 3(2). 968 Some of these bodies were serviced by a joint secretariat. See Council Decision of 17 October 2000 establishing a secretariat for the joint supervisory data protection bodies set up by the Europol, CIS and SIS Implementing Conventions [2000] OJ L271/1. 969 Framework Decision 2009/877/JHA of 2 November 2009 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters [2009] OJ L350/60. 970 For an account on the negotiations, see Marie McGinley and Rodrerick Parkes, ‘Data Protection in the EU’s Internal Security Cooperation: Fundamental Rights vs. Effective Cooperation?’ (SWP Research Paper 5, May 2007). 971 Framework Decision 2008/977/JHA, art 1(2). 972 ibid art 3. 973 ibid art 8. 974 ibid arts 5 and 9. 975 ibid arts 11–12. 976 ibid art 13.

602 Databases and to private parties,977 rights of access,978 rectification979 and compensation,980 judicial remedies981 and supervision.982 However, during the negotiations, their content was heavily compromised, resulting in a significantly lower level of protection of personal data than that provided in the Directive.983 However, the Framework Decision did not affect the data protection provisions in sector-specific third pillar instruments, ‘in particular those governing the functioning of Europol, Eurojust, the SIS and the CIS, as well as those introducing direct access for the authorities of Member States to certain data systems of other Member States’.984 Also, the Framework Decision did not affect the provisions in the Decision incorporating the Prüm framework into EU law.985 It thus transpired that the scope of the Framework Decision was very limited and that the aim of reaching a coherent data protection legal framework for the exchange of information in criminal matters was far from being achieved. The Lisbon Treaty created a momentum for new data protection legislation, primarily via the insertion, in the part on the TEU, of a specific provision on a right to data protection. Article 16(2) TEU prescribes that the European Parliament and the Council will: [L]ay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices or agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data.

It adds that compliance with these rules will be subject to the control of independent authorities. In terms of substantive data protection law, the abolition of the third pillar did not signify the applicability of the Data Protection Directive to criminal law, given that it explicitly excludes its application ‘in any case to processing operations concerning public security … and the activities of the State in the areas of criminal law’.986 In any case, a broad reform of both legal instruments was deemed necessary to accommodate the new internet reality and the need to address the implementation discrepancies at the national level.987 In this context, work on the so-called EU data protection reform 977 ibid art 14. 978 ibid art 17. 979 ibid art 18 980 ibid art 19. 981 ibid art 20. 982 ibid arts 23 and 25. 983 Joaquín Bayo Belgad, ‘The Area of Freedom, Security and Justice and the Role of National Courts in the EU Data Protection System’ in Elspeth Guild, Sergio Carrera and Alejandro Eggenschwiler (eds), The Area of Freedom, Security and Justice Ten Years on: Successes and Future Challenges under the Stockholm Programme (CEPS, 2010) 33–35; Paul de Hert and Vaggelis Papakonstantinou, ‘The Data Protection Framework Decision of 27 November 2008 Regarding Police and Judicial Cooperation in Criminal Matters: A Modest Achievement However Not the Improvement Everyone Had Hoped for’ (2009) 25(5) Computer Law & Security Review 403, 411. 984 Framework Decision 2008/977/JHA, Recital 39. 985 ibid. 986 Data Protection Directive, art 3(2). 987 Peter Hustinx, ‘EU Data Protection Law: The Review of Directive 95/46/EC and the Proposed General Data Protection Regulation’, Collected Courses of the European University Institute’s Academy of European Law, 24th Session on European Union Law, 2013, 26–27, available at www.statewatch.org/news/2014/sep/ eu–2014-09-edps-data-protection-article.pdf. See also Didier Bigo et al, ‘Towards a New EU Legal Framework for Data Protection and Privacy: Challenges, Principles and the Role of the European Parliament’ (Study for the European Parliament, 2011).

Privacy and Protection of Personal Data in the Post-Lisbon Era 603 ackage that would comprise a regulation (for the processing of personal data in the p internal market context) and a directive (for the processing of personal data in the police and judicial cooperation context), began as early as 2009 and the Commission released a position paper in 2010.988 The Commission proposal on a Directive regulating protection of personal data for the purposes of police and judicial cooperation was published in early 2012989 and Directive (EU) 2016/680 – the Law Enforcement Directive – was adopted in May 2016, with the deadline of implementation being set for May 2018. Its main innovation is its application also to domestic processing of personal data, thus addressing its gravest shortcoming.990 Therefore, the Directive concerns the processing of personal data irrespective of whether it takes place within or across national borders. However, the Law Enforcement Directive does not apply to the processing of personal data ‘in the course of an activity which falls outside the scope of Union law’,991 so the operation of intelligence services entrusted with safeguarding national security are not covered. However, where a clear delineation among the different tasks of intelligence agencies is missing, it is unclear as to whether the exception applies and it could be argued that when national intelligence agencies process personal data for the purposes of the Law Enforcement Directive, they should be regarded as falling within its remit. The ‘free movement’ of data is added as one of its stated purposes, signalling that data transfers are in principle to be permitted and streamlined through regulatory provisions.992 Furthermore, efforts have been made to ensure clarity in the text; therefore, the Directive contains a series of definitions on key concepts and terms such as profiling,993 competent authority,994 genetic data995 and biometric data.996 Given that personal data processing in the law enforcement context has special characteristics and needs, the Directive contains all major data protection principles, such as purpose limitation, data quality and data minimisation,997 but an attempt has been made to strike a balance between individual protection and the interests of police investigations through flexible rules and exceptions.998 Whereas the rules on safeguarding the purpose limitation principle have not undergone a reform as such,999 a novelty of the 988 Commission, ‘Communication from the Commission to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions – A comprehensive approach on personal data protection in the European Union’ COM (2010) 609 final. 989 Commission, ‘Proposal for a Directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data’ COM (2012) 10 final. 990 Law Enforcement Directive, art 2(1). 991 ibid art 2(3)(a). 992 Paul de Hert and Vagelis Papakonstantinou, ‘The New Police and Criminal Justice Data Protection Directive’ (2016) 7(1) New Journal of European Criminal Law 7, 11. 993 Law Enforcement Directive, art 3(4). 994 ibid art 3(7). 995 ibid art 3(12). 996 ibid art 3(13). 997 ibid art 4. 998 For example, under the Law Enforcement Directive, data should be adequate, relevant and not excessive, rather than adequate, relevant and limited to what is necessary, as stipulated in art 5(1)(c) GDPR. For a critique, see Thomas Marquenie, ‘The Police and Criminal Justice Authorities Directive: Data Protection Standards and Impact on the Legal Framework’ (2017) 33(3) Computer Law & Security Review 324. 999 Law Enforcement Directive, art 4(2).

604 Databases Law Enforcement Directive is that Member States are required to distinguish between personal data based on facts and personal data based on personal assessments,1000 and personal data of different categories of individuals (persons against whom there are serious grounds for believing that they have committed or are about to commit a criminal offence, convicted persons, victims and other parties, such as witnesses).1001 Emphasis has also been placed on the data quality principle by requiring competent national authorities to ensure that personal data which are inaccurate, incomplete or out of date are not transmitted or made available through verification of their quality prior to transfer.1002 Nevertheless, these obligations must be upheld as far as possible only. Furthermore, the exercise of individual rights (the right to information, access, deletion and rectification of personal data), though acknowledged, is subject to exceptions so as not to undermine the criminal justice process.1003 With regard to the right to request deletion of personal data in particular, Article 16(3) provides that restriction of processing may be chosen instead of erasure of the relevant data. Moreover, the Law Enforcement Directive prescribes specialised rules, particularly in relation to profiling, proscribing decision-making based solely on automated means.1004 Decisions must not be based on special categories of personal data, such as biometric data, unless suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.1005 In turn, profiling that results in discrimination against natural persons on the basis of special categories of personal data is prohibited. In addition, the Law Enforcement Directive designates national data protection authorities as independent supervisory authorities and provides detailed rules on their tasks and powers.1006 As for the transfer of personal data to third parties, the rule is that data may be transmitted outside the EU only after finding that the level of personal data protection is adequate in that third country or organisation. However, as with other principles, the Law Enforcement Directive provides leeway by allowing ‘transfers by way of appropriate safeguards’1007 or ‘derogations for specific situations’.1008 In any case, sector-specific instruments are not replaced; each one constitutes lex specialis to the Law Enforcement Directive, so their rules take precedence insofar as they regulate issues encompassed in the general instruments.1009 For issues left unregulated, they may be complemented by the general legislative instruments (lex generalis); however, it may be the case that it has been conscious choice of the EU legislature to remove certain issues that are outside the scope of the lex specialis.1010 1000 ibid art 7(1). 1001 ibid art 6. 1002 ibid art 7(2). 1003 ibid arts 10–17. For an analysis, see Catherine Jasserand, ‘Law Enforcement Access to Personal Data Originally Collected by Private Parties: Missing Data Subjects’ Safeguards in Directive 2016/680?’ (2018) 34(1) Computer Law & Security Review 154. 1004 Law Enforcement Directive, art 11. In turn, where processing involves (profiling-based) decision-making that is not solely based on automated means, any ‘preliminary profiling’ would not be covered by art 11. See WP29, ‘Guidelines on Automated Individual Decision-Making and Profiling’, 23. 1005 Law Enforcement Directive, art 11(2) and Recital 37. 1006 ibid arts 41–49. 1007 ibid art 37. 1008 ibid art 38. 1009 ibid art 2(3). 1010 For example, the non-existence of a right to information in the case of the criminal law branch of the SIS.

Privacy and Protection of Personal Data in the Post-Lisbon Era 605

B. Supervision In terms of supervision, the position of the EDPS has been significantly strengthened. Regulation (EC) 45/2001 concerning the processing of personal data by EU agencies and bodies that established the EDPS office defined its mandate as ‘ensuring that the fundamental rights and freedoms, of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’.1011 With the entry into force of the Lisbon Treaty, it was not clear whether bodies such as Europol and Eurojust would fall under the supervision of the EDPS, since the legal basis of the Regulation 45/2001 was Article 286 TEC (now replaced by Article 16 TFEU), according to which Community data protection law applies to institutions and bodies set up by the EC Treaty.1012 A key issue that arose in this context was whether the abolition of the pillars and the succession of the EC by the EU could be read as enabling to interpret Regulation 45/2001 as being applicable by analogy to EU bodies post-Lisbon, leading them to be placed under EDPS supervision. However, two main arguments seemed to indicate that this was not the case and that the drafting of the Treaty implied that specific legislation is required post-Lisbon to regulate data protection and supervision in particular. The first argument stemmed from Article 16 TFEU itself, which does not contain a specific reference to the EDPS (it refers in general to ‘the control of independent authorities’) and calls for the adoption of future data protection legislation after the entry into force of the Lisbon Treaty. The second argument arose from the specificity of the subject matter of EU action in criminal matters and the heightened need for privacy and protection of personal data in the criminal law field. This specificity is confirmed by a Declaration annexed to the Lisbon Treaty acknowledging that specific rules on the protection of personal data and the free movement of such data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU may prove to be necessary because of the specific nature of these fields.1013 The adoption of the Europol Regulation confirms this approach.1014 This Regulation explicitly attributes supervision to the EDPS in relation to the monitoring and ensuring the applications of the provision concerning fundamental rights with regard to the processing of personal data by Europol and an advisory role to Europol and data subjects on all matters concerning the processing of personal data.1015 As mentioned above, the Regulation contains specific rules on the duties,1016 including cooperation with national supervisory authorities,1017 and enables individuals to lodge complaints with the EDPS due to the processing of personal data by Europol.1018 This development is important 1011 Regulation (EC) No 45/2001, art 41(2). 1012 Article 286(1) EC, which called for the establishment of an independent supervisory body responsible for monitoring the application of Community data protection law to Community institutions and bodies. 1013 Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation. 1014 It must be pointed out that the forthcoming EPPO has also been under the supervision of the EDPS. See Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office [2017] OJ L283/1, arts 85–89. 1015 Europol Regulation, art 43. 1016 ibid. 1017 ibid art 44. 1018 ibid art 47.

606 Databases to increase the transparency and accountability of the agency, particularly in the light of its increased powers and the growing emphasis of collecting and processing huge amounts of data in the fight against terrorism and other serious crime. In the revision of Regulation 45/2001, the role of the EDPS has solidified; Article 52(3) of Regulation (EU) 2018/1725 foresees that the EDPS is among other things responsible for advising EU institutions and bodies and data subjects on all matters concerning the processing of personal data.1019

C. The Constitutionalisation of Data Protection With the incorporation of the Charter into EU law in the post-Lisbon era, it is worth shedding light on a specific feature of the Charter: the inclusion of two distinct rights, one on the respect for private and family life, enshrined under Article 7,1020 and one on personal data protection encompassed in Article 8.1021 The distinction between privacy and data protection is noteworthy1022 and the recognition of data protection as a fundamental right alongside privacy has acted as a major stimulus for delineating the respective roles of the two concepts, with numerous scholars heralding the separation of the two rights, whereas others approach the constitutionalisation of data protection in a more cautious manner.1023 Protection of personal data differs from the right to private life in it does not aim to create zones of non-interference by the state, but rather operates on a presumption that public authorities may process personal data.1024 The processing of personal data in general is ‘almost a natural presumption’1025 and an activity accepted by default and endorsed by the EU legislator, as long as a series of principles are respected.1026 It follows that ‘the sheer wordings of the data protection principles … already suggest heavy reliance on notions of procedural justice rather than normative (or substantive) justice’, with data protection law creating ‘a legal framework based upon the assumption that the processing of personal data is in principle allowed and legal’.1027 The very rationale of data protection is procedural rather than substantial 1019 Regulation 2018/1725, art 52(3). 1020 Article 7 in conjunction with art 52 of the Charter replicate the wording of art 8 ECHR. 1021 Article 8 encompasses requirements on purpose limitation, fair processing and rights of access and rectification. It also states that compliance with data protection rules must be subject to control by an independent authority. 1022 For an analysis of the distinction between privacy and data protection, see Paul de Hert and Serge Gutwirth, ‘Privacy, Data Protection and Law Enforcement: Opacity of the Individual and Transparency of Power’ in Erik Claes, Anthony Duff and Serge Gutwirth (eds), Privacy and the Criminal Law (Intersentia, 2006) 61–104. 1023 For an analysis, see, among others, Orla Lynskey, The Foundations of EU Data Protection Law (Oxford University Press, 2015); Herke Kranenborg, ‘Article 8: Protection of Personal Data’ in Steve Peers et al (eds), The EU Charter of Fundamental Rights: A Commentary (Hart Publishing, 2014) 223–66; Antoinette Rouvroy and Yves Poullet, ‘The Right to Informational Self-Determination and the Value of Self-Development; Reassessing the Importance of Privacy for Democracy’ in Serge Gutwirth et al (eds), Reinventing Data P rotection (Springer, 2009) 45–76; Stefano Rodotá, ‘Data Protection as a Fundamental Right’ in Serge Gutwirth et al (eds), Reinventing Data Protection? (Springer, 2009) 77–82. 1024 De Hert and Gutwirth (n 1022) 77. 1025 ibid. 1026 Maria Eduarda Gonçalves and Inês Andrade Jesus, ‘Security Policies and the Weakening of Personal Data Protection in the European Union’ (2013) 29 Computer Law & Security Review 255, 260. 1027 De Hert and Gutwirth (n 1022) 78.

Privacy and Protection of Personal Data in the Post-Lisbon Era 607 and its role is limited to following and regulating in detail different instances of personal data processing through the development of key legal principles or rules on remedies for the individual. Consequently, it will come into play only at a later stage, in order to minimise the impact of the processing.1028 As such, it cannot challenge whether the collection of personal data, which is the first stage in information processing, will in principle take place, but it will merely assist in identifying the modalities of such collection or of further stages of processing. Whilst it is true that the structural formulation renders data protection more ‘tangible’ than privacy, which is difficult to capture in precise terms, data protection cannot guarantee a certain level of opacity as privacy does; in fact, it may actually hinder the substantial engagement with privacy claims by depoliticising and devaluing them into data protection safeguards.1029 This is particularly relevant to state surveillance activities. Reliance on the right to data protection on its own does not suffice to determine the limits of the use of surveillance practices, and questions regarding the political choice to establish measures involving the collection and further processing of personal data may turn into a mere procedural checklist.1030 These dangers may lead to significantly lowering the level of protection afforded to individuals, which thus runs counter to the telos of the Charter, which, according to its Preamble, is to strengthen the protection of fundamental rights in ‘light of changes in society, social progress and scientific and technological developments’. In addition, whereas data protection is focused on the various categories of personal data, privacy is centred on the individual ‘in terms of identity and the self ’; therefore, it is ideally placed to assess the impact of measures to individuals and their established relationship with the state.1031 The inherent flexibility of privacy as a notion and a right allows it to evolve over time and adapt to technological developments, where the specificity of data protection may result in fragmented solutions and ultimately ‘miss the big picture’.1032 Key in this context is the existence of the fragmentary EU data protection framework, whereby different activities are subject to different rules. In an era of the erosion of purpose limitation and state boundaries (with the safeguards they entail) and vast categories of everyday data processed via the privatisation of information exchange, it is essential that the law addresses the new challenges arising from the extension of everyday surveillance and its profiling potential.1033 While data protection is undoubtedly a useful layer of protection, privacy – linked to freedom, autonomy and dignity and having the self as a reference point – may provide a more flexible framework to address the rapid changes in the collection, further processing and exchange of personal data, and thus provide more holistic protection. In view of the intricate relationship between the two rights, as briefly outlined above, the guidance by the CJEU has been useful. Admittedly, the Court has been striving 1028 Martin Scheinin and Mathias Vermeulen, ‘Unilateral Exceptions to Fundamental Rights in the Use of Detection Technologies in the Fight against Terrorism: Permissible Limitations of the Right to Privacy’ (EUI Working Paper 08/2010) 7. 1029 Mitsilegas (n 640) 106; Rocco Bellanova, ‘Data Protection, with Love’ (2014) 8 International Political Sociology 112, 114. 1030 Bellanova (n 1029) 114. 1031 Mitsilegas (n 640) 107. 1032 ibid 106. 1033 ibid 104.

608 Databases to comprehend the content of the right to the protection of personal data and apply its reasoning in a consistent manner, without frustrating the longstanding application of the ECHR standards in that respect.1034 In order to bypass these difficulties, the Court has largely resorted to a combined reading of the rights, particularly when assessing the proportionality of the interference with the two rights. It has even found that the p rotection of personal data resulting from the explicit obligation laid down in Article 8(1) of the Charter is especially important for the right to respect for private life.1035 Thus, the Court seems to favour an approach whereby the right to the protection of personal data is to be considered as reinforcing the privacy protection, rather than to substitute it.1036 This approach has enabled it to provide a high level of privacy protection to individuals, develop an elaborate checklist of markers that need to be assessed and provide important limits to the powers of states to conduct surveillance activities.

VI. Conclusion: What is the Future for Privacy and Data Protection in an Era of Security? The collection, storage, processing and exchange of personal data is a central feature of the development of EU criminal law. Recent years have witnessed the proliferation of databases and information exchange instruments at EU and national levels, and the intensification of the collection of personal data by both widening the categories of data collected and deepening the reach of authorities to personal data, including sensitive ones, such as biometric identifiers and DNA information. Information is collected and processed at three levels: at the level of the development of centralised European information systems, which interact with national authorities and operate for a wide range of often divergent purposes; at the level of cooperation and information exchange between national public authorities, particularly the police; and at the level of the involvement of the private sector with the co-option of the latter by the state in various ways. The proliferation of mechanisms has been accompanied by increasing calls to render information systems interoperable, as well as to extend access rights to a broad array of national law enforcement authorities and EU bodies and agencies, such as Europol. These steps betray the aim of a maximum collection and exchange of personal data across the EU under the banner of a general ‘security’ justification. It is no coincidence that the majority of the new instances of information collection and exchange at the EU level have been justified as responses to terrorism, first in the aftermath of 9/11, as well as the Madrid and London terrorist events, and more recently following the terrorist events in Paris, Brussels and Berlin. However, their reach extends much further. From The

1034 For an analysis, see Gloria González Fuster, ‘Fighting for Your Right to What Exactly? The Convoluted Case Law of the EU Court of Justice on Privacy and/or Personal Data Protection’ (2015) 2(2) Birkbeck Law Review 263. 1035 See Digital Rights Ireland (n 245) para 53. 1036 See also González Fuster (n 1034) 275.

The Future of Privacy in an Era of Security 609 Hague Programme – which focused largely on information exchange – onwards,1037 it is clear that the collection and further processing of personal data has become a panacea. The development of a ‘Security Union’1038 in the post-2015 era and the drafting of a roadmap to enhance information exchange1039 are also indicative of the established trend of harvesting the increasing possibilities of information technology. However, these efforts have been accompanied by growing concerns over the existence of trust among Member States as to how they collect personal data at the national level and how they handle personal data after this is provided to them by other Member States. The quality of personal data has also been a longstanding issue overshadowing the effectiveness of information exchange schemes, with eu-LISA being particularly preoccupied with this task, albeit in relation to centralised information systems for third-country nationals only.1040 Prior to the entry into force of the Lisbon Treaty, the considerable extension of the reach of the state occurred following limited debate and scrutiny, with the example of the Prüm framework being key in this context. Not only was Prüm presented to the EU as a fait accompli – with standards agreed behind closed doors outside the EU effectively being imposed on the EU legal order – but also the Prüm EU legislation leaves a number of key implementing measures (such as measures concerning DNA databases) to comitology. Prüm raises a further challenge relating to the method of integration envisaged for the exchange of personal data between national authorities. Largely reminiscent of mutual recognition, this method aims at achieving maximum cooperation via automaticity and speed, and with very few questions asked. A requested police authority in a Member State is under a duty to provide information available to it to a requesting authority in another Member State with very few questions asked – in the case of Prüm, obligations as far-reaching as providing DNA data have led to a number of Member States establishing DNA databases in the first place. This form of cooperation aims to circumvent legal provisions which are perceived as hurdles in the achievement of operational efficiency. However, these ‘legal hurdles’ reflect constitutional and human rights traditions in Member States and are linked to the internal coherence of domestic criminal justice systems, including the place and role of the police in these systems. Availability in extremis may lead to the law being circumvented in both the requesting and the requested state, with the relationship between the various legal orders and their interaction far from being clarified in the various instruments. Moreover, it may have significant legitimacy consequences: EU institutions agree not on EU standards of police cooperation, but in essence to recognise the validity of the various national systems

1037 In this context, see the Report by the Future Group (consisting mainly of Ministers of the Interior of a number of Member States), published in June 2008 and aiming to contribute to the formulation of the next five-year plan on EU Justice and Home Affairs, to succeed The Hague Programme. The centrality of information exchange in the Report is evident, with two of the four cross-cutting points identified by the Future Group being relevant: balancing mobility, security and privacy; and ensuring the best possible flow of data within Europe-wide information networks. See Council, Document 11653/08 (29 July 2008) 18. 1038 Commission (n 281). 1039 Council, Document 9368/1/16 REV 1 (6 June 2016). For its implementation, see Council, Document 7931/2018 (12 June 2018), https://www.statewatch.org/media/documents/news/2018/jun/eu-council-roadmap-interoperability-7931-18.pdf. 1040 See eu-LISA Regulation, art 1(7)(a).

610 Databases and to accept information produced by them and its movement across the EU without many conditions. As with mutual recognition, this choice effectively shields the development of EU action on police cooperation from meaningful democratic scrutiny and debate. The e-evidence proposals even go beyond the traditional operation of mutual recognition by essentially bypassing the national authorities in the Member State where the service provider is hosted and placing disproportionate burdens upon the private sector to safeguard the fundamental rights of those affected by the orders issued. This lack of scrutiny and transparency is particularly problematic in light of the significant consequences that the development of mechanisms of collection, analysis and exchange of personal data may have for fundamental rights, in particular privacy. As mentioned above, a wide range of data is being collected and retained, in various information systems that – notwithstanding their different purposes – become increasingly accessible to a wide range of law enforcement authorities, often not excluding national intelligence services. Access to information systems for third-country nationals in particular, as well as the collection and transfer of information by the private sector – be it phone records, bank transactions, passenger data or electronic communications – has increasingly led to the collection and use by the state of everyday personal data relating to largely legitimate transactions and innocent behaviour. Use of such information by the state is linked to a growing focus on prevention and suspicion, and is highly likely to be translated into the profiling of individuals. Mobility in particular has emerged as an inherently dangerous activity heralding state intervention and monitoring. This is particularly the case with the growing collection of pieces of everyday personal data (such as PNRs, phone records and bank records) over time, and pieces of biometrics in different information which may be cross-checked for the purposes of identification at various points over time. The combination of these pieces of information may be used to create fairly accurate profiles by the state and challenges traditional concepts of privacy and the self. Until the adoption of the Law Enforcement Directive, the secondary law on the protection of personal data was somewhat fragmentary, due the co-existence of different ad hoc data protection rules in EU legal instruments and the significant limitations of Framework Decision 2009/877/JHA. Following the adoption of that Directive, whilst the sector-specific rules remain intact, the level of privacy protection for individuals has been increased; however, this depends on the implementation of the provisions at the national level, particularly since most of them are flexible enough to accommodate the special requirements of criminal investigations. The revision of the data protection framework has been the product of the reinforced protection of individuals through the incorporation of the Charter into EU law and the elevation of data protection to the status of a fundamental alongside private life. The incorporation of the Charter into EU law has proved to be extremely significant in terms of allowing the CJEU to develop high privacy standards that must be taken into account in both the implementation of existing legislation and the formulation of subsequent laws. In a series of judgments, the Court has maximised the protection of individuals by endorsing a combined reading of both Charter articles in an attempt to strike a balance between the fight against terrorism and other serious crimes, and the need to safeguard individuals’ privacy. By placing the individual at the heart of protection, it has thus developed an elaborate checklist of constitutive elements of privacy protection to be followed when

The Future of Privacy in an Era of Security 611 scrutinising the a doption of a legislative instrument. As such, a new era for privacy seems to have emerged, with the CJEU acting as the ‘unlikely hero of data privacy in Europe’.1041 These pronouncements are all the more important in an era where the challenges for privacy and protection of personal data will proliferate. In an ever-growing and complex legal landscape, calls to increase the automation of information exchange are growing, with emphasis on streamlining and combining information stored in line with existing legal instruments.1042 Indeed, with national authorities gradually becoming mini-information hubs, concerns have been raised as to their capacities to process and analyse the vast amounts of information available to them. The proposed solutions strongly point to the direction of embedding interoperability of databases, both established at the EU and the national level, under the logic of automaticity and seamless availability. The possibilities offered by AI will also be harvested in the near future1043 by developing smart digital assistants to make future information overload manageable. These efforts will undoubtedly put the rights to privacy and data protection under significant pressure and expose individuals to extensive profiling, with potentially detrimental repercussions for them. In an era of high-speed technological developments in the ‘Security Union’, it remains to be seen how the processing of personal data will evolve and how the balance between fundamental rights and security will be re-struck.

1041 Julia Powles, ‘Data Privacy: The Tide is Turning in Europe – But is it Too Little, Too Late?’ (The Guardian, 6 April 2015), https://www.theguardian.com/technology/2015/apr/06/data-privacy-europe-facebook. 1042 Council, Document 8526/19 (16 April 2019), www.statewatch.org/news/2019/jul/eu-council-automation-Information-Exchange-8526-19.pdf. 1043 See Informal Meeting of Justice and Home Affairs Ministers, ‘Artificial Intelligence and Law Enforcement’, 18–19 July 2019, www.statewatch.org/news/2019/jul/eu-JHA-ministerial-AI-and-Law%20Enforcement.pdf. See also Gloria González-Fuster, ‘Artificial Intelligence and Law Enforcement: Impact on Fundamental Rights’ (Study for the LIBE Committee of the European Parliament, 2020).

10 The EU and the Global Governance of Crime I. Introduction The end of the Cold War coincided with a profound re-alignment of the global security agenda, with a number of new issues emerging as perceived global security threats alongside traditional military threats and meriting state responses at the global level. One of these major post-Cold War security issues has been the fight against transnational and organised crime. The securitisation of transnational and organised crime has led to the emergence of a far-reaching regime of global governance of crime constituted from a series of state initiatives at the global level. In this context, a multi-level model of global governance has emerged. States have responded via the conclusion of traditional international multilateral treaties, and also via the conclusion of a series of major regional treaties in the field by organisations such as the Council of Europe. These traditional forms of law-making have been complemented by the emergence of powerful ‘soft’ law initiatives, put forward in particular by organisations such as the Financial Action Task Force (FATF). The emergence of global standards and norms in the governance of crime has been accompanied by international mechanisms aimed at targeting not states, but individuals, via the imposition of sanctions. The work of the UN Security Council in the field is a key example. The aim of this chapter is to analyse the role of the EU in the emergence of this multi-level paradigm of global crime governance. The chapter will highlight both the contribution of the EU to the development of global standards and the challenges that the EU legal order has been facing with regard to the implementation of these standards.1 The analysis will take into account both the constitutional complexities inherent in the EU legal order, in particular as regards the constitutional and institutional evolution of internal EU action in the field of criminal law, and the substantive considerations underlying the emergence of the EU as a global actor in criminal matters. The chapter will focus on the role of the EU in four levels of global governance: governance via global multilateral treaties (looking at the relationship between the EU and the UN); governance via regional multilateral treaties (looking at the relationship between the EU and the Council of Europe); governance 1 See also V Mitsilegas, ‘The European Union and the Global Governance of Crime’ in V Mitsilegas, P Alldridge and L Cheliotis (eds), Globalisation, Criminal Law and Criminal Justice: Theoretical, Comparative and Transnational Perspectives (Hart Publishing, 2015) 153–98, upon which this chapter expands.

Governing Crime via Global Multilateral Treaties: The EU and the UN 613 via the emergence of ‘soft’ law (looking at the relationship between the EU and the FATF); and governance via the emergence of ‘global administrative law’ (looking at the relationship between the EU and the UN Security Council). It will explore synergies between these levels of norm production and will highlight the challenges of democratic control, fundamental rights and accountability arising from the role of the EU in global processes of criminalisation.

II. Governing Crime via Global Multilateral Treaties: The EU and the UN Legislative action at the UN level has provided the backbone for the emergence of a regime of global governance of crime. The EU has been an active participant in the negotiation of three major UN conventions in the field of criminal law: the 1988 Convention against Drug Trafficking; the 2000 Convention against Transnational Organised Crime (also known as the ‘Palermo Convention’); and the 2003 Convention against Corruption. These Conventions were negotiated and concluded during various stages of European integration, and in this light, the institutional aspect of EU participation varies accordingly: the 1988 Convention was concluded in the pre-Maastricht era, in the days of the single Community pillar, whereas the Conventions on organised crime and corruption were concluded in the days of the three-pillar EU structure. The state of play of relevant internal EC/EU law at the time of their adoption also varies: while the 1988 Convention was concluded at a time when no relevant legislation in the field of money laundering was in place at the Community level, the other two Conventions post-dated the adoption of internal EC/EU law in their respective fields. These differences are significant not only for the position of the EC/EU in the negotiation of the UN Conventions, but also in order to assess the subsequent impact of the UN standards on the EC/EU legal order.

A. Money Laundering: The 1988 United Nations Vienna Convention and EU Law A major step towards the globalisation of criminal law was undertaken by the UN in the 1980s in the form of the conclusion of the 1988 Vienna Convention against Illicit Trafficking in Narcotic Drugs and Psychotropic Substances. To a great extent prompted by the so-called US ‘war on drugs’, the Convention introduced a number of detailed provisions on drug trafficking, as well as – for the first time – the criminalisation of money laundering at the global level.2 Negotiations on the Convention coincided with

2 For an analysis of the Vienna Convention, see WC Gilmore, Dirty Money. The Evolution of International Measures to Counter Money Laundering and the Financing of Terrorism, 3rd edn (Council of Europe Press, 2004); see also, DP Stewart, ‘Internationalizing the War on Drugs: the UN Convention Against Illicit Traffic in Narcotic Drugs and Psychotropic Substances’ (1990) 18 Denver Journal of International Law and Policy 387.

614 The EU and the Global Governance of Crime a growing resolve by Community institutions to fight drug abuse and trafficking.3 Although no express Community competence in criminal matters existed under the Treaties at the time, the Community did conclude the Vienna Convention on the basis of its common commercial policy competence.4 According to the Declaration of Competence annexed to the Decision (which was adopted under Article 113 of the EEC Treaty), the European Economic Community was at the time competent for questions of commercial policy relating to the substances frequently used in the illicit manufacture of narcotic drugs and psychotropic substances, questions which are dealt with in Article 12 of the Vienna Convention. Leaving aside the question of its conclusion by the Community, the impact of the substantive standards of the Vienna Convention for the development of internal Community law has been significant. Evading questions of Community competence in criminal matters (still in the pre-Maastricht era), in 1991 the Council adopted the first Money Laundering Directive.5 The Directive was adopted on a dual internal market/ free movement legal basis,6 and was justified, inter alia, on the grounds of protecting the stability of financial institutions and confidence in the financial system as a whole.7 It introduced a number of provisions addressing the preventive aspect of money laundering countermeasures.8 It also introduced a definition of money laundering and obliged Member States to ‘prohibit’ conduct defined as such.9 The definition of money laundering (a concept introduced for the first time into the Community legal order) was copied almost verbatim from the Vienna Convention.10 A similar choice was made as regards the definition of property constituting the proceeds of crime and as regards the mens rea requirement for money laundering.11 These definitions, which are very broad and have raised concerns with regard to overcriminalisation in the field,12 have remained virtually unchanged in the subsequent revisions of the 1991 Directive, all the way up to the adoption of the third Money Laundering Directive in 2005.13 3 See, in this context, V Mitsilegas, Money Laundering Counter-measures in the European Union: A New Paradigm of Security Governance versus Fundamental Legal Principles (The Hague, Kluwer Law International, 2003) 52–54. 4 Council Decision of 22 October 1990 concerning the conclusion, on behalf of the European Economic Community, of the UN Convention against Illicit Trafficking in Narcotic Drugs and Psychotropic Substances [1990] OJ L326/56. 5 Council Directive 91/308/EEC of 10 June 1991 on prevention of the use of the financial system for the purpose of money laundering [1991] OJ L166/77. 6 Articles 57(2), first and third sentences, and 100a of the EEC Treaty. 7 For a discussion, see Mitsilegas (n 4) ch 3. 8 See section IV below. 9 The reference to ‘prohibition’ was introduced in order to circumvent the questionable Community competence to define criminal offences and impose criminal sanctions. However, Member States annexed to the text of the Directive a statement undertaking de facto to criminalise money laundering by the end of 1992. 10 Article 1 of Directive 91/308/EEC. See also, Preamble, Recital 9. 11 ibid art 1. 12 For an analysis, see Mitsilegas (n 4) chs 3 and 4. 13 Directive 2005/60/EC of the European Parliament and of the Council on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing [2005] OJ L309/15. The third Money Laundering Directive also calls on Member States to prohibit terrorist financing. The definition of the latter largely follows the wording of the 1999 UN Convention on the Suppression of the Financing of Terrorism (art 1(4) of the 2005 Directive). See V Mitsilegas and B Gilmore, ‘The EU Legislative Framework against Money Laundering and Terrorist Finance: A Critical Analysis in the Light of Evolving Global Standards’ (2007) 56 International and Comparative Law Quarterly 119.

Governing Crime via Global Multilateral Treaties: The EU and the UN 615 The main area where Community law diverged from the Vienna Convention as regards the criminalisation of money laundering involves the criminal offences considered predicate money laundering offences. While predicate money laundering offences in the Vienna Convention were limited (perhaps unsurprisingly, given the focus of that Convention) to drug trafficking, by 1991, the Community legislator had adopted a more expansive approach, allowing Member States to include in the list ‘any other criminal activity’.14 The list of predicate offences was subsequently extended – partly via references to another international law instrument, the 1990 Council of Europe Convention on money laundering – in the money laundering directives.15 Indicative of the synergy present in the development of Community and international instruments in the field, and reflecting a move from focusing on the proceeds of drug trafficking to targeting the proceeds of organised and serious crime more generally, the list of predicate offences (which was also mandated by the FATF on money laundering in the 1990s) was also extended at the UN level in the criminalisation of money laundering by the 2000 Convention against Transnational Organized Crime.16 The extension of the scope of the criminal law on money laundering via the extension of the list of predicate offences is thus a prime example of synergy and cross-fertilisation between international law, ‘soft’ law and EC/EU law.17

B. Transnational Organised Crime: The 2000 Palermo Convention and EU Law Perhaps the most impressive contribution of a UN multilateral treaty towards the globalisation of criminal law has been that of the Convention against Transnational Organized Crime and its Protocols, symbolically signed in Palermo in 2000. Negotiated throughout the 1990s and reflecting the growing securitisation of organised crime at the

14 Article 1, indent 5 of the 1991 Directive. See also, Preamble, Recital 5, which states that: ‘Whereas for the purposes of this Directive the definition of money laundering is taken from that adopted in the Vienna Convention; whereas, however, since money laundering occurs not only in relation to the proceeds of drugrelated offences but also in relation to the proceeds of other criminal activities (such as organised crime and terrorism), the Member States should, within the meaning of their legislation, extend the effects of the Directive to include the proceeds of such activities, to the extent that they are likely to result in laundering operations justifying sanctions on that basis.’ 15 The Second Money Laundering Directive called upon Member States to bring the definition of ‘serious crime’ in line with the definition in the then Joint Action on Confiscation ([1998] OJ L333/1). Article 1 of the Joint Action (which was formally repealed by, but in substance largely retained in, the 2001 Framework Decision on confiscation [2001] OJ L182/1) in turn called upon Member States not to make or uphold reservations with regard to arts 2 and 6 of the 1990 Council of Europe Money Laundering Convention, as regards offences punishable under certain thresholds. The Third Money Laundering Directive consolidated the position by including under ‘serious crimes’ all offences punishable by a minimum custodial sentence of one year or, as regards Member States which have a minimum threshold for offences in their legal system, all offences punishable by a minimum custodial sentence of at least six months (art 3(5)(f)). 16 See art 6(2) of the Convention. art 6(2)(a) calls on States Parties to apply the criminalisation of money laundering ‘to the widest range of predicate offences’. 17 On recent developments with regard to the alignment of EU law predicate offences with FATF Recommendations, see section IV below.

616 The EU and the Global Governance of Crime time, the Convention is an ambitious and comprehensive multilateral instrument aiming at combating and preventing organised crime. It contains provisions ranging from the criminalisation of participation in an organised crime group, money laundering and corruption, to provisions on judicial cooperation with regard to organised crime, police cooperation and the law of criminal procedure. The Convention is complemented by three Protocols on human trafficking, human smuggling and the illicit manufacturing of and trafficking in firearms.18 Participation of the EU in the negotiations to the Convention was marked by legal complexity. The Convention was negotiated post-Maastricht (with negotiations continuing and the final conclusion taking place after the entry into force of the Amsterdam Treaty), at a time when the EU was granted competence in criminal matters under the third pillar. However, the wide range of provisions included in the Convention and its Protocols meant that there were also matters deemed to fall within Community competence. The result was that those parts of the Convention where Community competence could be established were negotiated by the Commission, whereas matters falling under the third pillar were negotiated primarily by the Member States. It has been pointed out that the European Commission had joined the negotiations with observer status but during the negotiation process requested the Council to adopt recommendations allowing it to negotiate on behalf of the Community.19 Ironically, transparency in terms of the negotiating mandate was greater in terms of the ‘third pillar’ aspects of the Convention than with those aspects relating to Community law. Whereas a Joint Position (adopted before the entry into force of the Amsterdam Treaty) outlined the EU negotiating position,20 subsequent negotiating mandates to the Commission can be found in an ad hoc manner in various Council Conclusions.21 An exception to this trend was the publication of a Common Position on the negotiation of the Firearms Protocol; however, this Common Position was adopted on a third pillar legal basis,22 with the Commission participating in negotiations (on the basis of

18 See D McClean, Transnational Organized Crime: A Commentary on the UN Convention and its Protocols (Oxford University Press, 2007). For an overview of the background to and the negotiating history of the Convention, see also D Vlassis, ‘Drafting the United Nations Convention against Transnational Organized Crime’ in P Williams and D Vlassis (eds), Combating Transnational Crime: Concepts, Activities and Responses (Frank Cass, 2001) 356. 19 C Rijken and V Kronenberger, ‘The United Nations Convention against Transnational Organised Crime and the European Union’ in V Kronenberger (ed), The European Union and the International Legal Order: Discord or Harmony? (TMC Asser Press, 2001) 493–94. The authors argue that during the negotiation process, the Member States never gave full competence to the presidency to negotiate the UN Convention on their behalf (at 493). 20 Joint Position of 29 March 1999 defined by the Council on the basis of Article K.3 of the Treaty on European Union, on the proposed United Nations convention against organised crime [1999] OJ L87/1. 21 See, eg, the conclusions of the Telecommunications Council of 2 May 2000 (Council Doc 8058/00, Presse 127-G), according to which ‘the Council authorised the Commission to negotiate on behalf of the Community the draft UNTOC with regard to measures against money laundering, one of the main strands of the Convention, which fall within the scope of the Community’s powers, taking the provisions of the 1991 money laundering Directive as a basis’. 22 Council Common Position of 31 January 2000 on the proposed protocol against the illicit manufacturing of and trafficking in firearms, their parts and components and ammunition [2000] OJ L37/1, adopted on the basis of the TEU and in particular art 34(2)(a).

Governing Crime via Global Multilateral Treaties: The EU and the UN 617 Community competence) only subsequently.23 Greater transparency at the third pillar level may be explained by the combination of the relative lack of experience in international negotiations in the field, but also by the ambition to establish visible precedents confirming the emergence of the EU as a global actor in the field of criminal law. The 1999 Joint Position provides important insights into both the constitutional aspects of negotiating international agreements with content relating to the third pillar and the content of the EU goals in these negotiations. Adopted under a combination of Maastricht third pillar legal bases (Articles K.3(2) and K.5 TEU), the Joint Position was justified as necessary in order to contribute as fully as possible to the negotiation of the proposed convention and to avoid incompatibility between the proposed convention and instruments drawn up in the EU.24 In this light, the Joint Position called for account to be taken of measures already adopted, or in the course of preparation or adoption in accordance with the 1997 EU Action Plan on Organised Crime.25 Particular emphasis in this context was placed on the need for Member States to ensure consistency between the UN Convention and the 1998 EU Joint Action on the criminalisation of participation in a criminal organisation26 as regards the definition of such participation and its criminalisation.27 The Joint Position then went on to provide detailed guidelines on the negotiating position with regard to the scope of the Convention and the definition of organised crime, which mirrors the definition adopted at the EU level.28 Calls for consistency (and coordination) were primarily addressed to Member States (leaving a limited role for the presidency).29 23 See the conclusions of the ECOFIN Council of 31 January 2000 (Council Doc 5565/00, Presse 19-G), according to which ‘the Council adopted a decision authorising the Commission to participate, on behalf of the European Union – in the negotiation of the draft protocol to the UNTOC to combat the illegal trafficking in and the manufacture of firearms, their parts, components and ammunition’. The reference to the Commission negotiating on behalf of the EU – rather than the EC – is noteworthy in this context. 24 Joint Position (n 20) Preamble, Recital 8. 25 ibid, Preamble, Recital 5. For an overview of the Action Plan, see WC Gilmore, ‘The EU Action Plan to Combat Organised Crime: The Scope and Implementation of Legal Instruments’ in The Boundaries of Understanding. Essays in Honour of Malcolm Anderson (University of Edinburgh International Social Sciences Institute, 1999) 97–106. 26 Joint Action of 21 December 1998 adopted by the Council on the basis of Article K.3 of the Treaty on European Union, on making it a criminal offence to participate in a criminal organisation in the Member States of the European Union [1998] OJ L351/1. For an analysis, see V Mitsilegas, ‘Defining Organised Crime in the European Union: The Limits of European Criminal Law in an Area of Freedom, Security and Justice’ (2001) 26 European Law Review 565. 27 Joint Position (n 20) art 1(2). The Joint Position also called for consistency between the Convention and the 1998 EU Joint Action on confiscation; see art 1(6). 28 ibid art 1(3), which states that ‘insofar as the other provisions of the draft convention are concerned, it should apply as broadly as possible to the activities of criminal organisations and to international cooperation for combating such organisations. In principle, the relevant provisions of the draft convention should encompass the activities of persons, acting in concert with a view to committing serious crime, involved in any criminal organisation which has a structure and is, or has been, established for a certain period of time. They should not be limited to groups with a highly developed structure or enduring nature, such as mafia type organisations; and the organisations need not necessarily have formally defined roles for their participants or continuity of membership’. 29 See ibid art 2, according to which ‘in the negotiations on the proposed United Nations convention and any possible protocols, Member States shall, as far as is practicable, coordinate their positions, at the Presidency’s initiative, and seek to arrive at common standpoints on all issues which have significant implications for the interests of the Union’. See also art 3, which calls on Member States to ensure that the provisions of the proposed UN Convention and any possible protocols are not inconsistent with instruments drawn up between them.

618 The EU and the Global Governance of Crime The wording of the Joint Position has led commentators to argue that the presidency was in fact not authorised by the Member States to negotiate on their behalf, and therefore that the UN Convention and its Protocols could not be considered as agreements in the sense of Articles 24 and 38 TEU.30 Instruments of signature and conclusion of the Palermo Convention and its Protocols were adopted only at the Community level. As regards signature by the Community, two Decisions were adopted: one concerning the Convention itself and the Smuggling and Trafficking Protocols;31 and another concerning the Firearms Protocol.32 A clearer insight into the extent of Community competence is provided by the subsequent instruments on the conclusion of the Palermo Convention and its Protocols by the Community. Separate Decisions with regard to the Convention itself and the two Protocols on trafficking and smuggling were adopted in this context. The Decision on the conclusion of the Convention33 was adopted under Articles 47 (free movement/ right of establishment), 55 (free movement of services), 95 (internal market) and 179 (development cooperation) EC. It is worth quoting at length here the Declaration of Community Competence annexed thereto: The Community points out that it has competence with regard to progressively establishing the internal market, comprising an area without internal frontiers in which the free movement of goods and services is ensured in accordance with the provisions of the Treaty establishing the European Community. For this purpose, the Community has adopted measures to combat money laundering. They do, however, at present not include measures concerning cooperation between Financial Intelligence Units, detection and monitoring the movement of cash across the borders between the Member States or cooperation among judicial and law enforcement authorities. The Community also has adopted measures to ensure transparency and the equal access of all candidates for the public contracts and services markets which contributes to preventing corruption. Where the Community has adopted measures, it is for the Community alone to enter into external undertakings with third States or competent international organisations which affect those measures or alter their scope. This competence relates to Articles 7,34 935 and 31(2)(c)36 of the Convention. Moreover,

30 Rijken and Kronenberger (n 19) 494. 31 Council Decision of 8 December 2000 on the signing, on behalf of the European Community, of the United Nations Convention against transnational organised crime and its Protocols [2001] OJ L30/44. The legal bases for the Decision were arts 47 (free movement/right of establishment), 62(2)(a) (border controls), 63(3)(b) (illegal immigration and illegal residence) and 95 (internal market) EC (in conjunction with art 300(2)). The Decision confirms that ‘the elements of the Convention and the two Protocols thereto which are subject to Community competence were negotiated by the Commission, with the approval of the Council, on behalf of the Community’ (Preamble, Recital 1). 32 Council Decision of 16 October 2001 on the signing, on behalf of the European Community, of the United Nations Protocol on the illicit manufacturing of and trafficking in firearms [2001] OJ L280/5 (hereinafter the ‘Firearms Protocol’). The legal bases for the Decision were arts 95 (internal market) and 133 (common commercial policy) EC (in conjunction with art 300(2)). As with the Decision on the signing of the Convention (n 31), this Decision confirms the negotiation by the Commission of matters of the Protocol falling within Community competence (Preamble, Recital 1). 33 Council Decision of 29 April 2004 on the conclusion, on behalf of the European Community, of the United Nations Convention Against Transnational Organised Crime [2004] OJ L261/69. 34 Money laundering. 35 Corruption. 36 Prevention of the misuse by organised criminal groups of tender procedures conducted by public authorities and of subsidies and licences granted by public authorities for commercial activity.

Governing Crime via Global Multilateral Treaties: The EU and the UN 619 Community policy in the sphere of development cooperation complements policies pursued by Member States and includes provisions to combat corruption. This competency relates to Article 3037 of the Convention. Moreover, the Community considers itself bound by other provisions of the Convention to the extent that they are related to the application of Articles 7, 9, 30 and 31(2)(c), in particular the articles concerning its purpose and definitions and its final provisions.38

Three points are noteworthy in the Decision and the Declaration of Competence. The first is that legal bases used to adopt the Decision concluding the Palermo Convention have been extended in relation to the signature Decision to include Articles 55 (free movement of services) and 179 (development cooperation) EC. This ‘extension’ of competence is also reflected in the Declaration of Competence. The second point is that, contrary to the wording of the Declaration, there was now Community law on matters such as cooperation between Financial Intelligence Units (FIUs) and detection and monitoring the movement of cash across the borders between the Member States. While the Declaration recognises the potential development of Community law in this context,39 it had not been amended at the time of writing to reflect these developments. The third point involves the scope of some of the provisions of the Palermo Convention included in the Declaration of Competence. According to the latter, Community competence relates to Articles 7 and 9 of the Convention (on money laundering and corruption respectively). While these provisions refer mostly to the preventive and not the criminal law aspects of money laundering and corruption law (these are dealt with in Articles 6 and 8 of the Convention respectively), they can still be seen as containing certain criminal law elements (which did not fall expressly within Community competence at the time).40 A two-pronged strategy was followed with regard to the conclusion of the Smuggling and Trafficking Protocols.41 Two Decisions were adopted for the conclusion of each of the Protocols, reflecting the wide range of fields in which Community competence did arise: one set of Decisions was adopted on legal bases relating to development cooperation and economic, financial and technical cooperation with

37 Implementation of the Convention through Economic Development and Technical Assistance. 38 Council Decision of 29 April 2004 (n 33) Annex II, Declaration of competence in accordance with art 36(3) of the Convention. 39 ‘The scope and the exercise of Community competence are, by their nature, subject to continuous development and the Community will complete or amend this declaration, if necessary, in accordance with Art 36(3) of the Convention.’ ibid, Annex II. 40 Article 9(1) of the Palermo Convention calls on States Parties to ‘adopt legislative, administrative or other effective measures to promote integrity and to prevent, detect and punish the corruption of public officials’. Article 7(4) of the Convention calls for ‘global, regional, subregional and bilateral cooperation among judicial, law enforcement and financial regulatory authorities in order to combat money laundering’. To the extent that this provision refers to FIUs, it must be noted that the relevant provisions have since appeared in the (first pillar) 2005 third Money Laundering Directive (for an analysis of the constitutional implications of this inclusion, see Mitsilegas and Gilmore (n 13)). 41 At the time of writing, the EU has not yet concluded the Firearms Protocol (n 32). This is due to the need to wait for the implementation of relevant EU legislation by Member States; see Commission, ‘Report on Implementation of the Hague Programme for 2007’ COM (2008) 373 final.

620 The EU and the Global Governance of Crime third countries;42 and another set of Decisions was adopted on a Title IV legal basis (relating to Community immigration and borders law).43 The Declaration of Community Competence (found in Annex II and similar to all Decisions, with differences in terminology mainly in respect of the titles of the respective Protocols, that is, trafficking/smuggling) aimed at translating the à la carte participation of Denmark, Ireland and the UK in Title IV measures, and refers to exclusive Community competence with regard to border controls and visas, immigration policy regarding conditions of entry and residence, and measures to counter illegal immigration and illegal residence, including repatriation of illegal residents and cooperation between the relevant departments of the administrations of the Member States, as well as between those departments and the Commission, in the aforementioned areas.44 It was added that Community policy in the sphere of development cooperation complemented policies pursued by Member States and includes provisions to prevent and combat trafficking in persons. It is noteworthy that, unlike the Decision concluding the Palermo Convention, this was a rather general Declaration of Competence, in that there was no reference to specific provisions of the Protocols with regard to Community competence.45 This is notwithstanding the fact that a number of provisions in both Protocols relate to the adoption of criminal law, an area where the powers of the Community to legislate were contested at the time.46 The substantive provisions of the Palermo Convention as regards the criminalisation of organised crime demonstrate that the ‘consistency’ objective outlined in the 1999 EU Joint Position has been largely achieved. The definition of an organised crime group and the criminalisation of participation in a criminal organisation in the Convention47 largely mirror the provisions of the EU 1998 Joint Action making it a criminal offence to participate in a criminal organisation in an EU Member State.48

42 Articles 179 and 181a EC respectively. See Council Decision of 24 July 2006 on the conclusion, on behalf of the European Community, of the Protocol to Prevent, Suppress and Punish Trafficking in Persons in so far as the provisions of this Protocol fall within the scope of Articles 179 and 181a of the EC Treaty [2006] OJ L262/44; and Council Decision of 24 July 2006 on the conclusion, on behalf of the European Community, of the Protocol Against the Smuggling of Migrants in so far as the provisions of this Protocol fall within the scope of Articles 179 and 181a of the EC Treaty [2006] OJ L262/24. 43 Council Decision of 24 July 2006 on the conclusion, on behalf of the European Community, of the Protocol to Prevent, Suppress and Punish Trafficking in Persons in so far as the provisions of this Protocol fall within the scope of Part III, Title IV of the EC Treaty [2006] OJ L262/51; and Council Decision of 24 July 2006 on the conclusion, on behalf of the European Community, of the Protocol Against the Smuggling of Migrants in so far as the provisions of this Protocol fall within the scope of Part III, Title IV of the EC Treaty [2006] OJ L262/34. 44 According to the Declaration, the Community has adopted rules and regulations in these fields and, where it has done so, it is solely for the Community to enter into external undertakings with third states or competent international organisations. 45 A general clause common to all four Decisions states that they will apply insofar as the provisions of the Protocols fall within the scope of their respective legal bases (see, eg, art 2 of the Decision on the conclusion of the trafficking Protocol on a Title IV legal basis, above n 42). 46 The Community later adopted (still in the pre-Lisbon era) a first pillar Directive including criminal law provisions in the field of Title IV (on illegal work) [2009] OJ L168/24. EU competence to adopt criminal offences and sanctions is established in art 83(1) and (2) TFEU post-Lisbon. 47 Palermo Convention, arts 2 and 5 respectively. On the evolution of internal EU law in the field, see ch 2. 48 Mitsilegas (n 26).

Governing Crime via Global Multilateral Treaties: The EU and the UN 621 The Joint Action, which constituted the first major attempt at the international level to provide for harmonisation of the criminal law on organised crime, contained a broad definition of an organised crime group and a ‘dual’ model of criminalisation, with Member States given the choice to criminalise either participation in a criminal organisation as defined in the Joint Action or conspiracy.49 The Convention’s criminalisation of participation in a criminal organisation largely follows this approach,50 with the Convention text adding the criminalisation of ‘organising, directing, aiding, abetting, facilitating or counselling the commission of serious crime involving an organised crime group’.51 The Palermo Convention was in turn a benchmark for the development of subsequent EU law on organised crime. In 2005, the Commission tabled a proposal for a Framework Decision ‘on the fight against organised crime’, which aimed at replacing the 1998 Joint Action.52 According to the Commission, the new proposal took into account developments since 1998, including the introduction of Framework Decisions as a form of third pillar law in the Amsterdam Treaty and the need to take into account subsequent legislative developments, such as the Palermo Convention and the EU Framework Decision on terrorism.53 Negotiations resulted in the recent adoption of a third pillar Framework Decision ‘on the fight against organised crime’.54 The Framework Decision claims to build upon the Palermo Convention55 and repeals the 1998 Joint Action. The wording of the provisions on the definition of ‘criminal organisation’ and the criminalisation of offences relating to participation therein are broadly similar to the provisions of the Palermo Convention. This is particularly the case in respect of the definition of an organised crime group and the maintenance of the option for Member States to criminalise either participation in a criminal organisation or conspiracy. However, unlike the Palermo Convention, the Framework Decision refrained from criminalising the direction of an organised criminal group. On the other hand, the EU instrument goes further than the Convention by including provisions of greater detail than the latter, which are common to EU third pillar law, in particular detailed provisions on penalties. In this case, the EU legislator has used international law to update the internal acquis, while at the same time adding EU-specific elements in the internal instrument. Here, taking into account international standards was also used to enhance the effectiveness of EU law in the field of organised crime by justifying the transition

49 For a discussion, see Mitsilegas (n 26), 571–72. 50 See McClean (n 18) 67. Commenting on the implementation of art 5, he notes that ‘the statute books of the common law countries which have ratified the Convention will be searched in vain for crimes defined as set out in this Article. As has been clear from the beginning, the offences of conspiracy, soliciting, and other forms of participation in criminal conduct more than adequately cover the field described in the text of the Article’. 51 Palermo Convention, art 5(1)(b). 52 Commission, ‘Proposal for a Framework Decision on the fight against organised crime’ COM (2005) 6 final. 53 See V Mitsilegas, ‘The Third Wave of Third Pillar Law: Which Direction for EU Criminal Justice?’ (2009) 34 European Law Review 523. 54 Framework Decision 2008/841/JHA on the fight against organised crime [2008] OJ L300/42. 55 ibid, Preamble, Recital 6.

622 The EU and the Global Governance of Crime from an EU instrument of uncertain legal force (a Joint Action) to a clearly legally binding Framework Decision.56 In relation to the criminalisation of human trafficking and human smuggling, the Palermo Convention came at a time when no detailed EU legislation existed in the field.57 A number of EU measures followed the adoption of the Convention. In 2002, the Council adopted a third pillar Framework Decision defining and criminalising trafficking in human beings.58 It was designed not to implement, but rather to complement the work of the UN in the field.59 Having said that, the definition – and criminalisation – of human trafficking in the Framework Decision follows the definition adopted in the Palermo Protocol very closely.60 Unlike the Protocol, the Framework Decision introduces penalty levels (including a minimum custodial sentence of eight years) when a series of aggravating circumstances applies. The criminalisation of human trafficking in those terms has also been reflected in the recent post-Lisbon Directive on human trafficking, which has also placed great emphasis on the position of the victim.61 The year 2002 also saw the adoption of EU measures on human smuggling (or, according to EU terminology, the facilitation of unauthorised entry, transit and residence): a first pillar Directive defining ‘facilitation’, accompanied by a third pillar Framework Decision criminalising it.62 Neither of these instruments contains references to the Palermo Convention. The Directive defines ‘facilitation’ as intentionally assisting a third country national

56 See V Mitsilegas, ‘The EU and the Implementation of International Norms in Criminal Matters’ in M Cremona, J Monar and S Poli (eds), The External Dimension of the Area of Freedom, Security and Justice (Peter Lang, 2011) 239–72. 57 Note, in this context, the Maastricht Joint Action 97/154/JHA concerning action to combat trafficking in human beings and sexual exploitation of children [1997] OJ L63/2. However, the scope of the Joint Action was rather limited, with the focus being largely on trafficking for the purposes of sexual exploitation. 58 Council Framework Decision of 19 July 2002 on combating trafficking in human beings [2002] OJ L203/1. 59 See ibid Preamble, Recitals 4 (referring to the Palermo Protocol as ‘a decisive step towards international cooperation in the field’) and 6 (referring to the need for the EU to complement work done in international fora, in particular the UN). A similar reference, indicating awareness of, but not overt deference to, the relevant UN standards can be found in the Preamble to a 2004 first pillar Directive on residence permits for victims of trafficking who cooperate with essentially law enforcement authorities ([2004] OJ L261/19, Recital 3). The Directive (adopted on a Title IV legal basis) is largely drafted from the perspective of the efficiency of state action against traffickers, with the protective spirit permeating the Palermo Trafficking Protocol (in particular art 6 thereof) as regards victims being scarcely discernible in the EU instrument. 60 The offence includes trafficking for the purpose of labour exploitation. A notable omission from the EU text is trafficking for the purpose of removal of organs. A proposal tabled in 2003 by the then Greek EU p residency to criminalise the trade in human organs was blocked in the Council. See V Mitsilegas, The Coherence of the Adopted Measures during the Last Years by the EU with Regard to Organised Crime and the UN Convention on Organised Crime, Briefing Paper for the European Parliament LIBE Committee (2006), reproduced in D Bigo and A Tsoukala (eds), Controlling Security (L’Harmattan, 2008) 65. 61 Directive 2011/36/EU of the European Parliament and of the Council of 5 April 2011 on preventing and combating trafficking in human beings and protecting its victims, and replacing Council Framework Decision 2002/629/JHA [2011] OJ L101, 1. 62 Council Directive 2002/90/EC of 8 November 2002 defining the facilitation of unauthorised entry, transit and residence [2002] OJ L328, 4, and the corresponding Framework Decision [2002] OJ L328, 1. This ‘dual’ approach was adopted in order to address Member States’ concerns with regard to the extent of Community competence to adopt criminal law in the field; for an overview of the constitutional debate in this context, see V Mitsilegas, EU Criminal Law (Hart Publishing, 2009) ch 2.

Governing Crime via Global Multilateral Treaties: The EU and the UN 623 to enter or transit an EU Member State in breach of its aliens’ laws, and intentionally assisting ‘for financial gain’ a third country national to reside in an EU Member State irregularly. The definition goes beyond the UN Smuggling Protocol, which requires ‘a financial or other material benefit’ as a condition for the criminalisation of procuring of illegal entry.63 The Framework Decision introduces a series of criminal sanctions, including heavier penalties if the offences are committed for financial gain, if they are committed within the framework of an organised crime group or if they endanger the lives of the smuggled persons. The last two elements are also mentioned in the UN Smuggling Protocol, but the Protocol includes a further aggravating circumstance when smuggling entails inhuman or degrading treatment, including exploitation.64

C. Corruption: The 2003 UN Convention on Corruption and EU Law The most recent major UN multilateral treaty in criminal matters is the 2003 UN Convention against Corruption, which aims to establish a comprehensive anticorruption framework by focusing on both prevention and control.65 The breadth of the scope of the Convention meant that some areas covered were deemed to be related to EC competence, whereas other areas were deemed to be related to EU, third pillar powers. The approach taken with regard to the negotiations was thus broadly similar to the approach followed in the negotiations of the Palermo Convention. Transparency with regard to the various negotiating positions was limited. The eventual Council Decision on the conclusion, on behalf of the European Community, of the United Nations Convention against Corruption66 confirmed that the elements of the Convention which were subject to Community competence were negotiated by the Commission.67 The Community concluded the Convention on the basis of a plethora of legal bases, ranging from provisions on free movement and the internal market to development cooperation and provisions relating to the functioning of the EU institutions.68 Similarly, the 63 The disassociation of the financial gain element from the facilitation offence for the purposes of entry and transit raised concerns among humanitarian NGOs, which felt that they would be prosecuted for assisting third country nationals, including asylum seekers, to enter the EU. For that reason, and after protracted negotiations, a clause was added to the Directive granting Member States the discretion not to impose sanctions where the aim of the behaviour is to provide humanitarian assistance to the person concerned. See V Mitsilegas, J Monar and W Rees, The European Union and Internal Security (Palgrave Macmillan, 2003) 106–08. 64 Protocol Against the Smuggling of Migrants by Land, Sea and Air, supplementing the United Nations Convention Against Transnational Organized Crime, Article 6. The UN Smuggling Protocol also contains provisions on ensuring the safety and humane treatment of smuggled persons who are intercepted at sea, and a series of detailed provisions on prevention, elements that are absent from the EC/EU documents; see Mitsilegas (n 60) above. 65 For an overview, see P Webb, ‘The United Nations Convention against Corruption: Global Achievement or Missed Opportunity?’ (2005) 8 Journal of International Economic Law 191. 66 [2008] OJ L287/1. 67 ibid Preamble, Recital 1. 68 The legal bases of the Decision were: arts 47(2) (free movement/right of establishment), 57(2) (free movement of capital), 95 (internal market), 107(5) (monetary policy, ESCB), 179 (development cooperation), 181a (economic, financial and technical cooperation with third countries), 190(5) (European Parliament), 195(4)

624 The EU and the Global Governance of Crime Declaration annexed to the Decision established Community competence for a range of issues, starting with the prevention of corruption (including the adoption of codes of conduct and action within EU institutions), continuing with the proper functioning of the internal market (emphasising that the Community had adopted measures regarding transparency and equal access to public contracts and markets of Community relevance, appropriate accounting and auditing standards, and the prevention of money laundering) and concluding with development cooperation. This is a wide range of quite disparate fields, where Community action had not necessarily taken the form of legally binding instruments. It reflects the many areas potentially affected by anticorruption law and extends to both addressing corruption at an internal, institutional level and addressing corruption externally, as conduct which is detrimental to markets, the economy and beyond. As regards the negotiations of the third pillar/criminal law aspects of the Convention, a series of draft negotiating common positions have now been declassified. The first of these documents refers to a draft Common Position at the initiative of the Belgian EU presidency.69 The draft Common Position contained detailed guidelines on the criminal law aspects of corruption to be included in the UN Convention.70 It contained a ‘red line’, stating that the criminal offences and penalties shall not call into question the fundamental principles underlying Member States’ legal systems and that ‘in particular, in the negotiations on “illicit enrichment”, the Union should oppose any inclusion in the Convention of criminal offences so defined as to undermine those fundamental principles’.71 The draft Common Position called for the Palermo Convention to be taken as the basis for a number of provisions in the new Convention.72 Reflecting the growing importance of the fight against corruption in the context of the accession negotiations leading to the 2004 enlargement, candidate countries were invited to support the Common Position.73 Member States were called upon to ensure that the provisions of the Convention did not call into question the instruments drawn up between them, ‘in particular (Ombudsman), 199 (European Parliament rules of procedure), 207(3) (Council rules of procedure), 218(2) (Commission rules of procedure), 279 (Council financial regulations), 280 (fraud against EC financial interests) and 283 (staff regulations of officials) EC. 69 Initiative of the Kingdom of Belgium for the adoption by the Council of a draft Common Position defined by the Council on negotiations within the United Nations to draw up a United Nations Convention against Corruption, Council Doc 12837/2/01 REV 2 (2003). The draft Common Position was approved by the art 36 Committee at its meeting of 12 and 13 November 2001, and Coreper was invited to recommend to the Council its adoption Council Doc 14114/01 (2001). 70 According to art 2 of the draft Common Position, the Convention should cover, inter alia, active and passive corruption in the private sector, and apply to corruption both of national officials and of foreign officials, and include corruption of international officials; it should also cover the criminalisation of the laundering of proceeds of corruption and seizure/confiscation matters. Active and passive corruption in the private sector, trading in influence and accounting offences should also form part of the negotiations. 71 Draft Common Position, art 2(3). 72 Particularly for the provisions on laundering, seizure and confiscation of the proceeds of corruption, for the provisions on sanctions, the protection of witnesses, assistance and protection of victims, the liability of legal persons and jurisdiction, and for the provisions designed to improve international cooperation in criminal matters (draft Common Position, art 2(5)). See also the EU Presidency Statement of 21 January 2002 on the UN Convention against corruption, in particular paras 9–12, www.eu-un.europa.eu/articles/en/ article_1081_en.htm. 73 Draft Common Position, art 4.

Governing Crime via Global Multilateral Treaties: The EU and the UN 625 with regard to judicial assistance, extradition, combating corruption and the protection of the Community’s financial interests’.74 Last, but not least, the draft Common Position called on Member States to ‘coordinate their positions at the Presidency’s initiative and seek to arrive at common standpoints on all issues which have significant implications for the interests of the European Union’.75 This threefold approach – of mandating substantive negotiating guidelines (including ‘red lines’ in particular as regards provisions which would be deemed as threatening fundamental legal principles in Member States), safeguarding the internal acquis and calling for coordination in negotiations – was repeated in two subsequent draft Common Positions that are now publicly available. The draft second Common Position76 expressed support in principle for the inclusion of anti-money laundering measures in the Convention. However, Member States were asked to ensure that the provisions of the Convention do not call into question either the instruments drawn up between them, in particular the Council Decision concerning arrangements for cooperation between FIUs of the Member States in respect of exchanging information and other measures taken in the field of money laundering, or other international instruments to which they are party.77 Moreover, for provisions on the identification, tracing, seizing, freezing and confiscation of funds, Member States were called upon to ensure that the provisions of the Convention concerning compliance with such measures do not call into question their fundamental principles, in particular in respect of evidence, or their provisions on data protection.78 The draft third Common Position79 focused primarily on substantive guidelines on the criminalisation of corruption by public officials, and advocated consistency with the standards adopted in the Palermo Convention and the relevant Council of Europe Convention in the field.80 The red line here involved the inclusion of offences such as abuse of functions, unlawful enrichment, the use of classified or confidential information, and improper benefits, which Member States should not support. In the event of the criminalisation of such offences, Member States were called upon to ensure that

74 ibid art 5. 75 ibid art 7. 76 Draft second Common Position defined by the Council on the basis of Article 34(2)(a) of the Treaty on European Union on negotiations within the United Nations to draw up a United Nations Convention against Corruption, Council Doc 8897/4/02 REV 4, Brussels, 30 October 2003. 77 Draft second Common Position, art 5. 78 ibid art 6. 79 Initiative of the Kingdom of Denmark concerning the adoption by the Council of a draft third Common Position defined by the Council on the basis of Article 34(2)(a) of the Treaty on European Union on negotiations within the United Nations to draw up a United Nations Convention against Corruption, Council Doc 12215/2/02 REV 2, Brussels, 30 October 2003. The draft third Common Position was approved after some amendments by Coreper at its meeting of 25 September 2002, and the Council was invited to adopt it. Council Doc 12329/02, Brussels, 25 September 2002. 80 See draft third Common Position, arts 2 and 3 respectively. The same approach was followed with regard to criminalisation of money laundering (which, according to art 8, should be compatible with art 6 of the Palermo Convention) and corruption in the private sector (which should be compatible with arts 7 and 8 of the Council of Europe Convention). It is noteworthy that compatibility is here requested with international – and not EU – standards in the field.

626 The EU and the Global Governance of Crime these crimes did not call into question the fundamental principles underlying their legal systems.81 An examination of the finally adopted text of the UN Convention against Corruption in the light of the aforementioned documents demonstrates that the EU negotiating objectives with regard to criminal law have largely been met. The Convention requires States Parties to criminalise three types of conduct: bribery of national public officials,82 bribery of foreign public officials and officials of public international organisations,83 and embezzlement, misappropriation or other diversion of property by a public official.84 The last type of conduct is not currently covered by EU criminal law, while the EU has legislated on the criminalisation of corruption of national and Community officials.85 The criminalisation of bribery of national public officials in the UN Convention is worded in very similar terms to the relevant EU instruments on corruption.86 The UN Convention also criminalises a series of further corruptionrelated offences (trading in influence,87 abuse of functions,88 illicit enrichment,89 bribery in the private sector90 and embezzlement of property),91 but criminalisation here is not compulsory for States Parties, which need only consider going down that route. This wording seems to address EU concerns with regard to the criminalisation of illicit enrichment, which in any case would occur subject to the States Parties’ constitutions and the fundamental principles of their legal system.92 The inclusion in the Convention of the criminalisation of bribery in the private sector represents a partial victory for the EU. It has been reported that extending the Convention to cover the private sector was one of the most contentious issues during the negotiations, with the EU calling for criminalisation, but the US resisting such a move.93 The result has been a compromise, whereby the Convention includes the criminalisation of private sector corruption in very similar terms to the EU 2003 Framework Decision in the field,94 but such criminalisation falls within the discretion of States Parties to the Convention. The UN Convention against Corruption has introduced a number of corruptionrelated offences for States Parties to criminalise or to consider criminalising. The

81 Draft third Common Position, art 6. 82 UN Convention against Corruption, art 15. 83 ibid art 16. 84 ibid art 17. 85 See the Protocol to the EU Fraud Convention [1996] OJ C313/2; and the EU Convention against corruption involving officials of the European Communities or officials of the Member States of the European Union [1997] OJ C195/2. 86 The EU instruments refer to ‘corruption’, whereas the UN Convention refers to ‘bribery’. The terms will be used interchangeably for the purposes of this chapter. 87 UN Convention against Corruption, art 18. 88 ibid art 19. 89 ibid art 20. 90 ibid art 21. 91 ibid art 22. 92 Similarly, the Convention provisions on judicial cooperation in criminal matters appear to address EU concerns, as they are drafted in very general terms. 93 Webb (n 65) 213–14. 94 Council Framework Decision 2003/568/JHA of 22 July 2003 on combating corruption in the private sector [2003] OJ L192/54.

Governing Crime via Regional Multilateral Treaties 627 framework it puts forward is much more comprehensive when compared with the EU criminal law on corruption. The EU criminal law framework on corruption is both limited and fragmented, with Member States appearing reluctant to agree to a comprehensive anti-corruption law with teeth.95 Criminalisation has been introduced in the form of the quite ‘intergovernmental’ Maastricht Conventions (which have not been replaced post-Amsterdam by Framework Decisions). Where a Framework Decision has eventually been adopted (on corruption in the private sector), its implementation by Member States leaves much to be desired.96 Unlike the fields of money laundering and organised crime, there has been no EU legislative action in the field following the adoption of the 2003 UN Convention. This may signal the fact that in the field of the criminal law of corruption, the EU has opted to pursue its agenda by promoting standards at the global level instead of developing a comprehensive framework in internal EU law.97 This view is reinforced by the EU commitment to be reviewed as regards its implementation of the United Nations Convention against Corruption (UNCAC).98

III. Governing Crime via Regional Multilateral Treaties: The EU and the Council of Europe There are growing interconnections between the activities of the Council of Europe and the EU in the field of criminal law.99 Along with geographical and membership factors, these interconnections are linked to the fast-moving legislative activity of both organisations in criminal matters. In recent years, the Council of Europe has adopted a number of comprehensive, pioneering criminal law Conventions in fields such as money laundering, corruption and terrorism. Provisions in a number of these instruments significantly influenced the development of internal EU law in these fields. Increasingly, the EU is using its negotiating strength in the Council of Europe first to introduce three new elements on criminal law and then to export these elements to Europe and beyond, in particular in cases where no global consensus can be encountered initially.100 The regional Conventions of the Council of Europe form a laboratory for EU membership for candidate countries as regards criminal law and justice; this is also confirmed by the central place occupied by Council of Europe instruments in the

95 See also V Mitsilegas, ‘The Aims and Limits of EU Anti-corruption Law’ in J Horder and P Alldridge (eds), Modern Bribery Law: Comparative Perspectives (Cambridge University Press, 2013) 160–95. 96 See Commission, ‘Report on the implementation of the Framework Decision on corruption in the private sector’ COM (2007) 328 final. 97 For the emphasis on action in international fora, see, eg, Commission, ‘On a Comprehensive EU Policy against Corruption’ (Communication) COM (2003) 317 final. 98 https://ec.europa.eu/commission/presscorner/detail/en/IP_20_2416. 99 For details, see V Mitsilegas, ‘The EU and the Rest of the World: Criminal Law and Policy Interconnections’ in M Evans and P Koutrakos (eds), Beyond the Established Orders: Policy Interconnections between the EU and the Rest of the World (Hart Publishing, 2011) 149–78. 100 A prime example in this context is the conclusion of the Council of Europe Convention on Cybercrime; see V Mitsilegas, ‘Regional Organisations and the Suppression of Transnational Crime’ in N Boister and R Curry (eds), Research Handbook on Transnational Criminal Law (London, Routledge, 2014) 73–89.

628 The EU and the Global Governance of Crime assessment of states which are potentially future candidates for EU membership. Their ratification (along with the ratification of the relevant UN Conventions and the FATF Recommendations) is also a key requirement in the European Neighbourhood Policy Action Plans developed by the EU and in the EU’s relations with Russia.101 Last but not least, standards agreed in Council of Europe Conventions are increasingly important for the globalisation of criminal law in view of the fact that a number of Council of Europe Conventions are open for ratification to states outside Europe (most notably the US). In this manner, in areas where there is no global consensus on criminalisation (such as terrorism and cybercrime), Council of Europe regional instruments may serve as building blocks for a global level playing field. However, the use of Council of Europe multilateral conventions to export EU-endorsed standards does not mean that these standards necessarily limit the EU’s autonomy of action when legislating internally in the field. In recent years, the EU has become increasingly assertive in negotiations at the Council of Europe level, especially in the light of the growth of the internal acquis in criminal law. An example of this EU strategy with regard to the adoption and subsequent use of Council of Europe criminal law instruments involves the developments in the law of terrorism. At the EU level, a revised Framework Decision was adopted in 2008 to amend an earlier Framework Decision on combating terrorism.102 The 2008 Framework Decision expanded the scope of the 2002 instrument to introduce into the EU legal order offences relating to the prevention of terrorism. The basis for the elaboration of these offences was the Council of Europe Convention on the Prevention of Terrorism.103 The 2008 Framework Decision did not repeal, but rather amended the 2002 Framework Decision on combating terrorism.104 The 2008 instrument introduced three new offences: public provocation to commit a terrorist offence; recruitment for terrorism; and training for terrorism. However, for any of these acts to be punishable, it is not necessary that a terrorist offence is actually committed. This clause, which was copied verbatim from the Council of Europe Convention, did not exist in the 2002 EU instrument and signals a move towards the adoption of ‘preventive’ criminal law by the EU. However, criminalisation in the Framework Decision has its limits. In particular, it is noteworthy that in order for conduct to be treated as a criminal offence, a ‘terrorist motivation’ must exist.105 This condition, which does not exist in the main body of the Council of Europe Convention,106 may serve to limit criminalisation when the Framework Decision is

101 For details, see Mitsilegas (n 56). 102 Framework Decision 2008/919/JHA amending the 2002 Framework Decision on combating terrorism [2008] OJ L330/21. 103 Council of Europe Convention on the Prevention of Terrorism CETS No 196. 104 Framework Decision 2002/475/JHA on combating terrorism [2002] OJ L164/3 (hereinafter ‘the 2002 Framework Decision’). 105 ibid art 1(1). This article criminalises as terrorist offences those which, given their nature or context, may seriously damage a country or an international organisation where committed with the aim of: seriously intimidating a population, or unduly compelling a government or international organisation to perform or abstain from performing any act, or seriously destabilising or destroying the fundamental political, constitutional, economic or social structures of a country or an international organisation. 106 For a discussion, see A Hunt, ‘The Council of Europe Convention on the Prevention of Terrorism’ (2006) 12 European Public Law 613.

Governing Crime via Regional Multilateral Treaties 629 implemented.107 As will be seen below, the EU has continued to develop its internal acquis on criminalising terrorism in synergy not only with the Council of Europe, but also with the UN Security Council.108 The EU strategy with regard to the use of the Council of Europe Convention on the Prevention of Terrorism demonstrates the increasing assertiveness of the EU as a global actor in criminal matters, especially in fields where there is already a developed EU acquis. The EU played an active part in the negotiations of the Council of Europe Convention by opposing the negotiation of a comprehensive Council of Europe counterterrorism Convention and arguing in favour of narrowing down the scope of the latter to cover only areas where there were gaps in pre-existing international law.109 This lack of consensus with regard to the adoption of a comprehensive approach110 resulted in an instrument covering specific aspects of counter-terrorism action, in particular the criminalisation of ‘glorification-type’ conduct and not covering aspects of the criminalisation of terrorism which had already been addressed in the 2002 EU Framework Decision. The EU then used the Convention to justify the extension of criminalisation internally, while justifying EU action externally by stressing the ‘added value’ of the EU legal order in terms of integration and enforcement.111 According to the EU Justice and Home Affairs Ministers, the inclusion of the Convention offences in the Framework Decision is important ‘because it provides the advantages of the more integrated institutional framework of the EU and also because the legal regime of the Framework Decision in respect of the type and level of criminal penalties and compulsory rules on jurisdiction will be applicable to these offences’.112 The references to the special nature and features of EU law echo the arguments developing the concept of primacy of Community law in the context of EU constitutional law. The following two points are noteworthy in this context: that the specificity of the internal legal order – and the link with primacy – is established here with regard not to EC, but to EU law (a significant assertion in particular in the pre-Lisbon days); and that specificity and primacy come into play not only in relation to national, but also in relation to international law. The other side of the coin to these considerations (justifying the adoption of EU law notwithstanding the existence of a comprehensive Council of Europe Convention in the very same field) is the insertion of a disconnection

107 For further discussion of this Framework Decision, see Mitsilegas (n 53). 108 See section V below. 109 Hunt (n 106) 606–07. 110 See also para 11 of the Explanatory Memorandum to the Convention. 111 The Commission provided a similar justification when tabling recently a proposal to amend the EU Framework Decision on trafficking in human beings: the advantages of an EU approach were deemed to be related to the stronger bond created by the EU legal order, namely the immediate entering into force, and the monitoring and implementation; see COM (2009) 136 final, 7. 112 Justice and Home Affairs Council, ‘Conclusions of December 6–7’ (Council Doc 15966/07, Presse 275 (2007)), 21. The integration of the Convention standards into the EU legal order has also been justified on the ground that the Framework Decision would ‘trigger’ the implementation of cooperation mechanisms under EU law, in particular as regards the exchange of information on terrorist offences between Member States and the transfer of such information to Europol and Eurojust. See the comment by Tony McNulty, then a Home Office Minister, to the House of Commons European Scrutiny Committee, 26th Report (HC 2007–2008, 19-xxiv), para 26.3.

630 The EU and the Global Governance of Crime clause by the EU in the body of the Council of Europe instrument.113 Article 26(3) of the Convention states that: [P]arties which are members of the European Union shall, in their mutual relations, apply Community and European Union rules in so far as there are Community or European Union rules governing the particular subject concerned and applicable to the specific case, without prejudice to the object and purpose of the present Convention and without prejudice to its full application with other parties.114

The wording of this clause tries to achieve a delicate balance between safeguarding the EC and EU acquis115 (in particular as regards the future)116 and preserving the autonomy and primacy of EC (and now EU) law117 on the one hand, and alleviating concerns that such move might undermine the very regime established by the Council of Europe Convention on the other hand.118 Such concerns reflect fears about the growing power of the EU, whose Member States now constitute the majority of Council of Europe members, and the impact of such power on the reach of Council of Europe rules.119 113 The inclusion of disconnection clauses has been standard practice with regard to Council of Europe Conventions, in particular recent Conventions in criminal matters. For an overview and typology of disconnection clauses used by the EC/EU in Council of Europe Conventions, see International Law Commission, ‘Fragmentation of International Law: Difficulties Arising from the Diversification and Expansion of International Law, Report of the Study Group of the International Law Commission (finalised by Martti Koskenniemi)’, UN General Assembly Doc A/ CN.4/L.682 (2006), paras 289–94. 114 See also the Declaration of Community competence annexed to the Convention, which reads as follows: ‘The European Community/European Union and its Member States reaffirm that their objective in requesting the inclusion of a “disconnection clause” is to take account of the institutional structure of the Union when acceding to international conventions, in particular in case of transfer of sovereign powers from the Member States to the Community. This clause is not aimed at reducing the rights or increasing the obligations of a non-European Union Party vis-à-vis the European Community/EU and its Member States, inasmuch as the latter are also parties to this Convention. The disconnection clause is necessary for those parts of the Convention which fall within the competence of the Community/Union, in order to indicate that EU Member States cannot invoke and apply the rights and obligations deriving from the Convention directly among themselves (or between themselves and the European Community/ EU). This does not detract from the fact that the Convention applies fully between the European Community/EU and its Member States on the one hand, and the other Parties to the Convention on the other; the Community and the EU Member States will be bound by the Convention and will apply it like any Party to the Convention, if necessary, through Community/Union legislation. They will thus guarantee the full respect of the Convention’s provisions vis-à-vis non-EU Parties.’ 115 For a categorisation of disconnection clauses as ‘acquis-saving clauses’, see J Klabbers, ‘Safeguarding the Organizational Acquis: The EU’s External Practice’ (2007) 4(1) International Organizations Law Review 57, 70–71. 116 See, in this context, the criticism that disconnection clauses are quite ‘open’ and subject to change – International Law Commission (n 113) para 293. However, in this context, they are similar to the Declarations of Community competence attached to the UN Conventions discussed above in section II. However, the latter are also relevant for the determination of competence at the EU level. 117 For a discussion of disconnection clauses in the context of primacy in the first pillar, see M Cremona, ‘Defending the Community Interest: the Duties of Cooperation and Compliance’ in M Cremona and B de Witte (eds), EU Foreign Relations Law: Constitutional Fundamentals (Hart Publishing, 2008) 125–69. 118 See International Law Commission (n 113) para 294. 119 According to the Deputy Secretary General of the Council of Europe, speaking in the context of the new EU proposals on trafficking in human beings and their relationship with the relevant Council of Europe Convention in the field (which also contains a disconnection clause): ‘If EU legislation does not go as far as our Convention, for instance, as regards the 30 days recovery and reflection period, and if one applies the disconnection clause, we will find ourselves in a paradoxical situation of having two regimes applicable under the same Convention and a lower standard as compared to other parts of Europe.’ Speech by M de Boer-Buquicchio, ‘Who is Fighting Trafficking – Who is Not?’ (Hearing on Human Trafficking, European Parliament, Brussels, 8 October 2008).

Governing Crime via ‘Soft’ Law: The EU and the FATF 631 From the point of view of an international lawyer, the inclusion of such disconnection clauses in Council of Europe instruments is a matter of concern, as it may lead to the fragmentation of international law.120 However, from an EU law point of view, such concerns seem somewhat exaggerated: for internal EU law, efforts to safeguard the autonomy and primacy of the Community legal order are not something new;121 for EU external relations, it is in the interests of the EU for Council of Europe standards to be enforced as a key tool for EU policies with regard to candidate countries and its Council of Europe member neighbours.

IV. Governing Crime via ‘Soft’ Law: The EU and the FATF The examination of interconnections between EU law and international law in criminal matters cannot be complete without an overview of the interconnections between EU law and global ‘soft’ law in the field. Nowhere are such interconnections better illustrated than by looking at the relationship between the EC/EU and the FATF on money laundering (and now terrorist finance). The FATF is an ad hoc body, established by the G7 in 1989 within the auspices of the Organisation for Economic Co-operation and Development (OECD).122 Its main normative output has been a series of Recommendations, evolving over time and covering a wide range of aspects of the fight against money laundering. The 40 FATF Recommendations produced in 1990 were revised in 1996, 2003 and 2012,123 with money laundering countermeasures being deemed necessary to combat a series of emerging and new threats, from drug trafficking to organised crime and terrorism.124 The revisions of the FATF Recommendations have gone hand in hand with the renewal and gradual expansion of the FATF mandate to now include action against money laundering, the financing of terrorism and now proliferation.125 In relation to its membership, the FATF can be justifiably characterised as a rich countries club. This was particularly the case at its inception (it must be recalled that it was established by the G7 under the auspices of the OECD),126 with its membership having

120 See, in this context, the aforementioned Report by the International Law Commission, which examined disconnection clauses in the context of the fragmentation of international law. But see also the view of Klabbers, who notes that ‘it is, indeed, no coincidence that the most ardent critics of the disconnection clause have to resort to systemic arguments (risk of increased fragmentation, undermining legal equality) rather than any concrete and enforceable legal norm’. J Klabbers, Treaty Conflict and the European Union (Cambridge University Press, 2009) 222. 121 Although it is significant that disconnection clauses in Council of Europe instruments dealing with criminal law have perhaps been the closest we have come to safeguarding the primacy of EU (and not EC) law in the pre-Lisbon era. 122 For a detailed analysis of the role and work of the FATF, see Gilmore (n 2) chs 4–6. Gilmore characterises the FATF as an ‘ad hoc grouping of governments and others with a complex but highly focused agenda’ (at 92). 123 Since 2012, the FATF Recommendations are regularly updated (February 2013, October 2015, June 2016, October 2016, June 2017, November 2017 and February 2018). 124 See V Mitsilegas, ‘Countering the Chameleon Threat of Dirty Money: “Hard” and “Soft” Law in the Emergence of a Global Regime against Money Laundering and Terrorist Finance’ in A Edwards and P Gill (eds), Transnational Organised Crime: Perspectives on Global Security (Routledge, 2003) 195–211. 125 FATF, Financial Action Task Force Mandate (2012–2020) (Washington DC, FATF, 20 April 2012). 126 Gilmore notes that in addition to the participants in the G7 summit establishing the FATF (Canada, France, Germany, Italy, Japan, the UK, the US and the Commission), eight other states (Australia, Austria,

632 The EU and the Global Governance of Crime subsequently expanded to include ‘strategically important’ countries and largely to reflect financial globalisation.127 When looking at FATF membership today, it is striking that all 15 ‘old’ EU Member States, along with the Commission, are now full FATF members. However, none of the 12 states which joined the EU in 2004 and 2007 is a FATF member (they are all members of MONEYVAL – the Committee of Experts on the Evaluation of Anti-Money Laundering Measures, established in 1997 under the auspices of the Council of Europe).128 The main output by the FATF in terms of normative production has been the 40 Recommendations, geared mainly towards the prevention of money laundering and first published in 1990. The Recommendations were revised in 1996 and 2003, and were complemented post-9/11 by a set of eight Special Recommendations on Terrorist Finance. Although these Recommendations are not strictly instruments of ‘hard’ international law, their influence on the development of EC/EU anti-money laundering law has been tremendous. Both the second and the third EC Directives in the field, adopted in 2001 and 2005 respectively, have been justified as reactions to international developments in the field. The second Money Laundering Directive129 was justified by the Commission as necessary to implement (and go beyond) the revised FATF Recommendations of 1996.130 Both main changes introduced by the Directive (namely the extension of the money laundering predicate offences and the extension of preventive duties to non-financial professions) were justified by reference to FATF findings and requirements: the Preamble to the Directive stated that there has been a trend in recent years towards a much wider definition of money laundering based on a broader range of predicate underlying offences, as reflected, for example, in the 1996 revision of the 40 Recommendations of the FATF, the leading international body devoted to the fight against money laundering.131 It also accepted that there is a trend towards the increased use by money launderers of non-financial businesses, as confirmed by the work of the FATF on money laundering techniques and typologies.132 On the basis of these findings, the Directive extended the list of predicate offences and the list of professions to be covered by the Directive obligations to include, inter alia, lawyers.133 Belgium, Luxembourg, the Netherlands, Spain, Sweden and Switzerland) were invited to take part: Gilmore (n 2) 89. 127 The current membership criteria include, along with compliance with FATF standards, ‘strategic importance’: see FATF Membership Policy, www.fatf-gafi.org/pages/aboutus/membersandobservers/ fatfmembershippolicy.html. 128 See FATF, ‘FATF Members and Observers’, www.fatf-gafi.org/pages/aboutus/membersandobservers. 129 Directive 2001/97/EC of the European Parliament and of the Council of 4 December 2001 amending Council Directive 91/308/EEC on prevention of the use of the financial system for the purpose of money laundering [2001] OJ L344/76. 130 ‘Just as the 1991 Directive moved ahead of the original FATF 40 Recommendations in requiring obligatory suspicious transaction reporting, the European Union should continue to impose a high standard on its Member States, giving effect to or even going beyond the 1996 update of the FATF 40 Recommendations. In particular the EU can show the way in seeking to involve certain professions more actively in the fight against money laundering alongside the financial sector’: COM (1999) 352 final, 3. 131 Directive 2001/97/EC (n 129) Preamble, Recital 7. 132 ibid Recital 14. 133 Human rights concerns with regard to fair trial rights by the European Parliament have led to negotiations on the Directive being extended to the Conciliation stage – agreement was reached after the Directive was packaged as an emergency counter-terrorism measure in the weeks after 9/11. For an overview, see Mitsilegas (n 3).

Governing Crime via ‘Soft’ Law: The EU and the FATF 633 The third Money Laundering Directive was adopted in 2005.134 Its aim was twofold: to extend the scope of the legislation to also cover the fight against terrorist finance, a key political priority in the post-9/11 world; and to update existing legislation in the light of international regulatory developments in the field, most notably as regards customer identification.135 The Directive presents a major overhaul of the provisions on prevention – in particular, those provisions on customer identification – in the light of the revised FATF Recommendations in the field, introducing a number of FATF-inspired concepts such as the so-called ‘risk-based approach’ to customer identification and more detailed provisions on beneficial ownership and ‘politically exposed persons’.136 The influence of the FATF on the Community legal order is not limited to the successive Money Laundering Directives. The emphasis on terrorist finance this decade led to the adoption by the FATF of a series of ‘Special Recommendations’ on terrorist financing, reflecting the extension of the FATF mandate to cover the field. A number of Special Recommendations – which deal primarily with the surveillance of money flows – have now been implemented (quite swiftly) by the EU. These include a Regulation on controls of cash, which implements FATF Special Recommendation IX of 22 October 2004 and imposes, inter alia, requirements to declare cash over a certain threshold at the EU border;137 a Regulation on information on the payer accompanying wire transfers,138 implementing FATF Special Recommendation VII on wire transfers (SR VII);139 and a Directive on payment services in the internal market,140 implementing FATF Special Recommendation VI on alternative remittance systems.141 With the exception of the

134 Directive 2005/60/EC of the European Parliament and the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing [2005] OJ L309/15. 135 According to ibid Preamble, Recital 5: ‘Money laundering and terrorist financing are frequently carried out in an international context. Measures adopted solely at national or even Community level, without taking account of international coordination and cooperation, would have very limited effects. The measures adopted by the Community in this field should therefore be consistent with other action undertaken in other international fora. The Community action should continue to take particular account of the Recommendations of the Financial Action Task Force … which constitutes the foremost international body active in the fight against money laundering and terrorist financing. Since the FATF Recommendations were substantially revised and expanded in 2003, this Directive should be in line with the new international standard.’ 136 For further details and an overview of the Third Money Laundering Directive, see Mitsilegas and Gilmore (n 13). 137 Regulation (EC) No 1889/2005 of the European Parliament and of the Council of 26 October 2005 on controls of cash entering the Community [2005] OJ L309/9. See Recitals 4 and 5 of the Preamble to the Regulation. Recital 4 states that: ‘Account should also be taken of complementary activities carried out in international fora, in particular those of the Financial Action task Force on Money Laundering … Special Recommendation IX of 22 October 2004 of the FATF calls on governments to take measures to detect physical cash movements, including a declaration system or other disclosure obligation.’ 138 Regulation (EC) No 1781/2006 of the European Parliament and of the Council of 15 November 2006 on information on the payer accompanying transfers of funds [2006] OJ L345/1. 139 According to Recital 2 of the Preamble to the Regulation: ‘In order to facilitate their criminal activities, money launderers and terrorist financiers could try to take advantage of the freedom of capital movements entailed by the integrated financial area, unless certain coordinating measures are adopted at Community level. By its scale, Community action should ensure that Special Recommendation VII on wire transfers (SR VII) of the Financial Action Task Force … is transposed uniformly throughout the European Union, and, in particular, that there is no discrimination between national payments within a Member State and crossborder payments between Member States.’ 140 [2007] OJ L319/1. 141 See Council Doc 8864/1/09 REV 1 (2009).

634 The EU and the Global Governance of Crime Special Recommendation on non-profit organisations (which has been dealt with by non-legally binding means at the EU level), it can thus be seen that the ‘preventive’ FATF Special Recommendations have been implemented swiftly by the EU and primarily in the form of Regulations (which are directly applicable across the EU).142 This swift adoption is noteworthy in view of the potential conflict of some of these provisions with EU law. Along with the question of the existence of Community competence as regards the Cash Controls Regulation at the time,143 there are also questions about the compatibility of these measures with the development of the EU as an area without internal frontiers. A number of these provisions are essentially about the surveillance of money flows, which arguably constitutes an obstacle to the free movement of capital, with the EU already having to convince the FATF about the impossibility of imposing controls of cash within the internal borders of Member States.144 The influence of the FATF Recommendations on the evolution of EU anti-money laundering law has continued to be strong in the proposals tabled by the European Commission with the aim of aligning EU law with the revisions of the FATF Recommendations in 2012. This influence is evident in the Commission’s impact assessment accompanying the proposal for a fourth Money Laundering Directive, according to which one of the key ‘problem drivers’ is that the existing EU rules are inconsistent with the recently revised international anti-money laundering standards and explains that: [T]here is a strong incentive on jurisdictions to correct inconsistencies with the international standards. Full compliance can send an important reputational signal which is vital for countries seeking to attract foreign investment. Non-compliance on the other hand is subject to an attentive follow-up process by the FATF or MONEYVAL. Persistent non-compliance can lead to inclusion in one of the FATF’s Public Statements political and reputational damage.145

The Commission’s Explanatory Note to the proposal for a fourth Money Laundering Directive argues that ‘a revision of the Directive at this time is complementary to the revised FATF Recommendations, which in themselves represent a substantial strengthening of the anti-money laundering and combating terrorist financing framework’.146 The need to align EU law to the revised FATF Recommendations is also reflected in the

142 For further details and an evaluation in the light of the FATF standards, see Mitsilegas and Gilmore (n 13) 130. 143 ibid. 144 According to the Report on the implementation of the revised Strategy on Terrorist Financing (Council Doc, Council Doc 8864/1/09 REV 1 (n 141) 2: ‘After almost 2 years of discussion, a global agreement on an amended FATF methodology on FATF Special Recommendation IX on cash controls at the borders was reached at the February 2009 meeting in Paris. This agreement acknowledges the specificity of the EU as one jurisdiction and the possibility for it to be compliant with SR IX without (re)introducing controls at Member States’ internal borders.’ 145 Commission, ‘Impact Assessment accompanying the proposal for a Directive on the prevention of the use of the financial system for the purpose of money laundering including terrorist financing and the proposal for a Regulation on information accompanying transfers of funds’ (Staff Working Document) SWD (2013) 21 final, 18. 146 Commission, ‘Proposal for a Directive on the prevention of the use of the financial system for the purpose of money laundering including terrorist financing’ COM (2013) 45 final, 3.

Governing Crime via ‘Soft’ Law: The EU and the FATF 635 Preamble to the Directive.147 A major step in this direction has been the extension of the scope of the money laundering predicate offences to include tax offences.148 The drive to align EU law with the revised 2012 FATF Recommendations is also evident in the Commission’s proposal for a Regulation on information accompanying transfers of funds which accompanied the proposal for the fourth Money Laundering Directive.149 The Explanatory Note to the draft Regulation acknowledges that Regulation 1781/2006, which it seeks to amend, was to a large extent based on FATF Special Recommendation VII on wire transfers, but that a new set of FATF Recommendations has been adopted in 2012.150 The new Regulation is justified in a threefold manner by the Commission: in order to align EU law with the new FATF Recommendations, which the FATF ‘is constantly seeking to improve’;151 to ensure a common approach between EU Member States in order to address the ongoing evaluation of the implementation of the FATF Recommendations on the one hand152 and to ensure the free movement of capital and non-discrimination within the EU on the other;153 and in order to foster a coherent approach in the international context.154 It is revealing in this context that the Commission views the alignment of EU law with the FATF Recommendations not only to be necessary to ensure compliance with the FATF requirements at the EU level, but also to ensure the coherence of the global anti-money laundering regime whose main elements as developed by the FATF are accepted uncritically in the EU legal order. A minor shift in the EU approach is evident in the recent revision of the fourth Money Laundering Directive, with the EU emerging as a more autonomous actor in adopting legal standards on money laundering.155 The proposal for a fifth Money 147 Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC [2015] OJ L141/73. Recital 4 states that: ‘Measures adopted solely at national or even at Union level, without taking into account international coordination and cooperation, would have very limited effect. The measures adopted by the Union in that field should therefore be compatible with, and at least as stringent as, other actions undertaken in international fora. Union action should continue to take particular account of the FATF Recommendations and instruments of other international bodies active in the fight against money laundering and terrorist financing. With a view to reinforcing the efficacy of the fight against money laundering and terrorist financing, the relevant Union legal acts should, where appropriate, be aligned with the International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation adopted by the FATF in February 2012 (the revised FATF Recommendations).’ 148 Article 3(4)(f) of the draft Directive. See also Preamble, Recital 9, stating specifically that it is important to align tax crimes in line with the FATF Recommendations. For an analysis of the Directive, see V Mitsilegas and N Vavoula, ‘The Evolving EU Anti-money Laundering Regime: Challenges for Fundamental Rights and the Rule of Law’ (2016) 23 Maastricht Journal of European & Comparative Law 261; J Milaj, ‘Retention of Data in the New Anti-money Laundering Directive: “Need to Know” versus “Nice to Know”’ (2017) 7 International Data Privacy Law 115. 149 COM (2013) 44 final. 150 ibid 2. 151 ibid Preamble, Recital 3. 152 ibid. 153 ibid Recital 2. 154 ibid Recital 5. 155 European Commission, ‘Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directive 2009/101/EC’ COM (2016) 450 final.

636 The EU and the Global Governance of Crime Laundering Directive, which was released in July 2016 – and thus before the deadline for implementation of its predecessor – was prompted by the terrorist events in late 2015 and the revelations of the Panama Papers scandal, and lays down a series of measures to enhance the powers of EU Financial FIUs and establish public registries of beneficial owners of legal entities. The proposal forms part of the Commission’s Action Plan of February 2016 to strengthen the fight against terrorist financing.156 Nonetheless, as explained in the Explanatory Memorandum attached to the proposal, the latter ‘is also consistent with global developments’.157 It is added that ‘at [the] international level, the UN Security Council Resolutions 2199(2015) and 2253(2015) called for measures to prevent terrorist groups from gaining access to international financial institutions. In addition, the G20 statement of 18 April 2016 calls on the Financial Action Task Force (“FATF”) and the Global Forum on Transparency and Exchange of Information for Tax Purposes to make initial proposals to improve the implementation of the international standards on transparency, including on the availability of beneficial ownership information, and its international exchange’.158 The final text reflects the pioneering role of the EU in adopting stringent standards without internalising global standards; the fourth recital of the fifth Money Laundering Directive159 reads: While there have been significant improvements in the adoption and implementation of Financial Action Task Force (FATF) standards and the endorsement of the work of the Organisation for Economic Cooperation and Development on transparency by Member States in recent years, the need to further increase the overall transparency of the economic and financial environment of the Union is clear.

Nonetheless, whereas the involvement of FATF in shaping the legislative agenda on money laundering seems more peripheral in this case, it could be argued that the inclusion of virtual currency exchange platforms as ‘obliged entities’ subject to EU rules has been influenced by the FATF guidelines on virtual currencies.160 Furthermore, the configuration of the revised rules on cooperation between FIUs coincided with the update of the FATF Recommendations in November 2017.161 Overall, the influence of FATF standards on the EU legal order is noteworthy. These standards have been developed by a single-agenda, ad hoc body, with selective membership and a minimum of transparency and accountability in its operations.162

156 European Commission, ‘Communication from the Commission to the European Parliament and the Council on an Action Plan for strengthening the fight against terrorist financing’ COM (2016) 050 final. 157 European Commission (n 155) Explanatory Memorandum, 3. 158 ibid. 159 Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU [2018] OJ L156/43. See also the new money laundering ‘criminal law’ Directive – Directive (EU) 2018/1673 on combating money laundering by criminal law [2018] OJ L284/22 – where the need to take into account FATF standards is expressly acknowledged: Preamble, Recital 3. 160 FATF, ‘Guidance for a Risk-Based Approach: Virtual Currencies’ (June 2015), www.fatf-gafi.org/media/ fatf/documents/reports/Guidance-RBA-Virtual-Currencies.pdf. 161 FATF, Revision of the Interpretive Note to Recommendation 18 (clarifying the requirements on sharing of information related to unusual or suspicious transactions within financial groups) (November 2017). 162 For thoughts on the issues of transparency and accountability, which are relevant in the context of the FATF, see also J Cohen and CF Sabel, ‘Global Democracy?’ (2004–05) 37 NYU Journal of International Law

Governing Crime via ‘Soft’ Law: The EU and the FATF 637 In turn, the FATF depoliticised expert orthodoxy in terms of both money laundering typologies and the necessary measures to counter the phenomenon163 has constantly been renewed,164 and every time uncritically adopted by the European Commission (influencing, along with a number – but not all – of EU Member States, the evolution of the FATF standards, itself being an FATF member) in its proposals for EC and EU law in the field and subsequently by Member States in the Council. In this manner, a specific agenda developed by technocrats and with limited scrutiny at the global level has been legitimised, via the EC and EU decision-making process, and adopted at the EU level to bind both FATF and non-FATF members. The compliance of non-FATF EU members is ensured not only by the introduction of FATF ‘soft’ law in the EU legal order via clearly legally binding EU standards, but also by the membership of these states in MONEYVAL, the FATF-style regional body operating within the auspices of the Council of Europe. MONEYVAL membership consists primarily of countries from Central and Eastern Europe, both EU and non-EU members. The establishment of a specific peer-review mechanism for these states serves to ensure that the FATF peer review was complemented for non-members in Europe, but also serves to ensure compliance of these states with EU standards in the field, as MONEYVAL benchmarks are not limited to Council of Europe standards, but also include FATF, UN and EU anti-money laundering standards.165

and Policy 763, who note that ‘to a substantial and growing extent, then, rulemaking directly affecting the freedom of action of individuals, firms, and nation states (and the making of the rules to regulate this rulemaking) is taking place, undemocratically but not entirely unaccountably, in global settings created by the world’s nations but no longer under their effective control’ (at 764). 163 On various aspects of what I call the ‘depoliticisation’ in the development of global standards, see A Somek, ‘Administration without Sovereignty’ (2009) University of Iowa Legal Studies Research Paper 09-04, http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1333282 (noting that ‘where “problem-solving” serves as the preferred descriptor of an activity, ideological conflict does not enter the picture. Problemsolving is the antithesis of political struggle’ (at 17)); J Klabbers, ‘Institutional Ambivalence by Design: Soft Organizations in International Law’ (2001) 70 Nordic Journal of International Law 403 (noting that ‘the facility of doing business without being side-tracked or controlled, dovetails neatly with our late-modern (or postmodern) infatuation for management and technocracy as viable substitutes for politics’ (at 417)); D Kennedy, ‘Challenging Expert Rule: The Politics of Global Governance’ (2005) 27 Sydney Law Review 5 (talking, inter alia, about ‘the expert consensus’). For a more positive view, see AM Slaughter, A New World Order (Princeton University Press, 2004). Slaughter views the FATF typologies as ‘important opportunities for operational experts to identify and describe current money laundering trends and effective countermeasures’ and stresses the benefits of professional socialisation (at 54). She promotes the advantages of what she calls ‘government networks’, marrying hard and soft power and using information, persuasion and socialisation (at 168 et seq). 164 Kennedy notes in this context that progress narratives become policy programmes, ‘both by solidifying a professional consensus and by defining what counts as progress for the international governance system as a whole’ (Kennedy (n 163) 25). In the context of the FATF, the regular revision of both mandate and standards has been easier when compared to a more formal international organisation; see, in this context, A Boyle, ‘Some Reflections on the Relationship of Treaties and Soft Law’ (1999) 48 International and Comparative Law Quarterly 901, who notes that soft law instruments are easier to amend or replace than treaties (at 903). 165 See the MONEYVAL terms of reference: www.coe.int/dghl/monitoring/moneyval/Evaluations/About_ evaluation_en.asp. A similar process of peer review within the framework of the Council of Europe involves anti-corruption measures: the GRECO Group of states. The EU has become an observer to GRECO; see https://ec.europa.eu/home-affairs/news/20190710_european-union-becomes-observer-council-europesanti-corruption-body-greco_en.

638 The EU and the Global Governance of Crime Thus, in addition to the introduction of FATF standards in the EU legal order, a key indicator of the influence of the FATF paradigm on the EU has been the emphasis of the latter on evaluation and implementation not only through the traditional compliance methods of EU law, but also through a process of mutual evaluation and peer review which is inherent in the work of the FATF and its regional-style bodies such as MONEYVAL, but which has also been influential in the internal EU constitutional framework.166 The growing assertiveness of the EU in the production of multilateral standards in criminal matters in more traditional international fora such as the UN or the Council of Europe can only indirectly be confirmed in the context of the FATF, in large part owing to the lack of transparency in the production of ‘soft law’ in the field. At the same time, the EU has emerged as a major player in adopting in its internal legal order, via legally binding measures, the FATF standards in their constant evolution. The EU has also been instrumental in establishing a far-reaching, multi-layered framework of mutual evaluation and compliance bringing together the mechanisms employed by the FATF, the Council of Europe (and, in particular, the innovative compliance mechanisms under MONEYVAL) and the EU itself. In this manner, ‘soft law’ has perhaps proved to have sharper teeth than the multilateral conventions in the field.

V. Governing Crime via ‘Global Administrative Law’: The EU and the UN Security Council Calls for global, emergency counter-terrorism action post-9/11 have not resulted in the adoption of measures in the form of the traditional multilateral ‘hard law’ Conventions at the level of the UN. Rather, global standards have been adopted and promoted principally under the format of what legal scholars have labelled ‘global administrative law’.167 It has been noted that: [U]nderlying the emergence of global administrative law is the vast increase in the reach and forms of transgovernmental regulation and administration designed to address the consequences of globalized interdependence in such fields as security … much in the detail and implementation of such regulation is determined by transnational administrative bodies – including international organizations and informal groups of officials that perform administrative functions but are not directly subject to control by national governments or domestic legal systems or, in the case of treaty-based regimes, the states parties to the treaty.168

It is contested whether all or some of the norms included under the rubric of ‘global administrative law’ can really be classified as ‘law’.169 However, the term is a useful

166 On the emergence of peer-review mechanisms in EU law, see V Mitsilegas, ‘The European Union and the Globalisation of Criminal Law’ (2009–10) 12 Cambridge Yearbook of European Legal Studies 337. 167 B Kingsbury, N Krisch and RB Stewart, ‘The Emergence of Global Administrative Law’ (2004–05) 68 Law and Contemporary Problems 15. 168 ibid 16. 169 See in this context B Kingsbury, ‘The Concept of ‘Law in Global Administrative Law’ (2009) 20 European Journal of International Law 23; and A Somek, ‘The Concept of “Law” in Global Administrative Law: A Reply to Benedict Kingsbury’ (2009) 20 European Journal of International Law 985.

Governing Crime via ‘Global Administrative Law’ 639 analytical tool in terms of focusing on the process of the adoption of norms and in this context highlighting key differences between the development of global norms in this context and the traditional adoption of multilateral legally binding treaties. The production of normative standards at the level of ‘global administrative law’ or ‘government networks’ differs from the adoption of multilateral, expressly legally binding standards at the multilateral level in four main respects: standards are put forward by a limited number of states without the need for a global consensus; standards are adopted with a minimum of transparency; standards are adopted speedily (a factor which may explain the appeal of this form of normative production in times of perceived emergency); and standards are not explicitly legally binding rules of general application, but in reality have far-reaching consequences for law reform around the world. The adoption of preventive counter-terrorism sanctions by the UN Security Council constitutes a prime example of global administrative law in this context. The production of normative standards in criminal matters by the UN Security Council has been linked to global counter-terrorism efforts as part of a twofold strategy. The first element of this strategy has been the adoption, which began before 9/11, of a set of Resolutions specifically targeting the Taliban, Osama bin Laden, Al-Qaida and those associated with them. The first step in this direction was Resolution 1267 (1999), which imposed a series of restrictive measures against the Taliban, including an arms embargo, banning travel and the freezing of funds. In the latter context, paragraph 4(b) of the Resolution called on states to freeze funds and other financial resources, including funds derived or generated from property owned or controlled directly or indirectly by the Taliban, or by any undertaking owned or controlled by the Taliban, and to ensure that neither they nor any other funds or financial resources so designated are made available, by their nationals or by any persons within their territory, to or for the benefit of the Taliban or any undertaking owned or controlled, directly or indirectly, by the Taliban, except as may be authorised on the grounds of humanitarian need. The designation of those targeted by such measures and the consideration of exceptions will be made by a Sanctions Committee, established in paragraph 6 of the Resolution. Resolution 1333 (2000) extended the freezing regime expressly to individuals in the Al-Qaida organisation and requested the Sanctions Committee to maintain an up-to-date list of the individuals and entities designated as being associated with bin Laden, including those in Al-Qaida.170 The next substantive amendment to the sanctions regime came about after 9/11, with Resolution 1390 (2002).171 The latter adjusted the content of Resolution 1267 to take into account political developments since its adoption, but continued and consolidated the freezing regime established in paragraph 4(b) thereof. The Resolution urged all states to take immediate steps to enforce and strengthen through legislative enactments or administrative measures, where appropriate, the measures imposed under domestic laws or regulations against their nationals and other individuals or entities operating in their territory

170 Resolution 1333 (2000), para 8(c). 171 In the meantime, Resolution 1363 (2001) had established a mechanism to monitor the implementation of Resolutions 1267 and 1333.

640 The EU and the Global Governance of Crime in order to prevent and punish violations of the measures referred to in paragraph 2 of this R esolution, including the freezing of funds.172 The substantive and procedural elements of these Resolutions have been revised since, without fundamentally changing the emphasis on economic sanctions against specific individuals as a key Security Council counter-terrorism strategy.173 The emphasis on the adoption of legislative measures is even more prominent in the second element of the Security Council counter-terrorism strategy. Resolution 1373 (2001), adopted less than three weeks after the 9/11 attacks, called upon all states in particular to prevent and suppress the financing of terrorist acts, to criminalise terrorism finance and to extend the freezing regime to cover in general persons who commit or attempt to commit terrorist acts or participate in or facilitate the commission of such acts, entities owned or controlled directly or indirectly by such persons, and persons and entities acting on their behalf or direction.174 Resolution 1373 expressly called upon all states to ensure that any person who participates in the financing, planning, preparation or perpetration of terrorist acts or in supporting terrorist acts is brought to justice, and to ensure that, in addition to any other measures against them, such terrorist acts are established as serious criminal offences in domestic laws and regulations, and that the punishment duly reflects the seriousness of such terrorist acts.175 It also called upon all states, inter alia, to become parties as soon as possible to the relevant international conventions and protocols relating to terrorism, including the International Convention for the Suppression of the Financing of Terrorism of 9 December 1999.176 In this manner, the international community witnessed the production of global normative standards in the field of counter-terrorism outside the framework of the multilateral treaty. This shift did not go unnoticed by international lawyers, who stressed the Security Council’s ‘legislative’ role.177 In this context, it has been pointed out that Resolution 1373 is of a general and abstract character and does not name a single country, society or group of people;178 that with Resolution 1373, together with the related efforts of its 1267 Sanctions Committee, the Council is no longer responding with separate action directed at a particular state because of a concrete threat to peace arising from a specific incident;179 and that Resolution 1373 imposed general obligations on all states for an indefinite period, while Resolution 1267 set up a sanctions committee with court-like powers to identify and freeze the assets of individuals, groups and

172 Resolution 1267 (1999) para 8. 173 See, in this context, inter alia, Resolution 1452 (2002) amending the scope of sanctions of Resolutions 1267 and 1390; and Resolutions 1735 (2006) and 1822 (2008) introducing in particular changes in the procedures of the Sanctions Committee. 174 Resolution 1373 (2001), para 1(a)–(c). 175 ibid para 2(e). 176 ibid para 3(d). 177 See, in particular, S Talmon, ‘The Security Council as World Legislature’ (2005) 99 American Journal of International Law 175; JE Alvarez, ‘Hegemonic International Law Revisited’ (2003) 97 American Journal of International Law 873. 178 Talmon (n 177) 176–77. 179 Alvarez (n 177) 874.

Governing Crime via ‘Global Administrative Law’ 641 corporations.180 This production of normative standards by the Security Council has been criticised as undemocratic on the grounds of the limited transparency of Security Council negotiations,181 of the adoption of the Resolutions (in particular 1373) speedily as emergency measures,182 and, last but not least, on the ground of the selective membership of the Security Council. It has been forcefully pointed out that ‘a patently unrepresentative and undemocratic body such as the Council is arguably unsuitable for international lawmaking’ and that: ‘Council practice may be criticised as contrary to the basic structure of international law as a consent-based legal order.’183 It has also been argued that the Resolutions ‘circumvent the “vehicle par excellence of community interest”, namely the multilateral treaty’ and that, as such, they serve to promote the interests of a limited number of state actors.184 It must be noted in this context that the Resolutions not only impose an extensive normative restrictive counter-terrorism framework, but also aim to ensure and accelerate the implementation of the enforcement standards adopted in a pre-existing multilateral treaty, the 1999 Convention on Terrorist Finance.185 In a departure from the consensus required for the adoption of legally binding provisions in a multilateral international treaty, in the case of the UN Security Council, far-reaching norms are produced by a body operating with a limited agenda, membership, transparency or scrutiny. What makes this departure even more striking is that, in the counter-terrorism Resolutions, the individual (targeted by a series of sanctions) directly enters the realm of a system primarily designed to address inter-state relations.186 What renders the reach of these Resolutions even wider is that, in addition to the fact that they target individuals directly, they leave (in particular Resolution 1267) states and international organisations such as the EU with very limited discretion as to how to implement them. As Krisch has eloquently noted, insofar as Member State implementation is necessary to give measures effect, states’ action is reduced to a subordinate, non-discretionary role in the overall administrative machinery directed by the Council and its committees, resulting in a significant reduction of the distance between national and international law in this domain and leading to an increasing enmeshment between those layers.187

180 I Johnstone, ‘Legislation and Adjudication in the UN Security Council: Bringing down the Deliberative Deficit’ (2008) 102 American Journal of International Law 275, 283. 181 See, in particular, Talmon (n 177) 190. 182 See ibid 187; and the detailed analysis in Johnstone (n 180) 284. 183 Talmon (n 177) 179. 184 Alvarez (n 177) 874–75. Alvarez examines in detail the US influence on the passage of the Security Council Resolutions. See also Johnstone (n 180) 300, who points out that multilateral treaty negotiations tend to balance global concerns, leading to trade-offs and bargains that account for a wider range of interests than typically come out of Security Council negotiations. 185 See, in this context, the criticism of Alvarez, who notes that: ‘In Resolution 1373 the Council selected certain provisions of the then recently concluded International Convention for the Suppression of the Financing of Terrorism, added to others, and omitted other portions of the Convention (such as the explicit deference to other requirements of international law, including the rights due to persons charged with terrorism-related offences, the rights of extradited persons, the requisites of international humanitarian law, and the provisions on judicial dispute settlement).’ Alvarez (n 177) 875. 186 See especially in this context, PC Szasz ‘The Security Council Starts Legislating’ (2002) 96 American Journal of International Law 901; Johnstone (n 180) 295. 187 N Krisch, Beyond Constitutionalism: The Pluralist Structure of Postnational Law (Oxford University Press, 2010) 156–57.

642 The EU and the Global Governance of Crime

A. Implementation of the UN Security Council Resolutions by the EU The Resolutions have been implemented at the EU level via a combination of crosspillar legal instruments. Implementation of the first set of Resolutions, targeting the Taliban, Osama bin Laden and Al-Qaida and their associates, followed shortly after the adoption of the measures by the Security Council and consisted of second pillar Common Positions combined with first pillar Regulations. Council Common Position of 15 November 1999 concerning restrictive measures against the Taliban (1999/727/ CFSP),188 adopted under Article 15 TEU, stated that action by the Community is needed in order to implement the measures cited therein189 and called, inter alia, for flight bans,190 and for funds and other financial resources held abroad by the Taliban under the conditions set out in UN Security Council Resolution 1267 (1999) to be frozen.191 The Common Position was accompanied by Council Regulation (EC) No 337/2000 of 14 February 2000 concerning a flight ban and a freeze of funds and other financial resources in respect of the Taliban of Afghanistan,192 which was adopted under Articles 60 and 301 EC. Counter-terrorism action under the first pillar was justified by a statement that the measures set out in paragraph 4 of Resolution 1267 (1999) fall under the scope of the Treaty and therefore, notably with a view to avoiding distortion of competition, Community legislation is necessary to implement the relevant decisions of the Security Council as far as the territory of the Community is concerned.193 The Regulation stated, inter alia, that all funds and other financial resources designated by the Taliban Sanctions Committee will be frozen and that no funds or other financial resources designated by the Taliban Sanctions Committee will be made available to or for the benefit of the Taliban or any undertaking owned or controlled, directly or indirectly, by the Taliban.194 Thus, the Regulation, in combination with the Common Position, established a system of sanctions at the Community level by reference to the sanctions adopted at the UN Security Council. The same approach was adopted in order to implement Resolution 1333 (2000). A Council Common Position was adopted under Article 15 TEU,195 accompanied by a first pillar Regulation adopted under Articles 60 and 301 EC,196 with Community competence and action justified in a similar manner as to the adoption of

188 [1999] OJ L294/1. 189 ibid Preamble, Recital 2. 190 ibid art 1. 191 ibid art 2. 192 [2000] OJ L43/1. 193 ibid Preamble, recital 3. 194 ibid art 3. 195 Council Common Position of 26 February 2001 concerning additional restrictive measures against the Taliban and amending Common Position 96/746/CFSP (2001/154/CFSP) [2001] OJ L57/1. 196 Council Regulation (EC) No 467/2001 of 6 March 2001 prohibiting the export of certain goods and services to Afghanistan, strengthening the flight ban and extending the freeze of funds and other financial resources in respect of the Taliban of Afghanistan and repealing Regulation (EC) No 337/2000 [2001] OJ L67/1.

Governing Crime via ‘Global Administrative Law’ 643 Regulation 337/2000.197 The measures continued the Community sanctions regime established by reference to Security Council sanctions. The system was renewed, with some changes, at the implementation of Resolution 1390 (2002). A Council Common Position was again adopted under Article 15 TEU.198 However, the legal basis to the parallel first pillar Regulation was extended to include, along with Articles 60 and 301 EC, A rticle 308 EC.199 The addition of Article 308 to the legal basis of Regulation 881/2002 has been attributed to the need to take account of political developments taking place at the time. By January 2002, the Taliban regime in Afghanistan had fallen and so at the time that the Regulation was adopted, the persons and entities listed did not have a direct connection with the territory or governing regime of a third country. The initial choice of legal bases of Articles 60 and 301 EC, which was based on the principle that the individuals and entities listed were in effective control of the territory of a third country, or were associated with those in effective control and provided them with financial support was thus deemed no longer adequate to address the situation in Afghanistan.200 Under this technique, sanctions against individuals not linked to the government or the control of a country now fall clearly under the scope of Community law,201 with Regulation 881/2002 consolidating and expanding the sanctions regime in the light of developments in the Security Council.202 Parallel second and first pillar measures were subsequently adopted under the same legal bases, including measures implementing the exceptions to the sanctions regime introduced by Resolution 1452(2002),203 while the list of individuals or entities subject to the Community sanctions regime is being

197 According to Recital 3, Resolution 1333 (as with its predecessor Resolution 1267) fell within the scope of the Treaty and, therefore, notably with a view to avoiding distortion of competition, Community legislation was necessary to implement the relevant decisions of the Security Council, as far as the territory of the Community is concerned. 198 Council Common Position of 27 May 2002 concerning restrictive measures against Osama bin Laden, members of the Al-Qaida organisation and the Taliban and other individuals, groups, undertakings and entities associated with them and repealing Common Positions 96/746/CFSP, 1999/727/CFSP, 2001/154/CFSP and 2001/771/CFSP (2002/402/CFSP) [2002] OJ L139/4. 199 Council Regulation (EC) No 881/2002 of 27 May 2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Osama bin Laden, the Al-Qaida network and the Taliban, and repealing Council Regulation (EC) No 467/2001 [2002] OJ L139/9. As with the earlier Regulations, the avoidance of the distortion of competition was evoked as necessitating Community implementation of the relevant Security Council measures (Preamble, recital 4). 200 See M Cremona, ‘EC Competence, “Smart Sanctions” and the Kadi Case’ (2009) 28 Yearbook of European Law 559, 569. Cremona explains in detail the evolution of the interpretation of arts 60(1) and 301 EC in Community legislation prior to the adoption of the Regulations in question. She notes that although neither of these provisions expressly mentions individuals, instead referring to ‘economic relations with one or more third countries’, the concept has been broadly interpreted, in the first place to allow for targeted sanctions against natural and legal persons who are connected to a government or regime – the aim being to put pressure on a third state by taking measures against those people or entities who are either part of the government or closely connected to it (at 567–68). 201 It is noteworthy that the Preamble to Regulation 881/2002 also contains references to Resolution 1373, which extends the scope of economic sanctions beyond the Taliban (Recital 3). 202 See in particular, arts 2, 4 and 6 of Regulation 881/2002. 203 Council Common Position 2003/140/CFSP of 27 February 2003 concerning exceptions to the restrictive measures imposed by Common Position 2002/402/CFSP [2003] OJ L53/62; Council Regulation (EC) No 561/2003 of 27 March 2003 amending, as regards exceptions to the freezing of funds and economic resources, Regulation (EC) No 881/2002 [2003] OJ L82/1.

644 The EU and the Global Governance of Crime regularly updated by Commission Regulations introducing the amendments in the lists made by the Sanctions Committee into the Community legal order.204 A slightly different strategy was followed to implement Resolution 1373 in the EC and EU legal order. The contents of Resolution 1373 were split into two separate Council Common Positions: one concerning the general requirement for states to take action at the level of criminalisation, prevention and prosecution;205 and one specifically concerning sanctions against individuals.206 Adopted as emergency measures a few weeks after 9/11 (and the adoption of Resolution 1373), the Common Positions were adopted under a joint second and third pillar legal basis (Articles 15 and 34 TEU). The first, ‘general’ Common Position contains both provisions on freezing and provisions related to general obligations of criminalisation and prevention, ordinarily covered at the time by the third pillar. The second, ‘sanctions’ Common Position included both provisions on sanctions, and a general provision on cooperation and assistance between Member States (Article 4), which were also deemed to fall under the then third pillar. This Common Position was again accompanied by a first pillar Regulation adopted under Articles 60, 301 and 308 EC.207 According to the Preamble to the Regulation, Community action was necessary in order to implement the Common Foreign and Security Policy (CFSP) aspects of Common Position 2001/931/CFSP.208 The absence of a reference to the necessity of Community action to prevent distortion of competition (a model followed in the Regulations implementing the other Security Council sanctions Resolutions described above) is noteworthy in this context. Community action is here justified in order to implement the second pillar elements of the parallel Common Position. In this manner, an autonomous system of Community sanctions has been established, complementing the system where UN sanctions are copied by the Community described in the paragraphs above.209 Listing is done at the Community level, and the relevant lists are updated on a regular basis, this time by Council (and not Commission) instruments.210

204 Commission Implementing Regulation (EU) 2020/259 of 25 February 2020 amending for the 310th time Council Regulation (EC) No 881/2002 imposing certain specific restrictive measures against certain persons and entities associated with the ISIL (Da’esh) and Al-Qaida organisations [2020] OJ L54, 26 February. 205 Council Common Position of 27 December 2001 on combating terrorism (2001/930/CFSP) [2001] OJ L344/90. Along with general provisions on the freezing of funds and refraining from making funds available for terrorism, the Common Position calls inter alia for the criminalisation of terrorist finance (art 1, elements of the definition being copied from Resolution 1373), the suppression of support for terrorism (art 4), prevention (art 5) and bringing persons who participate in the financing, planning, preparation or perpetration of terrorist acts to justice (art 8). The Common Position further calls upon Member States to become parties as soon as possible to the relevant international conventions and protocols relating to terrorism listed in the annex to the Common Position (including the 1999 Terrorist Finance Convention – art 14). 206 Council Common Position of 27 December 2001 on the application of specific measures to combat terrorism (2001/931/CFSP) [2001] OJ L344/93. 207 Council Regulation (EC) No 2580/2001 of 27 December 2001 on specific restrictive measures directed against certain persons and entities with a view to combating terrorism [2001] OJ L344/70. 208 ibid Recital 3. 209 For a categorisation and overview of the various strands of the Community sanctions regime, see C Eckes, EU Counter-terrorist Policies and Fundamental Rights: The Case of Individual Sanctions (Oxford University Press, 2009). 210 For the latest list, at the time of writing, see Council Decision 2009/1004/CFSP of 22 December 2009 updating the list of persons, groups and entities subject to Articles 2, 3 and 4 of Common Position 2001/931/ CFSP on the application of specific measures to combat terrorism [2009] OJ L346/58.

Governing Crime via ‘Global Administrative Law’ 645

B. Judicial Review of the EU Implementation of UN Security Council Resolutions: Kadi I The relationship between EU law and the emergence of international norms in criminal matters has been tested extensively in litigation involving challenges to the EC/EU implementation of UN Security Council Resolutions. The Kadi I litigation involved rulings by both the Court of First Instance (CFI)211 and, on appeal, the Court of Justice.212 Along with the constitutionality of the EU legislator’s choice of legal basis to implement UN Security Council Resolution 1267 (1999), which the Court has managed to accommodate,213 the main issue at stake was the request by the applicants for the annulment of Regulation 467/2001, which, along with Common Position 2001/154/CFSP, implemented Security Council Resolution 1333 (2000) on the ground of the breach of their fundamental rights.214 The assertion of Community competence for the adoption of economic sanctions against individuals rendered the answer to the other main claim of the applicants, namely that the measures in question were in breach of fundamental rights, central in determining the relationship between Security Council norms and EU law, and the position of the individual therein. At the heart of this issue is the question of the extent to which measures implementing Security Council Resolutions can be reviewed in the light of Community law. The CFI took a very narrow view, essentially ruling that it could only review the lawfulness of the norms in question with regard to jus cogens.215 This ruling was rightly criticised for disregarding the autonomy of the Community legal order and for limiting the avenues for review on the grounds of fundamental rights.216 In this context, the CFI ruling was marked by an uncritical deference to the security logic underpinning executive counter-terrorism action as embodied in this context by the Security Council measures.217 However, on appeal, the Court of Justice responded with a remarkable departure from the CFI reasoning and outcome in a judgment linking the importance of respect for fundamental rights and the rule of law to the autonomy of the Community legal order. The Court began by stressing unequivocally that the Community is based on the rule of law,218 adding that fundamental rights form an integral part of the general

211 Case T-315/01, Yassin Abdullah Kadi v Council and Commission [2005] ECR II-3649; Case T-306/01, Ahmed Ali Yussuf and Al Barakaat International Foundation v Council and Commission [2005] ECR II-3533. 212 Joined Cases C-402/05P and C-415/05P, Yassin Abdullah Kadi and Al Barakaat International Foundation v Council and Commission [2008] ECR I-6351. 213 For details, see Mitsilegas (n 166). 214 See section III above. For a background to the legal framework of the case, see paras 11–45 of the Kadi CJEU ruling (n 211). 215 ibid paras 226 et seq; Yusuf and Al Barakaat (n 211) paras 277 et seq. 216 See, in particular, P Eeckhout, ‘Community Terrorism Listings, Fundamental Rights, and UN Security Council Resolutions: In Search of the Right Fit’ (2007) 3 European Constitutional Law Review 183. 217 See, in this context, J Murkens, ‘Countering Anti-constitutional Argument: The Reasons for the European Court of Justice’s Decision in Kadi and Al Barakaat’ (2008–09) 11 Cambridge Yearbook of European Legal Studies 15. 218 Kadi (n 212) para 281.

646 The EU and the Global Governance of Crime principles of law the observance of which the Court ensures,219 that respect for human rights is a condition for the lawfulness of Community acts and that measures incompatible with respect for human rights are not acceptable in the Community.220 At the same time, the Court stressed the autonomy of the Community legal order by stating that an international agreement could not affect the allocation of powers fixed by the Treaties or, consequently, the autonomy of the Community legal system,221 adding that the obligations imposed by an international agreement could not have the effect of prejudicing the constitutional principles of the EC Treaty.222 In this context, the Court noted that the primacy of international agreements in Community law would not extend to primary law, in particular to the general principles of which fundamental rights form part.223 In this light, the review by the Court of the validity of any Community measure in the light of fundamental rights had to be considered the expression, in a community based on the rule of law, of a constitutional guarantee stemming from the EC Treaty as an autonomous legal system which is not to be prejudiced by an international agreement.224 The Court combined these two lines of reasoning to assert its power to review the measures in question. In this context, the Court was careful to specify that the review of lawfulness to be ensured by the Community judicature applies to the Community act intended to give effect to the international agreement at issue, and not to the latter as such.225 The Court thus attempted to draw a distinction between a review of Community measures (which it had the power to conduct) and a review of UN measures (which fell outside its jurisdiction, even under jus cogens).226 According to the Court, while for the purposes of the interpretation of the contested Regulation, account had to be taken of the wording of Resolution 1390 (2002),227 the UN Charter did not impose the choice of a particular model of the implementation of resolutions.228 Moreover, the Regulation in question was not directly attributable to the UN.229 The Court thus asserted its power for the full review, in principle, of the lawfulness of all Community acts in the light of fundamental rights.230 It therefore found that the CFI had erred in law in this context.231 219 ibid para 283. The Court noted the special significance of the ECHR in this context referred to its ruling on the compatibility of the second Money Laundering Directive with fundamental rights – see section V.B above. 220 ibid para 284. The Court also stressed that the wording of Treaty Articles such as arts 297 and 307 EC cannot be understood as derogating from or challenging the principles of liberty, democracy and respect for human rights and fundamental freedoms enshrined in art 6(1) TEU as a foundation of the EU (see paras 303–04). 221 ibid para 282. 222 ibid para 285. 223 ibid para 308. 224 ibid para 316. 225 ibid para 286. 226 ibid para 287. The Court further noted that any judgment given by the Community judicature deciding that a Community measure intended to give effect to such a resolution is contrary to a higher rule of law in the Community legal order would not entail any challenge to the primacy of that resolution in international law; see para 288. 227 ibid para 297. 228 ibid para 298. 229 ibid para 314. 230 ibid para 326. 231 ibid para 327.

Governing Crime via ‘Global Administrative Law’ 647 The Court then reviewed the Regulation and annulled it (setting aside the CFI j udgment), finding that the rights of the defence, in particular the right to be heard, and the right to effective judicial review of those rights, were patently not respected,232 and that the measures entailed an unjustified restriction of Mr Kadi’s right to property.233 However, the Court also ruled that the freezing of funds could not per se be regarded as inappropriate or disproportionate ‘with reference to an objective of general interest as fundamental to the international community as the fight by all means against the threats to international peace posed by acts of terrorism’.234 In Kadi, the Court sent a strong signal about the autonomy of the Community legal order in external relations in general and the emergence of the EU as a global actor in security matters in particular.235 The assertion of the autonomy of the Community legal order was based on what the Court deemed to be fundamental principles of the Community constitutional order, namely the rule of law and the respect of fundamental rights. The focus on these principles further enabled the Court to embark on a hierarchisation exercise, asserting the primacy of what it called ‘a higher rule of law in the Community legal order’ over international agreements. The determination of the Court to stress the autonomy and primacy of the Community legal order was criticised by certain commentators, in that it showed an unwillingness to engage in a dialogue with the UN Security Council,236 while others viewed it rightly as a move of empowerment for the EU.237 A key factor in the Court’s interpretative choice was the nature of the measures under review: rather than being norms of general application, these were sanctions addressed to and directly affecting individuals.238 The focus on the individual rendered the articulation of a reasoning based on the protection of fundamental rights in a legal order based on the rule of law imperative. In this context, it is significant that the Court had to translate the position of the individual from the international to the Community legal order. Under international law (whose logic is premised primarily upon the state as a referent object), the individual is sidelined.239 By contrast, in the Community legal order based on the rule of law and fundamental rights, the position of the individual is central. The differences between the international and the Community legal orders, and the special features of the Community legal order in this context left

232 ibid para 334. 233 ibid para 370. 234 ibid para 363. 235 As Halberstam and Stein have noted, ‘until Kadi, the story of European constitutionalism has focused largely on establishing the Community’s legal order as autonomous from those of the Member States. With few exceptions, the constitutional gaze has been inward looking, that is, setting off the Union’s legal order from, and integrating it with, those of the Member States’. D Halberstam and E Stein, ‘The United Nations, the European Union, and the King of Sweden: Economic Sanctions and Individual Rights in a Plural World Order’ (2009) 46 CML Rev 13, 62. 236 G de Burca, ‘The European Court of Justice and the International Legal Order after Kadi’ (2009) NYU School of Law Jean Monnet Working Paper 01/2009, 36, www.jeanmonnetprogram. org/papers/09/090101. html. 237 T Tridimas, ‘Terrorism and the ECJ: Empowerment and Democracy in the EC Legal Order’ (2009) 34 European Law Review 103. 238 ibid 113. 239 See in this context the criticism of the CFI ruling by Guild, who points out that the structure of politics and law at the international level leaves the individual without a voice or visibility: E Guild, EU Counter-terrorism Action: A Fault Line between Law and Politics? (CEPS, 2010) 9–10.

648 The EU and the Global Governance of Crime the Court with little choice but to focus on the individual when interpreting the relationship between Community law and Security Council norms. However, these features of the Court’s ruling in Kadi should not be seen as signifying a complete dichotomy between Security Council norms on sanctions and Community law implementing these sanctions. In Kadi, the Court reiterated its finding that when interpreting the Regulation, account should be taken of the Security Council Resolution which the Regulation was designed to implement.240 While in Kadi the Court’s use of the wording of the Security Council Resolution as an interpretative tool did not avoid the annulment of the Regulation implementing Security Council Resolution 1390 (2002) on fundamental rights grounds, such use under a purposive interpretation was subsequently evoked by the Court in the case of M and Others to promote the Community law protection of the individual under the sanctions regime.241 On the other hand, a closer look at the relationship between the Community and Security Council norms and its interpretation by the Court demonstrates that the autonomy of the Community legal order, in particular as regards the respect of fundamental rights and the rule of law, is not that clear. Notwithstanding the Court’s assertion that the Community has leeway as to the method of implementation of the Security Council Resolution in question, and that the Regulation in question was not directly attributable to the UN, the fact remained that the mechanism used by the Community consists of directly importing listings by the Sanctions Committee into the Community legal order without the opportunity for the Community to modify them. The Community legal order thus accepted the verdict of a UN body operating beyond the scrutiny mechanisms of EC law resulting in highly invasive measures against individuals. It could, of course, be observed in this context that the Court’s intervention in Kadi emphasised the need for procedural standards in the listing procedure. Therefore, it could be viewed as part of a process linked to improvements in Security Council norms and practice as regards procedural rights.242 However, while the Court is prepared to review the compatibility of both procedural and certain substantive aspects of the Community sanctions regime implementing Security Council Resolutions with fundamental rights, it did not question the legitimacy, binding character or method of adoption of these Resolutions by a body such as the Security Council.243 This reluctance

240 Kadi (n 211) para 297. See also Case C-117/06, Möllendorf and Möllendorf – Niehuus [2007] ECR I-8361, para 54. 241 Case C-340/08, The Queen on the Application of M and Others v Her Majesty’s Treasury, [2010] ECR I-03913 (CJEU, 29 April 2010). The Court referred to the need to take into account of the wording and purpose of Resolution 1390 (2002), which Regulation 881/2002 (the implementation of which by the UK was the subject of a preliminary reference by the House of Lords) was designed to implement (at para 45). The Court focused on the linguistic divergences in the wording of art 2(2) of the Regulation in the different language versions and justified the need to take into account of the substance of Resolution 1390 (2002), but also of subsequent Security Council Resolutions and initiatives (paras 49–51). The Court opted for a restrictive interpretation of the scope of art 2(2) of the Regulation. 242 For an analysis of subsequent revisions of Security Council Resolutions in this light, in particular by Resolution 1822 (2008), see M Scheinin, ‘Is the ECJ Ruling in Kadi Incompatible with International Law?’ (2009) 28 Yearbook of European Law 637, 648–50. 243 Indeed, the language of the Court in Kadi stressed the relationship of Community law with international agreements.

Governing Crime via ‘Global Administrative Law’ 649 may be understandable in the light of the Court’s choice to assert jurisdiction with regard to measures which could be considered to be executive and thus outside judicial review. However, the fact remains that the Court did not question the fundamental choice by the Community to follow the security logic of the Security Council and copy the latter’s system of far-reaching sanctions against individuals as a counter-terrorism tool.244 As far as the EU is concerned, the imposition of UN-led individual sanctions as such remains a central element of the EU’s security policy.

C. Judicial Review of the EU Implementation of UN Security Council Resolutions: Kadi II The Court of Justice was invited to revisit its case law following the lodging of a request by Mr Kadi of annulment of a revised EU asset freezing Regulation which continued to list him therein, notwithstanding the Court’s ruling in Kadi I.245 During the Kadi II litigation, a number of key developments took place following the Court’s ruling in Kadi I, including, most notably, a series of revisions to the UN Security Council system of listing individuals whose assets should be frozen under Resolution 1267. Resolution 1822 (2008) introduced the requirement for listing proposals to identify those parts of the statement of case that may be publicly released, including for use by the Sanctions Committee for development of the summary described below or for the purpose of notifying or informing the listed individual or entity, and those parts which may be released upon request to interested States.246 The Resolution also provides that the Sanctions Committee, when it adds a name to its Consolidated List, is to make accessible on its website ‘a narrative summary of reasons for listing’ and that it is to make accessible on the same site ‘narrative summaries of reasons for listing’ names on that list before the adoption of Resolution 1822/2008.247 A further Security Council Resolution, 1904/2009, established an ‘Office of the Ombudsperson’, whose task is to assist the Sanctions Committee in the consideration of delisting requests. The person appointed to be the Ombudsperson must be an individual of high moral character, impartiality and integrity, with high qualifications and experience in relevant fields, including law, human rights, counter-terrorism and sanctions.248 A subsequent Resolution, 1989 (2011), extended the mandate and support of the Ombudsperson and included detailed provisions on listing and delisting procedures.249 The Security Council continues to have the ultimate decision-making power on delisting and is not obliged to follow a delisting recommendation by the Ombudsperson.250 Improvements in the listing procedure under Resolution 1822/2008 have been reflected in the EU legal order in

244 See also in this context the criticism of Scheinin, who advocates for the repeal of Resolution 1267 and its replacement with national or EU-level terrorist listing pursuant to Resolution 1373: Scheinin (n 242). 245 Regulation EC No 1190/2008 amending for the 101st time Regulation No 881/2001 [2008] OJ L322, 25. 246 Resolution 1822 (2008) para 12. 247 ibid para 13. 248 ibid para 20. 249 ibid para 12–35. 250 ibid para 23.

650 The EU and the Global Governance of Crime EU R egulation 1286/2009.251 According to the Regulation, the Commission will take a decision to list a natural or legal person for the first time only as soon as a statement of reasons is provided by the Sanctions Committee.252 Once the listing decision has been taken, the Commission must communicate without delay the statement of reasons to the affected parties providing an opportunity to express their views on the matter.253 The Commission must review its listing decision following the submission of observations which must be forwarded to the Sanctions Committee.254 A similar process may apply for those listed before 3 September 2008.255 Improvements in the UN listing system have led to hopes that the differences between UN Security Council practice and EU constitutional law as demonstrated in Kadi I could be bridged.256 However, further academic analyses have highlighted the persistent rule of law and human rights shortcomings of the UN Security Council sanctions system and the limits to the mandate and powers of the Ombudsperson.257 In deciding on the Kadi II appeal, the CJEU was faced with the markedly different approaches adopted by the General Court and the AG in their examination of the case. The General Court applied, albeit reluctantly, the reasoning of the Court of Justice in Kadi I and advocated the full review of not only the apparent merits of the contested measure but also the evidence and information on which the findings made in that measure are based.258 The General Court reiterated the CJEU emphasis in Kadi I on the need, in principle, for the full review of the contested Regulation in the light of fundamental rights,259 and went on to advocate extensive judicial review. The General Court highlighted the limits in judicial protection offered by improvements in the Security Council listing system.260 It advocated the application in this case as regards the extent and intensity of judicial review of the principles set out by the General Court with respect to the scrutiny of the autonomous EU sanctions regime in its OMPI case law.261 In particular, judicial review would include the review of the interpretation made by the competent EU institutions of the relevant facts: EU courts must not only establish whether the evidence relied on is factually accurate, reliable and consistent, but must also ascertain whether that evidence contains all the relevant information to be taken into account in order to assess the situation and

251 Council Regulation 1286/2009 amending Regulation No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Osama bin Laden, the Al-Qaida network and the Taliban [2009] OJ L346/42. 252 ibid art 7a(1). 253 ibid art 7a(2). 254 ibid art 7a(3). 255 ibid art 7c. 256 See J Kokott and C Sobotta, ‘The Kadi Case: Constitutional Core Values and International Law – Finding the Balance?’ (2012) 23 European Journal of International Law 1015. 257 G Sullivan and M de Goede, ‘Between Law and the Exception: the UN 1267 Ombudsperson as a Hybrid Model of Legal Expertise’ (2013) 26 Leiden Journal of International Law 833. 258 Case T-85/09, Kadi v Commission [2010] ECR II-5177. For a commentary, see C Eckes, ‘Controlling the Most Dangerous Branch from Afar: Multilayered Counter-terrorist Policies and the European Judiciary’ (2011) Amsterdam Law School Legal Studies Research Paper No 2011-08, 12–13, http://papers.ssrn.com/ so13/papers.cfm?abstract_id=1865785. 259 Kadi (n 211) para 126. 260 ibid para 128. 261 ibid para 139.

Governing Crime via ‘Global Administrative Law’ 651 whether it is capable of substantiating the conclusions drawn from it.262 Secrecy is not compatible with the requirements of such a level of judicial review: the General Court reiterated its findings in PMOI II263 that the Council is not entitled to base its decision to freeze funds on information or material in the file communicated by a Member State if the said Member State is not willing to authorise its communication to the EU courts whose task is to review the lawfulness of that decision; more importantly, the refusal by the Member State and the Council to communicate, even to the Court alone, certain information on which the contested measure was based had the consequence that the Court was unable to review the lawfulness of the contested decision.264 The General Court further supported these arguments by emphasising the draconian nature of freezing orders for the applicant which had been in place for a long period of time265 and putting forward the view that the measures in question were not temporary or precautionary, but actually of a criminal nature.266 According to the Court, the principle of full and rigorous judicial review of such measures is all the more justified, given that such measures have a marked and long-lasting effect on the fundamental rights of the persons concerned.267 In applying this standard of review, the General Court found that the rights of defence and effective judicial protection of Mr Kadi had been breached268 and that the contested Regulation also entailed a breach of the principle of proportionality by infringing Mr Kadi’s right to respect for property.269 In his Opinion, AG Bot advocated a much narrower scope of judicial review.270 He argued that freezing is merely a precautionary measure and does not constitute a criminal sanction, nor does it imply an accusation of a criminal nature.271 He then stressed that listing at the EU level is based on the decision of the UN and that such a decision is based on a summary of reasons drawn up by the Sanctions Committee on the basis of information or evidence which is provided to it by the state(s) that made

262 ibid para 142. 263 Case T-256/07, People’s Mojahedin Organization of Iran v Council (PMOI II) [2008] ECR II-3019. 264 Kadi (n 211) para 145. 265 ibid para 149. 266 ibid para 150: ‘It might even be asked whether – given that now nearly 10 years have passed since the applicant’s funds were originally frozen – it is not now time to call into question the finding of this Court, at paragraph 248 of its judgment in Kadi, and reiterated in substance by the Court of Justice at paragraph 358 of its own judgment in Kadi, according to which the freezing of funds is a temporary precautionary measure which, unlike confiscation, does not affect the very substance of the right of the persons concerned to property in their financial assets but only the use thereof. The same is true of the statement of the Security Council, repeated on a number of occasions, in particular in Resolution 1822 (2008), that the measures in question “are preventative in nature and are not reliant upon criminal standards set out under national law”. In the scale of a human life, 10 years in fact represent a substantial period of time and the question of the classification of the measures in question as preventative or punitive, protective or confiscatory, civil or criminal seems now to be an open one.’ The General Court also referred to the opinion of the United Nations High Commissioner for Human Rights (para 150) and to the interpretative notes to ‘Special Recommendation II on Terrorist Financing’, which recognises that the objectives of the recommended asset freezing measures are not only preventative but also punitive (para 163). 267 Kadi (n 211) para 151. 268 ibid paras 171–78 269 ibid paras 192–95. 270 ibid, Opinion of AG Bot (delivered on 19 March 2013). 271 ibid para 68.

652 The EU and the Global Governance of Crime the listing request, in most cases in confidence, and that is not intended to be made available to the EU institutions.272 This deference to decision-making at the UN level is coupled by the AG’s view that listings are part of a political process which goes beyond any individual case, and that the political dimension of this process in which the EU has decided to participate calls for moderation in the performance of the judicial review by the EU judicature – that is, it must not, in principle, substitute its own assessment for that of the competent political authorities.273 In this manner, the AG downplayed the impact of the listing process on the affected individuals and treated listing as a political rather than a legal issue which merits limited judicial scrutiny. In addition to these arguments, the AG cited the improvements in the procedure before the Sanctions Committee since 2008, which also militated in favour of a limited review of the internal lawfulness of the contested regulation by the EU judicature.274 This view was in line with the arguments of the Commission, the UK and intervening Member States in the appeals before the Court of Justice.275 According to the AG, an effective global fight against terrorism requires confidence and collaboration between the participating international, regional and national institutions rather than mistrust – the mutual confidence which must exist between the EU and the UN is justified by the fact that the values concerning respect for fundamental rights are shared by those two organisations.276 The assertion of such mutual trust enables the AG to accept that the listing and delisting procedures within the Sanctions Committee provide sufficient guarantees for the EU institutions to be able to presume that the decisions taken by that body are justified.277 This mutual trust and the presumption of compliance of Sanctions Committee procedures with EU law, along with the emphasis on the need to privilege the choices of states operating within the UN sanctions system, led the AG to considerably limit the scope of judicial scrutiny by concluding that the review performed by the EU judicature of the internal lawfulness of EU acts giving effect to decisions taken by the Sanctions Committee must not, in principle, call into question the merits of the listing, except in cases where the implementation procedure for that listing within the EU has highlighted a flagrant error in the factual finding made, in the legal classification of the facts or in the assessment of the proportionality of the measure.278 The Court of Justice adopted a more extensive model of judicial review than the one proposed by the AG.279 It concurred with the General Court and the AG in refusing to afford the contested Regulation immunity from jurisdiction.280 The Court then made express reference to the need for the European judiciary to ensure the, in principle, full review of the lawfulness of all EU acts in the light of fundamental rights,281

272 ibid

para 75. para 80. 274 ibid para 81. 275 ibid paras 82–84. 276 ibid para 85. 277 ibid para 87. 278 ibid para 110. 279 Joined Cases C-584/10 P, C-593/10 P and C-595/10 P, European Commission v Kadi (CJEU, 18 July 2013). 280 ibid paras 65–68. 281 ibid para 97. 273 ibid

Governing Crime via ‘Global Administrative Law’ 653 and mentioned in particular the respect for the rights of the defence and the right to effective judicial protection as enshrined in Articles 41(2) and 47 of the Charter respectively.282 Respect for these rights entails a number of obligations relating to the provision of reasons for the EU listing authority.283 As regards the extent of judicial review, the Court found that the EU judiciary must determine whether the competent EU authority has complied with procedural safeguards, including the obligation to state reasons.284 Moreover, effective judicial review requires that, as part of the review of the lawfulness of the grounds which are the basis of the decision to list or to maintain the listing of a given person, the EU courts are to ensure that that decision is taken on a sufficiently solid factual basis. Judicial review cannot be restricted to an assessment of the cogency in the abstract of the reasons relied on, but must concern whether those reasons or, at the very least, one of those reasons, deemed sufficient in itself to support that decision, is substantiated.285 To that end, it is for the EU courts, in order to carry out that examination, to request the competent EU authority, when necessary, to produce information or evidence, confidential or not, relevant to such an examination.286 The Court thus advocated a standard of evidence-based, detailed, substantive judicial review in concreto and not in abstracto.287 The Court of Justice thus put forward a standard of judicial review which consists of the substantive review of the listing based on evidence and information submitted to the European judiciary. It attempted to accommodate to some extent security arguments relating to secrecy.288 In order to strike a balance between the requirements attached to the right to effective judicial protection and those flowing from the security of the EU or its Member States or the conduct of their international relations, it is legitimate to consider possibilities such as the disclosure of a summary outlining the information’s content or that of the evidence in question. However, irrespective of whether such possibilities are taken, it is for the EU courts to assess whether and to what extent the failure to disclose confidential information or evidence to the person concerned and their consequential inability to submit their observations on them are such as to affect the probative value of the confidential evidence.289 Having regard to the preventive nature of the restrictive measures at issue, if, in the course of their review of the lawfulness of the contested decision, the EU courts consider that, at the very least, one of the reasons mentioned in the summary provided by the Sanctions Committee is sufficiently detailed and specific, that it is substantiated and that it constitutes in itself sufficient basis to support that decision, the fact that the same cannot be said of other such reasons cannot justify the annulment of that decision. In the absence of one such reason, the EU courts will annul the contested decision.290

282 ibid

paras 98–100. paras 111–16. 284 ibid para 118. 285 ibid para 119. 286 ibid para 120. 287 For further details, see ibid paras 121–24. 288 See ibid para 125–27. 289 ibid paras 128–29. 290 ibid para 130. 283 ibid

654 The EU and the Global Governance of Crime While attempting to accommodate to some extent security considerations, in Kadi II, the Court of Justice adopted a rigorous, substantive test of judicial review of listing decisions by the European judiciary. It reiterated that such a judicial review is indispensable to ensure a fair balance between the maintenance of international peace and security, and the protection of the fundamental rights and freedoms of the person concerned, those being shared values of the UN and the EU.291 While the emphasis on shared values may have been included to diffuse potential tensions with regard to the conflict between EU law and UN Security Council measures, the Court did not hesitate to emphasise the need to protect human rights in the face of a UN framework providing limited safeguards. The Court reiterated the substantial negative impact of sanctions to the affected individuals292 and, in a marked departure from the reasoning of AG Bot, went on to say that the improvements at the UN level with regard to listing do not provide the guarantee of effective judicial protection to the affected individual.293 In an example of judicial cross-fertilisation and dialogue, the Court of Justice based this finding on the ruling of the ECtHR in Nada.294 The Court of Justice went on to define the essence of effective judicial protection, which is that it should enable the person concerned to obtain a declaration from a court, by means of a judgment ordering annulment whereby the contested measure is retroactively erased from the legal order and is deemed never to have existed, that the listing of their name, or the continued listing of their name, on the list concerned was vitiated by illegality, the recognition of which may re-establish the reputation of that person or constitute for them a form of reparation for the non-material harm they have suffered.295 The Court found that while errors of law were made by the General Court,296 it is necessary to determine whether, notwithstanding those errors, the operative part of the judgment under appeal could be seen to be well founded on legal grounds other than those maintained by the General Court, in which event an appeal must be dismissed.297 The Court then went on to review the substance of the allegations against Mr Kadi298 and, dismissing the appeals, concluded that none of the allegations presented against Mr Kadi in the summary provided by the Sanctions Committee were such as to justify the adoption, at the EU level, of restrictive measures against him, either because the statement of reasons was insufficient, or because information or evidence which might substantiate the reason concerned, in the face of detailed rebuttals submitted by the party concerned, is lacking.299 The Court of Justice thus confirmed again, as in Kadi I, the autonomy of the EU legal order based on the respect for the rule of law and fundamental rights. While the Court’s ruling in Kadi I has had a noticeable impact in improving listing procedures at

291 ibid

para 131. para 132. 293 ibid para 133. 294 Nada v Switzerland (App No 10593/08) [2012] ECHR 1691. 295 ibid para 134. 296 See, in particular, ibid para 138. 297 ibid para 150. 298 ibid paras 151–62. 299 ibid para 163. 292 ibid

The Case of ‘Foreign Fighters’ 655 the UN level, in Kadi II it sent a clear message that such improvements can by no means equate to effective judicial protection. The Court continued to remind the international community that it is the individual who should be the focus of authorities in the invasive process of the imposition of restrictive sanctions. At the same time, the Court in Kadi II sent a clear message with regard to the relationship between the executive and the judiciary: the executive cannot use secrecy and confidentiality to evade judicial scrutiny, especially when the protection of fundamental rights is at stake. However, the Court did not appear to be as protective with regard to substantive fundamental rights, including the right to property. While it emphasised the far-reaching and adverse impact that restrictive measures have on the affected individuals, it fell short of endorsing the General Court’s strongly worded statement that restrictive measures can be considered to be in essence criminal sanctions. The Court of Justice seems to accept the preventive nature of sanctions, and did not engage with the argument of the General Court that procedural defects lead to a disproportionate impact of the affected individuals’ right to property – with the logic and essence of restrictive measures remaining largely unquestioned. In this light, Kadi II should be viewed as a triumph of procedural justice, perhaps at the expense of the protection of substantive fundamental rights, including the right to property.

VI. Globalisation of Criminal Law through Synergy between ‘Hard’ Law, ‘Soft’ Law, ‘Global Administrative Law’ and Supranational Law: The Case of ‘Foreign Fighters’ The production of criminal law norms at the level of the global executive and the infiltration of these norms into multiple legal orders at the regional, supranational and national levels has been ongoing. A key recent instance of such norm production involving a multi-level interaction of legal orders concerns the definition of terrorism via the criminalisation of conduct by ‘foreign fighters’.300 The initial response has come again from the UN Security Council, which has adopted a Resolution calling for the adoption of a wide range of measures on ‘foreign fighters’.301 The adoption of the Resolution was a US-led initiative aiming to address via the UN Security Council the lack of global consensus in the field, and pushing for measures notwithstanding the scarcity of data on the phenomenon of foreign fighters.302 The UN Security Council standards have since formed the basis of the adoption by the Council of Europe of its Additional Protocol to the Convention on the Prevention of Terrorism,303 which has amplified the provisions

300 See also V Mitsilegas, ‘Counter-terrorism and the Rule of Law in an Evolving European Union: Plus ça Change?’ (2021) New Journal of European Criminal Law 36. 301 Resolution 2178 (2014). 302 Lisa Ginsborg, ‘One Step Forward, Two Steps Back: The Security Council, “Foreign Terrorist Fighters”, and Human Rights’ in Manfred Nowak and Anne Charbord (eds), Using Human Rights to Counter Terrorism (Edward Elgar, 2018) 195, 195–99. 303 For a background to the Protocol, see N Piacente, ‘The Contribution of the Council of Europe to the Fight against Foreign Terrorist Fighters’ (2015) 1 Eucrim 12.

656 The EU and the Global Governance of Crime of the UN Security Council Resolution and has given them legally binding force via a multilateral regional treaty. As a third step, the Additional Protocol has now been ratified by the EU,304 which has also revised its internal legislation on the criminalisation of terrorism by adopting a new Directive to align EU law with the UN Security Council and Council of Europe standards.305 According to the Commission’s Explanatory Memorandum to the proposal, existing EU law needs to be reviewed ‘to implement new international standards and obligations taken by the EU and to tackle the evolving terrorist threat in a more effective way’306 – with express reference being made not only to the Council of Europe Convention and the UN Security Council Resolution in the field, but also to relevant FATF standards.307 It is worth noting here that the Commission refers to the revision of an Interpretative Note by a non-legislative body (the FATF) to take into account the standards set out by another non-legislative body (the UN Security Council) in order to shape the EU legislative response on the criminalisation of ‘foreign fighters’.308 In this manner, global executive standards adopted with limited scrutiny and transparency have exerted a significant influence on the significant extension of the criminalisation of terrorism in the EU and its Member States via a four-step process: the adoption of standards by the global executive (the UN Security Council); their influence on the output of other global executive actors (the FATF); the transformation of global executive standards into legally binding standards in a regional multilateral treaty (in the Council of Europe); and the subsequent mirroring of these standards in supranational EU law via the revision of the EU counter-terrorism Directive. Although there is still no global, international treaty on the criminalisation of terrorism at the UN level, the criminalisation of terrorism is being extended by other means.

VII. Conclusion The EU has been both actively involved in and influenced by the globalisation of criminal law. Notwithstanding internal constitutional and institutional complexities, the EU has emerged in one way or another as a global actor in the field. Along with attempts to influence global (and regional) standards in criminal matters, the EU has proved itself ready to advance the globalisation of criminal law via its internal acquis. EU institutions have not hesitated to internalise international law and use the text of international ‘hard’ and ‘soft’ law instruments as a basis to justify, establish and develop EC/EU criminal law.

304 Council Decision (EU) 2018/890 of 4 June 2018 on the conclusion, on behalf of the European Union, of the Additional Protocol to the Council of Europe Convention on the Prevention of Terrorism [2018) OJ L159, 22 June, 15–16. 305 Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA [2017] OJ L88/6, 31 March. See Preamble, recitals 5 and 6. 306 ‘Commission proposal for a Directive on combating terrorism and replacing Council Framework Decision 2002/475/JHA on combating terrorism’ COM (2015) 625 final, Brussels, 2 December 2015, 4. 307 ibid 5–6. 308 ibid 6.

Conclusion 657 This has been particularly the case in the context of the development of money laundering countermeasures, where interconnections between the EU, the regional European and the global levels have resulted in the development of a brand new regime of criminalisation, prevention and enforcement. In this and other fields (most notably organised crime and terrorism), in terms of substance, convergence between EU and international law has largely led to the extension of criminalisation and the proliferation of the powers of the state. In terms of the protection of fundamental rights on the other hand, EU Member States have been using international law largely to shield enforcement action from EU law. This is a reminder that the EU’s stance in international fora must be viewed in the light of internal developments in both constitutional and substantive law. The furthering of European integration in criminal matters over the past few decades has been coupled with a growing assertiveness by the EU in international negotiations. The EU has been actively involved in trying to shape the content of multilateral treaties in criminal matters (both at the UN and Council of Europe levels), with not inconsiderable success thus far. At the same time – particularly in relation to the Council of Europe, but also as regards the UN – EU institutions, including the European courts, have not hesitated to stress the autonomy of the EU legal order and to reserve the freedom to legislate in similar matters at the EU level in the future. For those viewing the glass half empty in terms of coherence and consistency, this may lead to the fragmentation of international law in the field. Those more optimistic would point out the growing interconnections between the EU and other international organisations and bodies in the production of criminal law (albeit in certain cases with minimal debate or transparency), and the striking similarities between global and EU standards in combating serious and transnational crime. However, this synergy should not detract from the need for meaningful scrutiny and accountability in the production of global and supranational criminal law norms. The need to assert the autonomy of the EU legal order in the development of a global paradigm of crime governance may prove to be increasingly imperative, not least in order to ensure the full and effective protection of fundamental rights, and in this manner ensuring the coherence of EU external action with the EU’s internal constitutional objectives and values.

11 The External Dimension of Mutual Trust Transatlantic Counter-terrorism Cooperation I. Introduction Another aspect of the development of the EU’s external action in criminal matters is via the conclusion of international agreements with third countries. Such agreements have been addressed in various parts of this book (in Chapters 1, 8, 9 and 12). This chapter will examine the external dimension of mutual trust in the context of the relations of the EU with third states, focusing on the most developed aspect of EU actorness in the field: its relations with the US. The events of 9/11 have acted as a catalyst for the adoption of a plethora of security measures in the US and beyond.1 For the EU, one of the key challenges has been to adapt to the new security landscape and to respond to US security demands. Securitisation post-9/11 accelerated and facilitated the adoption of internal EU law in the field of criminal justice, with landmark third pillar legislation, including the Framework Decision on the European Arrest Warrant and the Decision establishing Eurojust (but also the first pillar second Money Laundering Directive), adopted months after 9/11, being repackaged as counter-terrorism measures.2 A similar boost was given to the EU external action in the field, with the need for enhanced transatlantic counter-terrorism cooperation justifying the emergence of the EU as a global security actor. At the heart of EU external action has been the conclusion of a series of international agreements with the US, addressing a number of different components of a new transatlantic counter-terrorism consensus. The legal framework on transatlantic counter-terrorism cooperation has been evolving over time, with a number of agreements being repealed and replaced by new texts to address internal EU constitutional developments and concerns. Central to the discussions on the evolution of transatlantic counter-terrorism cooperation has been the issue of the impact of EU external action in the field on the preservation of European values, and in particular the protection of fundamental rights and the rule of law. The need for the EU to uphold these values in its external action is emphasised in the Lisbon Treaty. A key feature of the Treaty is its emphasis on the values 1 See V Mitsilegas, ‘The External Dimension of Mutual Trust: The Coming of Age of Transatlantic Counter-terrorism Cooperation’ in C Brière and A Weyembergh (eds), The Needed Balances in EU Criminal Law: Past, Present and Future (Hart Publishing, 2018) 215–42, upon which this chapter expands. 2 For an analysis, see V Mitsilegas, EU Criminal Law (Hart Publishing, 2009).

Transatlantic Counter-terrorism Cooperation 659 upon which the EU is deemed to be founded. References to European values and their constituent elements can be found throughout the general part of the TEU, as well as in parts of the TFEU. These values are central not only in defining European identity internally, but also in guiding the external action of the EU. Not surprisingly, respect for fundamental rights, democracy and the rule of law are expressly included in the list of EU values found in Article 2 TEU. This enumeration of the values upon which the EU is founded is not merely declaratory. According to Article 3(1) TEU, the promotion of these values is a key aim of the EU. The role of the EU in promoting its values is further highlighted with regard to EU external action, with Article 3(5) TEU stating that ‘in its relations with the wider world, the Union shall uphold and promote its values and interests and contribute to the protection of its citizens’. The centrality of the values of the EU when it acts at the global level is further confirmed by the specific Treaty provisions on external action. According to Article 21(1) TEU, ‘the Union’s action on the international scene shall be guided by the principles which have inspired its own creation, development and enlargement, and which it seeks to advance in the wider world’, which include democracy, the rule of law, the universality and indivisibility of human rights and fundamental freedoms, and respect for human dignity. According to Article 21(2) TEU, the EU will define and pursue common policies and actions, and will work for a high degree of cooperation in all fields of international relations in order to, inter alia, safeguard its values, and consolidate and support democracy, the rule of law, human rights and the principles of international law. Article 205 TFEU reiterates that these provisions will guide the EU’s actions on the international scene. It is thus clear that the respect of fundamental rights and the rule of law constitute key values which the EU must uphold and promote in its external action. This chapter will evaluate critically the evolution of transatlantic counter-terrorism cooperation and its impact on European values by focusing in particular on the extent to which mutual trust can operate in this field without a level playing field with regard to the protection of fundamental rights.

II. Transatlantic Counter-terrorism Cooperation: A Typology of EU–US Agreements and their Impact on European Values Transatlantic counter-terrorism cooperation has evolved following the conclusion of a series of agreements between the EU and the US covering a wide range of issues and triggered primarily by the events of 9/11. The conclusion of these agreements has created a multi-layered and extensive framework of transatlantic legal relationships in the field of security, which poses significant challenges to the EU legal order.3 The transatlantic counter-terrorism agreements fall into three main categories. The first category consists

3 See V Mitsilegas, ‘Transatlantic Counter-terrorism Cooperation and European Values: The Elusive Quest for Coherence’ in D Curtin and E Fahey (eds), A Transatlantic Community of Law (Cambridge University Press, 2014) 289–315,

660 The External Dimension of Mutual Trust of ‘traditional’ agreements between the EU and the US in criminal justice matters creating obligations for the two parties and for EU Member States. Such instruments are the EU–US Agreements on extradition and mutual legal assistance.4 Their signature formed an important constitutional precedent for the EU, these agreements being the first major international agreements concluded under the third pillar.5 The second category includes agreements concluded between the US and the EU criminal justice bodies with legal personality. The US has signed international agreements with Europol6 and Eurojust7 on the exchange of personal data. The third category of agreements can be characterised as ‘executive’ or ‘operational’ agreements. These are agreements which have been concluded as a response to US unilateral emergency security measures adopted post-9/11. Two sets of agreements have been evolving over time in this context: EU–US Agreements on the transfer of Passenger Name Record (PNR) data, and EU–US Agreements on the Terrorist Finance Tracking Programme (TFTP). Rather than imposing obligations solely on the parties, these Agreements serve to impose obligations on private sector entities to cooperate with the US on counter-terrorism, thus entailing a privatisation of security governance. Executive transatlantic cooperation agreements have had quite a turbulent history. As regards PNR, following the acceptance by the Commission of the adequacy of US data protection standards, transatlantic cooperation in this context began as a first pillar international agreement (between the Community and the US) in 2004.8 Following a Court of Justice ruling against the legality of the first pillar legal basis used,9 the EC–US Agreement was replaced by third pillar agreements between the EU and the US.10 After the refusal of the European Parliament to grant consent to the 2007 EU–US PNR Agreement, a new EU–US PNR Agreement has now 4 Agreement on extradition between the European Union and the United States of America [2003] OJ L181/27; Agreement on mutual legal assistance between the European Union and the United States of America [2003] OJ L181/34. See also the Council Decision, on the basis of Articles 24 and 38 TEU, concerning the signature of these agreements [2003] OJ L181/25. The EU has also signed a mutual legal assistance agreement with Japan: [2010] OJ L39/20. For a commentary, see A Weyembergh and I Wieczorek, ‘Norm Diffusion as a Tool to Uphold and Promote EU Values and Interests: A Case Study on the EU Japan Mutual Legal Assistance Agreement’ (2020) 11(4) New Journal of European Criminal Law 439. 5 See V Mitsilegas, ‘The New EU–US Co-operation on Extradition, Mutual Legal Assistance and the Exchange of Police Data’ (2003) 8 European Foreign Affairs Review 515. 6 Doc 13689/02 Europol 82, 4 November 2002; see Mitsilegas (n 2) above. 7 See V Mitsilegas, ‘Judicial Co-operation in Criminal Matters between the EU and Third States: International Agreements’ in M Leaf (ed), Cross-Border Crime (JUSTICE, 2006) 79–92. 8 Commission Decision on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States’ Bureau of Customs and Border Protection [2004] OJ L235/11 (including an Annex with the relevant US Undertakings); and Council Decision on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the US Department of Homeland Security, Bureau of Customs and Border Protection [2004] OJ L183/83 (the Agreement is annexed to the Decision). 9 Joined Cases C-317/04 and C-318/04, European Parliament v Council [2006] ECR I-4721. 10 An interim agreement to address the legal vacuum resulting from the Court’s ruling in 2006 was followed by another agreement in 2007: Council Decision 2006/729/CFSP/JHA on the signing, on behalf of the European Union, of an Agreement between the European Union and the USA on the processing and transfer of PNR data by air carriers to the US Department of Homeland Security [2006] OJ L298, 27 October, 27 (the text of the Agreement is annexed to this Decision); and Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) [2007] OJ L204/18 (hereinafter the ‘2007 PNR Agreement’). See also Council Decision approving the signing of the Agreement on the basis of Articles 24 and 38 TEU, at 16.

Transatlantic Counter-terrorism Cooperation 661 been concluded after the entry into force of the Lisbon Treaty.11 As regards the TFTP, the revelation by the press of the secret US programme of access to European SWIFT data12 led as a first step to the issuance of Representations to the EU, explaining the legal basis for the collection of SWIFT data under US law.13 Pressure by the European Parliament and a change in the SWIFT system architecture resulted in the conclusion of an EU–US TFTP Agreement, signed one day before the entry into force of the Lisbon Treaty.14 Notwithstanding the exertion of considerable political pressure by the US administration, the European Parliament rejected the agreement.15 This rejection led to a new round of transatlantic negotiations, this time fully post-Lisbon, resulting in the conclusion in the summer of 2012 of the second EU–US TFTP Agreement, which is currently in force.16 The conclusion of these agreements by the EU has met with strong objections and concerns on political, democratic and human rights/rule of law grounds. Concerns with regard to the uncritical adoption of US standards by the EU have been compounded by the marked lack of democratic scrutiny and transparency in the negotiation and conclusion of the agreements. From a constitutional point of view, the fact that the agreements were ultimately negotiated under the third pillar meant that negotiations were led formally by the presidency of the EU and that the European Parliament did not have any role in the process of negotiation and signature. These constitutional constraints were combined by the negotiating practice of Member States (and at times the Commission) which effectively shielded the agreements from any kind of meaningful debate and scrutiny. The EU–US Agreements on extradition and mutual legal assistance remained classified until the very last weeks before signature, notwithstanding repeated requests for their publication for the purposes of scrutiny.17 The Europol–US and Eurojust–US Agreements have not even been published in the Official Journal. The first version of the PNR Agreement (between the Community and the US) was transmitted to the 11 Council Decision of 13 December 2011 on the signing, on behalf of the European Union, of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security [2012] OJ L215/1; Council Decision of 26 April 2012 on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security [2012] OJ L215/4. 12 Eric Lichtblau and James Risen, ‘Bank Data is Sifted by US in Secret to Block Terror’ (New York Times, 23 June 2006), www.nytimes.com/2006/23/washington/23intel.html?_r=0&pagewanted=print. 13 Terrorist Finance Tracking Program – Representations of the United States Department of the Treasury [2007] OJ C166/18. 14 Council Decision 2010/16/CFSP/JHA of 30 November 2009 on the signing, on behalf of the European Union, of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for purposes of the Terrorist Finance Tracking Program [2010] OJ L8/9 (and see at 11 for the text of the Agreement). For the background, see A Amicelle, The EU’s Paradoxical Efforts at Tracking the Financing of Terrorism: From Criticism to Imitation of Dataveillance (CEPS Paper in Liberty and Security in Europe, No 56, August 2013). 15 For further details, see J Monar, ‘Editorial Comment. The Rejection of the EU–US SWIFT Interim Agreement by the European Parliament: A Historic Vote and its Implications’ (2010) 15 European Foreign Affairs Review 143. 16 Council Decision on the conclusion of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program [2010] OJ L195/3. 17 See House of Lords European Union Committee, EU–US Agreements on Extradition and Mutual Legal Assistance, 38th Report, session 2002–03, HL Paper 135.

662 The External Dimension of Mutual Trust uropean Parliament for examination under deadlines which, according to the ParliaE ment, did not enable it to conduct meaningful scrutiny – with the handling of scrutiny leading to the Parliament challenging the agreement in the Court of Justice.18 Similar scrutiny concerns have arisen with regard to the choice to deal with the Decision confirming the adequacy of the US data protection framework for the purposes of the PNR agreement via comitology.19 On the other hand, the first TFTP Agreement was, as seen above, signed a day before the entry into force of the Lisbon Treaty, in an attempt to conclude this under the intergovernmental process of the ‘old’ third pillar and thus pre-empt the Community elements brought about by Lisbon and effectively sideline the European Parliament. Moreover, significant limits have been placed by the Council on transparency and scrutiny of documents relating to the negotiations by members of the European Parliament.20 The conclusion of these agreements, negotiated with minimal transparency in the face of sustained and growing fundamental rights concerns expressed by national parliaments, EU expert bodies and civil society,21 was presented as a fait accompli, with signature dates set out in advance and leaving limited time for debate and scrutiny.22 Secrecy remains a feature as regards the implementation of some of these agreements and their scrutiny. The democratic and rule of law challenges posed by transatlantic counter-terrorism cooperation are combined with serious challenges to the protection of fundamental rights. These fundamental rights challenges are the result of two separate, but interrelated, factors: the highly invasive content of the EU–US Agreements, which substantially increases the power of the executive (in particular as regards the US) at the expense of individual rights; and the significant differences in the legal systems of EU Member States and the EU on the one hand, and the US on the other hand, as regards the protection of fundamental rights. The key area of concern is the impact of these agreements on the rights to the protection of private life and personal data.23 The EU–US Mutual Legal Assistance Agreement and the Agreements between the US and Europol and Eurojust respectively allow for the transfer of a wide range of personal data to the US. 18 V Mitsilegas, ‘Border Security in the European Union: Towards Centralised Controls and Maximum Surveillance’ in E Guild, H Toner and A Baldaccini (eds), Whose Freedom, Security and Justice? EU Immigration and Asylum Law and Policy (Hart Publishing, 2007) 359–94. The Court’s ruling resulted in the agreements being negotiated under the third pillar, with the European Parliament having a much more limited scrutiny role. 19 V Mitsilegas, ‘Contrôle des étrangers, des passagers, des citoyens : Surveillance et anti-terrorisme’ (2005) 58 Cultures et Conflits 155. 20 D Curtin, ‘Official Secrets and the Negotiation of International Agreements: Is the EU Executive Unbound?’ (2013) 50 CML Rev 423. 21 On the extradition/mutual legal assistance agreements and the Europol/US agreement, see Mitsilegas (n 5) 2003; on the PNR Agreements, see V Mitsilegas ‘The External Dimension of EU Action in Criminal Matters’ (2007) 12 European Foreign Affairs Review 457; on SWIFT, see the Opinion of the European Data Protection Supervisor of 25 January 2010; and the Opinion of the Article 29 Working Party of 22 January 2010. 22 A number of the Agreements envisaged an ex post scrutiny at the national level, with their c onclusion being subject to Member States’ internal constitutional procedures. While the EU–US Agreements on extradition and mutual legal assistance were signed in 2003, their conclusion on behalf of the EU took place only on 2009 – see Council Decision 2009/820/CFSP [2009] OJ L291/40, 40. 23 The EU–US Agreements on extradition and mutual legal assistance also raise concerns in relation to the right to life, relating to the possibility of the imposition of the death penalty following extradition or the provision of information under mutual legal assistance. For an analysis, see Mitsilegas (n 5).

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 663 Even so, recent years have seen attempts by the US authorities to bypass the cooperation arrangements envisaged by the EU–US Mutual Legal Assistance Agreement by requiring direct access to personal data located in the territory of the EU.24 In addition to the largely reactive model of data transfer provided for the EU–US mutual legal assistance framework, the executive transatlantic agreements have introduced significant quantitative and qualitative changes to the collection and transfer of personal data. As with the pre-existing anti-money laundering legal framework, the PNR and TFTP Agreements signify the privatisation of financial surveillance and are yet another example of the ‘responsibilisation strategy’ whereby the private sector is co-opted by the state in the fight against crime.25 However, while in the anti-money laundering framework, the private sector is called upon to transfer proactively private financial data to the state on the basis of specific suspicions,26 under the PNR and TFTP systems, private entities are obliged to transfer private financial data to the US authorities en masse and in bulk, without any prior internal risk assessment. Massive quantities of everyday personal data are thus collected by the US government for the primary purpose of risk assessment of future threats – constituting what de Goede has termed speculative security practices.27 This move towards speculative security, under a system of pre-emptive surveillance, poses fundamental challenges to the rights to private life and data protection (in particular regarding the questionable legality of the very collection of such personal data in bulk by the executive), but also more broadly to the presumption of innocence and concepts of citizenship and trust within the framework of the relationship between the individual and the state.28

III. The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation In addition to the inclusion of specific safeguards – in particular on data protection – in the text of the various EU–US agreements, transatlantic negotiations have resulted in attempts to ensure coherence between EU external security action and European values, most notably relating to the protection of the rights to private life and the protection of personal data. These mechanisms of achieving coherence – in order to achieve mutual trust and thus enable transatlantic cooperation in the field – are particularly visible in the two executive transatlantic agreements (on the TFTP and PNR), as these agreements have evolved over time in the face of sustained and considerable criticism by the European Parliament (which has an enhanced scrutiny role on international agreements after the entry into force of the Lisbon Treaty), expert EU data protection bodies

24 For an analysis, see S Carrera, G Gonzalez-Fuster, E Guild and V Mitsilegas, Access to Electronic Data by Third-Country Law Enforcement Authorities: Challenges to EU Rule of Law and Fundamental Rights (Centre for European Policy Studies, July 2015). 25 On the responsibilisation strategy, see D Garland, ‘The Limits of the Sovereign State: Strategies of Crime Control in Contemporary Society’ (1996) 36 British Journal of Criminology 445. 26 V Mitsilegas, Money Laundering Counter-measures in the EU (Kluwer Law International, 2003). 27 M de Goede, Speculative Security (University of Minnesota Press, 2012). 28 V Mitsilegas, ‘The Value of Privacy in an Era of Security’ (2014) 8 International Political Sociology 104.

664 The External Dimension of Mutual Trust and civil society. In addition to these mechanisms, the EU and the US have attempted to develop a level playing field in relation to human rights by concluding agreements establishing a common understanding of data protection. These mechanisms of promoting trust will be categorised and analysed below by focusing primarily on the provisions in the EU–US TFTP Agreement and complementing the analysis with provisions from other Agreements where relevant. As will be demonstrated from the analysis, efforts to achieve coherence have had mixed, if not limited, success, with fundamental concerns as to the challenges that the agreements pose to European values still remaining.

A. Mutual Trust via Operational Oversight To address concerns regarding the extensive scope of transfer of financial data to US authorities, a key innovation in the EU–US TFTP Agreement has been to embed a series of mechanisms of oversight into the operational aspects of the transfer of SWIFT data to the US. Going beyond the EU–US PNR Agreement, which focused on US oversight,29 the EU–US TFTP Agreement establishes mechanisms of oversight by the EU. The Agreement does provide for operational oversight, although not by a judicial authority, but by Europol. According to Article 4(1) of the Agreement, upon receipt of a request for data transfer, Europol will verify as a matter of urgency whether the Request complies with the requirements of Article 4(2), which requires in particular requests by US authorities: to identify as clearly as possible the data that are necessary for counterterrorism purposes; to substantiate clearly the necessity of the data; and to be tailored as narrowly as possible in order to minimise the amount of data requested. According to Article 4(5), once Europol has confirmed that the Request complies with the requirements of Article 4(2), the Request will have binding legal effect as provided under US law, within the EU as well as in the US and the designated provider (SWIFT, as indicated in the annex to the Agreement) is thereby authorised and required to provide the data to the US Treasury Department. Europol thus acts as a gatekeeper, whose approval is essential in order to authorise the transfer of SWIFT data to the US. This represents a significant move away from private oversight of the transfer of private personal data to the state and towards public oversight by a European body.30 Conferring these oversight powers upon Europol constitutes a change to its traditional role and represents an extension of Europol’s powers which was not envisaged in the 2009 Europol Decision31 and is not provided for in the recent draft Regulation on Europol.32 It thus appears that Europol’s powers have been extended via an international agreement. In addition to these legal basis concerns, there are a number of effectiveness and human rights concerns associated with the scrutiny role of Europol

29 See art 14 of the EU–US PNR Agreement. 30 A Amicelle, ‘The Great (Data) Bank Robbery: Terrorist Finance Tracking Program and the “SWIFT Affair”’ (May 2011) Research Questions No 36, Centre d’etudes et de recherches internationales Sciences Po, 20. 31 Council Decision establishing the European Police Office (Europol) [2009] OJ L121/37, art 5. 32 COM (2013) 173 final.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 665 under the Agreement. These concerns stem from the nature and powers of Europol and its position in the European security landscape. Europol is a law enforcement body with a clear security mandate. The TFTP Agreement has thus entrusted the scrutiny of US security services to another piece of the security apparatus, this time in Europe. Rather than legislating for judicial or privacy/data protection scrutiny of the operation of the TFTP Agreement, the European legislator has thus entrusted the scrutiny of the activities of parts of the US security services to their EU security/law enforcement counterparts. This choice casts doubts on the effectiveness of Europol’s oversight role and has led to allegations that Europol is unduly uncritical as regards requests from the US authorities, and that this has led to inadequate and ineffective oversight. It should be noted in this context that Europol is in the position under the Agreement of both scrutinising US requests for data transfers under Article 4 and having the option of requesting a search for relevant information obtained through the TFTP under Article 10. As the European Data Protection Supervisor has eloquently noted, it is hard to reconcile this power of Europol, which may be important for the fulfilment of Europol’s task and which requires good relations with the US Treasury, with the task of Europol to ensure independent oversight.33 These concerns seem to be confirmed by the second joint review of the controls set out in the Agreement, according to which in no case did the verification by Europol lead to a rejection of a US request.34 These concerns become exacerbated when one reads Europol’s report to the European Parliament on its role under Article 4.35 In its report, Europol appears to adopt a rather flexible approach with regard to the purpose limitation and specificity requirements of the Agreement: according to Europol, surprisingly, identifying a nexus to terrorism in specific cases is a requirement under other provisions in the Agreement ‘and forms no part of the request as submitted by the US Department of the Treasury to the Designated provider under Article 4’.36 Moreover, it is noted that: Due to the specific construction of the TFTP Agreement the US authorities must demonstrate a concrete nexus to terrorism in individual cases only in the context of the individual searches under [Article] 5(5) of the TFTP Agreement, once the received data are used for concrete search and/or analysis activities etc. Consequently Article 4(2) of the TFTP Agreement does not prohibit that the requests received by Europol exhibit a certain level of abstraction.37

These assertions by Europol are contrary to the very architecture of the Agreement, to the purpose of the safeguards inserted therein and to the very wording of Article 4(2), 33 Opinion of the European Data Protection Supervisor on the proposal for a Council Decision on the conclusion of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for purposes of the Terrorist Finance Tracking Program (TFTP II) [2010] OJ C355/10, para 25. 34 Commission Staff Working Document, Report on the second joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program. October 2012, SWD(2012) 454 final, Brussels, 14 December 2012 (hereinafter ‘Second Joint Review’) 6. 35 Europol Activities in Relation to the TFTP Agreement Information note to the European Parliament, File No 2566-566, 8 April 2011. 36 ibid 4. 37 ibid 7.

666 The External Dimension of Mutual Trust compliance with which Europol is entrusted to scrutinise. In particular, Article 4(2) requires US requests to identify as clearly as possible the data that are necessary for the purpose of the prevention, investigation, detection or prosecution of terrorism or terrorist financing.38 Requests must also be tailored as narrowly as possible in order to minimise the amount of data requested.39 The willingness of Europol to accommodate the requests from US security services relatively uncritically confirms Bigo’s theory of the socialisation of transnational security professionals. According to Bigo, the transnationalisation of bureaucracies has created a socialisation and a set of differentiated professional interests that take priority over national solidarities.40 This reasoning can apply by analogy to EU solidarities: Europol demonstrates greater solidarity with its US security counterparts than with the interests of EU citizens, parliamentarians and data protection/privacy professionals. The limits of privacy oversight by a security agency are thus vividly demonstrated. In addition to the operational oversight entrusted to Europol in Europe when US requests are received, the EU–US TFTP Agreement provides for a second level of post-transfer operational oversight in the US. Following the model established by the appointment of an Eminent Person located in the US, the Agreement provides in Article 12, entitled ‘Monitoring of safeguards and controls’, for oversight of the data protection and purpose limitation safeguards set out in the Agreement by independent overseers, including by a person appointed by the EU, with the agreement of and subject to appropriate security clearances by the US.41 According to Article 12(1), such oversight will include the authority to review in real time and retrospectively all searches made of the provided data, the authority to query such searches and, as appropriate, to request additional justification of the terrorism nexus. In particular, independent overseers shall have the authority to block any or all searches that appear to be in breach of Article 5 of the Agreement (which establishes a series of safeguards for the processing of data). Article 12(2) of the Agreement further provides for the monitoring of the independence of oversight within the framework of the review of the Agreement established under Article 13 and states that the Inspector General of the US Treasury will ensure that the independent oversight described in Article 12(1) is undertaken ‘pursuant to applicable audit standards’. This provision can be seen as an attempt to address EU calls for the establishment of a system of independent data protection supervision in the US, which would reflect the system established under EU law.42 It is questionable whether the Treasury audit mentioned in Article 12 is equivalent to independent data protection supervision. However, it constitutes an attempt – together with the innovative mechanism of locating an EU-appointed official in the US with specific powers of operational oversight – to enhance oversight and meet EU requirements to some extent.

38 EU–US TFTP Agreement, art 4(2)(a). 39 ibid art 4(2)(c). 40 D Bigo, ‘Globalized (In)Security: The Field and the Ban-opticon’ in D Bigo and A Tsoukala (eds), Terror, Insecurity and Liberty: Illiberal Practices of Liberal Regimes after 9/11 (Routledge, 2008). 41 EU–US TFTP Agreement, art 12(1). According to the Commission’s report on the second joint review of the Agreement, the parties have agreed on the appointment of a deputy EU overseer (at 8). The legal basis for this appointment is unclear. 42 See Opinion of the European Data Protection Supervisor (n 33) para 36.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 667

B. Mutual Trust via Regular Monitoring and Review In a similar fashion to the safeguards established in the EU–US PNR Agreement,43 another mechanism to ensure coherence and that the safeguards set out in the TFTP Agreement are met is the joint review of the Agreement on a regular basis. This mechanism is established by Article 13 of the Agreement and it involves both parties, the EU and the US, in monitoring the effectiveness of the safeguards, controls and reciprocity provisions set out in the Agreement. Article 13(2) sets out in greater detail areas to be covered by the review, which include the number of financial payment messages accessed; the number of occasions in which leads have been shared with Member States, third countries, and Europol and Eurojust; the implementation and effectiveness of the Agreement, including the suitability of the mechanism for the transfer of information, cases in which the information has been used for the prevention, investigation, detection or prosecution of terrorism and its financing; and compliance with the data protection obligations specified in the Agreement. The review will include a representative and random sample of searches and a proportionality assessment. For the purposes of the review, the EU will be represented by the Commission and the US by the Treasury, and each party may include in its delegation security, data protection and judicial experts; however, only the EU delegation is obliged to include in the delegation representatives of two data protection authorities, at least one of which must be from a Member State where a designated provider (thus far SWIFT) is based.44 Following the review, the Commission must present a Report to the European Parliament and the Council on the functioning of the TFTP Agreement.45 The joint review envisaged by the TFTP Agreement is an important transparency tool and brings into the public domain a variety of information on the detailed functioning of the Agreement. The Commission Report on the first joint review made a number of recommendations for improvement, including the need to further substantiate the added value of the TFTP programme – in particular via the collection and analysis of more feedback in order to provide more verifiable insights into the actual added value of the TFTP – the collection of more statistical information that should be made public, and the provision of as much information as possible substantiating the requests, provided to Europol in a written format in order to support it in its tasks under Article 4 and to allow for more effective independent review.46 The second joint review has proven to be more controversial, in particular as regards the intensification of the scrutiny of

43 Article 23 of the EU–US PNR Agreement. The mechanism of joint review of the transatlantic PNR Agreements by the US and the EU has been well established and present in all Agreements since the conclusion of the first one in 2004 – see Preamble, Recital 17. The latest Joint Evaluation was published in early 2021: COM (2021) 18 final, 12 January 2021. A similar evaluation process occurs regarding the EU–Australia PNR Agreement ([2012] OJ L186/4); the latest evaluation was released the same day as the EU–US Agreement: COM (2021) 19 final. 44 EU–US TFTP Agreement, art 13(3). 45 ibid art 13(2) final indent. 46 Commission report on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program 17–18 February 2011, Brussels, 16 March 2011.

668 The External Dimension of Mutual Trust the Agreement beyond the strict confines set out by the review itself. In its report on the Second Joint Review of the EU–US TFTP Agreement,47 the Commission felt obliged to report on parallel scrutiny efforts conducted by Europol’s Joint Supervisory Body on data protection (JSB). The JSB has produced a number of critical reports, highlighting gaps in data protection and Europol’s scrutiny role (ie, that the written requests Europol received were not specific enough to allow it to decide whether to approve or deny them, but that despite this, Europol had approved every request it received) as well as gaps in transparency and scrutiny resulting from the persistent informality in the practices of Europol (noting that Europol advised that orally provided information plays a role in its verification of each request; information which is provided to certain Europol officials with the stipulation that no record is made).48 The JSB has further highlighted the secrecy surrounding aspects of the scrutiny of the TFTP Agreement, noting that due to Europol’s classification of most TFTP-related information as EU SECRET, the JSB’s final report is classified as EU SECRET, a fact which has led the JSB to prepare a public statement in lieu of a second inspection report, where it reiterated the limits inherent in Europol’s oversight and that the current classification level applied to much of the information related to the Agreement prevents the release of a large proportion of relevant information.49 In its third report, the JSB noted that with a view to ensuring transparency, its assessment of the outcome of that year’s inspection had been drafted in such a way as to allow full publication and, therefore, the widest possible audience. It welcomed the progress made after its two prior inspections, but sustained its focus on the practices of Europol and highlighted the continuation of the transfer of personal data in bulk.50 The Commission Report on the second joint review criticised (instead of applauding) the additional layer of data protection scrutiny provided by the Europol JSB, noting that ‘parallel or uncoordinated initiatives or inquiries should be avoided because they undermine the Article 13 review process and have caused a considerable workload of the Treasury in particular’.51 This comment can be seen as a response to the US government’s concerns over the perceived interference and increased transparency that scrutiny by the Europol JSB might entail.52 Highlighting data protection and secrecy concerns to the European Parliament is viewed as a breach of mutual trust, but raises the question of between whom mutual trust is important from an EU constitutional perspective. The text of the Commission’s report on the joint review reveals an alignment of the Commission’s interests not with other EU bodies and actors, but with the US government, in a striking example of security socialisation. The Commission’s willingness to uphold security interests and to justify the securitised function of Europol as an overseer of the Agreement under Article 4 can also

47 Second Joint Review (n 34) above. Reviews have been taking place regularly; see more recently 5th Review, COM (2019) 342 final, 22 July 2019. 48 Report on the Inspection of Europol’s Implementation of the TFTP Agreement, conducted in November 2010 by the Europol Joint Supervisory Body (Brussels, 2 March 2011). 49 ‘Europol JSB Inspects for the Second Year the Implementation of the TFTP Agreement – Public Statement’ (‘Second inspection’) November 2011. 50 Implementation of the TFTP Agreement: assessment of the follow up of the JSB recommendations (Third JSB Report), November 2012. 51 Second Joint Review (n 34) 15–16. 52 ibid.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 669 be found in the second joint review. According to the review: ‘Europol staff has established an intensive dialogue with their Treasury counterparts. This has turned out to be a very important monitoring element, in addition to the formal regular reviews under Article 13.’53 It is striking that Europol’s perceived data protection role is here applauded, at the same time when the work of the data protection scrutineer par excellence, the Europol JSB, is being criticised. The security focus of the Commission as regards the review of the EU–US TFTP Agreement is also visible vis-a-vis the evaluation of the performance of Europol under Article 4. While the review accepts that in no case did verification by Europol lead to a rejection of a US request,54 the Commission’s report has gone to great lengths to stress and justify the operational considerations underpinning Europol’s role under the Agreement. According to the Commission: Europol explained that it carries out its verification task under Article 4 based on an operational assessment of the validity of the US request … The fact that the verification task under Article 4 has been given to Europol, i.e. to a law enforcement and not to a data protection body, shows that, ultimately, the verification criteria set out in Article 4 have to be assessed in the light of operational considerations and security needs. This is particularly true for the difficult question whether the US requests are ‘as narrowly tailored as possible’. (Article 4(2) lit c), emphasis added)55

The above comments by the Commission cause concern with regard to the extent to which scrutiny by Europol under Article 4 can operate as an effective safeguard and meaningful control of US requests for financial data under the TFTP Agreement. The second joint review remains essentially uncritical as regards the oversight approach adopted by Europol. According to the Commission, ‘the review teams felt that it is not for them (nor for any other monitoring body) to replace Europol’s final decision by their own less informed judgement’.56 Here the emphasis is placed again on security, with the reviewers exhibiting undue deference to Europol’s operational considerations placed within a securitised framework and demonstrating a confluence between EU and US law enforcement interests. Securitisation is here linked to depoliticisation, with the review team in essence negating the review task entrusted to it by the TFTP Agreement. This depoliticisation is accepted explicitly in the Commission’s report, noting that ‘the second review was based on the understanding that it was not its task to provide a political judgement on the Agreement, this being considered outside the scope and mandate under Article 13’ (emphasis added).57 At the same time, the review of the Agreement was accompanied by great efforts to accommodate US concerns with regard to maintaining secrecy,58 responding to US concerns to limit the amount of i nformation

53 ibid 16. 54 ibid 6. An emphasis on the role of Europol can be seen in the latest Review conducted in 2019: COM (2019) 342 final. 55 Second Joint Review (n 34) 7. 56 ibid. 57 ibid 4. 58 The second Commission report on the joint review of the Agreement highlighted persistent limitations on the provision of some documents during the review (at 3).

670 The External Dimension of Mutual Trust provided during the review,59 but also with producing a version of the report which would be acceptable by the Treasury.60

C. Mutual Trust via the Presumption of Adequacy A key and tested technique in attempting to address concerns over the limitations of the US data protection framework has been for the EU to declare that US standards on privacy and data protection are adequate. Declarations of adequacy have been central to the conclusion of transatlantic PNR Agreements.61 Following a similar pattern, Article 8 of the EU–US TFTP Agreement states that ‘subject to ongoing compliance with the commitments on privacy and protection of personal data set out in this Agreement, the US Treasury Department is deemed to ensure an adequate level of data protection … for the purposes of this Agreement’. This declaration is a demonstration of trust towards US authorities and must be read together with the Preambular provision stressing the parties’ ‘common values governing privacy’.62 It serves to legitimise the transfer of personal data to the US, but the question of whether the US system provides an adequate level of data protection and privacy standards compared with EU standards remains open. The assessment of adequacy is a positive declaration of trust in the US system of data protection and constitutes a further step towards the negative framing of trust formulated in the EU–US Mutual Legal Assistance Agreement.63 However, EU data protection and privacy standards form part of the fundamental rights whose protection is a key value that the EU must safeguard and promote in its external action.64 To back up the assertion of adequacy, the EU–US TFTP Agreement includes a number of data protection safeguards. In addition to the safeguards included in relation to US requests, the Agreement provides safeguards applicable to the processing of provided data, which include purpose limitation, the prohibition of data mining, the prohibition of interconnection of provided data with other databases, the requirement

59 ibid 5–6. 60 ibid. 61 For more background on this, see Mitsilegas (n 19). See art 19 of the latest EU–US PNR Agreement: Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program [2010] OJ L195/5. 62 ibid Preamble, Recitals 8 and 10. 63 According to art 9(2)(b) of the EU–US MLA Agreement, ‘generic restrictions with respect to the legal standards of the requesting State for processing personal data may not be imposed by the requested State as a condition … to providing evidence or information’. The Explanatory Note to the Agreement states that: ‘Article 9(2)(b) is meant to ensure that refusal of assistance on data protection grounds may be invoked only in exceptional cases … A broad, categorical, or systematic application of data protection principles by the requested State to refuse cooperation is therefore precluded. Thus, the fact the requesting and requested States have different systems of protecting the privacy of data (such as that the requesting State does not have the equivalent of a specialised data protection authority) or have different means of protecting personal data (such as that the requesting State uses means other than the process of deletion to protect the privacy or the accuracy of the personal data received by law enforcement authorities), may as such not be imposed as additional conditions.’ 64 EU–US TFTP Agreement, Preamble, Recital 4.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 671 to respect necessity and proportionality in data processing and the requirement for all searches of provided data to be based upon pre-existing information or evidence which demonstrates a reason to believe that the subject of the search has a nexus to terrorism or its financing.65 The Agreement also includes specific provisions on data retention and deletion,66 with Article 6(4) stating that ‘all non-extracted data received on or after 20 July 2007 shall be deleted not later than five (5) years from receipt’. However, as has been noted in the Commission’s report on the second joint review to the Agreement, the US Treasury informed the EU review team that the deletion of data could not be implemented as an ongoing process on a rolling basis, but that its intention would be to carry out this exercise only after longer time intervals.67 The Agreement also includes a series of provisions on specific data protection rights, including transparency,68 the right of access,69 the right to rectification, erasure or blocking,70 the maintenance of the accuracy of the information,71 and a provision of redress.72 However, these safeguards do not negate the fact that the EU–US TFTP Agreement has legitimised and allows for what the Europol JSB has called a ‘massive, regular, data transfer from the EU to the US’.73 The limits to uncritical assertions of the existence of adequacy in the way in which privacy and data protection are safeguarded in the US have been demonstrated in the recent case of Schrems.74 In Schrems, the Court of Justice annulled the Commission adequacy Decision finding that the level of the protection of personal data provided by the US was adequate for the purposes of the EU–US Safe Harbour Agreement. In assessing the validity of the adequacy Decision, the Court of Justice began by providing a definition of the meaning of adequacy in EU law and by identifying the means of its assessment. The first step for the Court was to look at the wording of Article 25(6) of Directive 95/46 on data protection, which provides the legal basis for the adoption by the European Commission of adequacy decisions concerning the transfer of personal data to third countries. The Court stressed that Article 25(6) ‘requires that a third country “ensures” an adequate level of protection by reason of its domestic law or its international commitments’ (emphasis added), adding that ‘according to the same provision, the adequacy of the protection ensured by the third country is assessed “for the protection of the private lives and basic freedoms and rights of individuals”’.75 The Court thus linked expressly Article 25(6) to obligations stemming from the EU Charter of Fundamental Rights: Article 25(6) of Directive 95/46 implements the express obligation laid down in Article 8(1) of the Charter to protect personal data and … is intended to ensure that the

65 ibid

art 5. art 6. Joint Review (n 34) 10. 68 EU–US TFTP Agreement, art 14. 69 ibid art 15. 70 ibid art 16. 71 ibid art 17. 72 ibid art 18. 73 JSB Third Report (n 50). 74 Case C-362/14, Maximillian Schrems v Data Protection Commissioner, ECLI:EU:C:2015:650. 75 ibid para 70. 66 ibid

67 Second

672 The External Dimension of Mutual Trust high level of that protection continues where personal data is transferred to a third country. (Emphasis added)76

The Court thus affirmed a continuum of data protection when EU law authorises the transfer of personal data to third countries and places emphasis on the positive obligation of ensuring a high level of data protection when such transfer takes place. The Court recognised that the word ‘adequate’ does not require a third country to ensure a level of protection identical to that guaranteed in the EU legal order: However … the term ‘adequate level of protection’ must be understood as requiring the third country in fact to ensure, by reason of its domestic law or its international commitments, a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union by virtue of Directive 95/46 read in the light of the Charter. (Emphasis added)77

The Court explained that if there were no such requirement, the objective of ensuring a high level of data protection would be disregarded, and this high level of data protection ‘could easily be circumvented by transfers of personal data from the European Union to third countries for the purpose of being processed in those countries’.78 The Court has thus introduced a high threshold of protection of fundamental rights in third countries: not only must third countries ensure a high level of data protection when they receive personal data from the EU, but they must provide a level of protection which, while not identical, is essentially equivalent to the level of data protection which is guaranteed by EU law. But how will equivalence be assessed in this context? The Court of Justice emphasised that: It is clear from the express wording of Article 25(6) of Directive 95/46 that it is the legal order of the third country covered by the Commission decision that must ensure an adequate level of protection. Even though the means to which that third country has recourse, in this connection, for the purpose of ensuring such a level of protection may differ from those employed within the European Union in order to ensure that the requirements stemming from Directive 95/46 read in the light of the Charter are complied with, those means must nevertheless prove, in practice, effective in order to ensure protection essentially equivalent to that guaranteed within the European Union. (Emphasis added)79

This finding is extremely important not only because it confirms the responsibilities of third countries to ensure a high level of protection, but also because it requires data protection to be effective in practice. The emphasis on ascertaining the effectiveness of the protection of fundamental rights in practice strongly reflects the approach of the ECtHR on the subject. While differences in the means of protection between the EU and third countries may not, as such, negate such protection, third countries are still under an obligation to ensure the provision of a high level of data protection, essentially equivalent to that of the EU, in practice. This approach places a number of duties on the European Commission when assessing adequacy. The Commission ‘is obliged to assess

76 ibid 77 ibid

para 72. para 73.

79 ibid

para 74.

78 ibid.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 673 [both] the content of the applicable rules in the third country resulting from its domestic law or international commitments and the practice designed to ensure compliance with those rules’ (emphasis added).80 Moreover: [I]n the light of the fact that the level of protection ensured by a third country is liable to change, it is incumbent upon the Commission, after it has adopted an [adequacy] decision pursuant to Article 25(6) of Directive 95/46, to check periodically whether the finding relating to the adequacy of the level of protection ensured by the third country in question is still factually and legally justified. Such a check is required, in any event, when evidence gives rise to a doubt in that regard.81

In this context, account must also be taken of the circumstances that have arisen after that Decision’s adoption.82 The important role played by the protection of personal data in the light of the fundamental right to respect for private life, and the large number of persons whose fundamental rights are liable to be infringed where personal data are transferred to a third country not ensuring an adequate level of protection reduce the Commission’s discretion as to the adequacy of the level of protection ensured by a third country and require a strict review of the requirements stemming from Article 25 of Directive 95/46, read in the light of the Charter.83 The Court’s conceptualisation of adequacy has thus led to the requirement of the introduction of a rigorous and periodical adequacy assessment by the European Commission, an assessment which must focus on whether a level of data protection essentially equivalent to that provided by the EU is ensured by third countries. On the basis of these general principles, the Court went on to assess the validity of the specific adequacy decision by the European Commission. The Court annulled the decision, finding that it constituted interference with the fundamental rights of the persons whose personal data are or could be transferred from the EU to the US,84 and that the decision did not meet the necessity test. The judgment was based in this context largely on the Court’s ruling in the case of Digital Rights Ireland85 and it reiterated that: Legislation is not limited to what is strictly necessary where it authorises, on a generalised basis, storage of all the personal data of all the persons whose data has been transferred from the European Union to the United States without any differentiation, limitation or exception being made in the light of the objective pursued and without an objective criterion being laid down by which to determine the limits of the access of the public authorities to the data, and of its subsequent use, for purposes which are specific, strictly restricted and capable of justifying the interference which both access to that data and its use entail. (Emphasis added)86

Legislation ‘permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the 80 ibid para 75. 81 ibid para 76. 82 ibid para 77. 83 ibid para 78. 84 ibid para 87–91. 85 Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung, Michael Seitlinger, Christof Tschohl and Others, EU:C:2014:238. See also ch 9. 86 Schrems v Data Protection Commissioner (n 74) para 93; Digital Rights Ireland (n 85) paras 57–61.

674 The External Dimension of Mutual Trust essence of the fundamental right to respect for private life, as guaranteed by Article 7 of the Charter’.87 In this manner, the Court of Justice stresses that generalised, mass and unlimited surveillance is contrary to privacy and data protection. The Court’s findings are thus also applicable to other instances of generalised surveillance sanctioned by EU law, including surveillance currently permitted under systems of transatlantic counterterrorism cooperation under the EU–US PNR and TFTP Agreements, both of which involve generalised, indiscriminate surveillance.

D. Mutual Trust via Reciprocity and Internalisation As with the EU–US PNR Agreement, another key element in the EU–US TFTP Agreement is the emphasis on reciprocity. Reciprocity operates at two levels: the first level involves the operational gain that the transfer of personal data under the agreements may entail for EU law enforcement; and the second level relates to the future reconfiguration of the Agreements in the event that the EU establishes its own PNR and TFTP systems. As regards the TFTP Agreement, the first level of reciprocity is reflected in Articles 9 and 10 of the Agreement, which call respectively for the proactive (spontaneous) and reactive provision of information obtained through the TFTP system by the US authorities to law enforcement, public security or counter-terrorism authorities of EU Member States as well as Europol and Eurojust. This is an effort to demonstrate an added value of this Agreement for the EU by attempting to ensure security benefits for the EU and Member States.88 The second level of reciprocity involves the potential future establishment of an EU TFTP system. The establishment of a European TFTP system has been proposed by the European Parliament as a step towards ensuring a move from personal data being transferred in bulk to the US to the extraction of the relevant personal data in the EU under a European system.89 It may also be seen as an effort to minimise European reliance on US intelligence.90 Article 11 of the Agreement states that during its duration, the Commission will carry out a study into the possible introduction of an equivalent EU system allowing for a more targeted transfer of data,91 adding that if the EU decides to establish an EU system, the US will cooperate and provide assistance and advice in order to contribute to the effective establishment of such a system.92 If the EU decides to establish such a system, the parties should consult to determine whether this Agreement would need to be adjusted accordingly.93 According to the Decision on the conclusion of the Agreement, if, five years after the entry into force of the Agreement, the equivalent EU system has not been set up, the EU shall consider whether to renew the Agreement in accordance with Article 21(2) thereof.94 The Commission’s 87 Schrems v Data Protection Commissioner (n 74) para 94. 88 Second Joint Review (n 34) 12–13: ‘reciprocity – the EU benefiting from TFTP data’. 89 European Parliament Resolution of 5 May 2010 P7_TA-PROV(2010)0143. 90 A Ripoll Servent and A MacKenzie, ‘The European Parliament as a “Norm Taker”? EU–US Relations after the SWIFT Agreement’ (2012) 17 European Foreign Affairs Review 83. 91 EU–US TFTP Agreement, art 11(1). 92 ibid art 11(2). 93 ibid art 11(3). 94 ibid art 2, third indent.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 675 report on the second joint review of the Agreement indicates that there will continue to be close cooperation and consultation with the US on this issue,95 and states explicitly that the functioning of reciprocity under the Agreement is an essential factor in assessing the necessity of a possible establishment of an equivalent EU system.96 In this manner, the two levels of reciprocity are linked together by the Commission, essentially presenting an EU TFTP system as an alternative if the US authorities do not cooperate sufficiently with the EU under the EU–US TFTP Agreement. This is a departure from the European Parliament’s rationale for the establishment of an EU system, the security focus of which is confirmed by the view of the Commission that the further information provided by the Treasury and Europol in the course of the second joint review constitutes useful and important input for the completion of the Commission’s impact assessment and the subsequent decision on the possible establishment of an EU system. The Commission published a Communication setting out options for a European TFTP system.97 The aims of such a system would be to contribute to the fight against terrorism and its financing and to limiting the amount of personal data transferred to third countries. The system should provide for the processing of the data required to run it on EU territory, subject to EU data protection principles and legislation.98 While the establishment of an EU TFTP system along these lines may be seen as an attempt to establish coherence by addressing data protection concerns ensuing from the transfer of financial data in bulk to the US, in reality, as is the case with similar proposals in the field of the transfer of PNR data, the effect of establishing an EU TFTP system will be to import into the EU and internally legitimise a highly invasive programme of executive action, and thus to normalise an emergency security response without questioning the necessity of the mass transfer of everyday financial data to the state authorities in the first place. As with the TFTP Agreement, the EU–US PNR Agreement focuses on reciprocity at two levels: at the level of seeking the provision of intelligence data from US authorities (the Department of Homeland Security (DHS)) to Member States’ law enforcement authorities and EU criminal justice bodies; and at the level of seeking to develop a European PNR system. Article 18 of the Agreement places the DHS under the duty to provide information obtained by PNR to Member States’ law enforcement authorities, Europol and Eurojust.99 This represents a stronger commitment than the text of the US letter to the EU within the framework of the 2007 Agreement, whereby the DHS would merely ‘encourage’ the transfer of such data.100 Such transfer of information must be consistent with existing agreements between the US and EU Member States, Europol and Eurojust.101 European authorities may also request access to PNR data or relevant analytical information obtained from PNR and the DHS must, subject to existing

95 See also ibid art 11(3). 96 Second Joint Review (n 34) 14. 97 Commission Communication, ‘A European Terrorist Finance Tracking System: Available Options’ COM (2011) final, Brussels, 13 July 2011. 98 ibid 2. 99 EU–US PNR Agreement, article 18(1). 100 ibid point IX, second paragraph. 101 ibid.

676 The External Dimension of Mutual Trust greements, provide such information.102 In this manner, EU and Member State A authorities are allowed to obtain information following transfers of personal data which pose challenges to EU privacy and data protection law. At the same time, the Agreement envisages the establishment of an EU PNR system and states that if and when an EU PNR system is adopted, the parties will consult to determine whether this Agreement would need to be adjusted accordingly to ensure full reciprocity. Such consultations will in particular examine whether any future EU PNR system would apply less stringent data protection safeguards than those provided for in this Agreement and, therefore, whether this Agreement should be amended.103 This is a striking provision,104 which seems to disregard the current challenges that the Agreement poses on EU fundamental rights standards and the requirement that any internal EU legislation in the field must comply fully with fundamental rights and, in particular, privacy and data protection as enshrined in the ECHR and the Charter. The necessity and compatibility of the EU PNR system with EU law remain questionable. The European Commission tabled a proposal for a Framework Decision on an EU PNR system as early as 2007.105 The Commission explained that the proposal was a result of the ‘policy learning’ from, inter alia, the existing EU PNR Agreements with the US and Canada.106 Agreement on the proposal was not reached before the entry into force of the Lisbon Treaty, a fact which led the Commission to table new legislation post-Lisbon, this time in the form of a Directive.107 The Commission justified the establishment of a European system of PNR transfer as necessary for law enforcement purposes due to its potential for risk assessment of air passengers and proposed a system which is very similar to the US PNR system, at least as regards the categories of transferred data108 and the emphasis on risk assessment.109 As with the US system, the potential for the proposed PNR system to lead to the profiling of individuals is considerable.110 Moreover, the necessity of an internal EU PNR system for law enforcement purposes

102 ibid art18(2). See also the Commission Report on the 2010 Joint Review, where the EU urged the DHS to respect its commitment to proactively share analytical information flowing from PNR data with EU Member States (at 12). 103 EU–US PNR Agreement, article 20(2). 104 See also the wording of the US letter to the EU within the framework of the 2007 Agreement, according to which the DHS expected not to be asked to undertake data protection measures in its PNR system that are more stringent than those applied by the US for its PNR system (point IX, para 1); see also Preamble of the Agreement, Recital 5. 105 Commission Proposal for a Council Framework Decision on the Use of Passenger Name Record (PNR) data for Law Enforcement Purposes, COM (2007) 654 final (6 November 2007). 106 ibid 2. 107 Commission Proposal for a Directive of the European Parliament and of the Council on the Use of Passenger Name Record Data for the Prevention, Detection, Investigation, and Prosecution of Terrorist Offences and Serious Crimes COM (2011) 32 final (2 February 2011). 108 Requested data include all forms of payment information, including billing address, travel status of air passengers (including confirmations), check-in status, no show or go show information, seat number and other seat information, number and other names of travellers on PNR, and ‘general remarks’. 109 V Mitsilegas, ‘Immigration Control in an Era of Globalisation: Deflecting Foreigners, Weakening Citizens, Strengthening the State’ (2012) 19 Indiana Journal of Global Legal Studies 3. 110 See Opinion of the European Data Protection Supervisor on the Proposal for a Directive of the European Parliament and of the Council on the Use of Passenger Name Record Data for the Prevention, Detection, Investigation and Prosecution of Terrorist Offences and Serious Crime (25 March 2011) 4–5.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 677 is questionable, particularly in the light of the major data protection and privacy challenges posed by its establishment. The adoption of the PNR Directive is facing a rocky road, having been rejected by the Civil Liberties Committee of the European Parliament in the spring of 2013.111 However, the draft Directive (as with its predecessor draft Framework Decision) constitutes a prime example of the internalisation of the US security model by the EU, leading to the lowering of internal EU privacy and data protection standards.112 The terrorist events in Paris in November 2015 strengthened calls for the establishment of an internal EU PNR system to address the issue of so-called ‘foreign fighters’, and resulted in the adoption of an EU PNR Directive.113 While this internalisation may be seen as justified by the need to ensure coherence between internal and external action on security – by establishing internal EU standards from scratch which can act as benchmarks for EU external action – in reality, the necessity for the adoption of such internal measures has not been justified and their adoption would in fact undermine coherence between EU external security action and EU values by significantly challenging the fundamental rights to privacy and data protection. The interplay between internal and external EU PNR law will become increasingly relevant, in view of Opinion 1/15, where the CJEU annulled the EU–Canada PNR Agreement114 and pending litigation on the EU PNR Directive in Luxembourg.

E. Mutual Trust via the Development of Global Security Standards Another way of attempting to ensure coherence is the externalisation of transatlantic counter-terrorism cooperation via the promotion of global standards. This approach has been central as regards the transfer of PNR data. Calls for approaching PNR negotiations from a global perspective have been made by the European Parliament following the adoption of the 2007 EU–US PNR Agreement. The rationale for these calls has been the perceived need for the European Union to adopt common principles underpinning the negotiating position of the EU not only with the US, but also with other third countries, bearing in mind that the EU has also negotiated PNR Agreements with Australia and Canada. The European Commission responded by issuing a Communication on a Global Approach to Transfers of PNR Data to Third Countries.115 In its Communication, the Commission went a step further and argued for the adoption of global standards in the field. It called upon the EU to consider initiating discussions with international

111 ‘Civil Liberties Committee Rejects EU Passenger Name Record Proposal’, European Parliament press release, 24 April 2013. 112 On the internalisation point, see further J Argomaniz, ‘When the EU is the “Norm-Taker”: The Passenger Name Records Agreement and the EU’s Internalization of US Border Security Norms’ (2009) 31 Journal of European Integration 119. 113 Directive (EU) 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime [2016] OJ L119/132. 114 For further analysis of the privacy and data protection impact of PNR systems, see ch 8. 115 European Commission, ‘Communication on the global approach to Transfers of Passenger Name Record (PNR) data to third countries’ COM (2010) 492 final, 21.9.2010.

678 The External Dimension of Mutual Trust partners that use PNR data and those that are considering using such data in order to explore whether there is common ground between them for dealing with PNR transfers on a multilateral level. The move towards multilateralism is justified as follows: As more and more countries in the world use PNR data, the issues arising from such use affect the international community. Even though the bilateral approach which has been adopted by the EU was the most appropriate one under the circumstances and seems to be the most appropriate one for the near future, it risks ceasing to be appropriate if many more countries become involved with PNR. The EU should therefore examine the possibility of setting standards for the transmission and use of PNR data on an international level. The Guidelines on PNR access that have been developed by ICAO in 2004 offer a solid basis for the harmonisation of the modalities of transmissions of PNR data. However, these guidelines are not binding and they deal insufficiently with data protection issues. They are therefore not sufficient in themselves, but should rather be used for guidance, especially on matters affecting the carriers.116

In this manner, the specific issues arising in the negotiations of EU Agreements with third countries, including the US, are exported to the global level. The EU is emerging as a global actor aiming to shape global, multilateral standards on PNR transfers. However, in doing so, it legitimises and accepts the far from globally accepted US approach focusing on the generalised surveillance of mobility which forms a central part of the US security response post-9/11. This signifies a move from US unilateral emergency action to the normalisation and generalisation of such action first via its internalisation in EU law (a European PNR Directive) and then via the development of global standards regulating the transfer of PNR data. Global standards in this context have the potential to result in an obligation for members of the international community to adopt systems of PNR data transfers, even though currently these systems are used by only a minority of states. The very logic and purpose of PNR systems is thus not questioned and the model of the generalised surveillance of mobility it entails becomes globalised.

F. Mutual Trust via the Development of a Transatlantic Privacy Framework Another way to ensure coherence between EU–US counter-terrorism cooperation and European values has been to attempt to bridge the parties’ differences with regard to data protection and privacy by developing a framework enabling a level playing field on privacy. The first step towards the establishment of such level playing field has been the parties’ agreement on a series of common data protection principles reached in 2009.117 Along with reference to a series of specific data protection standards, the parties aimed at reaching a broad understanding of equivalence of data protection taken ‘as a whole’, and not an understanding that is based upon the scrutiny of specific (singular) examples.118 116 ibid 10. 117 US Mission to the European Union, ‘US–EU Reach Agreement on Common Data Protection Principles, Joint Statement Adopted at the October 28, 2009, US–EU JHA Ministerial’. 118 ibid: ‘On equivalent and reciprocal application of data privacy law, the European Union and the United States should use best efforts to ensure respect for the requirements, taken as a whole as opposed to singular examples, that each asks the other to observe.’

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 679 This approach is reminiscent of the equivalence provisions in the EU–US Mutual Legal Assistance Agreement119 and in the Europol–USA Agreement,120 where it is stated that generic differences in data protection should not constitute an obstacle to the exchange of personal data. However, it is questionable whether such a broad approach to equivalence will suffice in all cases to ensure compliance with EU data protection and privacy standards. Yet, what is key to this approach is the focus essentially on mutual recognition of the data protection systems of the EU and the US taken as a whole, based upon the presumption that the systems do in fact in principle offer an acceptable level of protection. The emphasis on mutual recognition based on the development of common data protection standards is evident in the next step in the transatlantic privacy dialogue, which consists of efforts to conclude a transatlantic agreement on privacy. In 2009, the European Commission adopted a mandate for the negotiation of an EU–US Agreement on privacy, which would aim to provide for a number of data protection safeguards that would be applicable in transatlantic Agreements authorising the transfer of personal data.121 Negotiations towards a transatlantic privacy Agreement in the field started in 2010 and are ongoing.122 According to a Joint Statement on the negotiation of the agreement by European Commission Vice-President Viviane Reding and US Attorney General Eric Holder, such an agreement will allow for even closer transatlantic cooperation in the fight against crime and terrorism, through the mutual recognition of a high level of protection afforded equally to citizens of both the US and the EU, and thus will facilitate any subsequent agreements concerning the sharing of a specific set of personal data.123 Achieving mutual recognition in the light of the deep differences in privacy and data protection law between the two parties may be easier said than done. The experience with the application of the principle of mutual recognition internally in the EU in the Area of Freedom, Security and Justice has demonstrated that even in a Union whose members are all signatories to the ECHR, there are in practice limits to mutual recognition caused by differing levels of implementation of human rights provisions.124 On the basis of the internal EU lessons on mutual recognition, negotiations towards the transatlantic privacy Agreement seem to go in the right direction in terms of focusing on the establishment of common standards on privacy and data protection, but it is the

119 EU–US Agreement on Mutual Legal Assistance, art 9(2)(a). 120 Article 5(4) of the Europol–US Agreement states that the grounds for refusing or postponing assistance should be limited to the greatest extent possible. In the Exchange of Letters accompanying the Agreement (Doc 13996/02 Europol 95, 11 November 2002), it is stated that art 5(4) is to be understood not to permit the imposition of generic restrictions with respect to the sharing of personal data. 121 IP/10/609, Brussels, 26 May 2010, ‘European Commission Seeks High Privacy Standards in EU–US Data Protection Agreement’. 122 See Kristin Archick, ‘US–EU Cooperation against Terrorism’, Congressional Research Service 7-5700, 4 September 2013, which provides an overview of the contested issues in negotiations. 123 Joint Statement on the negotiation of a EU–US data privacy and protection agreement, Brussels, 21 June 2012, MEMO/12/474. 124 See V Mitsilegas, ‘The Limits of Mutual Trust in Europe’s Area of Freedom, Security and Justice: From Automatic Inter-state Cooperation to the Slow Emergence of the Individual’ (2012) 31 Yearbook of European Law 319;.more recently, see V Mitsilegas, ‘The Symbiotic Relationship between Mutual Trust and Fundamental Rights in Europe’s Area of Criminal Justice’ (2015) 6 New Journal of European Criminal Law 460.

680 The External Dimension of Mutual Trust implementation of these standards on the ground and the de jure and de facto compliance of state action with fundamental rights as enshrined in the ECHR and the Charter of Fundamental Rights which will be key for the success of the Agreement from a European perspective. A text of the transatlantic privacy agreement – otherwise known as the ‘Umbrella’ agreement – has been finalised.125 The Council has adopted a Decision on the signing of the Agreement,126 and negotiations on its conclusion are pending at the time of writing. The Agreement sets out data protection standards for the transatlantic exchange of personal information in relation to the prevention, detection or prosecution of criminal offences, including terrorism, with a view to ensuring ‘a high level of protection of personal information’ while enhancing cooperation between the US and the EU and its Member States.127 The Agreement establishes the framework for the protection of personal information when transferred between the US on the one hand, and the EU or its Member States on the other hand.128 The Agreement applies to both existing and future transatlantic agreements falling within its scope.129 It contains a number of data protection safeguards, including: the prohibition of the transfer of data to third parties without the consent of the competent EU body;130 limiting the retention period of the transferred data by excluding unnecessarily long retention periods and providing that the retention period should be periodically reviewed and by requiring specific agreement in cases of bulk data transfers;131 and references to the respect of the principles of proportionality, necessity, data quality and purpose limitation. As with the transatlantic data transfer agreements, it includes a provision on joint review.132 Perhaps one of the most important safeguards introduced by the Agreement is the fact that all EU citizens will be entitled to seek the enforcement of their privacy rights before the US courts.133 This has been an ongoing issue for years, with the US denying the granting of judicial redress and insisting on administrative redress only, which could not be accepted by the EU side, since it would depend on the goodwill of the US administration.134 In this context, the Agreement was subject to an essential prerequisite: the adoption of the Judicial Redress Act by Congress135 that would provide for the necessary amendments

125 Council Document 8557/16, Brussels, 18 May 2016. 126 Council Decision (EU) 2016/920 on the signing, on behalf of the European Union, of the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences [2016] OJ L154/1. 127 Article 2 of the Agreement. Compare this with the Commission documents on the stated purpose of the negotiations. According to the Commission, the purpose of ensuring a high level of protection of personal information appears as ‘a first and “self-standing” purpose of the agreement’. See Council Document 8761/14, 3. 128 ibid, Article 1(2). 129 ibid Preamble, Recital 3: ‘intending to provide standards of protection for exchanges of personal information on the basis of both existing and future agreements between the US and the EU and its Member States’. 130 ibid art 7. 131 ibid art 12. The Commission claims that these provisions go beyond what is found in most existing agreements. See Council Document 8761/14, 6. 132 Article 23. 133 ibid art 19. 134 Peter Schaar, ‘Leaky Umbrella’ (European Academy for Freedom of Information and Data Protection, 18 September 2015), http://www.eaid-berlin.de/?p=779. 135 The Judicial Redress Bill is available at: https://www.congress.gov/bill/114th-congress/house-bill/1428.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 681 to the 1974 Privacy Act so that EU citizens would be allowed to seek redress in the US. This is because under the Act, an ‘individual’ is defined as ‘a citizen of the US or an alien lawfully admitted for permanent residence’.136 Indeed, the Bill successfully passed on 20 October 2015. In addition to the Umbrella Agreement, and following the ruling of the Court of Justice in Schrems, an agreement under the name of the ‘Privacy Shield’ between the EU and the US was finalised in early 2016 and its adequacy was declared by the Commission in an Implementing Decision to the 1995 Data Protection Directive.137

G. Mutual Trust after Schrems II Notwithstanding the above developments, transatlantic data transfers have been the subject of continuing litigation before national courts and the CJEU. The latest case has also been generated by Max Schrems in the context of a complaint submitted before the Irish authorities relating to the compatibility with EU law of the transfer of Facebook data to the US on the basis of Standard Contractual Clauses.138 The Irish High Court, which sent the preliminary reference to Luxembourg, after analysing ongoing surveillance under the PRISM and UPSTREAM programmes, found that the US continues to carry out mass and indiscriminate processing of personal data that might expose the data subjects to a risk of a violation of the rights which they derive from Articles 7 and 8 of the Charter, that EU citizens do not have access to the same remedies against the unlawful processing of their personal data by the US authorities as US nationals, and that while they do have certain other remedies, those remedies encounter substantial obstacles.

i. The AG’s Opinion AG Saugmandsgaard Øe delivered his opinion on 19 December 2019.139 A key argument that the Court has been called upon to resolve in this new Schrems litigation is whether EU law is applicable to transatlantic data transfers, or whether the use of such data by US authorities for national security purposes means that EU law is not applicable or, even if it is, data transfers fall within the crime and security exceptions in EU data protection law. As seen above, this line of argument has also been presented in the latest waves of ‘internal’ CJEU cases on the compatibility of national data retention schemes with EU law. In a similar fashion to the development of ‘internal’ case law in the field,

136 5 USC para 552a(a)(2). 137 Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU–US Privacy Shield [2017] OJ L207/1. 138 This section is based on V Mitsilegas, ‘The Privatisation of Surveillance in the Digital Age’ in V Mitsilegas and N Vavoula (eds), Surveillance and Privacy in the Digital Age: European, Transatlantic and Global Perspectives (Hart Publishing, 2021) 101–58. 139 Case C-311/18, Data Protection Commissioner v Facebook Ireland, ECLI:EU:C:2020:559, Opinion of AG Saugmandsgaard Øe, delivered on 19 December 2019, paras 2–4.

682 The External Dimension of Mutual Trust the AG found that EU law is applicable to the transfers in question. He developed in this context a distinction between ‘private’ and ‘public’ ‘security’ activities. In his view, EU law does apply to intra-company transatlantic data transfers undertaken for commercial reasons when after the transfer has been initiated, the data may be processed by the public authorities of that third country for purposes that include the protection of internal security; what is important here is the activity of which that transfer forms part, while the purpose of any further processing that the transferred data will undergo by the public authorities in the third country of destination is irrelevant.140 The second question put forward was whether the reservation of competence in Article 4(2) TEU and Article 2(2) of the GDPR in relation to the protection of national security implies that the legal order of the EU does not include standards of protection with which the safeguards in place in a third country as regards the processing by the public authorities, for national security protection purposes, of data transferred should be compared.141 The AG sent a strong message supporting the applicability of EU law in this context. From the outset, he noted that requiring continuity of level of protection of fundamental rights in international data transfers is designed to avoid the risk that the standards applicable within the EU are circumvented,142 and that the assessment of the adequacy of the level of protection ensured in the third state of destination cannot ignore any interference with the exercise of the fundamental rights of the persons concerned that would result from state measures, notably in the field of national security, which, if they were adopted by a Member State, would fall outside the scope of EU law.143 Following earlier case law, the AG began by stating that EU law does not apply to national measures relating to the collection and use of personal data that are directly implemented by the state for the purposes of the protection of national security, without imposing specific obligations on private operators.144 However, he distinguished the above scenario from the situation where national provisions which, in the same way as section 702 of the Foreign Intelligence Surveillance Act (FISA), require electronic communications services providers to lend their support to the authorities competent in national security matters in order to allow them to access certain personal data,145 with the question arising of whether national measures which impose on those providers an obligation to make data available to public authorities for national security purposes, independently of any obligation to retain the data, fall within the scope of the GDPR and therefore of the Charter.146

140 ibid para 105. According to the AG, the approach by Facebook would render the provisions of the GDPR relating to transfers to third countries devoid of purpose, since it can never be precluded that data transferred in the course of a commercial activity will be processed for national security purposes after being transferred (para 107). 141 ibid para 203. 142 ibid para 204. 143 ibid para 206 According to the AG, the assessment of the adequacy of the level of protection with regard to such state measures entails a comparison of the safeguards attached to them with the level of protection required within the EU under the law of the Member States, including their commitments under the ECHR (para 207). 144 ibid para 211. 145 ibid para 212. 146 ibid para 217.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 683 The AG confirmed the applicability of EU law in these cases. Following the Court’s reasoning in Tele2,147 he found that EU law is applicable to national rules that require electronic communications services providers to lend their assistance to the authorities responsible for national security so that they may access certain data, it being immaterial whether or not those rules accompany a prior obligation to retain the data.148 What is important here is not the objective of the provisions at issue, but the fact that the provisions in question governed the providers’ activities and required them to carry out data processing – those activities therefore not constituting state activities in the fields of security and crime.149 Importantly, the AG expressly stated that the ‘making available’ of data by the controller for the benefit of a public authority satisfies the definition of processing in Article 4(2) of the GDPR150 and that the same applies to the prior filtering of the data by means of search criteria for the purposes of isolating the data to which the public authorities have requested access.151 Summing up, the GDPR and the Charter apply to national rules that require a provider of electronic communications services to lend its assistance to the authorities responsible for national security by making data available to them, where appropriate after having filtered them, even independently of any legal obligation to retain the data.152 In the case in question, EU law applies to a national measure requiring providers of electronic communications services to respond to a request from the authorities with competence for national security for access to certain data retained by those providers in the context of their commercial activities, independently of any legal obligation, by identifying in advance the data requested by the application of selectors (as in the context of the PRISM programme), as well as to a national measure requiring undertakings operating the telecommunications ‘backbone’ to grant the authorities responsible for national security access to data transiting via the infrastructures which they operate (as in the context of the UPSTREAM programme).153 According to the AG, the national security derogation is applicable only once those data have come into the possession of the state authorities, with the retention and subsequent use of those data by those authorities for national security purposes falling outside the scope of EU law.154 The AG has thus defined the realm of privatisation broadly, focusing on the activity involved and not on the purpose of making data available. Acting on behalf of the state will not stop the applicability of EU law if the activities in question are conducted by the private sector. Considerable space in the Opinion was devoted to upholding high standards in the determination of the EU level of protection in the process of adequacy assessment. The requirement for standards in the third country to be ‘essentially equivalent’ with EU 147 Confirmed subsequently in Case C-207/16, Ministerio Fiscal, ECLI:EU:C:2018:788. See ibid para 219. 148 ibid. 149 ibid para 220. See also para 221 for express references to Joined Cases C-203/15 and C-698/15, Tele2 and Watson, ECLI:EU:C:2016:970, para 78 and Ministerio Fiscal (n 147) para 37. 150 Data Protection Commissioner v Facebook Ireland (n 139) Opinion of AG Saugmandsgaard Øe, para 222, referring to Ministerio Fiscal (n 147) para 38. 151 Data Protection Commissioner v Facebook Ireland (n 139) Opinion of AG Saugmandsgaard Øe, referring to Case C-131/12, Google Spain and Google, EU:C:2014:317, para 28. 152 ibid para 223. 153 ibid para 225. 154 ibid para 226.

684 The External Dimension of Mutual Trust law was reiterated.155 The AG pointed out that the relevant provisions of the GDPR aimed at ensuring the continuity of the high level of protection of personal data ensured by the GDPR when they are transferred outside the EU and designed to ensure that the standards of protection resulting from EU law are not circumvented by transfers of personal data to a third country for the purpose of being processed there.156 The fact that a decision and the standard contractual clauses that it sets are not binding on the authorities of the third country of destination does not in itself render that decision invalid; the compatibility of the decision with the Charter depends on whether there are sufficiently sound mechanisms to ensure that transfers based on the standard contractual clauses are suspended or prohibited where those clauses are breached or impossible to honour.157 The private sector has a duty, and not the option, to comply with the Charter in this process. The fact that the exporter is given a right, in its bilateral relations with the importer, to suspend the transfer or terminate the contract where the importer is unable to honour the standard clauses is without prejudice to the obligation placed on the exporter to do so in the light of the requirements to protect the rights of the persons arising under the GDPR.158 Constitutional law and fundamental rights requirements thus trump private law relationships and clauses. Examination of compatibility by the private provider is holistic and must occur not in a generalised manner, but on a caseby-case basis, including a consideration of all of the circumstances characterising each transfer.159 Extensive duties of scrutiny also extend to supervisory authorities, with the AG expressly stating that the adoption of an adequacy decision cannot validly restrict their powers.160 Significantly, the AG proceeded to provide an assessment of the compatibility of the Privacy Shield with EU law, although an answer on this matter was not in his view necessarily required in the present question for a preliminary ruling. He began with general comments on his methodology of assessment of adequacy. He distinguished between applicable standards according to data-related activities in the US. It is the ECHR that will be the relevant benchmark to assess whether US law – in that it authorises the intelligence authorities to collect personal data themselves, without the assistance of private operators – calls into question the adequacy of the level of protection afforded in the US. Those provisions will also provide the standards of comparison that will make it possible to assess the adequacy of that level of protection with respect to the retention and use by those authorities for national security purposes of the data acquired.161 It is, however, EU law that will form the adequacy benchmark regarding the collection of personal data even to the extent that the collection of the data took place outside the territory of the US, during the stage in which the data are in transit from the European Union to that third country.162

155 ibid

para 115. para 117. 157 ibid para 127. 158 ibid para 132. 159 ibid para 135. 160 ibid para 142. 161 ibid para 229. 162 ibid para 230. 156 ibid

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 685 Scrutiny must include both provisions relating to the surveillance implemented in the territory of the third country and those that allow surveillance of the data in transit to that territory. Otherwise data protection could be circumvented.163 What is relevant for adequacy assessment are the provisions of the legal order of the third country of destination.164 In its evaluation, the Commission cannot hide behind the fact that a third country has failed to disclose its surveillance practices. When surveillance programmes are brought to its knowledge, the Commission must take them into account in its examination of adequacy. Likewise, if, after the adoption of an adequacy decision, the existence of certain secret surveillance programmes, implemented by the third country in question on its territory or while the data are in transit to that territory, is disclosed to it, the Commission is required to reconsider its finding as to the adequacy of the level of protection ensured by that third country if such disclosure gives rise to doubt in that respect.165 Secrecy should thus not trump an effective and regular scrutiny of the adequacy of the data protection system of a third country. In terms of his substantive assessment, the AG doubted that the Privacy Shield was in conformity with EU law, particularly Article 45(1) of the GDPR, read in the light of Articles 7, 8 and 47 of the Charter and Article 8 ECHR.166 He analysed in detail the gravity of interference of US surveillance with the rights to privacy and data protection, and highlighted the weaknesses of US law and the Privacy Shield itself to address fundamental rights concerns. He noted that the obligation imposed on providers by US law to make the data available to the National Security Agency (NSA) entails in itself an interference, even if this data are not subsequently consulted and used by the intelligence authorities, with the retention and actual access by those authorities to the metadata and content of the communications made available to them, just like the use of this data, constituting additional interferences.167 The AG noted that for filtering purposes, the NSA already had access, in the context of the UPSTREAM programme, to huge ‘packets’ of data forming part of the communication flows passing through the telecommunications ‘backbone’ and encompassing communications that do not contain the selectors identified by the NSA, and that access to the data for filtering purposes also constitutes an interference with the exercise of the right to respect for the private life of the data subjects, whatever the subsequent use of the data retained.168 The AG thus included a wide range of surveillance activities within the scope of interference with rights, without necessarily requiring the examination of whether accessed and filtered personal data have been subsequently used by the authorities. The AG doubted whether US law setting out guarantees applicable to all signals intelligence activities was sufficiently foreseeable to have the quality of law.169 In terms of interference with fundamental rights, and in a change from the Schrems ruling, the AG shied away from finding that US law authorised generalised access to the content of electronic communications,170 concluding that US law did not constitute interference

163 ibid

para 236. para 237. 165 ibid para 238. 166 ibid para 342. 167 ibid para 259. 168 ibid para 260. 169 ibid para 266. 170 ibid para 274. 164 ibid

686 The External Dimension of Mutual Trust with the essence of the fundamental right to data protection.171 In finding against generalised surveillance, the AG’s reasoning is not entirely convincing. While accepting that the UPSTREAM programme might entail generalised access to the content of electronic communications for automated filtering purposes, temporary access by the intelligence authorities to all the content of the electronic communications for the sole purpose of filtering by the application of selection criteria cannot be treated as equivalent to generalised access to that content, as temporary access for filtering purposes does not allow those authorities to retain the metadata or the content of the communications that do not meet the selection criteria or to establish profiles relating to the persons not targeted by those criteria.172 However, at the same time, the AG accepted that limits to the powers of US authorities depend on the framework of the choice of selectors,173 which was deemed insufficient to meet the criteria of foreseeability and proportionality of the interferences.174 However, in spite of these fundamental weaknesses, the AG found that the existence of the framework as such precludes the conclusion that section 702 of the FISA permits generalised access by the public authorities to the content of the electronic communications and thus amounts to a breach of the very essence of the right enshrined in Article 7 of the Charter.175 This line of reasoning is unconvincing and risks legitimising in principle an effectively generalised surveillance system by recourse to the case law not of the CJEU, but of the ECtHR.176 While the AG refrained from finding that US surveillance constituted an interference with the essence of the right to data protection, he found that US law fell short of EU law requirements of necessity and proportionality. He also found that the criteria included in section 702 of the FISA limiting the choice of selectors177 were not clear or precise and did not contain sufficient guarantees to prevent the risk of abuse.178 In particular, the selectors were not individually approved by the Foreign Intelligence Surveillance Court (FISC) or by any other judicial or independent administrative body before being applied;179 the Privacy Shield did not provide precise requirements to state reasons or to provide justification for the choice of selectors in the light of those administrative priorities imposed on the NSA;180 and the US law requirement that foreign intelligence collection must be always ‘as tailored as feasible’ fell short of the EU law standard of ‘strict necessity’ required by the Charter to justify an interference with the fundamental rights to privacy and data protection.181 Thus, it was not certain whether 171 ibid paras 278 and 280. 172 ibid para 276. 173 ibid para 277. 174 ibid para 278. 175 ibid para 278. 176 ibid paras 281–82. The AG referred to the ECHR and noted that the Strasbourg Court has not thus far considered that regimes that allow the interception of electronic communications, even on a mass scale, exceeded the margin of appreciation of the Member States. 177 ibid para 296. The US government and the Commission claim, on the other hand, that s 702 of the FISA limits by objective criteria the choice of selectors, since it permits only the collection of the electronic communications data of non-US persons located outside the US for the purpose of obtaining foreign intelligence information. 178 ibid para 297. 179 ibid para 298. 180 ibid para 299. 181 ibid para 300.

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 687 the safeguards accompanying US surveillance measures were essentially equivalent to those required under EU law.182 Moreover, US safeguards limiting the collection and use of data outside the territory of the US cannot suffice to meet the conditions of ‘foreseeability’ and ‘necessity in a democratic society’.183 The AG further devoted a large part of his Opinion to the shortcomings of both US law and the Privacy Shield regarding the right to an effective remedy. It is noted that the establishment of the Ombudsperson was intended to compensate for these shortcomings, with the Commission concluding in the Privacy Shield that ‘taken as a whole’, the oversight and recourse mechanisms provided therein offer a number of legal remedies to affected individuals.184 The AG was not convinced by that assessment. He reiterated the Court’s finding in Schrems that legislation that does not provide for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to them, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right enshrined in Article 47 of the Charter.185 He noted that the Privacy Shield did not mention any requirement to inform the data subjects that they were the subject of a surveillance measure.186 Moreover, he stressed that the condition in the Privacy Shield for a remedy to require the existence of a damage or a showing that the government intends to use or disclose information obtained from electronic surveillance was contrary to the case law of the CJEU in which it has held that, for the purpose of establishing the existence of an interference with the right to respect for private life of the person concerned, it is not necessary for that person to have been inconvenienced in any way as a result of the alleged interference.187 The various reviews carried out by the FISC and mentioned in the Privacy Shield do not compensate for the absence of an effective remedy;188 the AG found in particular that the FISC does not review individual surveillance measures before they are implemented.189 Nor are the shortcomings on effective remedy compensated by the establishment of the Ombudsperson, as such a person is not provided by law and does not meet the standards of independence under Article 47 of the Charter.190 The effectiveness of an extrajudicial remedy depends on the ability of the body in question to adopt binding reasoned decisions, with the Privacy Shield giving no indication that the Ombudsperson would take such decisions.191 Furthermore, the decisions of the Ombudsperson are not the subject of independent judicial review.192 Therefore, the essential equivalence between the judicial protection afforded in the US legal order to persons whose data are

182 ibid para 301. 183 ibid para 306. 184 ibid para 313, by reference to Privacy Shield, Recital 139. 185 ibid para 318, by reference to Schrems I (n 74) para 95. 186 ibid para 323. 187 ibid para 324. For this argument, see especially Joined Cases C-465/00, C-138/01 and C-139/01, Österreichischer Rundfunk [2003] ECR I-4989, para 75; Digital Rights Ireland (n 85) para 33; Schrems I (n 74) para 87. 188 Data Protection Commissioner v Facebook Ireland (n 139) paras 325–27. 189 ibid para 326. 190 ibid paras 336–37. 191 ibid para 338. 192 ibid para 340.

688 The External Dimension of Mutual Trust transferred to the US from the EU and that which follows from the GDPR read in the light of Article 47 of the Charter and Article 8 of the ECHR was questionable.193

ii. The CJEU Ruling The week when this chapter was finalised, the CJEU issued its judgment on Schrems II. The analysis here will highlight, as a rapid response, the Court’s key findings. The Court followed in key respects the outcomes of the Opinion of the AG, particularly in establishing the applicability of EU law, in giving flesh to the meaning of adequacy and its scrutiny, and in invalidating the Privacy Shield. However, there are a number of differences in focus and tone, which will be highlighted. From the outset, the Court stated that the possibility that the personal data transferred between two economic operators for commercial purposes might undergo, at the time of the transfer or thereafter, processing for the purposes of public security, defence and state security by the authorities of that third country cannot remove that transfer from the scope of the GDPR.194 In terms of the level of protection offered by the third country, the Court reiterated its findings in Schrems I regarding ‘essential equivalence’,195 with the benchmarks against which such equivalence is assessed being appropriate safeguards, enforceable rights and effective legal remedies in the third state.196 Adequacy must be effectively policed. A Commission adequacy decision adopted pursuant to Article 45(3) of the GDPR cannot prevent persons whose personal data have been or could be transferred to a third country from lodging a complaint before a national data protection supervisory authority which must be able to examine, with complete independence, whether the transfer of that data complies with the requirements laid down by the GDPR and, where relevant, to bring an action before the national courts in order for them, if they share the doubts of that supervisory authority as to the validity of the Commission adequacy decision, to make a reference for a preliminary ruling for the purpose of examining its validity.197 Unless there is a valid Commission adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer of data to a third country pursuant to standard data protection clauses adopted by the Commission, if, in the view of that supervisory authority and in the light of all the circumstances of that transfer, those clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law – in particular by Articles 45 and 46 of the GDPR and by the Charter – cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.198 The Court placed a number of enhanced duties upon private providers in terms of ensuring compliance of transfers with the Charter. It stated that standard contractual clauses which are binding between private parties are not capable of binding the

193 ibid

para 341. para 88. 195 ibid para 94. 196 ibid paras 98–105. 197 ibid paras 119–20, by reference to Schrems I (n 74) paras 53, 57, 65. 198 ibid para 121. 194 ibid

The Quest for Mutual Trust in Transatlantic Counter-terrorism Cooperation 689 authorities of a third country,199 and distinguished the adoption of these clauses from the adoption of a Commission adequacy Decision, as the adoption of the latter is not required prior to its adoption of standard contractual clauses (which, as pointed out above, are applicable to private parties, with third countries not specified).200 A series of obligations to ensure compliance with EU law apply to both the controller and the recipient of personal data under standard contractual clauses.201 EU law remains the benchmark in this context; a controller established in the EU and the recipient of personal data are required to verify, prior to any transfer, whether the level of protection required by EU law is respected in the third country concerned, with the recipient being, where appropriate, under an obligation to inform the controller of any inability to comply with those clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract.202 The Decision on standard contractual clauses adopted by the Commission requires such scrutiny and detailed scrutiny by national supervisory authorities,203 and is thus valid according to the Court.204 As with the AG, and although the answer to this question was not required in the present litigation, the CJEU did not shy away from examining the compatibility of the Privacy Shield with EU law. The Court noted from the outset that the Privacy Shield Decision is binding.205 It then set out the relevant EU law benchmarks for the protection of privacy and personal data,206 importantly reiterating that the communication of personal data to a third party, such as a public authority, constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, whatever the subsequent use of the information communicated. The same is true of the retention of personal data and access to that data with a view to their use by public authorities, irrespective of whether the information in question relating to private life is sensitive or whether the persons concerned have been inconvenienced in any way on account of that interference.207 The Court went on to assess the implementation of the US surveillance programmes208 in the light of the EU law benchmarks and found the US framework wanting in terms of providing an adequate level of protection. In this context, the Court found that section 702 of the FISA does not indicate any limitations on the power it confers to implement surveillance programmes for the purposes of foreign intelligence or the existence of guarantees for non-US persons potentially targeted by those programmes;209 that US law does not confer rights which are effective and enforceable, including rights which are enforceable against the US authorities in the courts;210 and that US law does not

199 ibid para 125. 200 ibid para 130. 201 ibid paras 133–45. 202 ibid para 142. 203 ibid para 147; the Court did not accept that the possibility of the adoption of divergent decisions by national supervisory authorities should act as a justification for a limited supervisory role. 204 ibid para 149. 205 ibid para 156. 206 ibid paras 171–77. 207 ibid para 171. 208 ibid para 178. 209 ibid paras 179–80. 210 ibid paras 181–82.

690 The External Dimension of Mutual Trust delimit the scope of bulk collection of personal data in a sufficiently clear and precise manner.211 The Court also found US law wanting in terms of guaranteeing effective judicial review, which is ‘inherent in the existence of the rule of law’212 and is of particular importance in the context of the transfer of personal data to that third country.213 The Court opined that US law does not guarantee the right to an effective remedy as it does not grant data subjects rights actionable in the courts against the US authorities.214 The establishment of the Ombudsperson is not capable of remedying these deficiencies. Notably, the Ombudsperson is not an independent authority to which data subjects can bring legal action215 and does not have the power to adopt binding decisions on the US intelligence services.216 The Schrems sequel is an extremely significant ruling regarding the protection of privacy and personal data, as well as regarding effective judicial protection in a system of globalised, privatised, large-scale surveillance. The ruling has profound implications for the external dimension of EU law and for the emergence of the EU as a global actor in the field. In this context, Schrems II cements the Court’s approach in Schrems I. In the eyes of the CJEU, the only relevant benchmarks in the context of transfers of personal data from the EU are the benchmarks of EU law. The Court notably departed from the Opinion of the AG by denying any role to the ECHR (or to national law) in the determination of the benchmarks under which conformity with EU law will be assessed. In a strong signal in favour of the autonomy of the EU legal order, the Court treats EU law as its only benchmark.217 Benchmarks include not only privacy and data protection standards, but also standards of judicial independence and effective remedy, all assessed by reference to the Charter. It thus comes as no surprise that the Court found the implicit trust placed by the Commission in the US authorities and their system of protection to be misplaced; trust is earned if compatibility (or ‘essential equivalence’) with EU law is demonstrated in practice and on the ground. Schrems II makes interesting reading on the relationship between the external and the internal dimension of EU constitutional law on privacy and data protection. It is noteworthy that the Court has avoided engaging with the AG’s assessment on whether US surveillance constitutes interference with the essence of the rights to privacy and data protection. Silence here may be read as upholding the finding of the Court in Schrems I, or at least as the Court not wishing to expressly change its jurisprudence on this point. The Court also avoided engaging with the question of whether US surveillance under section 702 of the FISA was targeted or not; its reference to the bulk collection of data in the US may be seen as hinting that the Court accepts that this is a system of mass surveillance. These questions are interrelated and subject to clarification by the Court in the pending ‘internal’ data retention cases, the outcome of which will shape the

211 ibid para 183. 212 ibid para 187. 213 ibid para 189. 214 ibid paras 191–92. 215 ibid paras 194–95. See also the Court’s remark on the nature of the Ombudsperson labelled in the Privacy Shield as a ‘Senior Coordinator for International Information Technology Diplomacy’ (para 193). 216 ibid para 196. 217 ibid para 99. See also paras 98 and 100.

Conclusion 691 EU’s internal benchmark, which will be relevant for EU external action (in particular if the Court develops criteria for targeted, ‘non-bulk’ surveillance). But Schrems II is also significant in terms of the privatised dimension of surveillance. The Court places private providers on both sides of the Atlantic operating under standard contractual clauses under detailed obligations to ensure the conformity of transatlantic data transfers with the Charter. EU law is the benchmark of conformity here. The annulment of the Privacy Shield by the Court makes standard contractual clauses largely the default position. Private actors are further responsibilised by the Court in upholding EU law. In a world of global corporations operating in a variety of jurisdictions, EU law is becoming, via the compliance of the private sector, the global standard on privacy and data protection.

IV. Conclusion The negotiation and conclusion of the EU–US counter-terrorism agreements presented the EU institutions with the significant challenge of responding to perceived global security needs, but also unilateral emergency security requirements imposed by the US executive, in a manner which would be compliant with fundamental rights and the rule of law, and would not undermine European values. The result has been a series of complex agreements, which include – particularly in the case of the executive transatlantic agreements on the transfer of PNR and SWIFT data – a number of innovative provisions on transatlantic security governance. The evaluation of the impact of these provisions on the content of the transatlantic agreements depends on the perspective adopted. From the perspective of furthering trust in transatlantic relations, the PNR and TFTP agreements can be seen as accepting and legitimising US executive choices and their logic, but also inserting a number of layers of scrutiny and transparency with regard to US practices. However, from the perspective of safeguarding and promoting European values, the result is less satisfactory. Notwithstanding the safeguards included in the agreements, both their text and implementation confirm their focus on security. Notwithstanding multiple avenues of scrutiny, efforts to maintain secrecy remain. The debate on the NSA surveillance scandal demonstrates that the existence of trust in the US system of privacy and data protection should by no means be taken for granted. Calls to address this lack of trust via the conclusion of a transatlantic privacy agreement may not be sufficient to effectively counter the paradigm of surveillance that transatlantic counter-terrorism cooperation entails. Following up from the already broad provisions of data transfer included in the EU–US Mutual Legal Assistance Agreement and in the Europol–US and Eurojust–US Agreements, the PNR and TFTP Agreements not only legitimise the bulk transfer to the US government of everyday personal data, but also open the door to the internalisation of this paradigm of surveillance in the EU via the establishment of a European PNR and potentially a TFTP system. This example of mimesis serves to highlight a third, and perhaps not as visible, institutional/competence perspective. By attempting to provide safeguards to address the challenges posed by US demands, the PNR and TFTP Agreements have developed a number of institutional innovations, including an increase in the powers of Europol, the appointment of

692 The External Dimension of Mutual Trust an EU scrutiny authority in the territory of a third country and the potential development of specific EU legislation on surveillance. The institutional aspect also becomes prevalent in the light of the calls to globalise the transatlantic security standards with respect to the transfer of PNR data, which would have the effect of both externalising the issue and normalising what started as emergency unilateral emergency action at a global level. While such externalisation and globalisation may represent a step forward for the emergence of the EU as a global security actor, its negative impact on the protection of fundamental rights at the global level may be considerable. The Court of Justice in its Schrems case law has reminded us of the importance of upholding European values – in particular the protection of fundamental rights – in the EU’s external action and of placing uncritically accepted concepts of mutual trust under rigorous scrutiny.218 Following the activism of the European Parliament in relation to the early versions of the PNR and TFTP Agreements, it is now the Court of Justice which has emerged as the institutional actor contributing towards the coming of age of the EU as a global security actor. In the field of transatlantic counter-terrorism cooperation, it is the Court which reminds us that EU external action in the field must respect and promote the very values upon which the EU claims to be founded.

218 See also V Mitsilegas, ‘Judicial Concepts of Trust in Europe’s Multi-level Security Governance: From Melloni to Schrems via Opinion 2/13’ (2015) 3 Eucrim 90; Mitsilegas (n 138).

12 EU Criminal Law after Brexit I. Introduction The withdrawal of the UK from membership of the EU has posed the unprecedented challenge of regulating the relationship between the EU and a state which has moved from being a member of the EU to being a third country for the purposes of EU law. The legal challenges to regulate this post-Brexit reality have been compounded in the field of European criminal law in view of the complex and at times uneasy relationship between the UK and this field of EU law even before Brexit. The post-Brexit EU–UK relationship has at the time of writing been regulated by the entry into force, after a long period of gestation, of the EU–UK Trade and Cooperation Agreement (TCA), which contains a number of provisions on security and criminal justice cooperation. This chapter will provide an analysis of the provisions of the TCA in the field and highlight the key future challenges facing European criminal law after Brexit. It will place this analysis in the broader historical, legal and political context of the UK’s relationship with European integration in criminal matters from the time that the UK was an EU Member State to the period in the run-up to Brexit. It will demonstrate that the ambivalence in the UK relationship with the EU in criminal matters – where the UK (and EU) focus on the effectiveness in law enforcement and security cooperation sits uneasily with UK concerns over the adverse impact of European integration in criminal matters on its sovereignty – is a common feature in the pre- and post-Brexit periods. The chapter will highlight continuity and change, and the innovations put forward by the TCA vis-a-vis the relations between the EU and third states in the field of criminal law. While the position of the UK as a third country leaves it constitutionally outside key areas of EU law, it will be seen that aspects of the TCA aim towards a close post-Brexit relationship in certain areas of criminal justice cooperation, while at the same time providing the EU with an opportunity to both develop its internal acquis and strengthen its overall position as a global actor in criminal matters.

II. Before Brexit: The Ambivalent Relationship between the UK and European Criminal Law In the pre-Brexit era, the UK developed an ambivalent relationship with the evolution of European integration in criminal matters.1 This ambivalence was premised on the 1 I have described this relationship as uneasy elsewhere: V Mitsilegas, ‘The Uneasy Relationship between the United Kingdom and European Criminal Law: From Opt-outs to Brexit?’ (2016) 63 Criminal Law Review 517.

694 EU Criminal Law after Brexit clash between the focus by the UK on the effectiveness of law enforcement and security cooperation and the use of the EU legal framework to achieve such effectiveness on the one hand, and concerns regarding the adverse impact of integration in the sensitive area of criminal law on state sovereignty on the other hand. In order to analyse the postBrexit legal landscape of EU–UK cooperation it should not be forgotten that, as has been pointed out by the House of Lords European Union Committee, the UK has been a leading protagonist in driving and shaping the nature and direction of cooperation at the EU level on police and security matters.2 A key example in this context has been the UK’s leadership in securing the application of the principle of mutual recognition in the field of criminal law, an idea which was put forward by the then UK Home Secretary Jack Straw at the Cardiff European Council in 1998. This initiative is emblematic of the UK approach towards European integration in criminal matters: the UK has pushed for a system based on automaticity in interstate cooperation, granting extraterritorial reach to national decisions, without this being envisaged to require any EU harmonisation initially in the field, with EU Member States thus not having to change their domestic criminal laws in order to comply with Brussels-led legislation.3 On the other hand, the UK has been reluctant to adopt EU legislation which would have an impact on domestic criminal procedure, in particular in the field of defence rights.4 The UK has also led in the development of an EU model of data-driven law enforcement and surveillance. Key examples include the export of a model of intelligence-led policing to Europol5 and the adoption of the controversial data retention Directive, which reflects a UK focus on large-scale surveillance.6 Yet these efforts by the UK to influence European criminal law have been combined with fears, at the political level, that European integration in criminal matters would unduly threaten state sovereignty. These fears were exacerbated by the changes in the constitutional framework underpinning criminal law brought about by the Lisbon Treaty, signifying in particular the end of unanimity in the Council and full powers for the Commission and the CJEU in the field of criminal law. The entry into force of the Lisbon Treaty has thus led to efforts by the UK to extend the pre-Lisbon provisions enabling UK ‘opt-outs’ in the field of EU migration law to the field of EU criminal law. Protocol 21 to the Lisbon Treaty extended the right of the UK not to participate in EU law to the whole of Title V TFEU on the Area of Freedom, Security and Justice, including criminal law measures.7 The right not to participate also extended to legislation amending existing measures which were binding upon the UK. The UK government would decide on its participation in post-Lisbon measures on a case-by-case basis.8

2 House of Lords European Union Committee, Brexit: Future UK–EU Security and Police Cooperation, 7th Report, session 2016–17, para 27. 3 See V Mitsilegas, EU Criminal Law (Hart Publishing, 2009) ch 3. 4 V Mitsilegas, EU Criminal Law after Lisbon (Hart Publishing, 2016) ch 6. 5 V Mitsilegas, ‘European Criminal Law after Brexit’ (2017) 28 Criminal Law Forum 219. UK officials have also held two Eurojust presidencies (including the inaugural presidency) and a key Directorship of Europol. 6 V Mitsilegas ‘The Privatisation of Surveillance in the Digital Age’ in V Mitsilegas and N Vavoula (eds), Surveillance and Privacy in the Digital Age: European, Transatlantic and Global Perspectives (Hart Publishing, 2021) 101–58. 7 Protocol 19 covers the UK’s participation regarding the Schengen acquis. 8 See Articles 3 and 4 of Protocol No 21.

The Ambivalent Relationship between the UK and European Criminal Law 695 The Lisbon Treaty has also introduced the legal possibility for the development of EU criminal justice à la carte, in the Treaty legal basis enabling the establishment of a European Public Prosecutor’s Office (EPPO). Reflecting Member States’ concerns over the impact of such an agency on national sovereignty and legal diversity, Article 86 TFEU introduced an exception to the ordinary decision-making procedure by requiring the establishment of the EPPO by enhanced cooperation.9 The UK announced from the outset its non-participation in the Regulation establishing the EPPO.10 The UK had a mixed record regarding participation in post-Lisbon EU criminal law pursuant Protocol 21. In the field of mutual recognition, it participated in the one major judicial cooperation instrument adopted after Lisbon, the Directive on the European Investigation Order (EIO).11 Its participation in this Directive may be seen to have come about against the odds in view of the increasingly Eurosceptic political climate at Westminster, but may be explained by the necessity to ensure that the UK remained in the first category of countries in an increasingly integrated system of judicial cooperation in the field of evidence.12 Less encouraging were the signs with regard to the UK participation in post-Lisbon EU criminal procedural law measures granting rights to individuals. While the UK opted in to the first measures adopted post-Lisbon on the rights of suspects and defendants in criminal procedure, it did not participate in key other instruments in the field, including in particular the Directive on the right of access to a lawyer.13 The non-participation of the UK in this measure could come as a surprise, given the fact that the Directive introduces minimum standards which would arguably lead to minimal (if any) legislative changes to domestic criminal procedure.14 However, non-participation may be explained by the UK government’s reluctance to participate in a constitutionalised post-Lisbon framework where institutions such as the Commission and the Court of Justice would have a say in evaluating the domestic implementation and proceeding to the interpretation of the terms of the Directive.15 9 See ch 8. 10 The European Union Act 2011 imposes a ‘referendum lock’ on the UK’s participation regarding cl 11, s 6 and in particular s 6(5)(c) of the EPPO: European Union Act 2011. See JR Spencer, ‘The UK and EU Criminal Law: Should We Be Leading, Following or Abstaining?’ in V Mitsilegas, P Alldridge and L Cheliotis (eds), Globalisation, Criminal Law and Criminal Justice: Theoretical, Comparative and Transnational Perspectives (Hart Publishing, 2015) 135–52. 11 Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters [2014] OJ L130/1. 12 House of Commons European Scrutiny Committee, ‘The European Investigation Order and Parliamentary Scrutiny of Opt-in Decisions, Oral Evidence of Theresa May’, HC 1416, published on 15 September 2011, Q1: ‘what we found was that the police were saying to us that they felt the EIO would be of significant benefit to them. Indeed, there was a concern that, if we were not part of the EIO, what we would see was that the requests from the UK would, frankly, go to the bottom of the pile in future, in relation to assistance that they wanted from police forces in other Member States’. 13 Directive 2013/48/EU on the right of access to a lawyer in criminal proceedings and in European arrest warrant proceedings, and on the right to have a third party informed upon deprivation of liberty and to communicate with third persons and with consular authorities while deprived of liberty [2013] OJ L294/1. For a critique, see D Giannoulopoulos, ‘Fair Trial Rights in the UK Post Brexit: Out with the Charter and EU Law, in with the ECHR?’ (2016) 7 New Journal of European Criminal Law 387, 389. 14 Baroness Ludford has pointed out that UK concerns have been taken into account in negotiations: oral evidence by Dominic Raab MP to the Justice Sub-Committee of the House of Lords Select Committee on the European Union, Directive 2013/48/EU on the right of access to a lawyer, Tuesday 19 January 2016, Q3. 15 The impact of the Court of Justice was a recurring theme in the oral evidence by Dominic Raab MP to the Justice Sub-Committee of the House of Lords Select Committee on the European Union, Directive 2013/48/EU

696 EU Criminal Law after Brexit Governmental concerns over the impact of participation in post-Lisbon EU criminal law in terms of the impact on domestic law in the light of judicial scrutiny by the Court of Justice also explains the tendency by the UK government not to opt in to the text of the Commission proposals, but rather to try to influence – to the greatest extent possible – negotiations and opt in post-adoption if the adopted measure appeared to be acceptable to the UK. This is the strategy that the UK has followed in relation to measures such as the Directive on trafficking in human beings16 to which the UK opted in post-adoption.17 This ‘wait and see’ strategy was increasingly coupled with a strategy attempting to broaden the field of the measures where the UK ‘opt-out’ applies. In the field of international agreements, the UK argued that Articles 1 and 2 of Protocol No 21 were ‘not restricted to provisions in agreements concluded under a Title V legal base, but to those adopted or concluded “pursuant to” Title V’.18 Moreover, the UK questioned the legal basis of measures adopted outside Title V TFEU, but which are deemed to include a criminal law component (such as the recently adopted fourth Money Laundering Directive)19 and resisted efforts to reclassify Title V measures as measures which could be adopted under different legal bases under the Treaty. The UK challenged legal basis choices and intervened in legal basis litigation before the Court of Justice, with limited success.20 This litigious and ‘wait and see’ approach raised questions of the UK government’s compliance with the principle of loyal cooperation and (at times perhaps unnecessarily) prolonged the legal and political uncertainty regarding the commitment by the UK in terms of participating in key elements of the EU criminal justice system, elements which the UK has contributed decisively towards shaping.21 on the right of access to a lawyer, Tuesday 19 January 2016, QQ 2, 3 and 6. The government’s review of the balance of competences in the field of criminal justice included an extensive section on the potential impact of the Court of Justice in the field post-Lisbon: HM Government, Review of the Balance of Competences between the United Kingdom and the European Union: Police and Criminal Justice, December 2014, paras 3.11–3.21. 16 Directive 2011/36/EU on preventing and combating trafficking in human beings and protecting its victims, and replacing Council Framework Decision 2002/629/JHA [2011] OJ L101/1. 17 See statement by Damian Green, Hansard, 9 May 2011, col 977: ‘we chose not to opt in to the directive when it was initially put on the table last summer, because the draft text had to go through an extensive period of negotiation between the European Council and the European Parliament. We wanted to be absolutely sure that the text would not change during those negotiations in a way that would be detrimental to the integrity of the UK’s criminal justice system. We wanted to consider a final text that had no risks attached and would not fundamentally change the UK’s already strong position in the fight against human trafficking’. 18 House of Lords European Union Committee, The UK’s Opt-in Protocol: Implications of the Government’s Approach, 9th Report, session 2014–15, HL Paper 136, para 38. 19 Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC [2015] OJ L141/73. 20 See Case C-431/11, UK v Council, judgment delivered on 26 September 2013 (the EEA case); Case C-137/12, Commission and Parliament v Council, judgment of 22 October 2013; Case C-377/12, Commission v Council (the Philippines case), judgment delivered on 11 June 2014; Case C-81/13, UK v Council, judgment delivered on 18 December 2014 (the Turkey case), critically analysed in House of Lords European Union Committee (n 18). 21 The ‘wait and see’ opt-in approach of the UK regarding the draft post-Lisbon Regulations on Eurojust and Europol are cases in point. See (then) Parliamentary Under Secretary of State for Security, James Brokenshire, written statement to Parliament, according to whom the government will conduct a thorough review of the final agreed text to inform active consideration of opting into the Eurojust Regulation post-adoption: https://www.gov.uk/government/speeches/european-commissions-proposals-on-eurojust-and-the-europeanpublic-prosecutors-office.

The Ambivalent Relationship between the UK and European Criminal Law 697 UK concerns regarding the impact of the entry into force of the Lisbon Treaty on the transfer of sovereign powers to the EU in the field of criminal justice resulted in a further political compromise in the Treaty of Lisbon, which addressed measures which had been adopted before the entry into force of the Lisbon Treaty, under the largely intergovernmental third pillar. Protocol No 36 on Transitional Provisions retained the pre-Lisbon limited powers of EU institutions with regard to third pillar law for a period of five years after the entry into force of the Lisbon Treaty.22 At least six months before the end of that period, the UK could notify to the Council its non-acceptance of the full powers of the EU institutions in third pillar law.23 In the event of a decision not to accept these powers, third pillar law would cease to apply to the UK,24 but the latter might notify subsequently its wish to participate in such legislation which had ceased to apply to it.25 This transitional period came to an end on 1 December 2014, a date that marked a significant step forward towards the constitutionalisation of EU criminal law by granting EU institutions their full powers of scrutiny with regard to third pillar law still in force after Lisbon. It is important to pay attention to the decisions made by the UK government after the expiry of the five-year deadline set out in the Transitional Provisions Protocol.26 The UK notified the presidency of the EU that, pursuant to Article 10(4) of Protocol 36, it did not accept the powers of the EU institutions; accordingly, third pillar law would cease to apply in the UK from 1 December 2014.27 However, the UK eventually indicated that it would seek to opt back in to 35 of the third pillar measures, including the Framework Decision on the European Arrest Warrant (EAW FD).28 The five-year transitional period expired at the end of November 2014 and the continuation of the applicability of these 35 measures to the UK was confirmed. Third pillar law would continue to apply to the UK vis-a-vis the vast majority of measures applying the principle of mutual recognition in criminal matters (including the EAW FD) and a number of other key measures, including legislation establishing Europol and Eurojust, and legislation on joint investigation teams and criminal records.29 Third pillar law which has ceased to apply to the UK following the expiry of the transitional period included, inter alia, a number of measures on substantive criminal law, the Council Framework Decision on prevention and settlement of conflicts of jurisdiction, and the Framework Decision on the mutual recognition of probation decisions.30 As was the case with the UK’s decision to participate in the post-Lisbon

22 Protocol No 36, art 10(1) and 10(3). For a background to the transitional provisions, see A Hinarejos, JR Spencer and S Peers, Opting out of EU Criminal Law: What is Actually Involved?, CELS Working Paper, New Series, vol 1, University of Cambridge Faculty of Law, September 2012. 23 Protocol No 36, art 10(4). 24 ibid art 10(4). 25 ibid art 10(5). 26 For an analysis, see V Mitsilegas, S Carrera and K Eisele, The End of the Transitional Period for Police and Criminal Justice Measures Adopted before the Lisbon Treaty: Who Monitors Trust in the European Justice Area?, CEPS Paper in Liberty and Security in Europe, No 74, Centre for European Policy Studies, Brussels, December 2014. 27 Council Document 12750/13. 28 Framework Decision 2002/584/JHA of 13 June 2002 on the European Arrest Warrant [2002] OJ L190/1. 29 See Annex to Decision 2014/836/EU [2014] OJ L343/11. 30 Notice 430/03 [2014] OJ C430/17.

698 EU Criminal Law after Brexit Directive on the EIO, the ‘opting-back-in to’ the EAW FD was supported by a number of relevant stakeholders and practitioners in the field of criminal justice.31 Similarly, views of law enforcement practitioners were taken into account by the UK government in its subsequent decision for the UK to opt back in to a series of measures related to the Prüm system of storage and exchange of personal data, including DNA data.32 In her speech before the House of Commons, the then Home Secretary Theresa May stressed the views of senior law enforcement officers and stated that attempts to exchange data in other ways would require not only intergovernmental agreements, but the building of separate systems.33 The UK government thus opted back in to the vast majority of the key third pillar law enforcement measures after the expiry of the Transitional Provisions Protocol deadline.

III. The Run-up to Brexit: Political versus Operational Considerations After the referendum on the UK’s membership of the EU, the key question in the field of criminal law has been the extent to which the EU–UK post-Brexit arrangements could replicate the pre-Brexit status quo. Maintaining close cooperation in the field of law enforcement and criminal justice cooperation was a priority for the UK. The willingness of the UK government to continue participating in cooperative arrangements in the post-Brexit era were expressed in a variety of ways by David Davis, Secretary of State for Exiting the European Union,34 and by the then Prime Minister Theresa May,35 and were enshrined in the government’s White Paper on Brexit.36 This political impetus also reflected a strong operational push from the UK authorities in favour of maintaining a close relationship, emanating from the acknowledgement that the UK is a leading

31 House of Commons Home Affairs Committee, Pre-Lisbon Treaty EU police and criminal justice measures: the UK’s opt-in decision, paras 8–12. See also T May, ‘Fight Europe by All Means, But Not over This Arrest Warrant’ (Daily Telegraph, 9 November 2014), www.telegraph.co.uk/news/politics/conservative/11216589/ Theresa-May-Fight-Europe-by-all-means-but-not-over-this-Arrest-Warrant.html. 32 Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime [2008] OJ L210/1; Council Decision 2008/616/ JHA of 23 June 2008 on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime [2008] OJ L210/12; Council Framework Decision 2009/905/JHA of 30 November 2009 on Accreditation of forensic service providers carrying out laboratory activities [2009] OJ L322/14. 33 House of Commons Hansard Debates for 8 December 2015: Theresa May – vol 603, cols 914, 916 respectively. 34 According to David Davis, ‘maintaining strong security cooperation we have with the EU’ was one of the Government’s top four overarching objectives in negotiations and future relationship with the EU: HC Deb, 12 October 2016, vol 615, col 328. 35 ‘I therefore want our future relationship with the European Union to include practical arrangements on matters of law enforcement and the sharing of intelligence material with our EU allies’: Theresa May, ‘The Government’s Negotiating Objectives for Exiting the EU’, 17 January 2017. 36 ‘As we exit, we will therefore look to negotiate the best deal we can with the EU to cooperate in the fight against crime and terrorism. We will seek a strong and close future relationship with the EU, with a focus on operational and practical cross-border cooperation’: The United Kingdom’s Exit from and New Partnership with the European Union, Cm 9417, presented to Parliament by the Prime Minister, February 2017.

The Run-up to Brexit: Political versus Operational Considerations 699 contributor to and user of EU criminal justice cooperation mechanisms. It has been noted that the UK was one of the greatest contributors to EU security cooperation as regards contributions to Europol and its databases,37 and to the Schengen Information System (SIS).38 Concerns were further raised regarding the adverse impact of Brexit on the UK capacity for intelligence-led policing following the weakening of its position in Europol.39 According to the UK government, the UK used Europol more than any other country.40 It saw the value in the EU-wide criminal record exchange system, which ‘has allowed the police to build a fuller picture of offending by UK nationals and allowed the courts to be aware of the previous offending of EU nationals being prosecuted’.41 In addition to the stated value of the Prüm system mentioned above, the UK authorities stressed the importance of continuing to take part in joint investigation teams,42 in which UK officers currently participate extensively.43 The capacity to act at a multilateral, transnational level was highlighted as a key advantage of joint investigation teams.44 UK security professionals also welcomed the adoption of an EU Passenger Name Record (PNR) transfer system45 as a significant step towards the security of the EU and the UK.46 This operational impetus towards maintaining a close relationship with the EU in the field of law enforcement and criminal justice cooperation needed to be reconciled with the legal and constitutional limits of the UK position as a third country and the at times diverging positions of the UK and the EU in terms of the content, benchmarks and scrutiny of any post-Brexit agreement. The central role that effective criminal

37 The National Crime Agency pointed out that the UK was ‘the second-largest contributor in Europe’ to the Europol Information System and that it led on ‘four or five’ of the 13 European Multidisciplinary Platform Against Criminal Threats (EMPACT) projects, which coordinate actions by Member States and EU organisations against threats identified by Europol in its Serious and Organised Crime Threat Assessment – National Crime Agency, evidence to House of Lords European Union Committee, Brexit: Future UK-EU Security Cooperation, Q19. 38 According to Security Commissioner Julian King, the UK has over 160,000 alerts on the SIS II platform: ibid Q86. 39 See in this context the warning of Rob Wainwright on the adverse security consequences of Brexit for the UK: William James, ‘Brexit Would Bring Serious Security Consequences – Europol Head’ (Reuters, 19 April 2016), http://uk.reuters.com/article/uk-britain-eu-europol-idUKKCN0XG16B. 40 HM Government, The UK’s Cooperation with the EU on Justice and Home Affairs, and on Foreign Policy and Security Issues, para 1.16. 41 Command Paper (8671), cited in House of Commons European Scrutiny Committee, Exchanging Information on Criminal Convictions, 2 March 2016, para 10.11, www.publications.parliament.uk/pa/cm201516/ cmselect/cmeuleg/342-xxiii/34213.htm. 42 For the principal legal framework, see Council Framework Decision of 13 June 2002 on joint investigation teams (2002/465/JHA) [2002] OJ L162/1. 43 According to the then Director of Public Prosecutions Alison Saunders, ‘we get a lot out of joint investigation teams because they help us to make sure that we collect the right evidence. It is much quicker than doing individual letters of request because you collect it all together and it is there; it helps with issues around jurisdiction. It helps with disclosure issues’ (evidence to House of Lords European Union Committee, Q54). 44 House of Lords EU Committee, paras 74 and 75. 45 Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime [2016] OJ L119/132. 46 J Evans and J Sawers (former heads of MI5 and MI6 respectively), ‘The EU Can’t Dictate to Us on Security But Staying in it Can Keep Us Safer’ (Sunday Times, 8 May 2016), https://www.thetimes.co.uk/article/ the-eu-cant-dictate-to-us-on-security-but-staying-in-it-can-keep-us-safer-rw6j2j72w.

700 EU Criminal Law after Brexit justice cooperation considerations play in the post-Brexit landscape was reflected in the negotiating positions of both the UK47 and of the EU.48 A reading of the negotiating positions revealed a common ambition of the two parties to ensure post-Brexit effectiveness in the field of judicial cooperation in criminal matters, with the continuation of speedy cooperation in extradition/surrender, continuing mutual legal assistance (MLA) on the basis of strict deadlines and, according to the EU, approximating not only MLA but also criminal records exchange arrangements to the pre-Brexit status quo.49 Both the UK and the EU further aspired to maintain wide-range data exchanges in terms of PNR data, DNA and fingerprint data (exchanged within the EU under the so-called Prüm system), and information on missing persons and objects (which take place under the framework of the second-generation Schengen Information System (SIS II)). Both negotiating positions acknowledge that the UK will be treated as a third state vis-a-vis the key criminal justice agencies – Eurojust and Europol – after Brexit, with the UK seeking a close relationship in particular with Europol. Notwithstanding this apparent common ground, the development of UK–EU criminal justice cooperation after Brexit faced a number of institutional, constitutional and legal challenges.

A. Human Rights A key challenge for cooperation arose from the different approaches that the UK and the EU take regarding the parameters of respect for human rights in the post-Brexit legal landscape. For the EU, respect for and safeguarding of human rights, democratic principles and the rule of law (including the UK continued commitment to respect the ECHR) constitute essential elements for post-Brexit cooperation. The future partnership should provide for automatic termination of the law enforcement cooperation and judicial cooperation in criminal matters if the UK were to denounce the ECHR, and it should also provide for automatic suspension if the UK were to abrogate domestic law giving effect to the ECHR.50 The UK mandate took a different approach in stating that the agreement should not specify how the UK or the EU Member States should protect and enforce human rights and the rule of law within their own autonomous legal systems.51

B. Data Protection A more specific human rights challenge involves the differences in the approach of the UK and the EU regarding the role and position of data protection post-Brexit. The

47 https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/ file/868874/The_Future_Relationship_with_the_EU.pdf. 48 https://www.consilium.europa.eu/media/42736/st05870-ad01re03-en20.pdf. 49 See V Mitsilegas, ‘Post-Brexit Challenges for Criminal Justice Co-operation’ (UK in a Changing Europe, 30 March 2020), https://ukandeu.ac.uk/post-brexit-challenges-for-criminal-justice-co-operation. 50 EU mandate, para 12. 51 UK mandate, para 112.

The Run-up to Brexit: Political versus Operational Considerations 701 negotiating positons seem to diverge greatly here. For the EU, data protection – like membership of the ECHR – constitutes a prerequisite for cooperation. In its mandate, the EU called for full respect of the EU’s personal data protection rules, including its decision-making process as regards adequacy decisions, with the adoption of adequacy decisions being a condition to achieve a high level of ambition on law enforcement and judicial cooperation in criminal matters.52 The security partnership should provide for suspension of law enforcement and judicial cooperation if the adequacy decision is repealed or suspended by the Commission or declared invalid by the CJEU.53 The UK mandate, on the other hand, attempted to shield and separate data protection from the main body of negotiations by treating it as a technical issue under a separate part (Part 3) of the document The Challenge of the UK as a Non-Schengen Third State.

C. The UK as a Third Country Throughout its negotiating Directives, the UK called for close criminal justice cooperation with the EU on the basis of precedents of EU relations in third countries, and in particular Norway, Iceland, Switzerland and Liechtenstein. However, what distinguishes these states from the UK is that they are Schengen members. It is difficult to see how their privileged position could be extended to a non-Schengen third state, such as the UK, especially regarding access to Schengen-related measures and databases such as the SIS. This differentiation was recognised in the EU mandate, whose underlying principles reflect the UK status as a non-Schengen third country and that a non-member of the EU cannot have the same rights and enjoy the same benefits as a member.54 This differentiation proved to be crucial in delimiting the level of ambition in (and closeness) of EU–UK cooperation. It is important to note that Schengen measures can be linked to the effectiveness of broader EU criminal law measures; for instance, the effectiveness and speed of the European Arrest Warrant (EAW) system is linked with access to alerts on suspects in SIS II.

D. The Role of the Court of Justice A broader institutional challenge involves the future role of the CJEU. The EU aimed at including criminal justice cooperation in an overall governance framework55 which includes rules on dispute resolution whereby questions on the interpretation of EU law end up before the CJEU for a binding ruling.56 Conversely, the UK envisaged a postBrexit security treaty as a separate agreement governed by its own rules and with no jurisdiction for the CJEU, citing existing precedents of agreements envisaging political forms of dispute resolution.57

52 EU

mandate, para 13. para 118. 54 ibid para 10. 55 ibid para 7. 56 ibid para 160. 57 UK mandate, para 30. 53 ibid

702 EU Criminal Law after Brexit

IV. After Brexit: The EU–UK Trade and Cooperation Agreement With the UK now having withdrawn from the EU and following the end of the transitional post-Brexit period, relations between the UK and the EU in the field of security and criminal justice are now governed by the UK–EU TCA, which entered into force on 1 May 2021.58 Security and criminal justice cooperation are covered in a separate part in the Agreement, Part III on law enforcement and judicial cooperation in criminal matters. Part III is supplemented by a series of Annexes developing further implementing, definitional or technical provisions. It is also accompanied by a series of notifications by the UK and the EU on behalf of the Member States59 (and by the EU separately).60 This section will analyse the key provisions of the TCA concerning security and criminal justice cooperation in order to evaluate whether and to what the extent EU–UK cooperation after Brexit can replicate the pre-Brexit status quo. The analysis will highlight the varied areas of ambition in the field of security and criminal justice cooperation, and will analyse the parameters of cooperation within the broader institutional and constitutional framework underpinning the position of the UK as a third country.

A. Surrender and the Arrest Warrant The TCA aims to provide a high degree of continuity with the previously applicable EAW system. The pre-Brexit terminology of ‘surrender’ ad of an ‘arrest warrant’ is maintained in the text – the heading of Title VII is ‘surrender’, the basis of the system is a ‘surrender decision’,61 and the objective of UK–EU cooperation is to base extradition on a mechanism of surrender pursuant to an arrest warrant.62 Title VII on surrender replaces the corresponding provisions of the following conventions applicable in the field of extradition in relations between the UK, on the one side, and Member States, on the other side: (a) the European Convention on Extradition, done at Paris on 13 December 1957, and its additional protocols; and (b) the European Convention on the Suppression of Terrorism, as far as extradition is concerned.63 Title VII is applicable in respect of EAWs issued in accordance with Council Framework Decision 2002/584/ JHA by a state before the end of the transition period where the requested person has not been arrested for the purpose of its execution before the end of the transition period.64

58 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:22021A0430(01)&from=EN. 59 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:C:2021:117I:FULL&from=EN.

60 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:22020X1231(02)&from=EN. 61 TCA,

art 613. art 596. 63 ibid art 629(1). 64 ibid art 632. 62 ibid

After Brexit: The EU–UK Trade and Cooperation Agreement 703

i. Judicialisation Cooperation remains judicial. The ‘Arrest Warrant’ for the purposes of the TCA means a judicial decision issued by a state with a view to the arrest and surrender by another state of a requested person, for the purposes of conducting a criminal prosecution or executing a custodial sentence or detention order.65 ‘Judicial authority’ means an authority that is, under domestic law, a judge, a court or a public prosecutor – a public prosecutor is considered a judicial authority only to the extent that domestic law so provides.66 The CJEU has held that, for the purposes of the EAW, the issuing authority (including public prosecutors) must be capable of exercising its responsibilities objectively without being exposed to the risk that its decision-making power be subject to external directions or instructions from the executive in particular, such as that it is beyond doubt that the decision to issue an EAW lies with that authority and not, ultimately, with the executive.67

ii. Scope, Deadlines and Forms Cooperation continues to take place in similar terms to the EAW in a number of respects. In terms of the scope of cooperation, an arrest warrant may be issued for acts punishable by the law of the issuing state by a custodial sentence or a detention order for a maximum period of at least 12 months or, where a sentence has been passed or a detention order has been made, for sentences or detention orders of at least four months.68 Cooperation takes place on the basis of specific elements introduced in a form.69 Cooperation is intended to be swift – the TCA has introduced similar deadlines to the EAW. Mirroring Article 17 of the EAW FD, the TCA sets out strict time limits for the decision to execute the arrest warrant.70 The latter must be dealt with and executed as a matter of urgency71 – in cases where the requested person consents to surrender, the final decision on the execution of the arrest warrant must be taken within 10 days after the consent was given,72 while in other cases, the final decision on the execution of the arrest warrant shall be taken within 60 days after the arrest of the requested person, a deadline which can be extended by a further 30 days where this is not possible.73 The TCA further mirrors the EAW FD (Article 23) in the provision on time limits for surrender.74

65 ibid

art 598(a). art 598(b). 67 Joined Cases C-508/18 and C-82/19 PPU, OG and PI, EU:C:2019:456, para 73. 68 TCA, art 599. 69 ibid art 606 – see the form contained in Annex 43. 70 ibid art 615. 71 ibid art 615(1). 72 ibid art 615(2). 73 ibid art 615(3) and (4). 74 ibid art 621. 66 ibid

704 EU Criminal Law after Brexit

iii. Grounds for Refusal The TCA includes a number of grounds to refuse to execute an arrest warrant. As with the EAW system, mandatory grounds for non-execution are initially limited to age, amnesty and ne bis in idem.75 There are a number of grounds for optional non-execution in a provision which includes details on the treatment of in absentia hearings.76 The TCA includes a detailed provision on guarantees to be given by the issuing state in particular cases,77 which incorporates the case law of the Court of Justice78 in requiring guarantees that if there are substantial grounds for believing that there is a real risk to the protection of the fundamental rights of the requested person, the executing judicial authority may require, as appropriate, additional guarantees as to the treatment of the requested person after the person’s surrender before it decides whether to execute the arrest warrant.79 The TCA contains a general provision on the rights of a requested person, outlining rights of information, translation and interpretation and access to a lawyer;80 however, this provision is much less detailed than the series of EU Directives on procedural rights in criminal proceedings. In addition to these safeguards, surrender will not occur on the basis of a series of grounds related to non-compliance with the proportionality principle, the non-existence of dual criminality, the occurrence of political offences and the existence of a nationality exception. All these elements constitute a departure from cooperation under the EAW model. If the executing judicial authority finds the information communicated by the issuing state to be insufficient to allow it to decide on surrender, it must request that the necessary supplementary information, in particular with respect to Articles 597 (principle of proportionality), 600 (grounds for mandatory non-execution of the arrest warrant) to 602 (political offence exception), 604 (guarantees to be given by the issuing state in particular cases) and 606 (content and form of the arrest warrant), be furnished as a matter of urgency and may fix a time limit for the receipt thereof, taking into account the need to observe the time limits provided for in Article 615.81

iv. Proportionality Respect for the principle of proportionality underpins the TCA surrender system: cooperation through the arrest warrant shall be necessary and proportionate, taking into account the rights of the requested person and the interests of the victims, and having regard to the seriousness of the act, the likely penalty that would be imposed and the possibility of a state taking measures less coercive than the surrender of the requested person, particularly with a view to avoiding unnecessarily long periods of pre-trial detention.82 Non-compliance with the proportionality principle may constitute 75 ibid art 600. 76 ibid art 601. 77 ibid art 604. 78 See in particular Joined Cases C-404/15 and C-659/15 PPU, Aranyosi and Căldăraru, EU:C:2016:198; for an analysis, see ch 4. 79 TCA, art 601(c). 80 ibid art 609. 81 ibid art 613(2). 82 ibid art 597.

After Brexit: The EU–UK Trade and Cooperation Agreement 705 a ground of refusal to recognise and execute an arrest warrant.83 The inclusion of a specific provision on proportionality reflects a pre-Brexit debate led by the UK which called for the use of proportionality in order to curb what was deemed the overuse of the EAW system by states – in particular, Poland – issuing EAWs for offences which fell within the scope of the EAW FD, but were in essence minor or trivial.84 This debate resulted in the inclusion of proportionality as a principle to be taken into account by the issuing authorities in the revised Handbook on how to issue and execute a European arrest warrant85 and in the EIO Directive.86 However, even pre-Brexit the UK took a further step in amending domestic law to treat non-compliance with proportionality as a ground of refusal to execute a warrant (and not merely as a requirement to be checked in the issuing state).87 The UK approach treating non-compliance with proportionality as a ground for refusal at the executing state has been reflected in the TCA, where the principle plays a prominent role in the operations of the EU–UK surrender system. As things stand, the TCA appears to offer greater protection to the defendant in terms of proportionality in comparison to internal EU law.

v. The Political Offence Exception The TCA introduces a political offence exception to surrender.88 In principle, it is provided that the execution of an arrest warrant may not be refused on the grounds that the offence may be regarded by the executing state as a political offence, as an offence connected with a political offence or as an offence inspired by political motives.89 However, the UK and the EU, acting on behalf of any of its Member States, may each notify the Specialised Committee on Law Enforcement and Judicial Cooperation that paragraph 1 will be applied only in relation to terrorist offences and, in particular: (a) the offences referred to in Articles 1 and 2 of the European Convention on the Suppression of Terrorism; (b) offences of conspiracy or association to commit one or more of the offences referred to in Articles 1 and 2 of the European Convention on the Suppression of Terrorism, if those offences of conspiracy or association correspond to the description of behaviour referred to in Article 599 of this Agreement; and (c) terrorism as defined in Annex 45 to the TCA.90 Where an arrest warrant has been issued by a state having made a notification as referred to in paragraph 2 or by a state on behalf of which such a notification has been made, the state executing the arrest warrant may apply reciprocity.91

83 ibid art 597(1). 84 For an overview of the debate, see T Ostropolski, ‘The Principle of Proportionality under the European Arrest Warrant – with an Excursus on Poland’ (2014) 5 New Journal of European Criminal Law 167. 85 Commission Notice, Handbook on how to issue and execute a European arrest warrant (2017/C 335/01) [2017] OJ C335/1, para 2.4. 86 TCA, art 6(1)(a) and (b) respectively. 87 Section 157 of the Anti-social Behaviour, Crime and Policing Act 2014 has amended s 21A of the Extradition Act 2003 to treat lack of proportionality as a ground for refusal (s 21A(1)(b)). 88 TCA, art 602. 89 ibid art 602(1). 90 ibid art 602(2). 91 ibid art 602(3). On the EU notification, see [2021] OJ C117 I/01.

706 EU Criminal Law after Brexit

vi. Dual Criminality The TCA also contains a provision on the verification of dual criminality. This states that in principle, surrender is subject to the condition that the acts for which the arrest warrant has been issued constitute an offence under the law of the executing state, whatever the constituent elements or however it is described.92 There are two exceptions to the requirement to verify the existence of dual criminality. The first concerns offences, where behaviour is punishable by deprivation of liberty or a detention order of a maximum period of at least 12 months, referred to in Articles 1 and 2 of the European Convention on the Suppression of Terrorism, or in relation to illicit trafficking in narcotic drugs and psychotropic substances, or murder, grievous bodily injury, kidnapping, illegal restraint, hostage-taking or rape, even where that person does not take part in the actual execution of the offence or offences concerned. Such a contribution must be intentional and made with the knowledge that the participation will contribute to the achievement of the group’s criminal activities93 and terrorism as defined in Annex 45 to the TCA.94 The second exception concerns the re-introduction of the exceptions to the verification of the existence of dual criminality in a manner similar to the model established by the EAW FD; however, this exception required notification by both the UK and the EU, acting on behalf of any of its Member States, to the Specialised Committee on Law Enforcement and Judicial Cooperation that, on the basis of reciprocity, the condition of dual criminality referred to in paragraph 2 will not be applied.95 The EU has made such a notification on behalf of a number of Member States.96

vii. Surrender of Own Nationals According to the TCA, the execution of an arrest warrant may not be refused on the grounds that the requested person is a national of the executing state.97 However, the text contains significant inroads into the principle that Member States can no longer refuse to surrender their own nationals applicable under the EAW system by the EAW FD. The UK and the EU, acting on behalf of any of its Member States, may each notify the Specialised Committee on Law Enforcement and Judicial Cooperation that that state’s own nationals will not be surrendered or that the surrender of their own nationals will be authorised only under certain specified conditions. The notification shall be based on reasons relating to the fundamental principles or practice of the domestic legal order of the UK or the state on behalf of which a notification was made. In such a case, the EU, on behalf of any of its Member States or the UK, as the case may be, may notify the Specialised Committee on Law Enforcement and Judicial Cooperation within a reasonable time after the receipt of the other party’s notification that the executing

92 TCA, art 599(2). 93 ibid art 599(3)(a). 94 ibid art 599(3)(b). 95 ibid art 599(4). 96 At the time of writing: Austria, Belgium, France, Greece, Ireland, Italy, Latvia, Lithuania, Poland, Portugal and Spain. 97 TCA, art 603(1).

After Brexit: The EU–UK Trade and Cooperation Agreement 707 judicial authorities of the Member State or the UK, as the case may be, may refuse to surrender its nationals to that state, or that surrender will be authorised only under certain specified conditions.98 In the event of a refusal to surrender on nationality grounds, an executing state must consider instituting proceedings against its own national which are commensurate with the subject matter of the arrest warrant, having taken into account the views of the issuing state. In circumstances where a judicial authority decides not to institute such proceedings, the victim of the offence on which the arrest warrant is based must be able to receive information on the decision in accordance with the applicable domestic law.99 Where a state’s competent authorities institute proceedings against its own national in accordance with paragraph 3, that state must ensure that its competent authorities are able to take appropriate measures to assist the victims and witnesses in circumstances where they are residents of another state, particularly with regard to the way in which the proceedings are conducted.100 A detailed notification has been submitted with a number of EU Member States declaring that they will no longer surrender their own nationals.101

viii. Operational Issues: Non-participation in SIS II However, these deadlines may be frustrated in practice by the fact that the UK as a third country no longer has direct access to real-time EAW-related alerts inserted into SIS II. The operational gap resulting from the lack of UK access to SIS II after Brexit has been highlighted by UK law enforcement authorities, with the UK government attempting to mitigate this loss by using the Interpol I-24/7 system for alerts.102 The challenges of replacing SIS with Interpol are twofold. From an operational/political perspective, it may prove an uphill struggle to persuade the authorities of EU Member States to duplicate work by inserting alerts in both the SIS II and Interpol systems.103 From a fundamental rights point of view, reliance on Interpol may prove to be controversial in view of the challenging human rights record of a number of its members and reports of abuse of the Interpol Red Notice alerts system.104 While the provisions of the TCA are marked by the clear ambition of replicating the pre-Brexit EAW system to the fullest extent possible, the constitutional position of the UK as a third country after Brexit (leading to its exclusion from EU databases and the re-introduction of bars to surrender by a number of EU Member States), as well as the need to persuade politically

98 ibid art 603(2). 99 ibid art 603(3). 100 ibid art 603(4). 101 At the time of writing: Croatia, Finland, France, Germany, Greece, Latvia, Poland, Slovakia, Slovenia and Sweden. France will also not surrender a person who was a French national when the act was committed. 102 Northern Ireland Affairs Committee, Cross-Border Co-operation on Policing, Security and Criminal Justice after Brexit, 4th Report, session 2019–21, HC Paper 766, para 59. 103 House of Lords, European Union Committee, Beyond Brexit; Policing, Law Enforcement and Security, 25th Report, session 2019–21, HL Paper 250, para 86. 104 For a critical view of Interpol governance and the misuse of Interpol Red Notices, see House of Commons Foreign Affairs Committee, In the Room: The UK’s Role in Multilateral Diplomacy, 1st Report, session 2021–22, para 119.

708 EU Criminal Law after Brexit verstretched authorities in EU Member States to grant equal priority to UK cooperao tion requests compared to requests received by their counterparts in EU Member States under the EAW under tight deadlines, pose key challenges to the effectiveness of the new EU–UK cooperation on surrender.

B. Mutual Legal Assistance The general provisions on MLA are contained in Title VIII. This does not replace, but merely supplements and facilitates the application between the UK and EU Member States of the 1959 European Convention on Mutual Assistance in Criminal Matters and its Additional Protocol of 1978.105 A competent authority for the purposes of this Title is any authority which is competent to send or receive requests for mutual assistance in accordance with the provisions of the European Mutual Assistance Convention and its Protocols and as defined by states in their respective declarations addressed to the Secretary General of the Council of Europe. ‘Competent authority’ also includes EU bodies notified in accordance with point (c) of Article 690(7).106 The EU has notified the UK that the EPPO will be deemed a ‘competent authority’ for the purposes of Title VIII.107 In addition to the channels of communication provided for under the European Mutual Assistance Convention and its Protocols, if direct transmission is provided for under their respective provisions, requests for mutual assistance may also be transmitted directly by public prosecutors in the UK to competent authorities of the Member States.108 In urgent cases, any request for mutual assistance, as well as spontaneous information, may be transmitted via Europol or Eurojust, in line with the provisions in the respective Titles of the TCA.109 Mutual assistance will be based on a standard form, which has not been developed yet, but will be established by the Specialised Committee on Law Enforcement and Judicial Cooperation.110 Time limits for the execution of requests are not as ambitious as those in the EIO Directive. The requested state must decide whether to execute the request for mutual assistance as soon as possible and in any event no later than 45 days after the receipt of the request,111 compared to the 30-day limit set out in Article 12(3) of the EIO Directive. The TCA does not include the EIO commitment for the decision on execution to be taken and for investigative measures to be carried out with the same swiftness and priority as for a similar domestic case (Article 12(1) EIO). The TCA mirrors the EIO by stating that a request for mutual assistance must be executed as soon as possible and in any event no later than 90 days after the decision authorising the request,112 and that if it is indicated in the request for mutual assistance that, 105 TCA, art 633(1). 106 ibid art 634. 107 EU–UK Trade and Cooperation Agreement – Notification by the Union [2020] OJ L444/1486, 31 December, s A(1). 108 TCA, art 641(1). 109 ibid. 110 ibid art 635. 111 ibid art 640(1). 112 ibid art 640(2),

After Brexit: The EU–UK Trade and Cooperation Agreement 709 due to procedural deadlines, the seriousness of the offence or other particularly urgent circumstances, a shorter time limit is necessary, or if it is indicated in the request that a measure for mutual assistance is to be carried out on a specific date, the requested state shall take as full account as possible of that requirement.113 The text of the TCA mirrors the EIO Directive in introducing a proportionality test at the stage of issuing a request. The competent authority of the requesting state may only make a request for mutual assistance if it is satisfied that the following conditions are met: (a) the request is necessary and proportionate for the purpose of the proceedings, taking into account the rights of the suspected or accused person; and (b) the investigative measure or investigative measures indicated in the request could have been ordered under the same conditions in a similar domestic case.114 Wherever possible, the competent authority of the requested state must consider recourse to an investigative measure other than the measure indicated in the request for mutual assistance if: (a) the investigative measure indicated in the request does not exist under the law of the requested state; or (b) the investigative measure indicated in the request would not be available in a similar domestic case.115 The competent authority of the requested state may also have recourse to an investigative measure other than the measure indicated in the request for mutual assistance if the investigative measure selected by the competent authority of the requested state would achieve the same result by less intrusive means than the investigative measure indicated in the request.116 However, the following investigative measures must always be available under the law of the requested state: (a) the obtaining of information contained in databases held by police or judicial authorities that is directly accessible by the competent authority of the requested state within the framework of criminal proceedings; (b) the hearing of a witness, expert, victim, suspected or accused person or third party in the territory of the requested state; (c) any non-coercive investigative measure as defined under the law of the requested state; and (d) the identification of persons holding a subscription to a specified phone number or IP address.117 The text of the TCA reverts back to the European Mutual Assistance Convention and its Protocols on the grounds for refusal to execute a request for MLA (which include political and fiscal offence exceptions and ordre public grounds) and adds to this list ne bis in idem in cases where the person in respect of whom the assistance is requested and who is subject to criminal investigations, prosecutions or other proceedings, including judicial proceedings, in the requesting state has been finally judged by another state in respect of the same acts, provided that if a penalty has been imposed, it has been enforced, is in the process of being enforced or can no longer be enforced under the law of the sentencing state.118 The TCA allows for the establishment of joint investigation

113 ibid art 640(3). 114 ibid art 636. 115 ibid art 637(2). 116 ibid art 637(3). 117 ibid art 637(2). 118 ibid art 639. Oehmichen and Keith note that the TCA grounds for refusal are more extensive than those included in the EIO Directive: A Oehmichen and B Keith, ‘Mutual Legal Assistance under the EU-UK Trade and Cooperation Agreement’ (2021) 12 New Journal of European Criminal Law 222, 228.

710 EU Criminal Law after Brexit teams (JITs), but states that the relationship between Member States within the JIT must be governed by EU law, notwithstanding the legal basis referred to in the Agreement on the setting up of the JIT.119 Overall, MLA is a field where the TCA has demonstrated a markedly lower level of ambition in comparison to surrender, which means that cooperation may be significantly slower. This relative lack of ambition may perhaps be explained by the view that the traditional system of MLA will be gradually replaced by cooperation (including public-private partnerships) in the field of digital evidence, where the EU is in the process of developing internal rules and in negotiating an agreement with the US after the Cloud Act, and where the UK has already concluded such an agreement with the US.120 Mitigations in the TCA include the introduction of specific provisions on the exchange of criminal records.

C. Exchange of Criminal Records Part III of the TCA contains a specific title on the exchange of criminal record information the objective of which is to enable the exchange of information extracted from the criminal record between EU Member States and the UK.121 Title IX takes precedence over the Title on Mutual Assistance.122 The provisions of Title IX supplement Articles 13 and 22(2) of the European Convention on Mutual Assistance in Criminal Matters and its Additional Protocols of 17 March 1978 and 8 November 2001, and replace Article 22(1) of the European Convention on Mutual Assistance in Criminal Matters, as supplemented by Article 4 of its Additional Protocol of 17 March 1978.123 In the relations between an EU Member State, on the one side, and the UK, on the other side, each must waive the right to rely on its reservations to Article 13 of the European Convention on Mutual Assistance in Criminal Matters and to Article 4 of its Additional Protocol of 17 March 1978.124 Article 645 provides for the designation of central authorities which will be competent for the exchange of criminal record information. The UK has identified the Chief Constable of Hampshire Constabulary, ACRO as the central authority. Central authorities must communicate criminal record information to each other at least once per month ((Article 646(2)) – in EU law, the Framework Decision on the exchange of criminal records calls for the communication of such information as soon as possible (Article 4 of Framework Decision 2009/315/JHA). Replies to requests for information must be transmitted by the central authority as soon as possible and in any event within 20 working days from the date the request was received;125 this is a longer deadline 119 TCA, art 642. 120 On the EU proposals on digital evidence and their relationship with the Cloud Act, see, inter alia, K Ligeti and G Robinson, ‘Sword, Shield and Cloud: Toward a European System of Public-Private Orders for Electronic Evidence in Criminal Matters?’ in Mitsilegas and Vavoula (n 6) 27–70. 121 TCA, art 643(1). 122 ibid art 633(2). 123 ibid art 643(2). 124 ibid art 643(3). 125 ibid art 649(1).

After Brexit: The EU–UK Trade and Cooperation Agreement 711 compared to the EU system, which requires in principle transmission of information within 10 working days (Article 8 of Framework Decision 2009/315/JHA).The TCA requires for specific information to be included when replying to requests made for the purposes of recruitment for professional or organised voluntary activities involving direct and regular contact with children.126 The exchange between states of information extracted from the criminal record will take place electronically in accordance with the technical and procedural specifications laid down in Annex 44.127 While the UK is no longer a member of the European Criminal Records Information System (ECRIS), the infrastructure developed pre-Brexit can form the basis for the electronic communications channel under the TCA.

D. Anti-money Laundering and Confiscation Cooperation The TCA contains a Title on anti-money laundering and countering terrorist financing devoted largely to preventive measures,128 as well as detailed provisions on UK–EU cooperation on freezing and confiscation.129 The objective of the Title on confiscation is to provide for cooperation between the UK, on the one side, and the Member States, on the other side, to the fullest extent possible for the purposes of investigations and proceedings aimed at the freezing of property with a view to subsequent confiscation thereof and investigations and proceedings aimed at the confiscation of property within the framework of proceedings in criminal matters.130 The Title contains specific provisions on bank information131 as well as provisions on the obligation to take and on the execution of provisional measures.132 Title XI also contains a detailed provision on the obligation to confiscate.133 Value-based confiscation is envisaged.134 Moreover, the scope of cooperation extends to non-criminal proceedings: a state must cooperate to the fullest extent possible under its domestic law with a state requesting the execution of measures equivalent to confiscation of property, where the request has not been issued within the framework of proceedings in criminal matters, insofar as such measures are ordered by a judicial authority of the requesting state in relation to a criminal offence, provided that it has been established that the property constitutes proceeds or: (a) other property into which the proceeds have been transformed or converted; (b) property acquired from legitimate sources, if proceeds have been intermingled, in whole or in part, with such property, up to the assessed value of the intermingled proceeds; or (c) income or other benefit derived from the proceeds, from property into which proceeds of crime have been transformed or converted, or from property with which the proceeds of crime have been intermingled, up to the

126 ibid

art 649(3). art 650. 128 ibid Title X. 129 ibid Title XI. 130 ibid art 656(1). 131 ibid arts 659–61. 132 ibid arts 663 and 664. 133 ibid art 665. 134 ibid art 665(3). 127 ibid

712 EU Criminal Law after Brexit assessed value of the intermingled proceeds, in the same manner and to the same extent as proceeds.135 The provisions of this Title apply in place of the ‘international cooperation’ chapters of the Council of Europe Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime and on the Financing of Terrorism, done at Warsaw on 16 May 2005 (hereinafter ‘the 2005 Convention’) and the Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime, done at Strasbourg on 8 November 1990 (hereinafter ‘the 1990 Convention’). Article 657 (Definitions) of this Agreement replaces the corresponding definitions in Article 1 of the 2005 Convention and Article 1 of the 1990 Convention. The provisions of this Title do not affect the states’ obligations under the other provisions of the 2005 Convention and the 1990 Convention.136 Cooperation will take place on the basis of a standard form provided in the Annexes to the TCA.137 The deadlines are similar to the EU Regulation on the mutual recognition of confiscation orders: the requested state must take the decision on the execution of the confiscation order without delay, and, without prejudice to paragraph 8 of this Article, no later than 45 days after receiving the request.138 Provisional measures must be taken within 96 hours of receiving the request.139 The requested state must ensure that the requests coming from another state to identify, trace, freeze or seize the proceeds and instrumentalities receive the same priority as those made within the framework of domestic procedures.140 Investigative assistance and provisional measures must be carried out as permitted by and in accordance with the domestic law of the requested state. Where the request concerning one of these measures specifies formalities or procedures which are necessary under the domestic law of the requesting state, even if this is unfamiliar to the requested state, the latter must comply with such requests to the extent that the action sought is not contrary to the fundamental principles of its domestic law.141 When requesting confiscation, investigative assistance and provisional measures for the purposes of confiscation, the requesting state shall ensure that the principles of necessity and proportionality are respected.142 The grounds for refusal to cooperate are limited.143 Cooperation may be refused if: (a) the requested state considers that executing the request would be contrary to the ne bis in idem principle; or (b) the offence to which the request relates does not

135 ibid art 665(5). 136 ibid art 656(6). 137 ibid art 679 and Annex 46. 138 ibid art 665(7). 139 ibid art 663(4). 140 ibid art 656(4). 141 ibid art 656(3). 142 ibid art 656(5). 143 It has been noted that the grounds for refusal are narrower than those provided in the 2005 Council of Europe Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime and on the Financing of Terrorism; see V Costa Ramos and G Pons, ‘Freezing and Confiscation under the EU–UK Trade and Cooperation Agreement’ (2021) 12 New Journal of European Criminal Law 233, 239.

After Brexit: The EU–UK Trade and Cooperation Agreement 713 constitute an offence under the domestic law of the requested state if committed within its jurisdiction. However, this ground for refusal applies to cooperation under Articles 658 (the obligation to assist) to 663 (spontaneous information) only insofar as the assistance sought involves coercive action.144 The UK and the EU, acting on behalf of any of its Member States, may each notify the Specialised Committee on Law Enforcement and Judicial Cooperation that, on the basis of reciprocity, the condition of double criminality referred to in point (b) of paragraph 1 of this Article will not be applied provided that the offence giving rise to the request is: (a) one of the offences listed in Article 599(4) (scope), as defined by the law of the requesting state; and (b) punishable by the requesting state by a custodial sentence or a detention order for a maximum period of at least three years.145 The EU has notified, on behalf of the following Member States, that on the basis of reciprocity, the condition of double criminality will not be applied: Austria, Belgium, France, Greece, Ireland, Italy, Latvia, Lithuania, Poland, Portugal and Spain. Cooperation under Articles 658 (the obligation to assist) to 663 (spontaneous information), insofar as the assistance sought involves coercive action, and under Articles 663 (obligation to take provisional measures) and 664 (execution of provisional measures) may also be refused if the measures sought could not be taken under the domestic law of the requested state for the purposes of investigations or proceedings in a similar domestic case.146 Where the domestic law of the requested state so requires, cooperation under Articles 658 (the obligation to assist) to 663 (spontaneous information), insofar as the assistance sought involves coercive action, and under Articles 663 (the obligation to take provisional measures) and 664 (execution of provisional measures) may also be refused if the measures sought or any other measures having similar effects would not be permitted under the domestic law of the requesting state, or, as regards the competent authorities of the requesting state, if the request is not authorised by a judicial authority acting in relation to criminal offences.147 Cooperation under Articles 665 (the obligation to confiscate) to 669 (imprisonment in default) may also be refused if: (a) under the domestic law of the requested state, confiscation is not provided for in respect of the type of offence to which the request relates; (b) without prejudice to the obligation pursuant to Article 665(3) (the obligation to confiscate), it would be contrary to the principles of the domestic law of the requested state concerning the limits of confiscation in respect of the relationship between an offence and (i) an economic advantage that might be qualified as its proceeds, or (ii) property that might be qualified as its instrumentalities; (c) under the domestic law of the requested state, confiscation may no longer be imposed or enforced because of the lapse of time; (d) without prejudice to Article 665(5) and (6) (the obligation to confiscate), the request does not relate to a previous conviction, or a decision of a judicial nature or a statement in such a decision that an offence or several offences have been committed, on the basis of which the confiscation has been ordered or is sought; (e) confiscation is either not enforceable in the requesting state or is still subject to

144 TCA,

art 670(1). art 670(2). 146 ibid art 670(3). 147 ibid art 670(4). 145 ibid

714 EU Criminal Law after Brexit rdinary means of appeal; or (f) the request relates to a confiscation order resulting o from a decision rendered in absentia of the person against whom the order was issued and, in the opinion of the requested state, the proceedings conducted by the requesting state leading to such a decision did not satisfy the minimum rights of defence recognised as due to everyone against whom a criminal charge is made.148 For the purposes of point (f) of Article 670(5), a decision is not considered to have been rendered in absentia if: (a) it has been confirmed or pronounced after opposition by the person concerned; or (b) it has been rendered on appeal, provided that the appeal was lodged by the person concerned.149 When considering, for the purposes of point (f) of Article 670(5), whether the minimum rights of defence have been satisfied, the requested state shall take into account the fact that the person concerned has deliberately sought to evade justice or the fact that that person, having had the possibility of lodging a legal remedy against the decision made in absentia, elected not to do so. The same applies where the person concerned, having been duly served with the summons to appear, elected not to do so or to ask for adjournment.150 States must not invoke a series of facts as a ground to refuse to cooperate.151 They must also not invoke bank secrecy as a ground to refuse any cooperation under this Title. Where its domestic law so requires, a requested state may require that a request for cooperation which would involve the lifting of bank secrecy be authorised by a judicial authority acting in relation to criminal offences.152 Where there are substantial grounds for believing that the execution of a freezing or confiscation order would entail a real risk for the protection of fundamental rights, before it decides on the execution of the freezing or confiscation order, the requested state shall consult the requesting state and may require that any necessary information be provided.153 Each state must ensure that persons affected by measures under Articles 663 (the obligation to take provisional measures) to 666 (execution of confiscation) have effective legal remedies in order to preserve their rights. The substantive reasons for requested measures under Articles 663–66 must not be challenged before a court in the requested state.154 Each state must designate a central authority to be responsible for sending and answering requests made under Title XI, the execution of such requests or their transmission to the authorities competent for their execution.155 The EU may designate an EU body, which may, in addition to the competent authorities of the Member States, make and (if appropriate) execute requests under this Title. Any such request is to be treated for the purposes of this Title as a request by a Member State. The EU may also designate that EU body as the central authority responsible for the purpose of sending and answering requests made under this Title by (or to) that body.156 Central authorities

148 ibid

art 670(5). art 670(6). 150 ibid art 670(7). 151 ibid art 670(9). 152 ibid art 670(8). 153 ibid art 671. 154 ibid art 689(2). 155 ibid art 676(1). 156 ibid art 676(2). 149 ibid

After Brexit: The EU–UK Trade and Cooperation Agreement 715 will communicate directly with one another.157 In urgent cases, requests or communications may be sent directly by the judicial authorities of the requesting state to judicial authorities of the requested state. In such cases, a copy must be sent at the same time to the central authority of the requested state through the central authority of the requesting state.158 The EU has notified the UK that the EPPO, in the exercise of its competences as provided for by Articles 22, 23 and 25 of Council Regulation (EU) 2017/1939, will be deemed to be a competent authority for the purpose of making and, if appropriate, executing freezing requests made under Title XI, as well as a central authority for the purpose of sending and answering to such requests. Requests will be sent to the Central Office of the EPPO.159 The UK has designated the Home Office as the Central Authority for the purposes of the sending, answering and execution of requests, or the transmission of such requests to the authorities competent for their execution, relating to the freezing and confiscation of property.160

E. Bodies, Offices and Agencies The TCA contains a number of provisions on UK relations with key EU criminal justice agencies, notably Europol and Eurojust. Title V of Part III is devoted to UK relations with Europol. A key change is that, as in the case of other EU databases post-Brexit, the UK will no longer have direct access to the Europol Information System. Cooperation will continue on the basis of national contact points and the posing of UK liaison officers in The Hague,161 and via the exchange of information between a UK central contact point and Europol; however, this will not preclude direct exchanges of information between Europol and the competent authorities of the UK.162 The UK has notified a wide range of authorities for the purposes of cooperation with Europol, specifically enumerating 21 authorities as well as any other authority that has statutory functions for any of the law enforcement purposes specified in Part 3 of the Data Protection Act 2018. The National Crime Agency has been designated as the UK national contact point for Europol (the UK Europol National Unit). Part III of the TCA also contains provisions on UK cooperation with Eurojust,163 which aims to provide for a number of avenues of cooperation taking into account the position of the UK as a third country. Cooperation between the UK and Eurojust will continue in the form of the appointment of liaison officers (a UK liaison prosecutor to Eurojust164 and a Eurojust liaison magistrate in the UK)165 in the form of the

157 ibid art 677(1). 158 ibid art 677(2). 159 EU–UK Trade and Cooperation Agreement – Notification by the Union (n 107). 160 Competent authorities designated by the United Kingdom under Part Three of the Agreement: Law Enforcement and Judicial Cooperation in Criminal Matters (2021/C 117 I/02) [2021] OJ CI117/11. 161 TCA, art 568. 162 ibid art 568(1) and (2). 163 ibid Title VI. 164 ibid art 585. 165 ibid art 586.

716 EU Criminal Law after Brexit e stablishment of contact points166 and in the form of cooperation with a wide range of UK authorities. The UK competent authorities for cooperation with Eurojust are the International Justice and Organised Crime Division at the Crown Prosecution Service (CPS), the Crown Office & Procurator Fiscal Service, the Public Prosecution Service Northern Ireland and any other UK public body which is responsible for investigating and/or prosecuting criminal conduct or which acts as a central authority in any jurisdiction of the UK. The centrality of cooperation with the UK for Eurojust will lead to a broader rethink of Eurojust’s internal legal framework with regard to the role and powers of liaison officers of third states and the exchange of information with third states, and may lead to the revision of internal EU law acquis (in particular, the Eurojust Regulation) in order to facilitate cooperation with third countries. In this manner, Brexit may act as a trigger for internal EU law reform. The TCA does not refer expressly to cooperation with the EPPO. However, as seen above, the EU has designated the EPPO as a competent authority in cooperation on MLA and confiscation. Moreover, according to its Regulation, the EPPO is granted competence for offences committed by a national of a participating EU Member State, provided that the Member State has extraterritorial jurisdiction over these offences, and for offences committed extraterritorially by a person who is subject to EU Staff Regulations or Conditions of Employment, provided that the Member State has extraterritorial jurisdiction (Article 22(b) and (c) of the EPPO Regulation). The TCA constitutes an Agreement of cooperation between the UK and the EPPO under Article 104(3) of the EPPO Regulation on EPPO relations with third countries. Its rules on MLA and cooperation on freezing and confiscation are applicable to the EPPO following the notification by the EU that the EPPO constitutes a competent authority for the purpose of these Titles. Here it can be seen that Brexit has provided an opportunity for the EU to strengthen its external relations profile and its place as a global actor in criminal matters. The TCA is a laboratory where for the first time EU agencies assume a central, operational role in external relations in the field of judicial cooperation in criminal matters.

F. Operational Cooperation and Data Exchange Part III of the TCA contains a number of provisions on the continuation of operational cooperation and data exchange between the UK and the EU and its Member States. A special Title (Title IV) is dedicated to cooperation on operational information enabling cooperation between a wide range of authorities.167 Cooperation will take place for the purposes of: (a) the prevention, investigation, detection or prosecution of criminal offences; (b) the execution of criminal penalties; (c) safeguarding against, and the prevention of, threats to public safety; and (d) the prevention and combating of money laundering and the financing of terrorism.168 Information, including information

166 ibid 167 ibid 168 ibid

art 584. art 563(1) and (2). art 563(1).

After Brexit: The EU–UK Trade and Cooperation Agreement 717 on wanted and missing persons as well as objects, may be requested by a competent authority of the UK or of a Member State, or provided spontaneously to a competent authority of the UK or of a Member State. Information may be provided in response to a request or spontaneously, subject to the conditions of the domestic law which applies to the providing competent authority and within the scope of its powers.169 Information may be requested and provided to the extent that the conditions of the domestic law which applies to the requesting or providing competent authority do not stipulate that the request or provision of information has to be made or channelled via judicial authorities.170 This Article will not affect the operation or conclusion of bilateral agreements between the UK and Member States, provided that the Member States act in compliance with EU law. It will also not affect any other powers which are available to the competent authorities of the UK or of the Member States under applicable domestic or international law to provide assistance through the sharing of information for the purposes set out in Article 563(1). The express granting in the TCA of shared competence between the EU and the Member States in the field of operational cooperation beg the question of, via a reasoning a contrario, whether in the other areas of cooperation in criminal justice and security mentioned in the TCA, EU competence has become exclusive. This view is especially strengthened vis-a-vis areas such as surrender, whereby the TCA has replaced existing international law arrangements. The TCA also contains a number of provisions on the exchange of personal data. It aims to achieve continuity in terms of the exchange of DNA, fingerprint and vehicle registration data in a similar manner to the system established under the EU Prüm regime. Title II of Part III contains detailed provisions on automated searches and comparison of DNA files,171 on the collection of cellular material and supply of DNA profiles,172 on dactyloscopic data and their automated searching,173 and on automated searches of vehicle registration data.174 If automated searches show a match between DNA profiles or dactyloscopic data, the supply of further available personal data and other information relating to the reference data shall be governed by the domestic law, including the legal assistance rules, of the requested state.175 States must make all categories of data available for searching and comparison to the competent law enforcement authorities of other states under conditions equal to those under which they are available for searching and comparison by the domestic competent law enforcement authorities.176 For the purpose of implementing the procedures on automated searching of DNA files, dactyloscopic and vehicle registration data, technical and procedural specifications are laid down in Annex 39 and Article 539.177 The Title includes further provisions of ex ante evaluation of UK compliance178 and

169 ibid

art 563(3). art 563(4). 171 ibid arts 530 and 531. 172 ibid art 532. 173 ibid arts 533 and 534. 174 ibid art 537. 175 ibid art 536. 176 ibid art 539(1). 177 ibid art 539(2). 178 ibid art 540. 170 ibid

718 EU Criminal Law after Brexit on a procedure for suspension and disapplication in the event that the EU considers it necessary to amend this Title because EU law relating to the subject matter governed by this Title is amended substantially, or is in the process of being amended substantially.179 The provisions on the Prüm regime have been welcomed by the UK law enforcement community.180 Title III of Part III of the TCA (Articles 542–62) involves the transfer and processing of PNR data. The Title aims to enable the continuous transfer of PNR data to the UK, with key provisions involving ensuring the ongoing transfer of PNR data from air carriers to the UK authorities,181 and the sharing by the UK of analytical information containing PNR data with Europol, Eurojust and Passenger Information Units (PIUs) in EU Member States.182 The TCA thus aims to continue the transfer of PNR data as seamlessly as possible183 and attempts to accommodate UK concerns to the greatest possible extent. A key example is the temporary derogation of the UK from the key obligation to in principle delete the PNR data of passengers after departure from the country, pending the implementation by the UK of ‘technical adjustments’.184 This provision reflects the fact that the current UK PNR systems do not reflect the requirements of the EU vis-a-vis third countries following the CJEU Opinion 1/15 on the EU–Canada PNR Agreement.185 This temporary derogation from the obligation to delete PNR data has been criticised by the European Data Protection Supervisor, who noted that the TCA does not on its own constitute a legal ground for the transfer of PNR data from the EU to the UK.186 A specific EU–UK Agreement on the transfer of PNR data may follow, and the adoption of an adequacy Decision by the Commission regarding the UK data protection regime for these purposes would be a precondition for the signature of such an agreement. The development of the internal EU benchmarks, in particular through the rulings of the CJEU in a number of pending cases on PNR litigation, will be key in this context.

G. Benchmarks A key question for the future of EU–UK relations in European criminal law involves the substance and the monitoring of the constitutional benchmarks underpinning such cooperation. Part III of the TCA contains a specific provision on the protection of human rights and fundamental freedoms in the field of law enforcement and judicial cooperation in criminal matters.187 Cooperation is based on the parties’ and Member States’ longstanding respect for democracy, the rule of law, and the protection

179 ibid art 541. 180 House of Lords, European Union Committee (n 103) para 36. 181 TCA, art 545. 182 ibid art 546. 183 House of Lords, European Union Committee (n 103) para 48. 184 TCA, art 552(4), (11)–(13). 185 House of Lords, European Union Committee (n 103) para 45. 186 Opinion 3/2021: EDPS Opinion on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, 22 February 2021, para 3.1. 187 TCA, art 524.

After Brexit: The EU–UK Trade and Cooperation Agreement 719 of fundamental rights and freedoms of individuals, including as set out in the Universal Declaration of Human Rights and the ECHR, and on the importance of giving effect to the rights and freedoms in the ECHR domestically.188 Thus, respect for and enforcement of the ECHR is key for cooperation under the TCA. The Court of Justice has already confirmed the importance of the UK being party to the ECHR for post-Brexit cooperation.189 The EU may terminate Part III if the UK denounces the ECHR.190 Part III may also be suspended in the event of serious and systemic deficiencies by one party in relation to the protection of fundamental rights or the principle of the rule of law.191 It has been argued that the repeal of the Human Rights Act 1998 could, if not followed by a legislative substitute, potentially be considered a big enough deficiency to trigger such suspension.192 Part III may also be suspended in the event of serious and systemic deficiencies by one party regarding the protection of personal data, including where those deficiencies have led to a relevant adequacy decision ceasing to apply.193 It includes detailed provisions on the data protection benchmarks applicable to cooperation.194 The establishment by the Commission of data adequacy – that the UK offers an adequate level of data protection, interpreted by the CJEU as ‘essentially equivalent’ to EU data protection law, and entails regular and ongoing monitoring of the systems of third states195 – is key in this context. In June 2021, the Commission adopted two adequacy decisions enabling the ongoing flow of personal data between the UK and the EU.196 In its adequacy assessment, the Commission examined the UK’s internal legal and institutional framework on data protection, placing emphasis on the UK’s adherence to the ECHR and submission to the jurisdiction of the Strasbourg Court.197 It noted that: In its structure and main components, the UK legal framework applying to data transferred under this Decision is thus very similar to the one applying in the European Union. This includes the fact that such framework does not only rely on obligations laid down in domestic law, that have been shaped by EU law, but also on obligations enshrined in international law, in particular through the United Kingdom’s adherence to the ECHR and Convention 108, as well as its submission to the jurisdiction of the European Court of Human Rights. These obligations arising from legally binding international instruments, concerning notably the protection of personal data, are therefore a particular important element of the legal framework assessed in this Decision.198 188 ibid art 524(1). 189 Case C-327/18 PPU, Minister for Justice and Equality v RO, ECLI:EU:C:2018:733. 190 TCA, art 692(2). 191 ibid art 693(1). 192 A Lazowski, ‘Mind the Fog, Stand Clear of the Cliff! From the Political Declaration to the Post-Brexit EU-UK Legal Framework – Part I’ (2020) 5 European Papers 1105, 1134. 193 TCA, art 693(2). 194 ibid art 525. 195 Case C-362/14, Maximillian Schrems v Data Protection Commissioner, ECLI:EU:C:2015:650, paras 75–76. For further details, see ch 9. 196 Commission Implementing Decision of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom, Brussels, 28.6.2021 C(2021) 4800 final; Commission Implementing Decision of 28 June 2021 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom [law enforcement], Brussels, 28.6.2021 C(2021) 4801 final. 197 ibid Recitals 120 and 161 respectively. 198 ibid Recitals 19 and 20 respectively.

720 EU Criminal Law after Brexit This passage is revealing of the EU’s approach on post-Brexit cooperation with the UK in the field of security and criminal justice, and is reminiscent of the CJEU’s approach to post-Brexit cooperation on surrender. The UK is deemed to be a trusted external partner in view of its participation in the human rights protection system established by the ECHR. Adherence to and compliance with the ECHR emerges as a key benchmark for EU–UK cooperation and suffices to establish trust even in cases of potential shortcomings in the UK system in specific cases. Adherence to the ECHR and to Council of Europe data protection instruments suffices to keep the UK as a member of what the Commission has called the ‘European privacy family’, but such adherence must be continued and is of particular importance for the stability and durability of the proposed adequacy findings.199 Continuous monitoring by the Commission of the application of the legal framework upon which the adequacy Decisions are based – as required by the CJEU in Schrems – is a key provision in both adequacy Decisions.200 This emphasis on continuous monitoring of the UK data protection regime is crucial, but does not assuage concerns regarding the soundness of the Commission’s adequacy assessment. A key concern is the compatibility of the UK regime on the bulk collection and retention of data with EU law, in particular following the development of the CJEU case law in Tele2 and Watson,201 and more recently in Privacy International202 and La Quadrature du Net and Others.203 It has been demonstrated that subsequent legislative and judicial developments in the UK have not led to the full compliance of the UK regime of bulk data collection and retention with EU law.204 The European Data Protection Board has criticised the Law Enforcement draft adequacy Decision, including on the grounds of the inclusion of an ‘immigration exemption’ to data protection,205 on the provisions on onward transfers of data to third countries and on bulk interceptions.206 The persistence of a large-scale surveillance regime in the UK casts doubts on the accuracy of the Commission’s adequacy Decisions and may lead to these Decisions being challenged. The c ompatibility of the UK data protection

199 Commission press release, https://ec.europa.eu/commission/presscorner/detail/en/IP_21_661, cited in L Woods, ‘Data Protection, the UK and the EU: The Draft Adequacy Decisions’ (EU Law Analysis, 24 February 2021), http://eulawanalysis.blogspot.com/2021/02/data-protection-uk-and-eu-draft.html. 200 Article 3(1) of both Decisions. The Decisions have an extendable expiry date: 27 June 2025 (art 4 of both Decisions). 201 Joined Cases C-203/15 and C-689/15, Tele2 Sverige AB v Post- och telestyrelsen (C-203/15) and Secretary of State for the Home Department v Tom Watson and Others (C-689/15) [2016] ECLI:EU:C:2016:970. 202 Case C-623/17, Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others, ECLI:EU:C:2020:790. 203 Joined Cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v Premier Ministre and Others, ECLI:EU:C:2020:791. 204 M White, ‘Is the Incompatibility of UK Data Retention Law with EU Law Really a Victory?’ (2021) 47 Legal Studies 130. The Commission has been criticised for failing to consider the partial response of the UK authorities to the CJEU rulings – see Woods (n 199). 205 According to art 1(2) of the Law Enforcement Adequacy Decision, the Decision does not cover personal data that is transferred for purposes of UK immigration control or that otherwise falls within the scope of the exemption from certain data subject rights for purposes of the maintenance of effective immigration control pursuant to para 4(1) of sched 2 to the Data Protection Act 2018. 206 EDPB, Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom, adopted on 13 April 2021, points 12, 14 and 29.

Conclusion 721 system with EU law will remain one of the key areas of contestation and evaluation in the years to come, with adequacy assessments also being contingent upon the development of the EU acquis, which is shaped decisively by the CJEU.

H. Governance and Dispute Resolution The TCA has introduced a multi-level political system of governance and dispute resolution. A key role in the field of criminal justice is envisaged for the Specialised Committee on Law Enforcement and Judicial Cooperation established in Part I of the TCA.207 The Specialised Committee’s powers include monitoring and reviewing the implementation of and ensuring the proper functioning of the TCA, adopting decisions, including amendments and recommendations, and providing a forum for consultations as part of the dispute resolution process.208 Part III of the TCA contains a specific Title on dispute settlement (Title XIII), which has exclusivity.209 It contains provisions on consultations,210 on a mutually agreed solution211 and on suspension,212 envisaging a role for the Specialised Committee on Law Enforcement and Judicial Cooperation throughout the process. The TCA contains no reference to the CJEU for the purposes of dispute resolution; however, the Court will remain relevant in its implementation. It has jurisdiction to rule on aspects of the functioning of the TCA, including on the adoption of data protection adequacy Decisions by the European Commission and the future development of the EU data protection benchmarks, which will form the basis of the Commission’s adequacy evaluation. The CJEU will continue to receive preliminary references from courts of EU Member States regarding the operation and the implementation of the TCA (for instance, on questions on the compatibility of the execution of arrest warrants or MLA requests received by UK authorities with EU law). The CJEU will also continue to develop the EU benchmarks applicable in the field of criminal justice via ongoing and evolving interpretation. Its role in defining the EU acquis is central, as EU Member States are under a duty to comply with EU law in their external relations.

V. Conclusion Brexit meant that the UK’s position vis-a-vis European criminal law has been transformed from one of internal ambivalence – balancing a strong impetus and strategic vision towards greater law enforcement cooperation with sovereignty concerns – to

207 TCA,

art 8(1)(r). art 8(4). 209 ibid art 697. 210 ibid art 698. 211 ibid art 699. 212 ibid art 700. 208 ibid

722 EU Criminal Law after Brexit the position of a third country aiming to replicate, to the fullest extent possible, the pre-Brexit status quo on security and criminal justice. The post-Brexit legal landscape is marked by the adoption of the EU–UK TCA, which demonstrates considerable ambition by both parties to maintain a high degree of cooperation after Brexit. From the analysis of the TCA, the impact of Brexit on future EU–UK criminal justice and security cooperation can be viewed from two different perspectives. Those who see the glass as ‘half-full’ can point out to the high level of ambition shown by the parties to replicate to the greatest extent possible the pre-Brexit status quo in key areas, including surrender, the exchange of criminal records, confiscation and cooperation with EU bodies and agencies, and the exchange of data (including DNA and passenger data). Those who view the glass as ‘half-empty’ will highlight the fact that the constitutional and institutional constraints underpinning these areas of high ambition, that key areas such as MLA are marked by a lower level of ambition, and that there are areas where the UK is entirely excluded by EU law (most notably in access to EU databases such as SIS II), and that there are a number of areas where the TCA is silent and where relations revert to a purely intergovernmental level (in the vast majority of areas covered by the EU mutual recognition acquis). In key priority areas, such as surrender and data exchange, cooperation is facilitated by the evocation by the EU of the UK’s adherence to and compliance with the ECHR, with the EU being prepared to disregard specific challenges to fundamental rights caused by the UK’s securitised approach (in particular in the field of large-scale surveillance) in order to ensure ongoing postBrexit cooperation. It remains to be seen how the TCA will be received by those who will deal with its implementation from an operational and legal perspective. From an operational perspective, it remains to be seen whether the authorities in EU Member States will continue to treat requests from their UK counterparts as a priority. From a legal perspective, it remains to be seen how the provisions of the TCA will be interpreted and monitored by EU institutions, and by national courts, and how national authorities (for instance, those asked to execute arrest warrants) will deal with concerns regarding non-compliance with fundamental rights. Notwithstanding the silence in the TCA on its role, the actions of the CJEU will remain important in this context, both in assessing the compatibility of cooperation with the UK with EU law and in developing the EU acquis, including on fundamental rights, which will form the benchmark to the implementation of the TCA. Issues of alignment of the UK with the evolving EU acquis will be a continuing feature in this context. On the other hand, it also remains to be seen whether the TCA will survive changes in the development of the EU criminal justice acquis (and whether the UK will align its law with the evolving acquis) and changes in internal UK law (especially concerning a potential change in the constitutional position of the ECHR in the UK). While the impact of Brexit on the position of the UK vis-a-vis the EU has inevitably been the focus of much of the analysis thus far, this chapter has also attempted to demonstrate that Brexit and the TCA will also have an impact on internal EU law. In view of the close relationship between the EU and the UK in the field of security, aspects of the EU substantive law approaches towards third countries may have to be rethought – for example, what is the distance of third countries from the internal EU law acquis? Moreover, the TCA provides an opportunity to strengthen the position of the EU as

Conclusion 723 a global actor in criminal matters. The attribution to the EU of exclusive competence in a number of key areas in the TCA may be a key development in that direction. The designation by the EU of the EPPO as an authority for the purposes of the operation of a number of judicial cooperation elements in the TCA is another example of this, and is a move which may transcend Brexit and lead to the EU emerging as a strong global actor in criminal law.

BIBLIOGRAPHY Abazi V, ‘The Future of Europol’s Parliamentary Oversight: A Great Leap Forward?’ (2014) 16(6) German Law Journal 1121. Acosta Arcarazo D and Martire J, ‘Trapped in the Lobby: Europe’s Revolving Doors and the Others as Xenos’ (2014) 39 European Law Review 374. Albors-Llorens A, ‘Changes in the Jurisdiction of the European Court of Justice under the Treaty of Amsterdam’ (1998) 35 CML Rev 1273. Albrecht PA and Braum S, ‘Deficiencies in the Development of European Criminal Law (1999) 5 European Law Journal 293. Alegre S, Jeandesboz J and Vavoula N, ‘European Travel Information and Authorisation System (ETIAS): Border Management, Fundamental Rights and Data Protection’ (Study for the LIBE Committee of the European Parliament, PE 583.148, 2017). Alexandrova V, ‘Presentation of the Commission’s Proposal on the Establishment of the European Public Prosecutor’s Office’ in LH Erkelens, AWH Meij and TM Pawlik (eds), The European Public Prosecutor’s Office: An Extended Arm or a Two-Headed Dragon? (The Hague, TMC Asser Press/Springer, 2015). Allegrezza S, ‘On Legality in Criminal Matters between Primacy of EU Law and National Constitutional Traditions: A Study of the Taricco Saga’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Allegrezza S and Mosna A, ‘Cross-border Criminal Evidence and the Future European Public Prosecutor: One Step Back on Mutual Recognition?’ in L Bachmaier Winter (ed), The European Public Prosecutor’s Office: The Challenges Ahead (Cham, Springer, 2018). Alston P and de Schutter O (eds), Monitoring Fundamental Rights in the EU: The Contribution of the Fundamental Rights Agency (Oxford, Hart Publishing, 2005). Alvarez JE, ‘Hegemonic International Law Revisited’ (2003) 97 American Journal of International Law 873. Ambos K, European Criminal Law (Cambridge, Cambridge University Press, 2018). ——, ‘Judgment (Grand Chamber) C-486/14 Piotr Kossowski, 29 June 2016’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Amicelle A, ‘The Great (Data) Bank Robbery: Terrorist Finance Tracking Program and the “SWIFT Affair”’ (2011) Centre d’etudes et de recherches internationales Sciences Po, Research Questions No 36. ——, ‘The EU’s Paradoxical Efforts at Tracking the Financing of Terrorism: From Criticism to Imitation of Dataveillance’ (2013) CEPS Policy Paper in Liberty and Security in Europe Series No 56. Amicelle A and Chaudieu K, ‘In Search of Transnational Financial Intelligence: Questioning Cooperation between Financial Intelligence Units’ in C King, C Walker and J Gurulé (eds), The Palgrave Handbook of Criminal and Terrorism Financing Law (London, Palgrave Macmillan, 2018). Amoore L and de Goede M (eds), Risk and the War on Terror (Abingdon, Routledge, 2008). Anagnostaras G, ‘Case Comment: Enhanced Protection of EU Nationals against Expulsion and the Concept of Internal Public Security: Comment on the PI Case’ (2012) 37 European Law Review 632. ——, ‘Mutual Confidence is Not Blind Trust! Fundamental Rights Protection and the Execution of the European Arrest Warrant: Aranyosi and Caldararu’ (2016) 53(6) CML Rev 1702. Anagnostopoulos I, ‘The Right of Access to a Lawyer in Europe: A Long Road Ahead?’ (2014) 4 European Criminal Law Review 3. Anderson M, den Boer M, Cullen P, Gilmore W, Raab C and Walker N, Policing the European Union (Oxford, Clarendon Press, 1995).

Bibliography 725 Argomaniz J, ‘When the EU is the “Norm-Taker”: The Passenger Name Records Agreement and the EU’s Internalization of US Border Security Norms’ (2009) 31 Journal of European Integration 119. Arnull A, ‘Taming the Beast? The Treaty of Amsterdam and the Court of Justice’ in D O’Keeffe and PM Twomey (eds), Legal Issues of the Amsterdam Treaty (Oxford, Hart Publishing, 1999). ——, The European Union and its Court of Justice, 2nd edn (Oxford, Oxford University Press, 2006). ——, ‘Article 47 CFR and National Procedural Autonomy’ (2020) 45 European Law Review 681. Asp P, The Substantive Criminal Law Competence of the EU (Stockholms, Skrifter Utgivna av Juridiska Fakulteten vid Stockholms Universitet Nr 79, 2013). ——, ‘Jeopardy on European Level: What is the Question to Which the Answer is the EPPO?’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stockholm, Stiftelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015). Azoulai L, ‘The Europeanisation of Legal Concepts’ in UB Neergaard and R Nielsen (eds), European Legal Method: In a Multi-level EU Legal Order (Copenaghen, DJØF Forlag Publishers, 2012). ——, ‘Introduction: The Question of Competence’ in L Azoulai (ed), The Question of Competence in the European Union (Oxford, Oxford University Press, 2014). Azoulai L and Coutts S, ‘Restricting Union Citizens’ Residence Rights on Grounds of Public Security: Where Union Citizenship and the AFSJ Meet: PI Case C-348/09, PI v Oberbürgermeisterin der Stadt Remscheid, Judgment of the Court of Justice (Grand Chamber) of 22 May 2012’ (2013) 50 CML Rev 557. Bachmaier Winter L, ‘European Arrest Warrant, Double Criminality and Mutual Recognition: A Much Debated Case’ (2018) 8 European Criminal Law Review 152. ——, ‘Cross-border Investigation under the EPPO Proceedings and the Quest for Balance’ in L Bachmaier Winter (ed), The European Public Prosecutor’s Office: The Challenges Ahead (Cham, Springer, 2018). ——, ‘Bypassing or Intensifying the Dialogue between Courts? The Impact of Melloni at the National Level’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Baker E, Harkin T, Mitsilegas V and Persak N, ‘The Need for and Possible Content of EU Pre-trial Detention Rules’ (2020) 3 Eucrim 221. Baldaccini A, ‘Counter-terrorism and the EU Strategy for Border Security: Framing Suspects with Biometric Documents and Databases’ (2008) 10 European Journal of Migration and Law 31. Balzacq T and Carrera S, ‘The Hague Programme: The Long Road to Freedom, Security and Justice’ in T Balzacq and S Carrera (eds), Security versus Freedom? A Challenge for Europe’s Future (Aldershot, Ashgate, 2006). Balzacq T, Bigo D, Carrera S and Guild S, ‘The Treaty of Prüm and EC Treaty: Two Competing Models for EU Internal Security’ in T Balzacq and S Carrera (eds), Security versus Freedom? A Challenge for Europe’s Future (Aldershot, Ashgate Publishing, 2006). ——, ‘Security and the Two-Level Game: The Treaty of Prüm, the EU and the Management of Threats’ (2006) CEPS Working Documents No 234. Balzacq T and Hadfield A, ‘Differentiation and Trust: Prüm and the Institutional Design of EU Internal Security’ (2012) 47(4) Cooperation and Conflict 539. Bang Fugslang Madsen H and Elholm T, ‘EPPO and the Principle of Subsidiarity’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stockholms, Stifelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015). Bard P and van Ballegooij W, ‘Judicial Independence as a Precondition for Mutual trust? The CJEU in Minister for Justice and Equality v LM’ (2018) 9 New Journal of European Criminal Law 353. Barrett G, ‘Cooperation in Justice and Home Affairs in the European Union: An Overview and a Critique’ in G Barrett (ed), Justice Cooperation in the European Union (Dublin, Institute of European Affairs, 1997). Bayo Belgad J, ‘The Area of Freedom, Security and Justice and the Role of National Courts in the EU Data Protection System’ in E Guild, S Carrera and A Eggenschwiler (eds), The Area of Freedom, Security and Justice Ten Years on: Successes and Future Challenges under the Stockholm Programme (Brussels, CEPS, 2010). Bell M, Racism and Equality in the European Union (Oxford, Oxford University Press, 2009). Bellanova R, ‘The “Prüm Process”: The Way Forward for EU Police Cooperation and Data Exchange?’ in E Guild and F Geyer (eds), Security versus Justice? Police and Judicial Cooperation in the European Union (Aldershot, Ashgate, 2008). ——, ‘Data Protection, with Love’ (2014) 8 International Political Sociology 112.

726 Bibliography Benedizione L and Paris E, ‘Preliminary Reference and Dialogue between Courts as Tools for Reflection on the EU System of Multilevel Protection of Rights: The Case of the Data Retention Directive’ (2015) 16 German Law Journal 1727. Benyon J, ‘The Politics of Police Co-operation in the European Union’ (1996) 24(4) International Journal of the Sociology of Law 353. Bernardi A (ed), I Controlimiti. Primato delle Norme Europee e Difesa dei Principi Costituzionali (Napoli, Jovene Editore, 2017). Besselink LFM, ‘The Parameters of Constitutional Conflict after Melloni’ (2014) 39 European Law Review 531. Betlem G, ‘The Doctrine of Consistent Interpretation: Managing Legal Uncertainty’ (2002) 22 Oxford Journal of Legal Studies 397. Bergström M, ‘The Impact of Case C-617/10: Åkerberg Fransson at National Level – The Swedish Example’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Bignami F, ‘Privacy and Law Enforcement in the European Union: The Data Retention Directive’ (2007) 8 Chicago Journal of International Law 233. ——, ‘Protecting Privacy against the Police in the European Union: The Data Retention Directive’ (2007) Duke Law School Science, Technology and Innovation Research Paper Series No 13. Bigo D, Polices en Réseaux. L’Experiénce Européenne (Paris, Presses de la Fondation nationale des Sciences Po, 1996). ——, ‘Liberty, Whose Liberty? The Hague Programme and the Conception of Freedom’ in T Balzacq and S Carrera (eds), Security versus Freedom? A Challenge for Europe’s Future (Aldershot, Ashgate, 2006). ——, ‘Globalized (In)Security: The Field and the Ban-opticon’ in D Bigo and A Tsoukala (eds), Terror, Insecurity and Liberty: Illiberal Practices of Liberal Regimes after 9/11 (Abingdon, Routledge, 2008). ——, ‘The Principle of Availability of Information’ (Briefing Note for European Parliament Civil Liberties Committee) in D Bigo and A Tsoukala (eds), Controlling Security (Paris, Centre d’études sur les conflits/ L’Harmattan, 2008). Bigo D, González Fuster G, Guild E, de Hert P, Jeandesboz J and Papakonstantinou V, ‘Towards a New EU Legal Framework for Data Protection and Privacy: Challenges, Principles and the Role of the European Parliament’ (Study for the European Parliament, PE 453.216, 2011). Bigo D and Guild E (eds), Controlling Frontiers: Free Movement into and within Europe (London, Routledge, 2005). Bigo D et al, Mapping The Field of the EU Internal Security Agencies (Paris, L’Harmattan/Centre d’études sur les conflits, 2007). Biondi A and Mastroianni R, ‘Case Note Joint Cases C-387/02, C-391/02, C-403/02, Berlusconi and Others, ECR [2005] I-3585’ (2006) 43 CML Rev 553. Block L, ‘EU Joint Investigation Teams; Political Ambitions and Police Practices’ in S Hufnagel, C Harfield and S Bronitt (eds), Cross-border Law Enforcement: Regional Law Enforcement Cooperation – European, Australian and Asia-Pacific Perspectives (New York, Routledge, 2012). Boehm F, Information Sharing and Data Protection in the Area of Freedom, Security and Justice: Towards Harmonised Data Protection Principles for Information Exchange at EU Level (Berlin, Springer, 2013). Boister N and Currie RJ (eds), Routledge Handbook of Transnational Criminal Law (Abingdon, Routledge, 2015). Böse M, ‘Die Zustaendigkeit der Europäischen Gemeinschaft fuer das Strafrecht Zugleich Besprechung von EuGH, Urteil vom 13.9.2005’ (2006) Goldtammer’s Archiv 211. ——, ‘Choice of Forum and Jurisdiction’ in M Luchtman (ed), Choice of Forum in Cooperation against EU Financial Crime: Freedom, Security and Justice and the Protection of Specific EU Interests (The Hague, Eleven International Publishing, 2013). ——, ‘An Assessment of the Commission’s Proposals on Electronic Evidence’ (Study for the European Parliament, PE 604.989, 2018). Bossong R, ‘The Action Plan on Combating Terrorism: A Flawed Instrument of EU Security Governance’ (2008) 46 Journal of Common Market Studies 27. Boyle A, ‘Some Reflections on the Relationship of Treaties and Soft Law’ (1999) 48 International and Comparative Law Quarterly 901. Bozhilova D, ‘Measuring Success and Failure of EU: Europeanization in the Eastern Enlargement: Judicial Reform in Bulgaria’ (2007) 9 European Journal of Law Reform 285.

Bibliography 727 Bracke N, ‘Flexibility, Justice Cooperation and the Treaty of Amsterdam’ in C Marinho (ed), Asylum, Immigration and Schengen Post Amsterdam: A First Assessment (Maastricht, EIPA, 2001). Brady H, ‘Europol and the European Criminal Intelligence Model: A Non-state Response to Organized Crime’ (2008) 2 Policing 103. Brammertz S, ‘Eurojust: Parquet Européen de la Première Génération?’ in G de Kerchove and A Weyembergh (eds), Vers un Espace Judiciaire Pénal Européen (Brussels, Éditions de l’Université de Bruxelles, 2000). Breyer P, ‘Telecommunications Data Retention and Human Rights: The Compatibility of Blanket Traffic Data Retention with the ECHR’ (2005) 11 European Law Journal 365. Brière C, ‘Cooperation of Europol and Eurojust with External Partners in the Fight against Crime: What are the Challenges Ahead?’ (2018) DCU Brexit Institute, Working Paper No 1. Bridge JW, ‘The European Communities and the Criminal Law’ [1976] Criminal Law Review 88. Brkan M, ‘The Essence of the Fundamental Rights to Privacy and Data Protection: Finding the Way through the Maze of the CJEU’s Constitutional Reasoning’ (2019) 20 German Law Journal 864. Brouwer E, ‘The Use of Biometrics in EU Databases and Identity Documents’ in J Lodge (ed), Are You Who You Say You are? The EU and Biometric Borders (Nijmegen, Wolf Legal Publishers, 2007). ——, Digital Borders and Real Rights: Effective Remedies for Third-Country Nationals in the Schengen Information System (Leiden, Martinus Nijhoff Publishers, 2008). Brown I, ‘Communications Data Retention in an Evolving Internet’ (2010) 19 International Journal of Law and Information Technology 95. Busuioc M, European Agencies. Law and Practices of Accountability (Oxford, Oxford University Press, 2013). Busuioc M and Curtin D, ‘The EU Internal Security Strategy, the EU Policy Cycle and the Role of (AFSJ) Agencies. Promise, Perils and Pre-requisites’ (Study for the LIBE Committee of the European Parliament, 2011). Busuioc M, Curtin D and Groenleer M, ‘Agency Growth between Autonomy and Accountability: The European Police Office as a “Living Institution”’ (2011) 18(6) Journal of European Public Policy 848. Buzan B, People, States and Fear: An Agenda for International Security Studies in the Post-Cold War Era (Brighton, Harvester Wheatsheaf, 1991). ——, ‘New Patterns of Global Security in the Twenty-First Century’ (1999) 67 International Affairs, 431. Buzan B, Waever O and de Wilde J, Security. A New Framework for Analysis (Boulder, Lynne Rienner Publishers, 1998). Caeiro P, ‘Jurisdiction in Criminal Matters in the EU: Negative and Positive Conflicts, and Beyond’ (2010) 93(4) Kritische Vierteljahresschrift für Gesetzgebung und Rechtswissenschaft 366. ——, ‘Introduction (or: Every Criminal Procedure Starts with a Bill of Rights)’ in The European Union Agenda on Procedural Safeguards for Suspects or Accused Persons: The ‘Second Wave’ and its Predictable Impact on Portuguese Law (Coimbra, Instituto Juridico Faculdade de Direito Universidade de Coimbra, 2015). ——, ‘’Scenes from a marriage’: Trust, Distrust and (Re)assurances in the Execution of a European Arrest Warrant’ in S Carrera, D Curtin and A Geddes (eds), 20 Years Anniversary of the Tampere Programme: Europeanisation Dynamics of the EU Area of Freedom, Security and Justice (Florence, European University Institute, 2020). Caeiro P and Amaral Rodrigues J, ‘A European Contraption: The Relationship between the Competence of the EPPO and the Scope of Member States’ Jurisdiction over Criminal Matters’ in K Ligeti, MJ Antunes and F Giuffrida (eds), The European Public Prosecutor’s Office at Launch (Milan, Wolters Kluwer/CEDAM, 2020). Caeiro P, Foffani L and Mitsilegas V, ‘Strengthening the Fight against Economic and Financial Crime within the EU’ (2020) 3 Eucrim 248. Caianiello M, ‘The Decision to Drop the Case: Res Iudicata or Transfer of Competence?’ in L Bachmaier Winter (ed), The European Public Prosecutor’s Office: The Challenges Ahead (Cham, Springer, 2018). Cameron I, ‘Balancing Data Protection and Law Enforcement Needs: Tele2 Sverige and Watson’ (2017) 54 CML Rev 1467. Campbell L, ‘Criminal Labels, the European Convention on Human Rights and the Presumption of Innocence’ (2013) 76 Modern Law Review 681. Carrera S and den Hertog L, ‘A European Border and Coast Guard: What’s in a Name?’ (2016) CEPS Paper in Liberty and Security in Europe No 88. Carrera S, González Fuster G, Guild E and Mitsilegas V, ‘Access to Electronic Data by Third-Country Law Enforcement Authorities: Challenges to EU Rule of Law and Fundamental Rights’ (Brussels, CEPS, 2015).

728 Bibliography Carrera S and Guild E, An EU Framework on Sanctions against Employers of Irregular Immigrants (2007) CEPS Policy Brief No 140. Carrera S and Mitsilegas V, ‘Upholding the Rule of Law by Scrutinising Judicial IndependenceL The Irish Court’s Request for a Preliminary Ruling on the European Arrest Warrant’ (2018) CEPS Commentary, https://www.ceps.eu/ceps-publications/upholding-rule-law-scrutinising-judicial-independence-irishcourts-request-preliminary. Carrera S, Mitsilegas V, Allsopp J and Vosyliute L, Policing Humanitarianism (Oxford, Hart Publishing, 2019). Carrera S et al, ‘Criminal Justice and Police Cooperation between the EU and the UK after Brexit: Towards a Principled and Trust-Based Partnership’ (2018) Report of a CEPS & QMUL Task Force. Catteau F, ‘Les droits procéduraux des personnes poursuivies et des vicitmes de criminalité devant la Court de Justice de l’Union Européenne. Vers un droit Européen de la procedure pénale?’ (2020) 2–3 Cahiers de droit européen 485. Chamon M, EU Agencies: Legal and Political Limits to the Transformation of the EU Administration (Oxford, Oxford University Press, 2016). Chin S, Veening W and Gerstetter C, ‘Limitations and Challenges of the Criminal Justice System in Addressing Environmental Crime’ (2014) Efface Policy Briefs on Environmental Crimes No 1. Chiti E, ‘The Emergence of a Community Administration: The Case of European Agencies’ (2000) 37(2) CML Rev 309. Cleary Yeager P and Simpson SS, ‘Environmental Crime’ in M Tonry (ed), The Oxford Handbook of Crime and Public Policy (Oxford University Press 2009). Cocq C and Galli F, ‘The Evolving Role of Europol in the Fight against Serious Crime: Current Challenges and Future Prospects’ in S Hufnagel and C McCartney (eds), Trust in International Police and Justice Cooperation (Oxford, Hart Publishing, 2017). Cohen J and Sabel CF, ‘Global Democracy?’ (2004–05) 37 NYU Journal of International Law and Policy 763. Coman-Kund F, ‘Europol’s International Exchanges of Data and Interoperability of AFSJ Databases’ (2020) 26 European Public Law 181. ——, ‘Europol’s International Cooperation between “Past Present” and “Present Future”: Reshaping the External Dimension of EU Police Cooperation’ (2018) 2 Europe and the World: A Law Review 1. ——, European Union Agencies as Global Actors: A Legal Study of the European Aviation Safety Agency, Frontex and Europol (Abingdon, Routledge, 2018). Coninsx M, ‘Eurojust’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on European Criminal Law (Cheltenham, Edward Elgar, 2016). Cooper I, ‘A New Form of Democratic Oversight in the EU: The Joint Parliamentary Scrutiny Group for Europol’ (2018) 10(3) Perspectives on Federalism 185. Corstens GJM, ‘Criminal Law in the First Pillar?’ (2005) 11 European Journal of Crime, Criminal Law and Criminal Justice 131. Costa MJ, ‘The Emerging EU Extradition Law. Petruhhin and Beyond’ (2017) 8 New Journal of European Criminal Law 192. Costa Ramos V and Pons G, ‘Freezing and Confiscation under the EU–UK Trade and Cooperation Agreement’ (2021) 12 New Journal of European Criminal Law 233. Cotterrell R, Law’s Community: Legal Theory in Sociological Perspective (Oxford, Clarendon Press, 1995). Coudert F, ‘The Europol Regulation and Purpose Limitation: From the “Silo-Based Approach” to … What Exactly?’ (2017) 3(3) European Data Protection Law Review 313. Coutts S, ‘Union Citizenship as Probationary Citizenship: Onuekwere’ (2015) 52 CML Rev 531. ——, ‘From Union Citizens to National Subjects: Pisciotti’ (2019) 56 CML Rev 536. Coventry T, ‘Pretrial Detention: Assessing European Union Competence under Article 82(2) TFEU’ (2016) 8 New Journal of European Criminal Law 43. Covolo V, L’Émergence d’un Droit Pénal en Réseau : Analyse Critique du Système Européen de Lutte Antifraude (Baden-Baden, Nomos, 2015). ——, ‘La Notion Autonome et Protéiforme d’ autorité judiciaire en droit de l’Union’ (2017) 100 KritV Kritische Vierteljahresschrift für Gesetzgebung und Rechtswissenschaft 217. Craig P, ‘The Fall and Renewal of the Commission: Accountability, Contract and Administrative Organisation’ (2000) 6(2) European Law Journal 98. ——, The Lisbon Treaty: Law, Politics, and Treaty Reform (Oxford, Oxford University Press, 2010).

Bibliography 729 ——, EU Administrative Law, 2nd edn (Oxford, Oxford University Press, 2012). Craig P and de Búrca G, EU Law: Texts, Cases, and Materials, 6th edn (Oxford, Oxford University Press, 2015). Cras S, ‘The Directive on the Right of Access to a Lawyer in Criminal Proceedings and in European Arrest Warrant Proceedings’ (2014) 1 Eucrim 32. ——, ‘The Directive on Procedural Safeguards for Children Who are Suspects or Accused Persons in Criminal Proceedings’ (2016) 2 Eucrim 109. ——, ‘The Directive on the Right to Legal Aid in Criminal and EAW Proceedings’ (2017) 1 Eucrim 32. Cras S and Erbežnik A, ‘The Directive on the Presumption of Innocence and the Right to Be Present on Trial’ (2016) 1 Eucrim 25. Cremona M, ‘Introduction’ in M Cremona (ed), The Enlargement of the European Union (Oxford, Oxford University Press, 2003). ——, ‘The Union as a Global Actor: Roles, Models and Identity’ (2004) 41 CML Rev 555. ——, ‘EC Competence, “Smart Sanctions” and the Kadi Case’ (2009) 28 Yearbook of European Law 559. Cremona M and de Witte B (eds), EU Foreign Relations Law: Constitutional Fundamentals (Oxford, Hart Publishing, 2008). Cross MKD, ‘The Limits of Epistemic Communities: EU Security Agencies’ (2015) 3(1) Politics and Governance 90. Crossman G, ‘Nothing to Hide, Nothing to Fear?’ (2008) 22(1–2) International Review of Law Computers and Technology 115. Curtin D, ‘Holding (Quasi-)Autonomous EU Administrative Actors to Public Account’, (2007) 13(4) European Law Journal 523. ——, ‘The Constitutional Structure of the Union: A Europe of Bits and Pieces’ (1993) 30 CML Rev 17. ——, ‘Official Secrets and the Negotiation of International Agreements: Is the EU Executive Unbound?’ (2013) 50 CML Rev 423. Curtin D and Nollkaemper A, ‘Conceptualizing Accountability in International and European Law’, Netherlands Yearbook of International Law, 2005. Daman M, ‘Cross-border Hot Pursuit in the EU’ (2008) 16(2) European Journal of Crime, Criminal Law and Criminal Justice 204. Dashwood A, ‘Issues of Decision-Making in the European Union after Nice’ in A Arnull and D Wincott (eds), Accountability and Legitimacy in the European Union (Oxford, Oxford University Press, 2002). Daskal J, ‘Microsoft Ireland, the CLOUD Act, and International Lawmaking 2.0’ (2018) 71 Stanford Law Review 9. ——, ‘Unpacking the CLOUD Act’ (2018) 4 Eucrim 220. ——, ‘The Opening Salvo: The CLOUD Act, E-evidence Proposals, and EU–US Discussions Regarding Law Enforcement Access to Data across Borders’ in F Bignami (ed), EU Law in Populist Times: Crises and Prospects (Cambridge, Cambridge University Press, 2019). De Baere G, ‘From “Don’t Mention the Titanium Dioxide Judgment” to “I Mentioned it Once, But I Think I Got Away with it All Right”: Reflections on the Choice of Legal Basis in EU External Relations after the Legal Basis for Restrictive Measures Judgment’ (2013) 15 Cambridge Yearbook of European Legal Studies 537. De Biolley S and Weyembergh A, ‘L’Espace Pénal Européen et les Droits des Victimes’ (2005) 31 Revue de la Faculté de Droit, Université Libre de Bruxelles 93. De Buck B, ‘Joint Investigation Teams: The Participation of Europol Officials’ (2007) 8 ERA Forum 259. De Burca G, ‘The European Court of Justice and the International Legal Order after Kadi’ (2009) New York University School of Law Jean Monnet Working Paper 01/2009. De Goede M, Speculative Security: The Politics of Pursuing Terrorist Monies (Minneapolis, University of Minnesota Press, 2012). De Hert P and Gutwirth S, ‘Interoperability of Police Databases within the EU: An Accountable Political Choice?’ (2006) 20(1–2) International Review of Law Computers & Technology 21. ——, ‘Privacy, Data Protection and Law Enforcement: Opacity of the Individual and Transparency of Power’ in E Claes, A Duff and S Gutwirth (eds), Privacy and the Criminal Law (Oxford, Intersentia, 2006). De Hert P and Papakonstantinou V, ‘The Data Protection Framework Decision of 27 November 2008 Regarding Police and Judicial Cooperation in Criminal Matters: A Modest Achievement, However Not the Improvement Everyone Had Hoped for’ (2009) 25(5) Computer Law & Security Review 403. ——, ‘The New Police and Criminal Justice Data Protection Directive’ (2016) 7(1) New Journal of European Criminal Law 7.

730 Bibliography ——, ‘Data Protection and the EPPO’ (2019) 10 New Journal of European Criminal Law 34. De Jong F and van Lent L, ‘The Presumption of Innocence as a Counterfactual Principle’ 12 Utrecht Law Review 32. De la Cuesta JL, ‘Concurrent National and International Criminal Jurisdiction and the Principle “Ne Bis in Idem”: General Report’ (2002) 73(3–4) Revue Internationale de Droit Pénal 707. De Lobkowicz W, L’Europe et la Sécurité Intérieure : Une Élaboration par Étapes (Paris, La Documentation Francaise, 2002). ——, ‘La sécurité intérieure de l’Union Européenne élargie’ in G de Kerchove and A Weyembergh (eds), Sécurité et justice : Enjeu de la politique extérieure de l’Union Européenne (Brussels, Éditions de l’Université de Bruxelles, 2003). De Morales Romero MM, ‘Dual Criminality under Review: On the Puigdemont Case’ (2018) 8(2) European Criminal Law 167. De Vries K, Bellanova R and de Hert P, ‘Proportionality Overrides Unlimited Surveillance: The German Constitutional Court Judgment on Data Retention’ (Brussels, CEPS, 2010). De Witte B, ‘Article 53’ in S Peers, T Hervey, J Kenner and A Ward (eds), The EU Charter of Fundamental Rights: A Commentary (Oxford, Hart Publishing, 2014). De Zwaan JW and Goudappel FANJ (eds), Freedom, Security and Justice in the European Union (The Hague, TCM Asser Press, 2006). Deboyser C, ‘Eurojust’s Role in the Matter of Choice of Forum’ in M Luchtman (ed), Choice of Forum in Cooperation against EU Financial Crime: Freedom, Security and Justice and the Protection of Specific EU Interests (The Hague, Eleven International Publishing, 2013). ——, ‘European Public Prosecutor’s Office and Eurojust: “Love Match or Arranged Marriage”?’ in LH Erkelens, AWH Meij and TM Pawlik (eds), The European Public Prosecutor’s Office: An Extended Arm or a Two-Headed Dragon? (The Hague, TMC Asser Press/Springer, 2015). Dehousse R, ‘From Community to Union’ in R Dehousse (ed), Europe after Maastricht: An Ever Closer Union? (Munich, Law Books in Europe, 1994). ——, ‘Regulation by Networks in the European Community: The Role of European Agencies’ (1997) 4(2) Journal of European Public Policy 246. Delmas-Marty M, ‘The European Union and Penal Law’ (1998) 4 European Law Journal 87. ——, ‘Guest Editorial: Combating Fraud – Necessity, Legitimacy and Feasibility of the Corpus Juris’ (2000) 37 CML Rev 247. ——, ‘Necessity, Legitimity and Feasibility of the Corpus Juris’ in M Delmas-Marty and J Vervaele, The Implementation of the Corpus Juris in the Member States, vol 1 (Antwerp, Intersentia, 2000). ——, ‘Towards an Integrated European Criminal Law’ (2005) 7 Cambridge Yearbook of European Legal Studies 17. Delmas-Marty M and Vervaele J, The Implementation of the Corpus Juris in the Member States, vol 1 (Antwerp, Intersentia, 2000). Den Boer M, ‘Europe and the Art of International Police Co-operation: Free Fall or Measured Scenario?’ in D O’Keeffe and PM Twomey (eds), Legal Issues of the Maastricht Treaty (London, Chancery Law Publisher, 1994). ——, ‘An Area of Freedom, Security and Justice: Bogged Down by Compromise’ in D O’Keeffe and PM Twomey (eds), Legal Issues of the Amsterdam Treaty (Oxford, Hart Publishing, 1999). ——, ‘The Incorporation of Schengen into the TEU: A Bridge Too Far?’ in J Monar and W Wessels (eds), The European Union after the Treaty of Amsterdam (New York, Continuum, 2001). ——, ‘New Dimensions in EU Police Co-operation: The Hague Milestones for What They are Worth’ in JW de Zwaan and FANJ Goudappel (eds), Freedom, Security and Justice in the European Union (The Hague, TCM Asser Press, 2006). Den Boer M and Brüggeman W, ‘Shifting Gear: Europol in the Contemporary Policing Era’ (2007) 23(3) Politique européenne 77. Den Boer M, Hillebrand C and Noelke A, ‘Legitimacy under Pressure: The European Web of Counterterrorism Networks’ (2008) 46(1) Journal of Common Market Studies 101. Denza E, The Intergovernmental Pillars of the European Union (Oxford, Oxford University Press, 2004). DeSimone C, ‘Pitting Karlsruhe against Luxembourg? German Data Protection and the Contested Implementation of the EU Data Retention Directive’ (2010) 11(3) German Law Journal 291. Dine J, ‘European Community Criminal Law?’ [1993] Criminal Law Review 246.

Bibliography 731 Disley E et al, ‘Evaluation of the Implementation of the Europol Council Decision and of Europol’s Activities’ (Report for Europol Management Board, Rand Europe, 2012) Doody J, ‘The Institutional Framework of EU Counter-terrorism’ in F de Londras and J Doody (eds), The Impact, Legitimacy and Effectiveness of EU Counter-terrorism (New York, Routledge, 2015). Douglas-Scott S, ‘The Rule of Law in the European Union: Putting the Security into the ‘Area of Freedom, Security and Justice’ (2004) 29 European Law Review 219. Dougan M, ‘Minimum Harmonization and the Internal Market’ (2000) 37 CML Rev 853. ——, ‘The Treaty of Lisbon 2007: Winning Minds, Not Hearts’ (2008) 45 CML Rev 617. Drewer D and Miladinova V, ‘The Big Data Challenge: Impact and Opportunity of Large Quantities of Information under the Europol Regulation’ (2017) 33(3) Computer Law & Security Review 298. Đurđević Z, ‘Judicial Control in Pre-trial Criminal Procedure Conducted by the European Public Prosecutor’s Office’ in K Ligeti (ed), Towards a Prosecutor for the European Union (Oxford, Hart Publishing, 2012). Eckes C, ‘Case T-228/02, Organisation des Modjahedines du Peuple d’Iran v. Council and UK (OMPI), Judgment of the Court of First Instance (Second Chamber) of 12 December 2006’ (2007) 44 CML Rev 1117. ——, EU Counter-Terrorist Policies and Fundamental Rights: The Case of Individual Sanctions (Oxford, Oxford University Press, 2009). ——, ‘Controlling the Most Dangerous Branch from Afar: Multilayered Counter-Terrorist Policies and the European Judiciary’ (2011) Amsterdam Law School Legal Studies Research Paper Series No 2011-08 12. Eeckhout P, ‘Community Terrorism Listings, Fundamental Rights, and UN Security Council Resolutions: In Search of the Right Fit’ (2007) 3 European Constitutional Law Review 183. ——, EU External Relations Law, 2nd edn (Oxford, Oxford University Press, 2011). ——, ‘Opinion 2/13 on EU Accession to the ECHR and Judicial Dialogue: Autonomy or Autarchy?’ (2015) Jean Monnet Center for International and Regional Economic Law and Justice, Working Paper Series 01/15. ‘Editorial: The Tampere Summit: The Ties That Bind or the Policemen’s Ball’ (1999) 36 CML Rev 1119. ‘Editorial: The Court of Justice and the Third Pillar’ (2005) 30 European Law Review 773. Erkelens LH, Geelhoed W and Meij A (eds), Shifting Perspectives on the European Public Prosecutor’s Office (The Hague, TMC Asser Press/Springer, 2018). Fabbrini F, ‘Human Rights in the Digital Age: The European Court of Justice Ruling in the Data Retention Case and its Lessons for Privacy and Surveillance in the United States’ (2015) 28 Harvard Human Rights Journal 65. Fabbrini F and Sajo A, “The Dangers of Constitutional Identity” (2019) 25 European Law Journal 457. Falletti F, ‘The European Public Prosecutor’s Office and the Principle of Equality’ (2017) 1 Eucrim 25. Faraldo-Cabana P, ‘One Step Forward, Two Steps Back? Social Rehabilitation of Foreign Offenders under Framework Decisions 2008/909/JHA and 2008/947/JHA’ (2019) 10 New Journal of European Criminal Law 151. Farmer A, Germani AR and Sollund R, ‘Conclusions and Recommendations from the EFFACE Project’ (2015) EFFACE Report. Fennelly N, ‘The Area of “Freedom, Security and Justice” and the European Court of Justice: A Personal View’ (2000) 49 International and Comparative Law Quarterly 10. Ferraro F and de Capitani E, ‘The New European Border and Coast Guard: Yet Another “Half Way” Reform?’ (2016) 17 ERA Forum 388. Fijakowski A, ‘The Paradoxical Nature of Crime Control in Post-communist Europe’ (2007) European Journal of Crime, Criminal Law and Criminal Justice 155. Fijnaut C, ‘The “Communitization” of Police Cooperation in Western Europe’ in HG Schermers et al (eds), Free Movement of Persons in Europe: Legal Problems and Experience (Dordrecht, Martinus Nijhoff Publishers, 1993). ——, ‘The Schengen Treaties and European Police Co-operation’ (1993) 1 European Journal of Crime, Criminal Law and Criminal Justice 37. ——, ‘Police Co-operation and the Area of Freedom, Security and Justice’ in N Walker (ed), Europe’s Area of Freedom, Security and Justice (Oxford, Oxford University Press, 2004). Fijnaut C and Paoli L (eds), Organised Crime in Europe: Concepts, Patterns and Control Policies in the European Union and Beyond (Dordrecht, Springer, 2004). Fijnaut C and Groenhuijsen MS, ‘A European Public Prosecution Service: Comments on the Green Paper’ (2002) 10(4) European Journal of Crime, Criminal Law and Criminal Justice 321.

732 Bibliography Fletcher M, ‘Some Developments to the Ne Bis in Idem Principle in the European Union: Criminal Proceedings against Hüseyn Gözütok and Klaus Brügge’ (2003) 66 Modern Law Review 769. ——, ‘Extending “Indirect Effect” to the Third Pillar: The Significance of Pupino?’ (2005) 30 European Law Review 862. Fletcher M, Lööf R and Gilmore B, EU Criminal Law and Justice (Cheltenham, Edward Elgar, 2008). Flore D, ‘La Perspective d’un Procureur Européen’ (2008) 9 ERA Forum 229. ——, ‘A European Public Prosecutor’s Office: Guidelines for the European Agenda’ in G Grasso et al (eds), Le Sfide dell’Attuazione di una Procura Europea: Definizione di Regole Comuni e Loro Impatto sugli Ordinamenti Interni (Milan, Giuffrè, 2013). ——, ‘Garantie Judiciaire et Droit Applicable: Quelques Éléments de Réflexion’ in G Giudicelli-Delage, S Manacorda and J Tricot (eds), Le Contrôle Judiciaire du Parquet Européen ; Nécessité, Modèles, Enjeux (Paris, Collection de l’UMR de Droit Comparé de Paris (Université Paris 1), Société de Législation Comparée, vol 37, 2015). Flore D and de Biolley S, ‘Des Organes Juridictionnels en Matière Pénale pour l’Union Européenne’ (2003) 5 Cahiers de droit européen 597. Fontanelli F, ‘Implementation of EU Law through Domestic Measures after Fransson: The Court of Justice Buys Time and “Non-preclusion” Troubles Loom Large’ (2014) 39 European Law Review 682. ——, ‘Hic Sunt Nationes: The Elusive Limits of the EU Charter and the German Constitutional Watchdog’ (2013) 9 European Constitutional Law Review 315. Franssen N, ‘The Future Judicial Cooperation between the EPPO and Non-Participating Member States’ (2018) 9(3) New Journal of European Criminal Law 291. ——, ‘The Future Judicial Cooperation between the EPPO and Third Countries’ (2019) 10(2) New Journal of European Criminal Law 168. ——, ‘Comments on the EPPO from a Dutch Perspective’ in K Ligeti, MJ Antunes and F Giuffrida (eds), The European Public Prosecutor’s Office at Launch (Milan, Wolters Kluwer/CEDAM, 2020). Franssen N and Weyembergh A, ‘The Future Relationship between the European Public Prosecutor’s Office and Eurojust’ in C Chevallier-Govers and A Weyembergh (eds), La Création du Parquet Européen : Simple évolution ou Révolution au sein de l’Espace Judiciaire Européen ? (Brussels, Bruylant, 2021). Fromage D, ‘The Second Yellow Card on the EPPO Proposal: An Encouraging Development for Member State Parliaments?’ (2015) 35(1) Yearbook of European Law 1. Gammeltoft-Hansen T, ‘Filtering Out the Risk Migrant: Migration Control, Risk Theory and the EU’ (2006) AMID Working Paper Series No 52/2006. Garland D, ‘The Limits of the Sovereign State: Strategies of Crime Control in Contemporary Society’ (1996) 36 British Journal of Criminology 445. ——, The Culture of Control: Crime and Social Order in Contemporary Society (Oxford, Oxford University Press, 2001). Georgakakis D, ‘La Démission de la Commission Européenne: Scandale et Tournant Institutionnel (octobre 1998–mars 1999)’ (2008) 38–39 Cultures et conflits. Gerstetter C, Stefes C, Faure M, Mitsilegas V et al, Environmental Crime and the EU: Synthesis of the Research Project ‘European Union Action to Fight Environmental Crime (EFFACE) (Berlin, Ecologic Institute Publisher, 2016). Gerstetter C and Faure M, Environmental Crime and the EU. Synthesis of the Research Project ‘European Union Action to Fight Environmental Crime’ (EFFACE) (Berlin, Ecologic Institute Publisher, 2016). Geyer F, ‘Case Note: European Arrest Warrant. Court of Justice of the European Communities’ (2008) 4 European Constitutional Law Review 149. ——, ‘Taking Stock: Databases and Systems of Information Exchange in the Area of Freedom, Security and Justice’ (2008) CEPS Research Paper Series No 9. Giannoulopoulos D, ‘Fair Trial Rights in the UK Post Brexit: Out with the Charter and EU Law, in with the ECHR?’ (2016) 7 New Journal of European Criminal Law 387. Gilmore WC, ‘The EU Action Plan to Combat Organised Crime: The Scope and Implementation of Legal Instruments’ in E Bort and R Keat (eds), The Boundaries of Understanding: Essays in Honour of Malcolm Anderson (Edinburgh, University of Edinburgh Social Sciences Institute, 1999). ——, ‘The Twin Towers and the Third Pillar: Some Security Agenda Developments’ (2003) EUI Working Paper Law No 2003/7. ——, Dirty Money: The Evolution of Money Laundering Countermeasures, 3rd edn (Strasbourg, Council of Europe Publishing, 2004).

Bibliography 733 Ginsborg L, ‘One Step Forward, Two Steps Back: The Security Council, “Foreign Terrorist Fighters”, and Human Rights’ in M Nowak and A Charbord (eds), Using Human Rights to Counter Terrorism (Cheltenham, Edward Elgar, 2018). Giudicelli-Delage G and Manacorda S (eds), L’intégration pénale indirecte (Paris, Société de législation comparée, 2005). Giudici S, ‘Generalstaatsanwaltschaft Berlin: A Further Development of Extradition Rules of Union Citizens to Third Countries’ (2021) 6 European Papers: A Journal on Law and Integration 211. Giuffrida F, ‘The Limitation Period of Crimes: Same Old Italian Story, New Intriguing European Answers – Case Note on C-105/14, Taricco’ (2016) 7 New Journal of European Criminal Law 100. ——, ‘Taricco Principles beyond Taricco: Some Thoughts on Three Pending Cases (Scialdone, Kolev, Menci)’ (2018) 9 New Journal of European Criminal Law 31. ——, ‘Cross-border Crimes and the European Public Prosecutor’s Office’ (2017) 3 Eucrim 149. ——, ‘The European Public Prosecutor’s Office: King without Kingdom?’ (2017) CEPS Research Report No 2017/03. ——, ‘Comparative Analysis’ in F Giuffrida and K Ligeti (eds), Admissibility of OLAF Final Reports as Evidence in Criminal Proceedings (Luxembourg, University of Luxembourg, 2019). Glas LR and Krommendijk J, ‘From Opinion 2/13 to Avotiņš: Recent Developments in the Relationship between the Luxembourg and Strasbourg Courts’ (2017) 17(3) Human Rights Law Review 567. Gless S, ‘Europol’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook of European Criminal Law (Cheltenham, Edward Elgar, 2016). Gless S and Pfirter P, ‘Cross-border Access and Exchange of Digital Evidence: Cloud Computing Challenges to Individual Rights and the Rule of Law’ in V Mitsilegas and N Vavoula (eds), Surveillance and Privacy in the Digital Age: European, Transatlantic and Global Perspectives (Oxford, Hart Publishing, 2021). Gless S and Wahl T, ‘A Comparison of the Evolution and Pace of Police and Judicial Cooperation in Criminal Matters: A Race between Europol and Eurojust?’ in C Brière and A Weyembergh (eds), The Needed Balances in EU Criminal Law: Past, Present and Future (Oxford, Hart Publishing, 2018). Gless S and Zeitler HE, ‘Fair Trial Rights and the European Community’s Fight against Fraud’ (2001) 7(2) European Law Journal 219. Göhler J, ‘To Continue or Not: Who Shall Be in Control of the European Public Prosecutor’s Dismissal Decisions?’ (2015) 6 New Journal of European Criminal Law 102. Goodall K, ‘Incitement to Religious Hatred: All Talk and No Substance?’ (2007) 70 Modern Law Review 89. Gonçalves ME and Andrade Jesus I, ‘Security Policies and the Weakening of Personal Data Protection in the European Union’ (2013) 29 Computer Law & Security Review 255. González Fuster G, ‘Fighting for Your Right to What Exactly? The Convoluted Case Law of the EU Court of Justice on Privacy and/or Personal Data Protection’ (2015) 2(2) Birbeck Law Review 263. ——, ‘Artificial Intelligence and Law Enforcement – Impact on Fundamental Rights’ (Study for the LIBE Committee of the European Parliament, PE 656.295, 2020). González Fuster G and Paepe P, ‘Reflexive Governance and the EU Third Pillar: Analysis of Data Protection and Criminal Law Aspects’ in E Guild and F Geyer (eds), Security versus Justice? Police and Judicial Cooperation in the European Union (Aldershot, Ashgate, 2008). Gragl P, ‘An Olive Branch from Strasbourg? Interpreting the ECtHR’s Resurrection of Bosphorus and Reaction to Opinion 2/13 in the Avotiņš Case: ECtHR 23 May 2016, Case No 17502/07, Avotiņš v Latvia’ (2017) 13 European Constitutional Law Review 551. Granger MP and Irion K, ‘The Court of Justice and the Data Retention Directive in Digital Rights Ireland: Telling off the EU Legislator and Teaching a Lesson in Privacy and Data Protection’ (2014) 39(6) European Law Review 834. Grasso G, Sicurella R and Giuffrida F, ‘EPPO Material Competence: Analysis of the PIF Directive and the Regulation’ in K Ligeti, MJ Antunes and F Giuffrida (eds), The European Public Prosecutor’s Office at Launch (Milan, Wolters Kluwer/CEDAM, 2020). Grimm D, ‘Comments on the German Constitutional Court’s Decision on the Lisbon Treaty: Defending Sovereign Statehood against Transforming the European Union into a State’ (2009) 5 European Constitutional Law Review 353. Groenendijk K, Guild E and Minderhoud P (eds), In Search of Europe’s Borders (Leiden, Brill, 2003).

734 Bibliography Groenleer M, The Autonomy of the European Union Agencies: A Comparative Study of Institutional Development (Delft, Eburon, 2009). Groussot X and Bogojevic S, ‘Subsidiarity as a Procedural Safeguard of Federalism’ in L Azoulai (ed), The Question of Competence in the European Union (Oxford, Oxford University Press, 2014). Groussot X and Ericsson A, ‘Ne Bis in Idem in the EU and ECHR Legal Orders’ in B van Bockel (ed), Ne Bis in Idem in EU Law (Cambridge, Cambridge University Press, 2016). Groussot X and Popov Z, ‘What’s Wrong with OLAF? Accountability, Due Process and Criminal Justice in European Anti-Fraud Policy’ (2010) 47 CML Rev 608. Grother P, Ngan M and Hanaoka K, ‘Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects’ (2019) National Institute of Standards and Technology Internal Report No 8289. Grünhage J, ‘The 1996/97 Intergovernmental Conference: A Survey of the Process’ in J Monar and W Wessels (eds), The European Union after the Treaty of Amsterdam (New York, Continuum, 2001). Gruszczak A, ‘The EU Criminal Intelligence Model’ in C Harding and JB Banach-Gutierrez (eds), EU Criminal Law and Policy. Values, Principles and Methods (Abingdon, Routledge, 2017) Guild E, ‘The Uses and Abuses of Counter-terrorism Policies in Europe: The Case of the ‘Terrorist Lists’ (2008) 46 Journal of Common Market Studies 173. ——, EU Counter-terrorism Action: A Fault Line between Law and Politics? (Brussels, CEPS, 2010). Guild E and Carrera S, ‘The Political and Judicial Life of Metadata: Digital Rights Ireland and the Trail of the Data Retention Directive’ (2014) CEPS Paper in Liberty and Security No 65. Guild E, Mendos Kuşkonmaz E, Mitsilegas V and Vavoula N, ‘Data Retention and the Future of Large-Scale Surveillance: The Evolution and Contestation of Judicial Benchmarks’ (2021) European Law Journal, forthcoming. Guild E and Niessen J, The Developing Immigration and Asylum Policies of the European Union (The Hague, Martinus Nijhoff Publishers, 1996). Guild E et al, ‘Implementation of the EU Charter of Fundamental Rights and its Impact on EU Home Affairs Agencies. Frontex, Europol and the European Asylum Support Office’ (Study for the LIBE Committee of the European Parliament, PE 453.196, 2011). ——, ‘What is Happening to the Schengen Borders?’ (2015) CEPS Paper in Liberty and Security in Europe No 86, December 2015. Haguenau-Moizard C, ‘Vers une harmonisation communautaire du droit pénal?’ (2006) 42 Revue trimestrielle du droit européen 377. Halberstam D, ‘“It’s the Autonomy, Stupid!” A Modest Defense of Opinion 2/13 on EU Accession to the ECHR, and the Way Forward’ (2015) Michigan Law School, Public Law and Legal Theory Research Paper Series No 432. Halberstam D and Möllers C, ‘The German Constitutional Court says “Ja zu Deutschland!”’ (2009) 10 German Law Journal 1241. Halberstam D and Stein E, ‘The United Nations, the European Union, and the King of Sweden: Economic Sanctions and Individual Rights in a Plural World Order’ (2009) 46 CML Rev 13. Hamran L and Szabova E, ‘European Public Prosecutor’s Office: Cui Bono?’ (2013) 4(1–2) New Journal of European Criminal Law 40. Harding C, ‘Exploring the Intersection of European Law and National Criminal Law’ (2000) 25 European Law Review 374. Harding C and Banach-Gutierrez JB, ‘The Emergent EU Criminal Policy: Identifying the Species’ (2012) 37 European Law Review 758. Harkin T ‘The Case Law of the Court of Justice of the European Union on “Judicial Authority” and Issuing European Arrest Warrants’ (2021) New Journal of European Criminal Law 1. Harlow C, Accountability in the European Union (Oxford, Oxford University Press, 2002). Hartwig S, ‘Frontex: From Coordinating Controls to Combating Crime’ (2020) 2 Eucrim 134. Hayes B et al, ‘The Law Enforcement Challenges of Cybercrime: Are We Really Playing Catch-Up?’ (Study for the LIBE Committee of the European Parliament, PE 536.471, 2015). Helenius D, ‘Admissibility of Evidence and the European Public Prosecutor’s Office’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stockholm, Stiftelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015). Helmberg M, ‘Eurojust and Joint Investigation Teams: How Eurojust Can Support JITs’ (2007) 8 ERA Forum 24.

Bibliography 735 Henderson K, ‘Perceptions of Internal Security Issues in the New Member States’ in K Henderson (ed), The Area of Freedom, Security and Justice in the Enlarged European Union (Basingstoke, Palgrave Macmillan, 2004). Henderson LN, ‘The Wrongs of Victim’s Rights’ (1985) 37 Stanford Law Review 937. Herlin-Karnell E, ‘Commission v. Council: Some Reflections on Criminal Law in the First Pillar’ (2007) 13 European Public Law 69. ——, ‘Annotation of Ireland v Parliament and Council’ (2009) 46 CML Rev 1667. ——, The Constitutional Dimension of European Criminal Law (Oxford, Hart Publishing, 2012). Herrnfeld HH, ‘Choice of Forum and Case Allocation in the EPPO Regulation’ in European Law Institute, K Ligeti and G Robinson (eds), Preventing and Resolving Conflicts of Jurisdiction in EU Criminal Law (Oxford, Oxford University Press, 2018). ——, ‘The Draft Regulation on the Establishment of the European Public Prosecutor’s Office: Issues of Balances between the Prosecution and the Defence’ in C Brière and A Weyembergh (eds), The Needed Balances in EU Criminal Law: Past, Present and Future (Oxford, Hart Publishing, 2018). ——, ‘Mechanisms for Settling Conflicts of Jurisdiction’ in M Luchtman (ed), Choice of Forum in Cooperation against EU Financial Crime: Freedom, Security and Justice and the Protection of Specific EU Interests (The Hague, Eleven International Publishing, 2013). Hetzer H, ‘Fight against Fraud and Protection of Fundamental Rights in the European Union’ (2006) 14 European Journal of Crime, Criminal Law and Criminal Justice 20. Hetzer W, ‘National Criminal Prosecution and European Tendering of Evidence: Perspectives of the European Anti-Fraud Office (OLAF)’ (2004) 12 European Journal of Crime, Criminal Law and Criminal Justice 166. Hijmans H, ‘The European Data Protection Supervisor: The Institutions of the EC Controlled by an Independent Authority’ (2006) 43(5) CML Rev 1313. ——, ‘The European Union as a Constitutional Guardian of Internet Privacy and Data Protection: The Story of Article 16 TFEU’ (PhD thesis, University of Amsterdam and Vrije Universiteit Brussel, 2016). ——, ‘Data Protection and Surveillance: The Perspective of EU Law’ in V Mitsilegas and N Vavoula (eds), Surveillance and Privacy in the Digital Age: European, Transatlantic and Global Perspectives (Oxford, Hart Publishing, 2021). Hillgruber C, ‘Anmerkung’ (2005) 17 JuristenZeitung 841. Hillion C, ‘The Copenhagen Criteria and their Progeny’ in C Hillion (ed), EU Enlargement: A Legal Approach (Oxford, Hart Publishing, 2004). ——, ‘The European Union is Dead – Long Live the European Union: A Commentary on the Treaty of Accession 2003’ (2004) 29 European Law Review 583. Hinarejos A, ‘Recent Human Rights Developments in the EU Courts: The Charter of Fundamental Rights, the European Arrest Warrant and Terror Lists’ (2007) 7(4) Human Rights Law Review 793. Hinarejos A, Spencer JR and Peers S, ‘Opting out of EU Criminal Law: What is Actually Involved?’ (2012) University of Cambridge Faculty of Law CELS Working Paper, New Series No 1. Hodgson J, ‘Criminal Procedure in Europe’s Area of Freedom, Security and Justice: The Rights of the Suspect’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on European Criminal Law (Cheltenham, Edward Elgar, 2016). Honig M, ‘Human Dignity, Identity Review of the European Arrest Warrant and the Court of Justice as a Listener in the Dialogue of Courts: Solange-III and Aranyosi’ (2016) 12 European Constitutional Law Review 549. Hufnagel S, Policing Cooperation across Borders: Comparative Perspectives on Law Enforcement within the EU and Australia (Farnham, Ashgate, 2013). ——, ‘Organized Crime’ in V Mitsilegas, B Bergström and T Konstadinides (eds), Research Handbook of European Criminal Law (Cheltenham, Edward Elgar, 2016). ——, Policing Global Regions: The Legal Context of Transnational Law Enforcement Cooperation (Abingdon, Routledge, 2021). Hunt A, ‘The Council of Europe Convention on the Prevention of Terrorism’ (2006) 12 European Public Law 613. Hustinx P, ‘EU Data Protection Law: The Review of Directive 95/46/EC and the Proposed General Data Protection Regulation’ (2013) Collected Courses of the European University Institute’s Academy of European Law, 24th Session on European Union Law.

736 Bibliography Iglesias Sanchez S, ‘The Court and the Charter: The Impact of the Entry into Force of the Lisbon Treaty on the ECJ’s Approach to Fundamental Rights’ in (2012) 49 CML Rev 1565. Incalza T, ‘National Anti-money Laundering Legislation in a Unified Europe: Jyske’ (2014) 51 CML Rev 1829. Inghelram JFH, Legal and Institutional Aspects of the European Anti-Fraud Office (OLAF): An Analysis with a Look Forward to a European Public Prosecutor’s Office (Groningen, Europa Law Publishing, 2011). ——, ‘Judicial Review of Investigative Acts of the European Anti-Fraud Office (OLAF): A Search for a Balance’ (2012) 49(2) CML Rev 601. Jacobs F, ‘The Role of the European Court of Justice in the Protection of the Environment’ (2006) 18(2) Journal of Environmental Law 185. Jacobs JB and Blitsa D, ‘Major “Minor” Progress under the Third Pillar: EU Institution Building in the Sharing of Criminal Record Information’ (2008) 8 Chicago-Kent Journal of International and Comparative Law 111. Jackson J, ‘Cultural Barriers on the Road to Providing Suspects with Access to Lawyer’ in R Colson and S Field (eds), EU Criminal Justice and the Challenges of Legal Diversity: Towards a Socio-legal Approach to EU Criminal Policy (Cambridge, Cambridge University Press, 2016). Janssens C, The Principle of Mutual Recognition in EU Law (Oxford, Oxford University Press, 2013). Jasserand C, ‘Law Enforcement Access to Personal Data Originally Collected by Private Parties: Missing Data Subjects’ Safeguards in Directive 2016/680?’ (2018) 34(1) Computer Law & Security Review 154. Jeney P, ‘The Future of Eurojust’ (Study for the LIBE Committee of the European Parliament, PE 462.451, 2012). Jimeno-Bulnes M, ‘The Proposal for a Council Framework Decision on Certain Procedural Rights in Criminal Proceedings throughout the European Union’ in E Guild and F Geyer (eds), Security versus Justice? Police and Judicial Cooperation in the European Union (Aldershot, Ashgate, 2008). Johnston A, ‘The European Union, the Ongoing Search for Terrorists’ Assets and a Satisfactory Legal Framework: Getting Warmer or Colder?’ [2007] Cambridge Law Journal 525. Johnstone I, ‘Legislation and Adjudication in the UN Security Council: Bringing Down the Deliberative Deficit’ (2008) 102(2) American Journal of International Law 275. Jonsson Cornell A, ‘EU Police Cooperation Post-Lisbon’ in M Bergström and A Jonsson Cornell (eds), European Police and Criminal Law Co-operation (Oxford, Hart Publishing, 2014). Juszszak A and Sason E, ‘Fighting Terrorism through the Euroepan Public Prosecutor’s Office (EPPO)?’ (2019) 1 Eucrim 66. Kaiafa-Gbandi M, ‘Das Corpus Juris und die Typiesierung des Strafphänomens im Bereich der Europäischen Union’ (1999) 82 KritV 162. ——, To poiniko dikaio stin Europaiki Enossi (Athens and Thessaloniki, Sakkoulas, 2003). ——, ‘The Importance of Core Principles of Substantive Criminal Law for a European Criminal Policy Respecting Fundamental Rights and the Rule of Law’ (2011) 1 European Criminal Law Review 7. ——, ‘The Establishment of an EPPO and the Rights of the Suspects and Defendants: Reflections upon the Commission’s 2013 Proposal and the Council’s Amendments’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stockholm, Stiftelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015). Kennedy D, ‘Challenging Expert Rule: The Politics of Global Governance’ (2005) 27 Sydney Law Review 5. Keohane D, ‘The Absent Friend: EU Foreign Policy and Counter-terrorism’ (2008) 46(1) Journal of Common Market Studies 125. Kietz D and Perthes V (eds), The Potential of the Council Presidency: An Analysis of Germany’s Chairmanship of the EU, 2007 (Berlin, SWP Research Paper 1, 2008). Kindt E, Privacy and Data Protection Issues of Biometric Identifiers (Dordrecht, Springer, 2013). Kingsbury B, ‘The Concept of ‘Law in Global Administrative Law’ (2009) 20 European Journal of International Law 23. Kingsbury B, Krisch N and Stewart RB, ‘The Emergence of Global Administrative Law’ (2004–05) 68 Law and Contemporary Problems 15. Klabbers J, ‘Institutional Ambivalence by Design: Soft Organizations in International Law’ (2001) 70 Nordic Journal of International Law 403. ——, ‘Safeguarding the Organizational Acquis: The EU’s External Practice’ (2007) International Organizations Law Review 57. ——, Treaty Conflict and the European Union (Cambridge, Cambridge University Press, 2009).

Bibliography 737 Klip A, ‘European Integration and Harmonisation and Criminal Law’ in DM Curtin, A Klip, KM Smits and JA McCahery, European Integration and Law (Antwerp, Intersentia, 2006). ——, European Criminal Law (Antwerp, Intersentia, 2009). ——, European Criminal Law, 2nd edn (Cambridge, Intersentia, 2012). ——, European Criminal Law, 3rd edn (Cambridge, Intersentia, 2016). ——, ‘Violations of Defence Rights’ Directives’ (2018) 26(4) European Journal of Crime, Criminal Law and Criminal Justice 271. Klip A and van der Wily H, Harmonisation and Harmonising Measures in Criminal Law (Amsterdam, Royal Netherlands Academy of Arts and Sciences, 2002). Kochenov D and Pirker B, ‘Deporting the EU Citizens within the European Union: A Counter-intuitive Trend in Case C-348/09, PI v Oberbürgermeisterin der Stadt Remscheid’ (2013) 19 Columbia Journal of European Law 384. Kokott J and Sobotta C, ‘The Kadi Case – Constitutional Core Values and International Law: Finding the Balance?’ (2012) 23 European Journal of International Law 1015. Konstadinides T, ‘Wavering between Centres of Gravity: Comment on Ireland v Parliament and Council’ (2010) 35 European Law Review 88. ——, ‘Destroying Democracy on the Ground of Defending it? The Data Retention Directive, the Surveillance State and Our Constitutional Ecosystem’ (2011) 36 European Law Review 722. ——, ‘Mass Surveillance and Data Protection in EU Law: The Data Retention Directive Saga’ in M Bergström and A Jonsson Cornell (eds), European Police and Criminal Law Cooperation (Oxford, Hart Publishing, 2014). Kostakopoulou D, ‘Is There an Alternative to “Schengenland”?’ (1998) 46(5) Political Studies 886. ——, ‘The Area of Freedom, Security and Justice and the European Union’s Constitutional Dialogue’ in C Barnard (ed), The Fundamentals of EU Law Revisited: Assessing the Impact of the Constitutional Debate (Oxford, Oxford University Press, 2007). ——, ‘When EU Citizens Become Foreigners’ (2014) 20 European Law Journal 459. Kostakopoulou D and Ferreira N, ‘Testing Liberal Norms: The Public Policy and Public Security Derogations and the Cracks in European Union Citizenship’ (2013) University of Warwick School of Law Legal Studies Research Paper No 2013-18. Koutrakos P, ‘Editorial: Development and Foreign Policy: Where to Draw the Line between the Pillars’ (2008) 33(3) European Law Review 289. Kranenborg H, ‘Article 8: Protection of Personal Data’ in S Peers et al (eds), The EU Charter of Fundamental Rights. A Commentary (Oxford, Hart Publishing, 2014). Kreher A, ‘Agencies in the European Community: A Step towards Administrative Integration in Europe’ (1997) 4(2) Journal of European Public Policy 225. Krisch N, Beyond Constitutionalism: The Pluralist Structure of Postnational Law (Oxford, Oxford University Press, 2010). Kuijper PJ, ‘The Evolution of the Third Pillar from Maastricht to the European Constitution: Institutional Aspects’ (2004) 41 CML Rev 609. Kuhl L, ‘Le Renforcement des Dispositifs Existants et la Lutte Contre la Fraude au Budget de l’Union’ in P Ghaleh-Marzban (ed), Quelles Perspectives pour un Ministère Public Européen? Protéger les Intérêts Financiers et Fondamentaux de l’Union (Paris, Dalloz, 2010). Labayle H, ‘La Coopération Européenne en Matière de Justice et d’Affairs Intérieures et la Conférence Intergouvernmentale’ (1997) 33 Revue Trimestrielle du Droit Européen 1. ——, ‘Un Espace de Liberté, de Sécurité et de Justice’ (1998) 34 Revue Trimestrielle du Droit Européen 813. ——, ‘Three Principles of Reflection’ in Notre Europe, Protecting European Citizens against International Crime (Paris, Notre Europe, 2000). ——, ‘Architecte ou Spectatrice? La Cour de Justice de l’Union dans l’Espace de Liberté, Sécurité et Justice’ (2006) 42 Revue Trimestrielle du Droit Européen 1. ——, ‘L’ouverture de la jarre de Pandore : réflexions sur la compétence de la Communauté en matière pénale’ (2006) Cahiers de droit européen 379. Labayle M and Nilsson HG, ‘The Role and Organisation of Eurojust: Added Value for Judicial Cooperation in Criminal Matters’ in J Monar (ed), The Institutional Dimension of the European Union’s Area of Freedom, Security and Justice (Brussels, College of Europe Studies, Peter Lang, 2010).

738 Bibliography Ladenburger C, ‘Police and Criminal Law in the Treaty of Lisbon: A New Dimension for the Community Method’ (2008) 4 European Constitutional Law Review 20. Lamberigts S, ‘The Directive on the Presumption of Innocence: A Missed Opportunity for Legal Persons?’ (2016) 1 Eucrim 36. Lamberigts S, ‘The Privilege against Self-Incrimination: A Chameleon of Criminal Procedure’ (2016) 7 New Journal of European Criminal Law 418. Lane Scheppele K, Kochenov D and Grabowska-Moroz B, ‘EU Values are Law, after All: Enforcing EU Values through Systemic Infringement Actions by the European Commission and the Member States of the European Union’ (2020) 39 Yearbook of European Law 3. Lasagni G, ‘La Corte di Giustizia e la Definizione di Idem nel Diritto della Concorrenza: Verso la Creazione di una Nozione Uniforme?’ (2020) 47 Giurisprudenza Commerciale 5. Lavenex S, ‘Mutual Recognition and the Monopoly of Force: Limits of the Single Market Analogy’ (2007) 14(5) Journal of European Public Policy 762. Lazowski A, ‘Constitutional Tribunal on the Surrender of Polish Citizens under the European Arrest Warrant: Decision of 27 April 2005’ (2005) 1 European Constitutional Law Review 569. ——, ‘And Then They were Twenty-Seven … A Legal Appraisal of the Sixth Accession Treaty’ (2007) 44 CML Rev 401. ——, ‘EU Criminal Law and Enlargement’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on European Criminal Law (Cheltenham, Edward Elgar, 2016). ——, ‘Mind the Fog, Stand Clear of the Cliff! From the Political Declaration to the Post-Brexit EU–UK Legal Framework – Part I’ (2020) 5 European Papers 1105. Lelieur J, ‘“Transnationalising” Ne Bis in Idem: How the Rule of Ne Bis in Idem Reveals the Principle of Personal Legal Certainty’ (2013) 9(4) Utrecht Law Journal 198. Lenaerts K, ‘The Rule of Law and the Coherence of the Judicial System of the European Union’ (2007) 44 CML Rev 1625. ——, ‘Exploring the Limits of the EU Charter of Fundamental Rights’ (2012) 8 European Constitutional Law Review 375. ——, ‘La Vie Après L’Avis: Exploring the Principle of Mutual (Yet Not Blind) Trust’ (2017) 54(3) CML Rev 806. ——, ‘Upholding the Rule of Law through Judicial Dialogue’ (2019) 38 Yearbook of European Law 3. Lenaerts K and Corthaut T, ‘Of Birds and Hedges: The Role of Primacy in Invoking Norms of EU Law’ (2006) 31 European Law Review 287. Lenaerts K and Gutiérrez-Fons JA, ‘The European Court of Justice and Fundamental Rights in the Field of Criminal Law’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook of European Criminal Law (Cheltenham, Edward Elgar, 2016). Lenaerts K, Maselis I and Gutman K, EU Procedural Law (Oxford, Oxford University Press, 2014). Lane Scheppele K, Kochenov D and Grabowska-Moroz B, ‘EU Values are Law, after All: Enforcing EU Values through Systemic Infringement Actions by the European Commission and the Member States of the European Union’ (2020) 39 Yearbook of European Law 3. Letschert R and Rijken C, ‘Rights of Victims of Crime: Tensions between an Integrated Approach and a Limited Legal Basis for Harmonisation’ (2013) 4 New Journal of European Criminal Law 226. Ligeti K, ‘The European Public Prosecutor’s Office’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on European Criminal Law (Cheltenham, Edward Elgar, 2016). ——, ‘The Protection of the Procedural Rights of Persons Concerned by OLAF Administrative Investigations and the Admissibility of OLAF Final Reports as Criminal Evidence’ (2017) Report for the European Parliament’s Committee on Budgetary Control No 25. ——, ‘Fundamental Rights Protection between Strasbourg and Luxembourg. Extending Transnational Ne Bis in Idem across Administrative and Criminal Procedures’ in European Law Institute, K Ligeti and G Robinson (eds), Preventing and Resolving Conflicts of Jurisdiction in EU Criminal Law (Oxford, Oxford University Press, 2018). Ligeti K, Antunes MJ and Giuffrida F (eds), The European Public Prosecutor’s Office at Launch (Milan, Wolters Kluwer/CEDAM, 2020). Ligeti K and Robinson G, ‘Sword, Shield and Cloud: Toward a European System of Public-Private Orders for Electronic Evidence in Criminal Matters?’ in V Mitsilegas and N Vavoula (eds), Surveillance and Privacy in the Digital Age: European, Transatlantic and Global Perspectives (Oxford, Hart Publishing, 2021).

Bibliography 739 Ligeti K and Simonato M, ‘The European Public Prosecutor’s Office: Towards a Truly European Prosecution Service?’ (2013) 4(1–2) New Journal of European Criminal Law 7. Ligeti K and Weyembergh A, ‘The European Public Prosecutor’s Office: Certain Constitutional Issues’ in LH Erkelens, AWH Meij and TM Pawlik (eds), The European Public Prosecutor’s Office: An Extended Arm or a Two-Headed Dragon? (The Hague, TMC Asser Press/Springer, 2015). Lindahl H, ‘Finding a Place for Freedom, Security and Justice: The European Union’s Claim to Territorial Unity’ (2004) 29 European Law Review 461. Lo Schiavo G, ‘The Principle of Ne Bis in Idem and the Application of Criminal Sanctions: Of Scope and Restrictions’ (2018) 14(3) European Constitutional Law Review 644. Lock T, ‘Fishing for Better Rights Protection: The Court of Justice on the Application of the Charter in the Member States and the Reach of Ne Bis in Idem’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Lohse KM, ‘The European Public Prosecutor: Issues of Conferral, Subsidiarity and Proportionality’ in LH Erkelens, AWH Meij and TM Pawlik (eds), The European Public Prosecutor’s Office: An Extended Arm or a Two-Headed Dragon? (The Hague, TMC Asser Press/Springer, 2015). Loughlin M, ‘What is Constitutionalisation?’ in P Dobner and M Loughlin (eds), The Twilight of Constitutionalism? (Oxford, Oxford University Press, 2010). Luchtman M, ‘Choice of Forum and the Prosecution of Cross-border Crime in the European Union: What Role for the Legality Principle?’ in M Luchtman (ed), Choice of Forum in Cooperation against EU Financial Crime: Freedom, Security and Justice and the Protection of Specific EU Interests (The Hague, Eleven International Publishing, 2013). ——, ‘The ECJ’s Recent Case Law on Ne Bis in Idem: Implications for Law Enforcement in a Shared Legal Order’ (2018) 55(6) CML Rev 1717. ——, ‘Forum Choice and Judicial Review under the EPPO’s Legislative Framework’ in W Geelhoed, AWH Meij and LH Erkelens (eds), Shifting Perspectives on the European Public Prosecutor’s Office (The Hague, TMC Asser Press/Springer, 2018). Luchtman M and Vervaele JAE (eds), ‘Investigatory Powers and Procedural Safeguards: Improving OLAF’s Legislative Framwork through a Comparison with Other EU Law Enforcement Authorities (ECN/ESMA/ ECB)’ (Utrecht, Utrecht University Repository, 2017). Lynskey O, ‘The Data Retention Directive is Incompatible with the Rights to Privacy and Data Protection and is Invalid in its Entirety: Digital Rights Ireland’ (2014) 51(6) CML Rev 1789. ——, The Foundations of EU Data Protection Law (Oxford, Oxford University Press, 2015). Majone G, ‘The New European Agencies: Regulation by Information’ (1997) 4(2) Journal of European Public Policy 262. Manacorda S, ‘Judicial Activism dans le cadre de l’espace de liberté, de justice et de sécurité de l’Union européenne’ (2005) Revue de science criminelle et du droit pénal compare 956. ——, ‘La Localisation de la Garantie Juridictionnelle du Parquet Européen’ in GGeneviève GiudicelliDelage, S Manacorda and J Tricot (eds), Le Contrôle Judiciaire du Parquet Européen : Nécessité, Modèles, Enjeux (Paris, Collection de l’UMR de Droit Comparé de Paris (Université Paris 1), Société de Législation Comparée, vol 37, 2015). ——, ‘The Taricco Saga: A Risk or an Opportunity for European Criminal Law?’ (2018) 9 New Journal of European Criminal Law 4. Mancano L, ‘Criminal Conduct and Lack of Integration into the Society under EU Citizenship: This marriage is Not to Be Performed’ (2015) 6 New Journal of European Criminal Law 53. Mangenot M, ‘Jeux Européens et Innovation Institutionnelle : Les Logiques de Création d’Eurojust’ (2006) 62 Cultures et conflits 43. Manes V, ‘Some Lessons from the Taricco Saga’ (2018) 9 New Journal of European Criminal Law 12. ——, ‘Taricco, Endgame’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Manes V and Caianiello M, Introduzione al Diritto penale Europeo. Fonti, Metodi, Istituti, Casi (Turin, Giappichelli, 2020). Manoledakis I, ‘Das Corpus Juris als falsche Grundlage eines gesamteu-ropäischen Strafjustizsystems’ (1999) 82 KritV 181.

740 Bibliography Marin L, ‘“A Spectre is Haunting Europe”: European Citizenship in the Area of Freedom, Security and Justice’ (2011) 17 European Public Law 705. Markou C, ‘The Cyprus and Other EU Court Rulings on Data Retention: The Directive as a Privacy Bomb’ (2012) 28 Computer Law & Security Review 468. Marletta A, ‘Interinstitutional Relationship of European Bodies in the Fight against Crimes Affecting the EU’s Financial Interests. Past Experience and Future Models’ (2016) 3 Eucrim 141. ——, ‘Forum Choice in the Area of Freedom, Security and Justice’ in European Law Institute, K Ligeti and G Robinson (eds), Preventing and Resolving Conflicts of Jurisdiction in EU Criminal Law (Oxford, Oxford University Press, 2018). ——, ‘Report on the Field Research at Eurojust, February 2015’ in European Law Institute, K Ligeti and G Robinson (eds), Preventing and Resolving Conflicts of Jurisdiction in EU Criminal Law (Oxford, Oxford University Press, 2018). Marquenie T, ‘The Police and Criminal Justice Authorities Directive: Data Protection Standards and Impact on the Legal Framework’ (2017) 33(3) Computer Law & Security Review 324. Martufi A, ‘Assessing the Resilience of “Social Rehabilitation” as a Rationale for Transfer: A Commentary on the Aims of Framework Decision 2008/909/JHA’ (2018) 9 New Journal of European Criminal Law 43. Martufi A and Gigengack D, ‘Exploring Mutual Trust through the Lens of an Executing Judicial Authority: The Practice of the Court of Amsterdam in EAW Proceedings’ (2020) 11 New Journal of European Criminal Law 282. Matos S, ‘Privacy and Data Protection in the Surveillance Society: The Case of the Prüm System’ (2019) 66 Journal of Forensic and Legal Medicine 155. Matravers M, ‘The Victim, the State and Civil Society’ in A Bottoms and JV Roberts (eds), Hearing the Victim: Adversarial Justice, Crime Victims and the State (Cullompton, Willan, 2010). McClean D, Transnational Organized Crime: A Commentary on the UN Convention and its Protocols (Oxford, Oxford University Press, 2007). McDonagh B, Original Sin in a Brave New World: An Account of the Negotiation of the Treaty of Amsterdam (Dublin, Institute of European Affairs Publisher, 1998). McGinley M and Parkes R, ‘Data Protection in the EU’s Internal Security Cooperation. Fundamental Rights vs Effective Cooperation?’ (2007) Stiftung Wissenschaft und Politik German Institute for International and Security Affairs SWP Research Paper No 5. Mégie A, ‘L’Institutionnalisation d’un Pouvoir Judiciaire Européen Incertain en Quête de Légitimité : L’Unité de Coopération Eurojust’ (2007) 23 Politique européenne 57. ——, ‘Mapping the Actors of European Judicial Cooperation’ in D Bigo et al, Mapping the Field of the EU Internal Security Agencies (Paris, L’Harmatan/Centre d’études sur les conflits, 2007). Meij A, ‘Some Explorations into the EPPO’s Administrative Structure and Judicial Review’ in LH Erkelens, AWH Meij and TM Pawlik (eds), The European Public Prosecutor’s Office: An Extended Arm or a Two-Headed Dragon? (The Hague, TMC Asser Press/Springer, 2015). Meyer F, ‘“From Solange II to Forever I”: The German Federal Constitutional Court and the European Arrest Warrant (and How the CJEU Responded)’ (2016) 7 New Journal of European Criminal Law 283. ——, ‘Recognising the Unknown: The New Confiscation Regulation’ (2020) 10(2) European Criminal Law Review 140. Milaj J, ‘Retention of Data in the new Anti-money Laundering Directive: “Need to Know” versus “Nice to Know”’ (2017) 7 International Data Privacy Law 115. Militello V ‘The Notion of Organised Crime in EU Law’ in S Carnevale, S Forlati and O Giolo (eds), Redefining Organised Crime: A Challenge for the European Union? (Oxford, Hart Publishing, 2017). Mirandola S and Lasagni G, ‘The European Ne Bis in Idem at the Crossroads of Administrative and Criminal Law’ (2019) 2 Eucrim 126. Mitsilegas V, ‘New Forms of Transnational Policing: The Emergence of Financial Intelligence Units in the European Union and the Challenges for Human Rights – Part I’ (1999) 3(2) Journal of Money Laundering Control 147. ——, ‘Defining Organised Crime in the European Union: The Limits of European Criminal Law in an Area of Freedom, Security and Justice’ (2001) 56 European Law Review 565. ——, ‘The Dynamics of Justice and Home Affairs: Laboratories, Driving Factors and Costs’ (2001) 39 Journal of Common Market Studies 747.

Bibliography 741 ——, ‘Countering the Chameleon Threat of Dirty Money: “Hard” and “Soft” Law in the Emergence of a Global Regime against Money Laundering and Terrorist Finance’ in A Edwards and P Gill (eds), Transnational Organised Crime: Perspectives on Global Security (London, Routledge, 2003). ——, ‘From National to Global, from Empirical to Legal: The Ambivalent Concept of Transnational Organised Crime’ in ME Beare (ed), Critical Reflections on Transnational Organized Crime, Money Laundering and Corruption (Toronto, University of Toronto Press, 2003). ——, ‘Justice and Home Affairs: Europeanization as a Government-Controlled Process’ (2003) 119 Proceedings of the British Academy 309. ——, Money Laundering Counter-measures in the European Union: A New Paradigm of Security Governance versus Fundamental Legal Principles (The Hague, Kluwer Law International, 2003). ——, ‘The New EU–US Co-operation on Extradition, Mutual Legal Assistance and the Exchange of Police Data’ (2003) 8 European Foreign Affairs Review 515. ——, ‘Contrôle des Étrangers, des Passagers, des Citoyens: Surveillance et Anti-Terrorisme’ (2005) 58 Cultures et Conflits 155. ——, ‘Operational Co-operation and Counter-terrorism in the EU’ in F Pastore (ed) Supranational Counter-terrorism: A Test under Duress for EU principles and Institutions (2005) Centro Studi di Politica Internazionale (CeSPI) Working Paper No 22/2005. ——, ‘The Constitutional Implications of Mutual Recognition in Criminal Matters in the EU’ (2006) 43 CML Rev 1277. ——, ‘Constitutional Principles of the European Community and European Criminal Law’ (2006) 8 European Journal of Law Reform 301. ——, ‘Trust-Building Measures in the European Judicial Area in Criminal Matters: Issues of Competence, Legitimacy and Inter-institutional Balance’ in T Balzacq and S Carrera (eds), Security versus Freedom? A Challenge for Europe’s Future (Aldershot, Ashgate, 2006). ——, ‘Judicial Co-operation in Criminal Matters between the EU and Third States: International Agreements’ in M Leaf (ed), Cross-border Crime: Defence Rights in a New Era of International Judicial Cooperation (London, Justice, 2006). ——, ‘Border Security in the European Union. Towards Centralised Controls and Maximum Surveillance’ in E Guild, H Toner and A Baldaccini (eds), Whose Freedom, Security and Justice? EU Immigration and Asylum Law and Policy (Oxford, Hart Publishing, 2007). ——, ‘The External Dimension of EU Action in Criminal Matters’ (2007) 12 European Foreign Affairs Review 457. ——, ‘The Transformation of Criminal Law in the “Area of Freedom, Security and Justice”’ (2007) 26 Yearbook of European Law 2007 1. ——, ‘The Coherence of the Adopted Measures During the Last Years by the EU with Regard to Organised Crime and the UN Convention on Organised Crime’ (Briefing Paper for European Parliament LIBE Committee, IP/C/LIBE/FWC/2005-24, 2006) in D Bigo and A Tsoukala (eds), Controlling Security (Paris, Centre d’études sur les conflits/L’Harmattan, 2008). ——, ‘Databases in the Area of Freedom, Security and Justice’ in C Stefanou and H Xanthaki (eds), Towards a European Criminal Record (Cambridge, Cambridge University Press, 2008). ——, ‘Drafting to Implement EU Law: The European Arrest Warrant in the United Kingdom’ in C Stefanou and H Xanthaki (ed), Legislative Drafting: A Modern Approach. Essays in Honour of Sir William Dale (London, Routledge, 2008). ——, ‘The Competence Question: The European Community and Criminal Law’ in E Guild and F Geyer (eds), Security versus Justice: Police and Judicial Co-operation in the European Union (Aldershot, Ashgate, 2008). ——, ‘The New EU–US Co-operation on Extradition, Mutual Legal Assistance and the Exchange of Police Data’ (2008) 8 European Foreign Affairs Review 515. ——, ‘What are the Main Obstacles to Police Co-operation in the EU?’ (Briefing Paper for European Parliament LIBE Committee, IP/C/LIBE/FWC/2005-24, 2006) in D Bigo and A Tsoukala (eds), Controlling Security (Paris, Centre d’études sur les conflits/L’Harmattan, 2008). ——, EU Criminal Law (Oxford, Hart Publishing, 2009). ——, ‘The Third Wave of Third Pillar Law: Which Direction for EU Criminal Justice?’ (2009) 34 European Law Review 523.

742 Bibliography ——, ‘European Criminal Law and Resistance to Communautarisation Post-Lisbon’ (2010) 1 New Journal of European Criminal Law 458. ——, ‘The European Union and the Globalisation of Criminal Law’ (2010) 12 Cambridge Yearbook of European Legal Studies 2009–2010 337. ——, ‘Transatlantic Counter-terrorism Cooperation after Lisbon’ (2010) 3 European Criminal Law Associations’ Forum 111. ——, ‘Human Rights, Terrorism and the Quest for Border Security’ in M Pedrazzi, I Viarengo and A Langs (eds), Individual Guarantees in the European Judicial Area in Criminal Matters (Brussels, Bruylant, 2011). ——, ‘The EU and the Implementation of International Norms in Criminal Matters’ in M Cremona, J Monar and S Poli (eds), The External Dimension of the Area of Freedom, Security and Justice (Bern, Peter Lang, 2011). ——, ‘The EU and the Rest of the World: Criminal Law and Policy Interconnections’ in M Evans and P Koutrakos (eds), Beyond the Established Orders: Policy Interconnections between the EU and the Rest of the World (Oxford, Hart Publishing, 2011). ——, ‘The Changing Landscape of the Criminalisation of Migration in Europe: The Protective Function of European Union Law’ in MJ Guia, M van der Woude and J van der Leun (eds), Social Control and Justice: Crimmigration in an Age of Fear (The Hague, Eleven International Publishing, 2012). ——, ‘Immigration Control in an Era of Globalisation: Deflecting Foreigners, Weakening Citizens, Strengthening the State’ (2012) 19 Indiana Journal of Global Legal Studies 3. ——, ‘The Limits of Mutual Trust in Europe’s Area of Freedom, Security and Justice: From Automatic Inter-state Cooperation to the Slow Emergence of the Individual’ (2012) 31 Yearbook of European Law 319. ——, ‘Security versus Justice: The Individualisation of Security and the Erosion of Citizenship and Fundamental Rights’ in S Ugelvik and B Hudson (eds), Justice and Security in the 21st Century: Risks, Rights and the Rule of Law (Abingdon, Routledge, 2012). ——, ‘The Aims and Limits of EU Anti-corruption Law’ in J Horder and P Alldridge (eds), Modern Bribery Law: Comparative Perspectives (Cambridge, Cambridge University Press, 2013). —— (ed), ‘Special Issue: The Future of Prosecution after Lisbon’ (2013) 4 New Journal of European Criminal Law 3. ——, ‘Article 49 (the Principles of Legality and Proportionality of Criminal Offences and Penalties)’ in S Peers T Hervey J Kenner and A Ward (eds), The EU Charter of Fundamental Rights: A Commentary (Oxford, Hart Publishing, 2014). ——, ‘From Overcriminalisation to Decriminalisation: The Many Faces of Effectiveness in European Criminal Law’ (2014) 5 New Journal of European Criminal Law 415. ——, ‘EU Criminal Law Competence after Lisbon: From Securitised to Functional Criminalisation’ in D Acosta and C Murphy (eds), EU Security and Justice Law (Oxford, Hart Publishing, 2014). ——, ‘Transatlantic Counter-terrorism Cooperation and European Values: The Elusive Quest for Coherence’ in E Fahey and D Curtin (eds), A Transatlantic Community of Law (Cambridge, Cambridge University Press, 2014). ——, ‘The Value of Privacy in an Era of Security: Embedding Constitutional Limits on Pre-emptive Surveillance’ (2014) 8(1) International Political Sociology 104. ——, The Criminalisation of Migration in Europe: Challenges for Human Rights and the Rule of Law (London, Springer, 2015). ——, ‘The European Public Prosecutor before the Court of Justice: The Challenge of Effective Judicial Protection’ in G Giudicelli-Delage, S Manacorda and J Tricot (eds), Le Contrôle Judiciaire du Parquet Européen : Nécessité, Modèles, Enjeux (Paris, Collection de l’UMR de Droit Comparé de Paris (Université Paris 1), Société de Législation Comparée, vol 37, 2015). ——, ‘The European Union and the Global Governance of Crime’ in V Mitsilegas, P Alldridge and L Cheliotis (eds), Globalisation, Criminal Law and Criminal Justice: Theoretical, Comparative and Transnational Perspectives (Oxford, Hart Publishing, 2015). ——, ‘Regional Organisations and the Suppression of Transnational Crime’ in N Boister and RJ Currie (eds), Routledge Handbook of Transnational Criminal Law (Abingdon, Routledge, 2015). ——, ‘The Symbiotic Relationship between Mutual Trust and Fundamental Rights in Europe’s Area of Criminal Justice’ (2015) 6 New Journal of European Criminal Law 460. ——, ‘The Transformation of Privacy in an Era of Pre-emptive Surveillance’ (2015) 20 Tilburg Law Review 34.

Bibliography 743 ——, ‘Judicial Concepts of Trust in Europe’s Multi-level Security Governance: From Melloni to Schrems via Opinion 2/13’ (2015) 3 European Criminal Law Associations’ Forum 90. ——, ‘Area 2: Harmonisation of Substantive Environmental Criminal Law at EU level. Study in the Framework of the EFFACE Research Project’ (contribution to WP7, the European Union Action to Fight Environmental Crime (EFFACE) research project, 2016). ——, EU Criminal Law after Lisbon: Rights, Trust and the Transformation of Justice in Europe (Oxford, Hart Publishing, 2016). ——, ‘Managing Legal Diversity in Europe’s Area of Criminal Justice: The Role of Autonomous Concepts’ in R Colson and S Field (eds), EU Criminal Justice and the Challenges of Legal Diversity: Towards A Socio-legal Approach to EU Criminal Policy (Cambridge, Cambridge University Press, 2016). ——, ‘The Uneasy Relationship between the United Kingdom and European Criminal Law: From Opt-outs to Brexit?’ (2016) Criminal Law Review 517. ——, ‘European Criminal Law after Brexit’ (2017) 28(2) Criminal Law Forum 219. ——, ‘The External Dimension of Mutual Trust: The Coming of Age of Transatlantic Counter-terrorism Cooperation’ in C Brière and A Weyembergh (eds), The Needed Balances in EU Criminal Law: Past, Present and Future (Oxford, Hart Publishing, 2018). ——, ‘Judicial Dialogue in Three Silences’ (2018) 9 New Journal of European Criminal Law 38. ——, ‘The Privatisation of Mutual Trust in Europe’s Area of Criminal Justice: The Case of e-Evidence’ (2018) 25(3) Maastricht Journal of European and Comparative Law 263. ——, ‘The Impact of Legislative Harmonisation on Effective Judicial Protection in Europe’s Area of Criminal Justice’ (2019) Review of European Administrative Law 117. ——, ‘The Normative Foundations of the Criminalisation of Human Smuggling. Exploring the Fault Lines between European and International Law’ (2019) 10 New Journal of European Criminal Law 68. ——, ‘Re-setting the Parameters of Mutual Trust: From Aranyosi to LM’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). ——, ‘Autonomous Concepts, Diversity Management and Mutual Trust in Europe’s Area of Criminal Justice’ (2020) 57 CML Rev 45. ——, ‘Conceptualising Impunity in the Law of the European Union’ in S Montaldo and L Marin (eds), The Fight against Impunity in EU Law (Oxford, Hart Publishing, 2020). ——, ‘Counter-terrorism and the Rule of Law in an Evolving European Union: Plus Ça Change?’ (2021) 12 New Journal of European Criminal Law 36. ——, ‘The Criminalisation of Migration in the Law of the European Union: Challenging the Preventive Paradigm’ in GL Gatta, V Mitsilegas and S Zirulia (eds), Controlling Immigration through Criminal Law: European and Comparative Perspectives on ‘Crimmigration’ (Oxford, Hart Publishing, 2021). ——, ‘European Prosecution between Cooperation and Integration: The European Public Prosecutor’s Office and the Rule of Law’ (2021) 28 Maastricht Journal of European and Comparative Law 245. ——, ‘Judicial Dialogue, Legal Pluralism and Mutual Trust in Europe’s Area of Criminal Justice’ (2021) 46 European Law Review 579. ——, ‘Mutual Recognition and Criminal Law’ in S Iglesias Sànchez and MG Dominguez (eds), Fundamental Rights in the EU Area of Freedom, Security and Justice (Cambridge, Cambridge University Press, 2021). ——, ‘The Privatisation of Surveillance in the Digital Age’ in V Mitsilegas and N Vavoula (eds), Surveillance and Privacy in the Digital Age: European, Transatlantic and Global Perspectives (Oxford, Hart Publishing, 2021). Mitsilegas V and Carrera S (eds), Constitutionalising the Security Union: Effectiveness, Rule of Law and Rights in Countering Terrorism and Crime (Brussels, Centre for European Policy Studies Publisher, 2017). Mitsilegas V, Carrera S and Eisele K, The End of the Transitional Period for Police and Criminal Justice Measures Adopted before the Lisbon Treaty. Who Monitors Trust in the European Justice Area? (Brussels, CEPS Paper in Liberty and Security in Europe No 74). Mitsilegas V, Fasoli E, Giuffrida F and Fitzmaurice M, The Legal Regulation of Environmental Crime (Leiden, Brill NiJhoff, forthcoming, 2022). Mitsilegas V and Gilmore WC, ‘The EU Legislative Framework against Money Laundering and Terrorist Finance: A Critical Analysis in the Light of Evolving Global Standards’ (2007) 56 International and Comparative Law Quarterly 119.

744 Bibliography Mitsilegas V and Giuffrida F, ‘Ne Bis in Idem’ in A Lucifora, V Mitsilegas, R Parizot and R Sicurella (eds), General Principles for a Common Criminal Law Framework in the EU. A Guide for Legal Practitioners (Milan, Giuffrè, 2017). ——, ‘The Role of EU Agencies in Fighting Transnational Environmental Crime: New Challenges for Eurojust and Europol’ (2017) 1(1) Brill Research Perspectives in Transnational Crime 1. ——, ‘The European Public Prosecutor’s Office and Human Rights’ in W Geelhoed, AWH Meij and LH Erkelens (eds), Shifting Perspectives on the European Public Prosecutor’s Office (The Hague, TMC Asser Press/Springer, 2018). Mitsilegas V, Monar J and Rees W, The European Union and Internal Security (Basingstoke, Palgrave Macmillan, 2003). Mitsilegas V and Vavoula N, ‘Criminal Law: Institutional Rebalancing and Judicialisation as Drivers of Policy Change’ in F Trauner and A Ripoll Servent (eds), Policy Change in the Area of Freedom, Security and Justice: How EU Institutions Matter (Abingdon, Routledge, 2015). ——, ‘The Evolving EU Anti-money Laundering Regime: Challenges for Fundamental Rights and the Rule of Law’ (2016) 23(2) Maastricht Journal of European & Comparative Law 261. ——, ‘Strengthening Europol’s Mandate. A Legal Assessment of the Commission’s Proposal to Amend the Europol Regulation’ (Study for the LIBE Committee of the European Parliament, PE 694.200, 2021). Monar J, ‘Justice and Home Affairs in the Treaty of Amsterdam: Reform at the Price of Fragmentation’ (1998) 23 European Law Review, 320. ——, ‘Enlargement-Related Diversity in EU Justice and Home Affairs: Challenges, Dimensions and Management Instruments’ (2000) Dutch Scientific Council for Government Policy, Working Document No W112. ——, ‘Decision-Making in the Area of Freedom, Security and Justice’ in A Arnull and D Wincott (eds), Accountability and Legitimacy in the European Union (Oxford, Oxford University Press, 2002). ——, ‘Common Threat and Common Response? The European Union’s Counter-terrorism Strategy and its Problems’ (2007) 42(3) Government and Opposition 292. ——, ‘Editorial Comment: The Rejection of the EU–US SWIFT Interim Agreement by the European Parliament: A Historic Vote and its Implications’ (2010) 15 European Foreign Affairs Review 143. ——, ‘The Institutional Framework of the AFSJ: Specific Challenges and Dynamics for Change’ in J Monar (ed), The Institutional Dimension of the European Union’s Area of Freedom, Security and Justice (Brussels, Peter Lang, 2010). ——, ‘Eurojust’s Present and Future Role at the Frontline of European Union Criminal Justice Cooperation’ (2013) 14(2) ERA Forum 187. Monar J and Morgan R (eds), The Third Pillar of the European Union: Cooperation in the Fields of Justice and Home Affairs (Brussels, European Interuniversity Press, 1994). Monaco FR, ‘Europol: The Culmination of the European Union’s International Police Cooperation Efforts’ (1995) 19 Fordham International Law Journal 247. Monjean-Decaudin S, ‘L’Union Européenne Consacre le Droit à l’Assistance Linguistique dans les Procédures Pénales : Commentaire de la Directive Relative aux Droits à l’interprétation et à la traduction dans les procedures pénales’ (2011) 47 Revue Trimestrielle du Droit Européen 763. Montaldo S, ‘Offenders’ Rehabilitation and the Cross-border Transfer of Prisoners and Persons Subject to Probation Measures and Alternative Sanctions: A Stress Test for EU Judicial Cooperation in Criminal Matters’ (2019) 5 Revista Brasilera de Direito Processual Penal 925. Moor AD and Vermeulen G, ‘The Europol Council Decision: Transforming Europol into an Agency of the European Union’ (2010) 47(4) CML Rev 1089. Morán Martínez RA, European Public Prosecutor: Working Group Conclusions (Madrid, Fiscalía General del Estado, 2009). Morgan C, ‘Proposal for a Framework Decision on Procedural Safeguards for Suspects and Defendants in Criminal Proceedings throughout the European Union’ (2003) 4 ERA Forum 91. Mouzakiti F, ‘Cooperation between Financial Intelligence Units in the EU: Challenges for the Rights to Privacy and Data Protection’ in K Benson, C King and C Walker (eds), Assets, Crimes and the State: Innovation in 21st Century Legal Responses (Abingdon, Routledge, 2020). ——, ‘Cooperation between Financial Intelligence Units in the European Union: Stuck in the Middle between the General Data Protection Regulation and the Police Data Protection Directive’ (2020) 11(3) New Journal of European Criminal Law 351.

Bibliography 745 Müller-Graff PC, ‘The Legal Bases of the Third Pillar and its Position in the Framework of the Union Treaty’ (1994) 31 CML Rev 493. Müller-Witte B, For Our Eyes Only? Shaping an Intelligence Community within the EU (European Union Institute for Security Studies Paper, 2004). ——, ‘The Effect of International Terrorism on EU Intelligence Co-operation’ (2008) 46(1) Journal of Common Market Studies 49. Murkens J, ‘Countering Anti-constitutional Argument: The Reasons for the European Court of Justice’s Decision in Kadi and Al Barakaat’ (2008–09) 11 Cambridge Yearbook of European Legal Studies 15. Murphy C, ‘Fundamental Rights and Security: The Difficult Position of the European Judiciary’ (2010) 16 European Public Law 289. ——, ‘Romanian Constitutional Court, Decision No 1258 of 8 October 2009 Regarding the Unconstitutionality Exception of the Provisions of Law No 298/2008 Regarding the Retention of the Data Generated or Processed by the Public Electronic Communications Service Providers, as Well as for the Modification of Law No 506/2004 Regarding the Personal Data Processing and Protection of Private Life in the Field of Electronic Communication Area’ (2010) 47 CML Rev 933. Nazzini R, ‘Parallel Proceedings in EU Competition Law: Ne Bis in Idem as a Limiting Principle’ in B van Bockel (ed), Ne Bis in Idem in EU Law (Cambridge, Cambridge University Press, 2016). Neframi E, ‘L’aspect externe de l’espace de liberté, de sécurité et de justice : quel respect des principes et objectifs de l’action extérieure de l’Union?’ in C Flaesch-Mougin and LS Rossi (eds), La Dimension Extérieure de l’Espace de Liberté, de Sécurité et de Justice de l’Union Européenne après le Traité de Lisbonne (Brussels, Bruylant, 2013). Nicolaidis K, ‘Trusting the Poles? Constructing Europe through Mutual Recognition’ (2007) 14(5) Journal of European Public Policy 682. Nicolaidis K and Shaffer G, ‘Transnational Mutual Recognition Regimes: Governance without Global Government’ (2005) 68 Law and Contemporary Problems 263. Niemeier N, La Sécurité Intérieure dans l’Union Européenne : Après la Présidence Allemande et Avant la Présidence Francaise (2008) Université Robert Schuman, Collection Securint, Working Paper No 6. Nieto Martín A, ‘The Foundations of Mutual Recognition and the Meaning of Dual Criminality’ (2018) 8 European Criminal Law Review 160. ——, ‘Principio di Legalità e European Public Prosecutor’s Office (EPPO)’ in G Grasso et al (eds), Le Sfide dell’Attuazione di una Procura Europea: Definizione di Regole Comuni e Loro Impatto sugli Ordinamenti Interni (Milan, Giuffrè, 2013). Nilsson H, ‘Eurojust: The Beginning or the End of the European Public Prosecutor?’ (paper presented to the third Eurojustice conference in Santander, Spain, 24–27 October 2000, typescript with author). ——, ‘Decision-Making in EU Justice and Home Affairs: Current Shortcomings and Reform Possibilities’ (2002) Sussex European University Institute Working Paper No 57. ——, ‘Mutual Trust or Mutual Mistrust?’ in G de Kerchove and A Weyembergh (eds), Sécurité et justice : Enjeu de la politique extérieure de l’Union Européenne (Brussels, Éditions de l’Université de Bruxelles, 2003). ——, ‘How to Combine Minimum Rules with Maximum Legal Certainty?’ (2011) Europaraettslig Tidskrift 665. Novokmet A, ‘The EPPO and Judicial Review of a Decision Not to Prosecute: A Slippery Area or a Final Arrangement?’ in Z Đurđević and M Bonačić (eds), Integration of the EPPO in the National Criminal Justice Systems: Institutional, Procedural and Cooperative Challenges (Zagreb, Croatian Annual of Criminal Sciences and Practice, 2020). Nowak C, ‘Impact of the Case C-486/14 – Kossowski at National Level’, V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Nowag J, ‘EU Law, Constitutional Identity, and Human Dignity: A Toxic Mix? Bundesverfassungsgericht: Mr R’ (2016) 53 CML Rev 1447. Nowell-Smith H, ‘Behind the Scenes in the Negotiation of EU Criminal Justice Legislation’ (2012) 3 New Journal of European Criminal Law 38. O’Keeffe D, ‘Recasting the Third Pillar’ (1995) 32 CML Rev 893. Öberg J, ‘Union Regulatory Criminal Law Competence after the Lisbon Treaty’ (2011) 19 European Journal of Crime, Criminal Law and Criminal Justice 289.

746 Bibliography ——, ‘Exit, Voice and Consensus: A Legal and Political Analysis of the Emergency Brake in EU Criminal Policy’ (2021) 46(4) European Law Review 506. Occhipinti JD, The Politics of EU Police Cooperation: Toward a European FBI? (Boulder, Lynne Rienner, 2003). Oehmichen A and Keith B, ‘Mutual Legal Assistance under the EU–UK Trade and Cooperation Agreement’ (2021) 12 New Journal of European Criminal Law 222. Ostropolski T, ‘The Principle of Proportionality under the European Arrest Warrant – with an Excursus on Poland’ (2014) 5 New Journal of European Criminal Law 167. Panzavolta M, ‘Choice of Forum and the Lawful Judge Concept’ in M Luchtman (ed), Choice of Forum in Cooperation against EU Financial Crime: Freedom, Security and Justice and the Protection of Specific EU Interests (The Hague, Eleven International Publishing, 2013). Parizot R, ‘Les Interactions en Procédure Pénale : La Victime, Vecteur Symbolique de la Circulation du Jurisprudence’ in G Giudicelli-Delage and S Manacorda (eds), L’intégration pénale indirecte (Paris, Société de législation comparée, 2005). Parkin J, ‘The Difficult Road to the Schengen Information System II: The Legacy of Laboratories and the Cost for Fundamental Rights and the Rule of Law’ (2011) CEPS Paper in Liberty and Security in Europe. Patrone I, ‘Conflicts of Jurisdiction and Judicial Cooperation Instruments: Eurojust’s Role’ (2013) 14(2) ERA Forum 215. Paulesu PP, ‘Ne Bis in Idem and Conflicts of Jurisdiction’ in R Kostoris (ed), Handbook of European Criminal Procedure (Cham, Springer, 2018). Pech L and Scheppele KL, ‘Illiberalism Within: Rule of Law Backsliding in the EU’ (2017) 19 Cambridge Yearbook of European Legal Studies 3. Peers S, ‘Caveat Emptor? Integrating the Schengen Acquis into the European Union Legal Order’ (1999) 2 Cambridge Yearbook of European Legal Studies 87. ——, ‘Mutual Recognition and Criminal Law in the European Union: Has the Council Got it Wrong?’ (2004) 41(1) CML Rev 5. ——, ‘Governance and the Third Pillar: The Accountability of Europol’ in D Curtin and RA Wessel (eds), Good Governance and the European Union: Reflections on Concepts, Institutions and Substance (Cambridge, Intersentia, 2005). ——, EU Justice and Home Affairs Law, 2nd edn (Oxford University Press 2006). ——, ‘Salvation Outside the Church: Judicial Protection in the Third Pillar after the Pupino and Segi Judgments’ (2007) 44 CML Rev 883. ——, ‘The European Community’s Criminal Law Competence: The Plot Thickens’ (2008) 33(3) European Law Review 399. ——, ‘Key Legislative Developments on Migration in the European Union: SIS II’ (2008) 10 European Journal of Migration and Law 77. ——, ‘Proposed New Border Control Systems’ (Study for the European Parliament, PE408.296, 2008). ——, EU Justice and Home Affairs Law, 3rd edn (Oxford, Oxford University Press, 2011). ——, EU Justice and Home Affairs Law. Vol 2: EU Criminal Law, Policing, and Civil Law, 4th edn (Oxford, Oxford University Press, 2016). Peers S, Hervey T, Kenner J and Ward A (eds), The EU Charter of Fundamental Rights: A Commentary (Oxford, Hart Publishing, 2014). Peers S, Moreno-Lax V, Garlick M, Guild E (eds), EU Immigration and Asylum Law (Text and Comentary), 2nd edn (Leiden, Brill, 2015). Pereira R, Environmental Criminal Liability and Enforcement in European and International Law (Leiden, Brill, 2015). Persak N, ‘EU Criminalisation, its Normative Justifications, and Criminological Considerations for EU Criminal Policy and Justice’ in J Ouwerkerk et al (eds), The Future of EU Criminal Justice Policy and Practice: Legal and Criminological Perspectives (Leiden, Brill, 2019). Petit Leclair S, ‘Justice et Sécurité en Europe : Eurojust ou la Création d’un Parquet Européen’ (2012) 20 Cahiers de la sécurité 38. Piacente N, ‘The Contribution of the Council of Europe to the Fight against Foreign Terrorist Fighters’ (2015) 12 Eucrim 12. Piris JC, The Lisbon Treaty: A Legal and Political Analysis (Cambridge, Cambridge University Press, 2010). Plachta M, ‘Joint Investigation Teams. A New Form of International Cooperation in Criminal Matters’ (2005) 13(2) European Journal of Crime, Criminal Law, and Criminal Justice 284.

Bibliography 747 Prainsack B and Toom V, ‘The Prüm Regime: Situated Disempowerment in Transnational DNA Profile Exchange’ (2010) 50(6) British Journal of Criminology 1117. ——, ‘Performing the Union: The Prüm Decision and the European Dream’ (2013) 44 Studies in History and Philosophy of Biological and Biomedical Sciences 71. Prechal S, ‘Joined Cases C-397/01 to C-403/01, Bernhard Pfeiffer et al., Judgment of the Court (Grand Chamber) of 5 October 2004’ (2005) 42 CML Rev 1445. ——, ‘Direct Effect, Indirect Effect, Supremacy and the Evolving Constitution of the European Union’ in C Barnard (ed), The Fundamentals of EU Law Revisited: Assessing the Impact of the Constitutional Debate (Oxford, Oxford University Press, 2007). Pujas V, ‘The European Anti-Fraud Office (OLAF): A European Policy to Fight against Economic and Financial Fraud?’ (2003) 10(5) Journal of European Public Policy 778. Puntscher Riekmann S, ‘Security, Freedom and Accountability: Europol and Frontex’ in E Guild and F Geyer (eds), Security versus Justice? Police and Judicial Cooperation in the European Union (Aldershot, Ashgate, 2008). Quintel T, ‘Connecting Personal Data of Third Country Nationals: Interoperability of EU Databases in the Light of the CJEU’s Case Law on Data Retention’ (2018) University of Luxembourg Working Paper No 2/2018. ——, ‘Interoperability of EU Databases and Access to Personal Data by National Police Authorities under Article 20 of the Commission Proposals’ (2018) 4 European Data Protection Law Review 470. ——, ‘Interoperable Data Exchanges within Different Data Protection Regimes: The Case of Europol and the European Border and Coast Guard Agency’ (2020) 26 European Public Law 205. Raffaelli R, ‘C-394/11 Radu. Judgment of the Court of Justice of the European Union, 29 January 2013’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Rauhofer J and Mac Sithigh D, ‘The Data Retention Directive Never Existed’ (2014) 11(1) Scripted 119. Rijken C, ‘Joint Investigation Teams: Principles, Practice, and Problems. Lessons Learnt from the First Efforts to Establish a JIT’ (2006) 2(2) Utrecht Law Review 99. Rijken C and Kronenberger V, ‘The United Nations Convention against Transnational Organised Crime and the European Union’ in V Kronenberger (ed), The European Union and the International Legal Order: Discord or Harmony? (The Hague, TMC Asser Press, 2001). Rijken C and Vermeulen G (eds), Joint Investigation Teams in the European Union: From Theory to Practice (The Hague, TMC Asser Press, 2006). Rijpma JJ, ‘Frontex and the European System of Border Guards: The Future of the European System of Border Guards’ in M Fletcher, E Herlin-Karnell and C Matera (eds), The European Union as an Area of Freedom Security and Justice (Abingdon, Routledge, 2016). Ripoll Servent A and MacKenzie A, ‘The European Parliament as a “Norm Taker”? EU–US Relations after the SWIFT Agreement’ (2012) 17 European Foreign Affairs Review 83. Röß S, ‘The Conflict between European Law and National Constitutional Law Using the Example of the European Arrest Warrant’ (2019) 25(1) European Public Law 25. Roberts A, ‘Privacy, Data Retention and Domination: Digital Rights Ireland v Minister for Communications’ (2015) 78(3) Modern Law Review 535. Rodotá S, ‘Data Protection as a Fundamental Right’ in S Gutwirth et al (eds), Reinventing Data Protection? (Dodrecht and London, Springer, 2009). Rosanò A, ‘Ne Bis Interpretatio in Idem: The Two Faces of the Ne Bis in Idem Principle in the Case Law of the European Court of Justice’ (2017) 18 (1) German Law Journal 39. Roth R, ‘Non Bis in Idem Transnational : Vers de Nouveaux Paradigmes?’ in S Braum and A Weyembergh (eds), Le Contrôle Juridictionnel dans l’Espace Pénal Européen (Brussels, Editions de l’Université de Bruxelles, 2009). Rouvroy A and Poullet T, ‘The Right to Informational Self-Determination and the Value of Self-Development: Reassessing the Importance of Privacy for Democracy’ in S Gutwirth et al (eds), Reinventing Data Protection (Dordrecht, Springer, 2009). Ruggeri S, ‘Criminal Investigations, Interference with Fundamental Rights and Fair Trial Safeguards in the Proceedings of the European Public Prosecutor’s Office: A Human Rights Law Perspective’ in L Bachmaier Winter (ed), The European Public Prosecutor’s Office: The Challenges Ahead (Cham, Springer, 2018).

748 Bibliography Salazar L, ‘La Protection des Intérêts Financiers de l’UE : Un Grand Avenir derrière Elle …’ (2008) 3–4 Eucrim 115. Saluzzo S, ‘Impunity and EU or Member States’ Extradition Agreements with Third Countries’ in S Montaldo and L Marin (eds), The Fight against Impunity in EU Law (Oxford, Hart Publishing, 2020). Sarmiento D, ‘Un paso más en la constitucionalización del tercer pilar de la Union europea. La sentencia Maria Pupino y el efecto directo de las decisiones marco’ (2005) 10 Revista Electronica de Estudios Internacionales. ——, ‘European Union: The European Arrest Warrant and the Quest for Constitutional Coherence’ (2008) 6 International Journal of Constitutional Law 171. ——, ‘Who’s Afraid of the Charter? The Court of Justice, National Courts and the New Framework of Fundamental Rights Protection in Europe’ (2013) 50 CML Rev 1267. ——, ‘Ne Bis in Idem in the Case Law of the European Court of Justice’ in B van Bockel (ed), Ne Bis in Idem in EU Law (Cambridge, Cambridge University Press, 2016). Satzger H, ‘The European Public Prosecutor and the National Prosecution: Potential Conflicts and How They Could Be Avoided’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stockholm, Stiftelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015). Sayers D, ‘Protecting Fair Trial Rights in Criminal Cases in the European Union: Where Does the Roadmap Take Us?’ (2014) 14 Human Rights Law Review 733. Schalken T and Pronk M, ‘On Joint Investigation Teams, Europol and Supervision of Their Joint Actions’ (2002) 10 European Journal of Crime, Criminal Law and Criminal Justice 70. Scharf-Kröner C and Seyderhelm J, ‘OLAF Investigations outside the European Union. Practical and Legal Aspects’ (2019) 3 Eucrim 209. Schattenberg B, ‘SIS: Privacy and Legal Protection’ in HG Schermers et al (eds), Free Movement of Persons in Europe: Legal Problems and Experience (Dordrecht, Martinus Nijhoff Publishers, 1993). Scheinin M, ‘Is the ECJ Ruling in Kadi Incompatible with International Law?’ (2009) 28 Yearbook of European Law 637. Scheinin M and Vermeulen M, ‘Unilateral Exceptions to Fundamental Rights in the Use of Detection Technologies in the Fight against Terrorism: Permissible Limitations of the Right to Privacy’ (2011) EUI Working Papers Law 2010/08 delivered under the Detecter project. Scherrer A, Jeandesboz J and Guittet EP, ‘Developing an EU Internal Security Strategy, Fighting Terrorism and Organised Crime’ (Study for the LIBE Committee of the European Parliament, PE 462.423, 2011). Schimmelfennig F and Sedelmeier U, ‘Governance by Conditionality: EU Rule Transfer to the Candidate Countries of Central and Eastern Europe’ (2004) 11 Journal of European Public Policy 661. Schinina M, ‘What Balance between Eurojust and Europol from a Parliamentary Angle?’ (2020) 11(2) New Journal of European Criminal Law 123. Schneider A, ‘In Absentia Trials and Transborder Criminal Procedures: The Perspective of EU Law’ in S Quattrocolo and S Ruggeri (eds), Personal Participation in Criminal Proceedings (Cham, Springer, 2019). Scholten M and Simonato M, ‘EU Report’ in M Luchtman and J Vervaele (eds), ‘Investigatory Powers and Procedural Safeguards: Improving OLAF’s Legislative Framwork through a Comparison with Other EU Law Enforcement Authorities (ECN/ESMA/ECB)’ (Utrecht, Utrecht University Repository, 2017). Schünemann B (ed), A Programme for European Criminal Justice (Cologne, Carl Heymanns Verlag, 2006). Schütze R, From Dual to Cooperative Federalism: The Changing Structure of European Law (Oxford, Oxford University Press, 2009). Sellier E and Weyembergh A, ‘Criminal Procedural Laws across the European Union: A Comparative Analysis of Selected Main Differences and the Impact They Have over the Development of EU Legislation’ (Study for the European Parliament, PE 604.977, 2018). Serneels C, ‘“Unionisation” of the European Court of Human Rights’ Ne Bis in Idem Jurisprudence: The Case of Mihalache v Romania’ (2020) 11(2) New Journal of European Criminal Law 227. Sevenster HG, ‘Criminal Law and EC Law’ (1992) 29 CML Rev 29. Shapiro M, ‘The Problems of Independent Agencies in the United States and the European Union’ (1997) 4(2) Journal of European Public Policy 276. Shuibhne NN, ‘Limits Rising, Duties Ascending: The Changing Legal Shape of Union Citizenship’ (2015) 52 CML Rev 889.

Bibliography 749 ——, ‘“The Territory of the Union” in EU Citizenship Law: Charting a Route from Parallel to Integrated Narratives’ (2019) 38 Yearbook of European Law 267. Schutte JE, ‘Establishing Enhanced Cooperation under Article 86 TFEU’ in W Geelhoed, AWH Meij and LH Erkelens (eds), Shifting Perspectives on the European Public Prosecutor’s Office (The Hague, TMC Asser Press/Springer, 2018). Sheptycki J, Ben Jaffel H and Bigo D, ‘International Organised Crime in the European Union’ (Study for the LIBE Committee of the European Parliament, PE 462.420, 2011). Sicurella R, ‘Some Reflections on the Need for a General Theory of the Competence of the European Union in Criminal Law’ in A Klip (ed), Substantive Criminal Law of the European Union (Antwerp, Maklu, 2011). ——, ‘Setting up a European Criminal Policy for the Protection of EU Financial Interests: Guidelines for a Coherent Definition of the Material Scope of the European Public Prosecutor’s Office’ in K Ligeti (ed), Towards a Prosecutor for the European Union, vol I (Oxford, Hart Publishing, 2012) ——, ‘A Blunt Weapon for the EPPO? Taking the Edge Off the Proposed PIF Directive’ in W Geelhoed, LH Erkelens and AWH Meij (eds), Shifting Perspectives on the European Public Prosecutor’s Office (The Hague, TMC Asser Press/Springer, 2018). ——, ‘Effectiveness of EU Law and Protection of Fundamental Rights: The Questions Settled and the New Challenges after the ECJ Decision in MAS and MB Case (C-42/17)’ (2018) 9 New Journal of European Criminal Law 24. Sieber U, ‘Union européenne et droit pénal européen’ (1993) Revue de science criminelle et du droit pénal comparé 249. Simonato M, ‘OLAF Investigations in a Multi-level System: Legal Obstacles to Effective Enforcement’ (2016) 3 Eucrim 137. ——, ‘What Role for Crime Victims in the Forum Choice?’ in European Law Institute, K Ligeti and G Robinson (eds), Preventing and Resolving Conflicts of Jurisdiction in EU Criminal Law (Oxford, Oxford University Press, 2018). Slaughter AM, A New World Order (Princeton, Princeton University Press, 2004). Smith KE, ‘The Evolution and Application of EU Membership Conditionality’ in M Cremona (ed), The Enlargement of the European Union (Oxford, Oxford University Press, 2003). Smulders B, ‘Is the Commission Proposal for a European Public Prosecutor’s Office Based on a Harmonious Interpretation of Articles 85 and 86 TFEU?’ in LH Erkelens, AWH Meij and TM Pawlik (eds), The European Public Prosecutor’s Office: An Extended Arm or a Two-Headed Dragon? (The Hague, TMC Asser Press/ Springer, 2015). Somek A, ‘Administration without Sovereignty’ (2009) University of Iowa Legal Studies Research Paper No 09-04. ——, ‘The Concept of “Law” in Global Administrative Law: A Reply to Benedict Kingsbury’ (2009) 20 European Journal of International Law 985. Snell J, ‘Is Opinion 2/13 Obsolescent?’ (2017) 4 European Law Review 449. Spano R, ‘The Rule of Law as the Loadstar of the European Convention on Human Rights: The Strasbourg Court and the Independence of the Judiciary’ (2021) 119 European Law Journal 8. Spapens T, ‘Joint Investigation Teams in the European Union: Article 13 JITS and the Alternatives’ (2011) 19(3) European Journal of Crime, Criminal Law, and Criminal Justice 239. Spena A, ‘Human Smuggling and Irregular Immigration in the EU: From Complicity to Exploitation?’ in S Carrera and E Guild (eds), Irregular Migration, Trafficking and Smuggling of Human Beings (Brussels, CEPS, 2016). Spencer JR, ‘The Corpus Juris Project and the Fight against Budgetary Fraud (1998) 1 Cambridge Yearbook of European Legal Studies 77. ——, ‘The Corpus Juris Project: Has it a Future?’ (1999) 2 Cambridge Yearbook of European Legal Studies 87. ——, ‘Mutual Recognition and Choice of Forum’ in M Luchtman (ed), Choice of Forum in Cooperation against EU Financial Crime: Freedom, Security and Justice and the Protection of Specific EU Interests (The Hague, Eleven International Publishing, 2013). ——, ‘The UK and EU Criminal Law: Should We Be Leading, Following or Abstaining?’ in V Mitsilegas, P Alldridge and L Cheliotis (eds), Globalisation, Criminal Law and Criminal Justice: Theoretical, Comparative and Transnational Perspectives (Oxford, Hart Publishing, 2015).

750 Bibliography Stefanou C, ‘Organised Crime and the Use of EU-Wide Databases’ in I Bantekas and G Keramidas (eds), International and European Financial Law (London, Butterworths, 2006). Stefanou C and Xanthaki H (eds), Towards a European Criminal Record (Cambridge, Cambridge University Press, 2008). Steinbach A, ‘The Lisbon Judgment of the German Federal Constitutional Court – New Guidance on the Limits of European Integration?’ (2010) 11 German Law Journal 367. Stewart DP, ‘Internationalizing the War on Drugs: The UN Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances’ (1990) 18 Denver Journal of International Law and Policy 387. Sullivan G and de Goede M, ‘Between Law and the Exception: The UN 1267 Ombudsperson as a Hybrid Model of Legal Expertise’ (2013) 26 Leiden Journal of International Law 833. Suominen A, ‘The Past, Present and the Future of Eurojust’ (2008) 15(2) Maastricht Journal of European and Comparative Law 217. Symeonidou-Kastanidou E and Naziris Y, ‘The Impact of Case C-187/01 [Gözütok/Brügge] at the National Level: Inadvertent Legacy’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Szasz PC, ‘The Security Council Starts Legislating’ (2002) 96 American Journal of International Law 901. Tadic FM, ‘How Harmonious Can Harmonisation Be? A Theoretical Approach towards Harmonisation of (Criminal) Law’ in A Klip and H van der Wilt, Harmonisation and Harmonising Measures in Criminal Law (Amsterdam, Royal Netherlands Academy of Arts and Sciences, 2002). Talmon S, ‘The Security Council as World Legislature’ (2005) 99 American Journal of International Law 175. Taverne M and Broeders T, The Light’s at the End of the Funnel! Evaluating the Effectiveness of the Transnational Exchange of DNA Profiles between the Netherlands and Other Prüm Countries (Paris, Legal Publishers, 2015). Thony JF, ‘Processing Financial Information in Money Laundering Matters: The Financial Intelligence Units’ (1996) 3 European Journal of Crime, Criminal Law and Criminal Justice 257. Thwaites N, ‘Eurojust: Autre Brique dans l’Édifice de la Coopération Judiciaire en Matière Pénale ou Solide Mortier?’ (2003) 1 Revue de science criminelle et de droit pénal compare 45. Thym D, ‘The Schengen Law: A Challenge for Legal Accountability in the European Union’ (2002) 8 European Law Journal 218. Tobler C, ‘Case C-176/03, Commission v Council, ECR [2005] I-7879’ (2006) 43 CML Rev 835. Toggenburg GN, ‘The Role of the New EU Fundamental Rights Agency: Debating the “Sex of Angels” or Improving Europe’s Human Rights Performance?’ (2008) 33(3) European Law Review 385. Tomkin J, ‘Article 50’ in S Peers, T Hervey, J Kenner and A Ward (eds), The EU Charter of Fundamental Rights: A Commentary (Oxford, Hart Publishing, 2014). Tomkins A, ‘Responsibility and Resignation in the European Commission’ (1999) 62(5) Modern Law Review 744. Tonry M, ‘“Rebalancing the Criminal Justice System in Favour of the Victim”: The Costly Consequences of Populist Rhetoric’ in A Bottoms and JV Roberts (eds), Hearing the Victim: Adversarial Justice, Crime Victims and the State (Cullompton, Willan, 2010). Toom V, ‘Cross-border Exchange and Comparison of Forensic DNA Data in the Context of the Prüm Decision’ (Study for the LIBE Committee, PE 604.971, 2018). Torres Pérez A, ‘Melloni in Three Acts: From Dialogue to Monologue’ (2014) 10 European Constitutional Law Review 308. Tovo C, Le Agenzie Decentrate dell’Unione Europea (Naples, Editoriale Scientifica, 2016). Tozsa S, ‘The European Commission’s Proposal on Cross-border Access to E-Evidence’ (2018) 4 Eucrim 212. Tracol X, ‘Legislative Genesis and Judicial Death of a Directive; The European Court of Justice Invalidated the Data Retention Directive (2006/24/EC) Thereby Creating a Sustained Period of Legal Uncertainty about the Validity of National Laws Which Enacted it’ (2014) 30(6) Computer Law and Security Review 736. ——, ‘The Judgment of the Grand Chamber Dated 21 December 2016 in the Two Joint Tele2 Sverige and Watson Cases: The Need for a Harmonised Legal Framework on the Retention of Data at EU Level’ (2017) 33(4) Computer Law & Security Review 541.

Bibliography 751 ——, ‘The Two Judgments of the European Court of Justice in the Four Cases of Privacy International, La Quadrature du Net and Others, French Data Network and Others and Ordre des Barreaux francophones et germanophone and Others: The Grand Chamber is Trying Hard to Square the Circle of Data Retention’ (2021) Computer Law & Security Review 1. Tridimas T, The General Principles of EU Law, 2nd edn (Oxford, Oxford University Press, 2006). ——, ‘Terrorism and the ECJ: Empowerment and Democracy in the EC Legal Order’ (2009) 34 European Law Review 103. Twomey P, ‘Constructing a Secure Space: The Area of Freedom, Security and Justice’ in D O’Keeffe and PM Twomey (eds), Legal Issues of the Amsterdam Treaty (Oxford, Hart Publishing, 1999). Tzanou M, ‘The Added Value of Data Protection as a Fundamental Right in the EU Legal Order in the Context of Law Enforcement’ (Florence, European University Institute, EUI PhD thesis series, 2013). Vagliasindi GM, ‘The EU Environmental Crime Directive’ in A Farmer, M Faure and GM Vagliasindi (eds), Environmental Crime in Europe (Oxford, Hart Publishing, 2017). Vainio N and Miettinen S, ‘Telecommunications Data Retention after Digital Rights Ireland: Legislative and Judicial Reactions in the Member States’ (2015) 23 International Journal of Law and Information Technology 290. Van Bockel B, ‘The “European” Ne Bis in Idem Principle: Substance, Source, and Scope’ in B van Bockel (ed) The Ne Bis in Idem Principle in EU Law (Alphen aan den Rijn, Kluwer Law International, 2010). ——, The Ne Bis in Idem Principle in EU Law (Alphen aan den Rijn, Kluwer Law International, 2010). Van den Wyngaert C, ‘Eurojust and the European Public Prosecutor in the Corpus Juris Model: Water and Fire?’ in N Walker (ed), Europe’s Area of Freedom, Security and Justice (Oxford, Oxford University Press, 2004). Van den Wyngaert C and Stessens G, ‘The International Ne Bis in Idem Principle: Resolving Some of the Unanswered Questions’, 1999 (48) 4 International and Comparative Law Quarterly 779. Van der Aa and Ouwerkerk J, ‘The European Protection Order: No Time to Waste or a Waste of Time?’ (2011) 19 European Journal of Crime, Criminal Law and Criminal Justice 267. Van der Schyff G, ‘Member States of the European Union, Constitutions, and Identity: A Comparative Perspective’ in C Callies and G van der Schyff (eds), Constitutional Identity in a Europe of Multilevel Constitutionalism (Cambridge, Cambridge University Press, 2020). Van der Wilt H, ‘Court of Justice of the European Communities: Judgment of 3 May 2005 (Silvio Berlusconi and Others), Joint Cases C-387/02, C-391/02 and C-403/02’ (2006) 2 European Constitutional Law Review 303. Van Duyne PC and Vander Beken T, ‘The Incantations of EU Organised Crime Policy’ (2009) 51(2) Crime, Law and Social Change 261. Van Elsuwege P, ‘The Adoption of “Targeted Sanctions” and the Potential for Inter-institutional Litigation after Lisbon’ (2011) 7 Journal of Contemporary European Research, 488. Vavoula N, ‘The Recast Eurodac Regulation: Are Asylum Seekers Treated as Suspected Criminals?’ in C Bauloz et al (eds), Seeking Asylum in the European Union: Selected Protection Issues Raised by the Second Phase of the Common European Asylum System (Leiden, Brill Nijhoff, 2015). ——, ‘Exchanging Information on Road Traffic Offences: A Measure of Police Cooperation or Transport Policy? Case Note on C-43/12 Commission v Parliament and Council’ (2016) 7 New Journal of European Criminal Law 113. ——, ‘Prevention, Surveillance, and the Transformation of Citizenship in the “Security Union”: The Case of Foreign Terrorist Fighters”’ in U Sieber et al (eds), Alternative Systems of Crime Control: National, Transnational, and International Dimensions (Berlin, Duncker & Humblot, 2018). ——, ‘Consultation of EU Immigration Databases for Law Enforcement Purposes: A Privacy and Data Protection Assessment’ (2020) 22 European Journal of Migration and Law 139. ——, ‘Interoperability of EU Information Systems: The Deathblow to the Rights to Privacy and Personal Data Protection of Third-Country Nationals?’ (2020) 26(1) European Public Law 131. ——, ‘Police Information Exchange: The Future Developments Regarding Prüm and the API Directive’ (Study for the LIBE Committee of the European Parliament, PE 658.542, 2020). ——, Immigration and Privacy in the Law of the European Union: The Case of Information Systems (Leiden, Brill Nijhofff, forthcoming, 2021). ——, ‘The Transformation of Eurodac under the New Pact on Migration and Asylum: From the Sidekick of the Dublin System to a Database in Support of EU Policies on Asylum, Resettlement and Irregular Migration’ (European Council on Refugees an Exiles (ECRE) Working Paper No 13, 2021).

752 Bibliography Vavoula N and Mitsilegas V, ‘Strengthening Europol’s Mandate: A Legal Assessment of the Commission’s Proposal to Amend the Europol Regulation’ (Study for the LIBE Committee of the European Parliament, PE 694.200, 2021). Vedaschi A, ‘Privacy Versus Security: Regulating Data Collection and Retention in Europe’ in BJ Goold and L Lazarus (eds), Security and Human Rights, 2nd edn (Oxford, Hart, 2019). Vedaschi A and Lubello V, ‘Data Retention and its Implications for the Fundamental Right to Privacy: A European Perspective’ (2015) 20 Tilburg Law Review 14. Vervaele JAE, ‘Towards an Independent European Agency to Fight Fraud and Corruption in the EU?’ (1999) 7(3) European Journal of Crime, Criminal Law and Criminal Justice 331. ——, ‘Joined Cases C-187/01 and C-385/01, Criminal Proceedings against Hüseyin Gözütok and Klaus Brügge’ (2004) 41 (3) CML Rev 795. ——, ‘The European Community and Harmonization of the Criminal Law Enforcement of Community Policy’ (2006) 3–4 Eucrim 87. ——, ‘Quel Statut pour le Ministère Public?’ in P Ghaleh-Marzban (ed), Quelles Perspectives pour un Ministère Public Européen? Protéger les Intérêts Financiers et Fondamentaux de l’Union (Paris, Dalloz, 2010). ——, ‘Ne Bis in Idem: Towards a Transnational Constitutional Principle in the EU?’ (2013) 9(4) Utrecht Law Review 211. ——, ‘European Territoriality and Jurisdiction: The Protection of the EU’s Financial Interests in its Horizontal and Vertical (EPPO) Dimension’ in M Luchtman (ed), Choice of Forum in Cooperation against EU Financial Crime: Freedom, Security and Justice and the Protection of Specific EU Interests (The Hague, Eleven International Publishing, 2013). ——, ‘The Material Scope of Competence of the European Public Prosecutor’s Office: Lex Uncerta and Unpraevia?’ (2014) 15 ERA Forum 85. ——, ‘Schengen and Charter-Related Ne Bis in Idem Protection in the Area of Freedom, Security and Justice: M and Zoran Spasic’ (2015) 52 (5) CML Rev 1339. ——, ‘Judicial and Political Accountability for Criminal Investigations and Prosecutions by a European Public Prosecutor’s Office: The Dissymmetry of Shared Enforcement’ in M Scholten and M Luchtman (eds), Law Enforcement by EU Authorities: Implications for Political and Judicial Accountability (Cheltenham, Edward Elgar, 2017). Vergés Bausili A, Rethinking the Methods of Dividing and Exercising Powers in the EU: Reforming Subsidiarity and National Parliaments (2002) New York University School of Law, Jean Monnet Working Paper No 9/02. Vermeulen G, ‘A European Judicial Network Linked to Europol? In Search of a Model for Structuring Transnational Criminal Investigations in the EU’ (1997) 4(4) Maastricht Journal of European and Comparative Law 346. Viganò F, ‘Supremacy of EU Law vs (Constitutional) National Identity: A New Challenge for the Court of Justice from the Italian Constitutional Court’ (2017) 7 European Criminal Law Review 103. ——, ‘Melloni Overruled? Considerations on the “Taricco II” judgment of the Court of Justice’ (2018) 9 New Journal of European Criminal Law 18. Vlassis D, ‘Drafting the United Nations Convention against Transnational Organized Crime’ in P Williams and D Vlassis (eds), Combating Transnational Crime: Concepts, Activities and Responses (London, Frank Cass, 2001). Wade M, ‘Judicial Control: The CJEU and the Future of Eurojust’ (2013) 14(2) ERA Forum 201. Waever O, ‘Securitization and De-securitization’ in RD Lipschutz (ed), On Security (New York, Columbia University Press, 1995). Wahl T, ‘The European Public Prosecutor’s Office and the Fragmentation of Defence Rights’ in K Ligeti, MJ Antunes and F Giuffrida (eds), The European Public Prosecutor’s Office at Launch (Milan, Wolters Kluwer/CEDAM, 2020). Wall A, A Stranger in Europe: Britain and the EU from Thatcher to Blair (Oxford, Oxford University Press, 2008). Walsch C, ‘Europeanization and Democracy: Negotiating the Prüm Treaty and the Schengen III Agreement’ (2008) 45 Croatian Political Science Review 81. Wakefield J, ‘Good Governance and the European Anti-Fraud Office’ (2006) 12(4) European Public Law 550. Wasmeier M, ‘Ne Bis in Idem and the Enforcement Condition: Balancing Freedom, Security and Justice?’ (2014) 5(4) New Journal of European Criminal Law 534.

Bibliography 753 ——, ‘The Choice of Forum by the European Public Prosecutor’ in LH Erkelens, AWH Meij and TM Pawlik (eds), The European Public Prosecutor’s Office: An Extended Arm or a Two-Headed Dragon? (The Hague, TMC Asser Press/Springer, 2015). ——, ‘The Legal Basis for Preventing and Resolving Conflicts of Criminal Jurisdiction in the TFEU’ in European Law Institute, K Ligeti and G Robinson (eds), Preventing and Resolving Conflicts of Jurisdiction in EU Criminal Law (Oxford, Oxford University Press, 2018). Wasmeier M and Thwaites N, ‘The “Battle of the Pillars”: Does the European Community Have the Power to Approximate National Criminal Laws?’ (2004) 29 European Law Review 613. Wathelet M, ‘Accelerated Procedures before the European Court of Justice’ in K Bradley, N Travers and A Whelan (eds), Of Courts and Constitutions. Liber Amicorum in Honour of Nial Fennelly (Oxford, Hart Publishing, 2014). Wattel PJ, ‘Ne Bis in Idem and Tax Offences in EU Law and ECHR Law’ in B van Bockel (ed), Ne Bis in Idem in EU Law (Cambridge, Cambridge University Press, 2016). Weatherill S, ‘Harmonisation: How Much, How Little?’ (2005) 16(3) European Business Law Review 533. ——, ‘Why Harmonise?’ in T Tridimas and P Nebbia (eds), European Law for the Twenty-First Century: Rethinking the New Legal Order, vol 2 (Oxford, Hart Publishing, 2004). Webb P, ‘The United Nations Convention against Corruption. Global Achievement or Missed Opportunity?’ (2005) 8 Journal of International Economic Law 191. Weber-Panariello PA, The Integration of Matters of Justice and Home Affairs into Title VI of the Treaty on European Union. A Step Towards More Democracy? (1994) EUI Working Paper RSC No 95/32. Wesseling M, Gijs de Vries : Vers la coordination des politiques antiterroristes européennes, efficacité ou symbolisme? (Paris, Master Mémoire, Institut d’Etudes Politiques de Paris, 2005). Weyembergh A, L’harmonisation des Legislations des Législations: Condition de l’Espace Pénal Européen et Révélateur de ses Tensions (Brussels, Editions de l’Universite de Bruxelles, 2004). ——, ‘Approximation of Criminal Laws, the Constitutional Treaty and the Hague Programme’ (2005) 42 CML Rev 1567. ——, ‘The Functions of Approximation of Penal Legislation within the European Union’ (2005) 12 Maastricht Journal of European and Comparative Law 149. ——, ‘Coordination and Initiation of Investigations and Prosecutions through Eurojust’ (2013) 14(2) ERA Forum 177. ——, ‘An Overall Analysis of the Proposal for a Regulation on Eurojust’ (2013) 4 Eucrim 127. ——, ‘Comment on CJEU, 11 February 2003, Joined Cases C-187/01 and C-385/01 Criminal Proceedings v Hüseyn Gözütok and Klaus Brügge’ in V Mitsilegas, A di Martino and L Mancano (eds), The Court of Justice and European Criminal Law: Leading Cases in a Contextual Analysis (Oxford, Hart Publishing, 2019). Weyembergh A and Armada I, ‘The Principle of Ne Bis in Idem in Europe’s Area of Freedom, Security and Justice’ in V Mitsilegas, M Bergström and T Konstadinides (eds), Research Handbook on EU Criminal Law (Cheltenham, Edward Elgar, 2016). Weyembergh A, Armada I and Brière C, ‘The Inter-agency Cooperation and Future Architecture of the EU Criminal Justice and Law Enforcement Area’ (Study for the LIBE Committee of the European Parliament, PE 510.00, 2014). ——, ‘The Cooperation between Police and Justice at the EU Level: The Representative Example of Joint Investigation Teams’ in C Brière and A Weyembergh (eds), The Needed Balances in EU Criminal Law: Past, Present and Future (Oxford, Hart Publishing, 2018). Weyembergh A and Brière C, ‘Towards a European Public Prosecutor’s Office EPPO’ (Study for the LIBE Committee of the European Parliament, PE 571.399, 2016). Weyembergh A and Santamaria V, ‘Le Contrôle Démocratique dans l’Espace Pénal Européen’ in M Dony and LS Rossi (eds), Démocratie, Cohérence et Transparence. Vers une Constitutionnalisation de l’Union Européenne? (Brussels, Institut d’Etudes Européennes, 2008). Weyembergh A and Wieczorek I, ‘Norm Diffusion as a Tool to Uphold and Promote EU values and interests: A case study on the EU Japan Mutual Legal Assistance Agreement’ (2020) 11(4) New Journal of European Criminal Law 439. White M, ‘Is the Incompatibility of UK Data Retention Law with EU Law Really a Victory?’ (2021) 47 Legal Studies 130.

754 Bibliography White S, Protection of the Financial Interests of the European Communities: The Fight against Fraud and Corruption (The Hague, Kluwer Law International, 1998). ——, ‘Harmonisation of Criminal Law under the First Pillar’ (2006) 31 European Law Review 92. ——, ‘Towards a Decentralised European Public Prosecutor’s Office?’ (2013) 4(1–2) New Journal of European Criminal Law 22. Wieczorek I, ‘The EPPO Draft Regulation Passes the First Subsidiarity Test: An Analysis and Interpretation of the European Commission’s Hasty Approach to National Parliaments’ Subsidiarity Arguments’ (2015) 16(5) German Law Journal 1247. ——, ‘Understanding JHA Agencies in Context: Where Does Eurojust Lie in the Constitutional Architecture of the Area of Freedom Security and Justice?’ in M Fletcher, E Herlin-Karnell and C Matera (eds), The European Union as an Area of Freedom Security and Justice (Abingdon, Routledge, 2016). ——, ‘The Principle of Subsidiarity in EU Criminal Law’ in C Brière and A Weyembergh (eds), The Needed Balances in EU Criminal Law: Past, Present and Future (Oxford, Hart Publishing, 2018). Wils W, ‘The Principle of “Ne Bis in Idem” in EC Antitrust Enforcement: A Legal and Economic Analysis’ (2003) 26(2) World Competition 131. Xanthaki H, ‘Eurojust: Fulfilled or Empty Promises in EU Criminal Law?’ (2006) 8(2–3) European Journal of Law Reform 175. ——, ‘Genesis: UCLAF and the Transition to OLAF’ in C Stefanou, S White and H Xanthaki (eds), OLAF at the Crossroads: Action against EU Fraud (Oxford, Hart Publishing, 2011). Zimmermann F, ‘Choice of Forum and Choice of Law under the Future Regulation on the Establishment of a European Public Prosecutor’s Office’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stockholm, Stiftelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015). Zirulia S, ‘Is that a smuggler? The Blurring Line between Facilitating Illegal Immigration and Providing Humanitarian Assistance at the European Borders’ in GL Gatta, V Mitsilegas and S Zirulia (eds), Controlling Immigration through Criminal Law. European and Comparative Perspectives on ‘Crimmigration’ (Oxford, Hart Publishing, 2021). Zerbes I, ‘Collecting and Using Evidence: a Patchwork of Legal Orders’ in P Asp (ed), The European Public Prosecutor’s Office: Legal and Criminal Policy Perspectives (Stockholm, Stiftelsen Skrifter utgivna av Juridiska fakulteten vid Stockholms universitet, 2015). Zwiers M, The European Public Prosecutor’s Office: Analysis of a Multilevel Criminal Justice Systems (Cambridge, Intersentia, 2011).

Online Citations (Blogs, Online Magazines etc) Baudrihaye-Gérard L, ‘Can Belgian, French and Swedish Prosecutors Issue European Arrest Warrants? The CJEU Clarifies the Requirement for Independent Public Prosecutors’ (EU Law Analysis, 2 January 2020) http://eulawanalysis.blogspot.com/2020/01/can-belgian-french-and-swedish.html. Brunsden J, ‘Member States Split over Commission Powers’ (European Voice, 28 February 2008) www.politico. eu/article/member-states-split-over-commission-powers. ——, ‘France Seeks Quick Deal to Penalise Employment of Illegal Immigrants’ (European Voice, 17 July 2008) www.politico.eu/article/france-seeks-quick-deal-to-penalise-employment-of-illegal-immigrants. Bunyan T, ‘The “Point of No Return”: Interoperability Morphs into the Creation of a Big Brother Centralised EU State Database Including All Existing and Future Justice and Home Affairs Databases’ (Statewatch Analysis, July 2018) www.statewatch.org/media/documents/analyses/eu-interop-morphs-into-centraldatabase.pdf. Campbell Z and Jones C, ‘Leaked Reports Show EU Police are Planning a Pan-European Network of Facial Recognition Databases’ (The Intercept, 21 February 2020) https://theintercept.com/2020/02/21/eu-facialrecognition-database. Christakis T, ‘E-Evidence in the EU Council: The Key Issue of When One Member State Can Review the Requests from Another’ (Cross-border Data Forum, 1 October 2018) https://www.crossborderdataforum. org/e-evidence-in-the-eu-council-the-key-issue-of-when-one-member-state-can-review-the-requestsfrom-another.

Bibliography 755 Di Giacomo D, Georgiev S and Colacino Dias L, ‘Feasibility Study and Cost Assessment of the Establishment of a Centralised ECRIS TCN Solution’ (Wavestone study for the European Commission Directorate-General for Justice and Consumers, 2017) www.statewatch.org/media/documents/news/2017/jul/eu-com-ecristcn-proposal-feasibility-study-centralised-system.pdf. Evans J and Sawers J ‘The EU Can’t Dictate to Us on Security But Staying in it Can Keep Us Safer’ (Sunday Times, 8 May 2016) www.thetimes.co.uk/article/the-eu-cant-dictate-to-us-on-security-but-staying-in-itcan-keep-us-safer-rw6j2j72w. Franssen V, ‘The European Commission’s E-Evidence Proposal: Toward an EU-Wide Obligation for Service Providers to Cooperate with Law Enforcement? (European Union Law Blog, 12 October 2018) https:// europeanlawblog.eu/2018/10/12/the-european-commissions-e-evidence-proposal-toward-an-eu-wideobligation-for-service-providers-to-cooperate-with-law-enforcement. Fromage D, ‘The New Joint Parliamentary Scrutiny Group for Europol: Old Wine in New Bottles?’ (TARN: The Academic Research Network Blog on EU Agencies & Institutional Innovation, 17 June 2017) https:// tarn.maastrichtuniversity.nl/the-new-joint-parliamentary-scrutiny-group-for-europol-old-wine-in-newbottles. Graf von Luckner J, ‘German Prosecutors are Insufficiently Independent to Issue European Arrest Warrants’ (European Law Blog, 11 June 2019) https://europeanlawblog.eu/2019/06/11/german-prosecutors-areinsufficiently-independent-to-issue-european-arrest-warrants. Guild E and Vavoula N, ‘The Latest Personal Data Grab: Is the EU a Global Leader in Personal Data Protection?’ (Open Democracy, 28 September 2020) www.opendemocracy.net/en/can-europe-make-it/latest-personaldata-grab-eu-global-leader-personal-data-protection. Goldirova R, ‘EU States Clash over Penalties for Hiring Illegal Immigrants’ (EUobserver, 24 July 2008) https:// euobserver.com/justice/26536. Hinnant L, ‘France Puts 78,000 Security Threats on Vast Police Database’ (Associated Press, 4 April 2018) https://apnews.com/article/a1690ac25cea4d5b8d2b622d3fd4e646. Hunko A, ‘Secret Alerts are Increasing Rapidly: Why?’ (Pressemitteilungen, 21 February 2018) https://www. andrej-hunko.de/en/press/3990-secret-alerts-are-increasing-rapidly-why. Jones C, ‘“Complex, Technologically Fraught and Expensive”: The Problematic Implementation of the Prüm Decision’ (Statewatch, 2012) www.statewatch.org/media/documents/analyses/no-197-prumimplementation.pdf. ——, ‘Secrecy Reigns at the EU’s Intelligence Analysis Centre’ (Statewatch, 2013) www.statewatch.org/ analyses/no-223-eu-intcen.pdf. ——, ‘Disproportionate and Discriminatory: The European Criminal Records Information System on ThirdCountry Nationals (ECRIS-TCN)’ (Statewatch Analysis, February 2019) www.statewatch.org/media/ documents/analyses/no-340-ecris-tcn.pdf. Kochenov D, ‘AG Bot in PI (Case C-348/09): Committing a Crime Disqualifies EU Citizens from Permanent Residence’ (European Law Blog, 3 March 2012) https://europeanlawblog.eu/2012/03/13/ag-bot-in-p-icase-c-34809-committing-a-crime-disqualifies-eu-citizens-from-permanent-residence. Kuster B and Tsianos V, ‘Erase Them! Eurodac and Digital Deportability’ (Transversal/EIPCP Multilingual Webjournal, 2013) https://transversal.at/transversal/0313/kuster-tsianos/en. Lamberigts S, ‘The Presumption of Innocence (and the Right to Be Present on Trial) Directive’ (European Union Law Blog, 3 May 2016) https://europeanlawblog.eu/2016/05/03/the-presumption-of-innocenceand-the-right-to-be-present-at-trial-directive. Lichtblau E and Risen J, ‘Bank Data is Sifted by US in Secret to Block Terror’ (New York Times, 23 June 2006) www.nytimes.com/2006/06/23/washington/23intel.html. Lynskey O, ‘Joined Cases C-293/12 and 594/12 Digital Rights Ireland and Seitlinger and Others: The Good, the Bad and the Ugly’ (European Law Blog, 8 April 2014) https://europeanlawblog.eu/2014/04/08/ joined-cases-c-29312-and-59412-digital-rights-ireland-and-seitlinger-and-others-the-good-the-badand-the-ugly. ——, ‘Tele2 Sverige AB and Watson et al: Continuity and Radical Change’ (EU Law Blog, 12 January 2017) https://europeanlawblog.eu/2017/01/12/tele2-sverige-ab-and-watson-et-al-continuity-and-radicalchange. May T, ‘Fight Europe by All Means, But Not over This Arrest Warrant’ (Daily Telegraph, November 2014) www.telegraph.co.uk/news/politics/conservative/11216589/Theresa-May-Fight-Europe-by-all-meansbut-not-over-this-Arrest-Warrant.htm.

756 Bibliography Michl W, ‘Brott statt Böller’ (Verfassungsblog, December 2020) https://verfassungsblog.de/brot-statt-boller. Mitsilegas V, ‘Post-Brexit Challenges for Criminal Justice Co-operation’ (UK in a Changing Europe, 30 March 2020) https://ukandeu.ac.uk/post-brexit-challenges-for-criminal-justice-co-operation. Monar J, ‘Specific Factors, Typology and Development Trends of Modes of Governance in the EU Justice and Home Affairs Domain’ (2006) EU-Newgov.org deliverable 01/17, http://www.eu-newgov.org/database/ DELIV/D01D17_Emergence_NMG_in_JHA.pdf. Ni Loideain N, ‘Not So Grand: The Big Brother Watch ECtHR Grand Chamber Judgment’ (Information Law and Policy Centre, 28 May 2021) https://infolawcentre.blogs.sas.ac.uk/2021/05/28/not-so-grand-the-bigbrother-watch-ecthr-grand-chamber-judgment. Peers S, ‘The Data Retention Judgment: The CJEU Prohibits Mass Surveillance’ (EU Law Analysis Blog, 8 April 2014) http://eulawanalysis.blogspot.hu/2014/04/the-data-retention-judgment-cjeu.html. Peers S, ‘The Reform of Europol: Modern EU Agency, or Intergovernmental Dinosaur?’ (EU Law Analysis, 18 June 2014) http://eulawanalysis.blogspot.com/2014/06/the-reform-of-europol-modern-eu-agency. html. Powles J, ‘Data Privacy: The Tide is Turning in Europe – But is It Too little, Too Late?’ (The Guardian, 6 April 2015) www.theguardian.com/technology/2015/apr/06/data-privacy-europe-facebook. Sajfert J, ‘Bulk Data Interception/Retention Judgments of the CJEU: A Victory and a Defeat for Privacy’ (European Union Law Blog, 26 October 2020) https://europeanlawblog.eu/2020/10/26/bulk-datainterception-retention-judgments-of-the-cjeu-a-victory-and-a-defeat-for-privacy. ——, ‘The Big Brother Watch and Centrum för Rättvisa Judgments of the Grand Chamber of the European Court of Human Rights: The Altamont of Privacy?’ (European Law Blog, 8 June 2021) https://europeanlawblog. eu/2021/06/08/big-brother-watch-and-centrum-for-rattvisa-judgments-of-the-grand-chamber-of-theeuropean-court-of-human-rights-altamont-of-privacy. Sanchéz Nicolàs E, ‘France “Got its Way” as Portugal Ends e-Privacy Deadlock’ (EUobserver, February 2021) https://euobserver.com/science/150904. Schaar P, ‘Leaky Umbrella’ (European Academy for Freedom of Information and Data Protection, 18 September 2015) www.eaid-berlin.de/leaky-umbrella-updated-18-february-2016. Toggenburg GN, ‘The EU Fundamental Rights Agency: Satellite or Guiding Star?’ (SWP Comments, 15 March 2007) https://www.swp-berlin.org/en/publication/the-eu-fundamental-rights-agency. Vavoula N, ‘Detecting Foreign Fighters: The Reinvigoration of the Schengen Information System in the Wake of Terrorist Attacks’ (EU Immigration and Asylum Law and Policy Blog, 3 May 2016) https:// eumigrationlawblog.eu/detecting-foreign-fighters-the-reinvigoration-of-the-schengen-informationsystem-in-the-wake-of-terrorist-attacks. Wendel M, ‘Grundrechtswende zur Jahreswende’ (Verfassungsblog, January 2021) https://verfassungsblog.de/ grundrechtswende-zur-jahreswende. White M, ‘A Threat to Human Rights? The New e-Privacy Regulation and Some Thoughts on Tele2 and Watson’ (EU Law Analysis Blog, 10 January 2017) http://eulawanalysis.blogspot.gr/2017/01/a-threat-tohuman-rights-new-e-privacy.html. Wojkic A, ‘A German Court Refuses to Extradite a German Citizen to Poland Because of the State of the Polish Judicial System’ (Rule of Law, January 2021) https://ruleoflaw.pl/german-court-european-arrest-warrantpoland. Woods L, ‘Data Retention and National Law: The ECJ Ruling in Joined Cases C-203/15 and C-698/15 Tele2 and Watson (Grand Chamber)’ (EU Law Analysis Blog, 21 December 2016) http://eulawanalysis.blogspot. com/2016/12/data-retention-and-national-law-ecj.html. ——, ‘Mobile Phone Theft and EU E-Privacy Law: The CJEU Clarifies Police Powers’ (EU Law Analysis Blog, 4 October 2018) http://eulawanalysis.blogspot.com/2018/10/mobile-phone-theft-and-eu-eprivacy-law. html. ——, ‘When is Mass Surveillance Justified? The CJEU Clarifies the Law in Privacy International and Other Cases’ (EU Law Analysis Blog, 7 October 2020) http://eulawanalysis.blogspot.com/2020/10/when-is-masssurveillance-justified.html. Ziller J, ‘The Conseil d’Etat Refuses to Follow the Pied Piper of Karlsruhe’ (Verfassungsblog, 24 April 2021) https://verfassungsblog.de/the-conseil-detat-refuses-to-follow-the-pied-piper-of-karlsruhe.

INDEX access to a lawyer, right to, 258, 265–70 CFREU, 287–88 children’s rights, 275–76 direct effect, 32 ECHR, 287–88 legal aid, relationship with, 270–73 UK, 695 EU-UK TCA, 704 accession of the EU to ECHR: Opinion 2/13 autonomy of EU legal order, 216–17 fundamental rights, protection of, 216–17 mutual recognition principle, 216–17 mutual trust, 216–17 Action Plans: Hague (2004), 25, 27–28, 69, 70, 255–56, 371 availability principle, 531, 545–46 information exchange, 608–9 interagency cooperation, 473–74 interoperability of databases, 517 migration, 505–6 response to 9/11, 25 Stockholm (2009), 27, 69–70, 127–28, 130, 260, 354, 469 interagency cooperation, 473–74 presumption of innocence, 277 victims’ rights, 317 Tampere (1999), 25, 197, 393–94, 466, 549–50 actions for annulment, 16, 65, 75, 100, 379, 427–28, 430, 434 actions for damages, 15, 428–29 accountability: EPPO, 456–58 Eurojust, 410–11 EDPS, 476 Europol, 379–81 administrative inquiries, 382–83 scrutiny, 381–82 transparency, 382–83 FRA, 476 JSBs, 475 Supervisory Committee of OLAF, 475 see also scrutiny and transparency; supervision

administrative and criminal proceedings concurrently: ne bis in idem principle, 180–81 compatibility of, 184–89 incompatibility of, 181–84 see also concurrent jurisdiction Advanced Passenger Information (API), 521, 588 Advocaten voor de Wereld VZW case: EAW Framework Decision, 203–6, 222, 323 Agency for Fundamental Rights (FRA), 476 Amsterdam Treaty: Palermo Convention, 616–17, 621 third pillar developments AFSJ, 8–9 background, 7–8 CJEU’s role, 13–17 Common Position, 10–11 decision-making, 9–10 decisions, 11 European Commission, 10 European Council, 10 European Parliament, 10 Framework decisions, 11 institutional framework, 9–17 joint actions, 11–12 member states, 10 right of initiative, 12 Schengen acquis, 9, 491–92 Aranyosi case: extradition rights, 331 mutual trust, 223–26 ECtHR response, 226–28 impact of Aranyosi, 230–35 German Constitutional Court’s response, 228–30 rule of law test, 235–42, 252–53 rule of law test challenges to, 237–42 LM case, 235–37

758 Index Area of Freedom, Security and Justice (AFSJ), 3, 8–9, 62–63 mutual recognition and mutual trust, relationship between, 198–99, 226 national diversity, 68–70 transnational ne bis in idem, 152, 168–71, 191–92 arrest warrants: mutual recognition principle, 199–200 see also European Arrest Warrant artificial intelligence, see technological advancements asset freezing: EU-UK TCA, 711–12, 714–15 Kadi case, 647, 649–51 mutual recognition, 199–200 terrorist sanctions, 52–55 Kadi case, 647, 649–51 UNSC Resolutions, 639–41, 644 assimilation principle, 36, 38–39, 300 national criminal law Community law, impact of, 93–94 autonomous concepts, see judicial authority autonomy of EU legal order, 193–94, 233, 573, 628, 657, 690 Kadi I case, 645–48, 654–55 Opinion 2/13, 216–17 bail decisions: mutual recognition principle, 199–200 Berlin Wall, fall of the, 3–4 biometric data: CIR, 521–22 data protection, 608–11 Data Protection Directive, 601–2, 681 Europol, 484–85, 486, 491 ECRIS- TCN, 529 Eurodac, 512 Europol, 483, 484–85, 486, 491 Prüm Framework, 543 SIS, 494–96, 498, 500 VIS, 506 Biometric Matching Service (BMS), 517–18, 519–20 blind trust approach: concerns, 218–19, 221–23, 225, 233–34 EAWs, 209, 211, 326 ne bis in idem, relationship with, 193 border management, 470–71 ETIAS, 516 interoperability of information systems, 518–19 see also Frontex border security, 474 Brexit, 693, 721–23 data exchange, 700 EU-UK TCA, 716–17, 722

EU-UK TCA, 702 anti-money laundering and confiscation cooperation, 711–15 benchmarks, 718–21 bodies, offices and agencies, 715–16 dispute resolution, 721 exchange of criminal records, 710–11 governance, 721 mutual legal assistance, 708–10 operational cooperation and data exchange, 716–18 surrender and arrest warrants, 702–8 Europol Regulation, 356–57 judicial cooperation, 699–700 data protection, 700–1 dual criminality, 706, 713 EU-UK TCA, 716, 718–21, 723 human rights, 700 mutual legal assistance, 708–9 surrender of own nationals, 706–7 terrorist offences, 705 police cooperation, 693–94 political and operational considerations, 698–700 CJEU’s role, 701 data protection, 700–1 human rights, 700 UK as a third country, 701 pre-Brexit integration in criminal matters, 693–94 EAW Framework Decision, 697, 698 EIO Directive, 695–96 mutual recognition, 695–96 UK influence, 694–95 UK opt-out, 696–97 UK participation, 695–96 ‘wait-and-see’ approach, 696 surrender and arrest warrants dual criminality, 706 forms, 703 grounds for refusal, 704 judicialization, 703 political offence exception, 705 proportionality, 704–5 scope, 703 SIS II participation, 707–8 surrender of own nationals, 706–7 terminology, 702 time limits, 703 transition period, 697–98 BVerG, see German Constitutional Court case management system (CMS), 408, 460–61 Charter of Fundamental Rights of the EU (CFREU), 19–20, 45–47, 60 access to a lawyer, right to, 287–88

Index 759 data protection, 451, 512, 564–65, 610–11 constitutionalisation of, 606–8 see also General Data Protection Regulation defendants’ rights, 287–89 legal aid, 272–73 legality principle, 38, 204 mutual trust EAW Framework Decision, 212–14 ne bis in idem principle, 148–50, 151, 193, 182–84, 185–86, 191–94 compatibility with CISA enforcement condition, 164–68 presumption of innocence, 278–79 proportionality, 129–30 children’s rights, 274–76 choice of forum: EPPO Regulation, 172, 176–80, 195, 444, 454 Eurojust, 409–10, 418 citizenship law, 320 criminal law considerations, 336–37, 346–48 imperative grounds of public security, 337–40 sexual exploitation of minors, 340–46 EAW Framework, 320–21 immigration and criminal law confused, 326–27 mutual recognition principle, 323, 325–26 national discretion, limits on, 327–28 non-discrimination principle, 323, 328 refusal to surrender, 323–25 ‘residence’ concept, 321–22, 323 residence threshold, 325–26 ‘staying’ concept, 321–22 extradition requests from third countries, 331–36 Transfer of Sentenced Persons Framework, 321 mutual recognition principle, 328–29 targets, 329–30 Cold War, end of, 3–4, 115, 612–13 Common Foreign and Security Policy (CFSP), 6, 53–67, 467–68 Common Identity Repository (CIR), 519–22 Common Positions, 10–11 CJEU role, 14–16 Common Security and Defence Policy (CSDP), 467–68 Community law (pre-Lisbon), 95–96 conferral of competence, 96–100 Convention on the Future of Europe, 113–14 environmental crime, 100–4 judgment, reactions to, 104–8 Ship-Source Pollution case, 108–13

national criminal law, impact on assimilation principle, 93–94 effectiveness of Community law, 92–93 limits, 91–92 proportionality, 91–92 national criminal law principles, impact of legal certainty principle, 94 retroactive application principle, 94–95 see also EU law competence to criminalise, 89–90, 130–31, 146–47 challenges case for decriminalisation, 142–46 criminalising hate speech, 135–39 functional criminalisation, 139–42 securitised criminalisation, 131–35 criminal and administrative law, relationship between, 120–21 extending EU competence, 121–22 catch-all provision, 125 fight against fraud, 122–25 Lissabon-Urteil case, 125–27 post-Lisbon, 114–15 functional criminalisation, 117–19 minimum rules, 119–20 policy responses, 127–30 securitised criminalisation, 115–17 pre-Lisbon competence issues, 95–96 competition disputes, 96–100 Environmental Crime case, 100–8 Future of Europe Convention, 113–14 Ship-Source Pollution case, 108–13 reform proposals, 130–31 environmental crime, 139–42 hate crimes, 135–39 organised crime, 131–35 unauthorised entry, transit and stay, 142–46 scope, 130–31 administrative law, 121–25 minimum rules, 119–20 concurrent jurisdiction, 171 administrative and criminal proceedings concurrently compatibility of, 184–89 incompatibility of, 181–84 ne bis in idem principle, 180–89 conflicts of jurisdiction, 171–76 EU financial interests, protection of, 176–80 Eurojust, 403–4, 479 conferral of competence, 18–19 Community law (pre-Lisbon), 96–100 Convention on the Future of Europe, 113–14

760 Index criminal law and internal market law, relationship between acquisition and possession of weapons, 48–49 criminal law and transport policy, relationship between road traffic offences, 49–52 criminalisation competence, 114–15 functional criminalisation, 117–19, 139–42 minimal rules, 119–20 securitised criminalisation, 115–17, 131–35 internal and external dimensions, relationship between Kadi I case, 645–49 terrorist sanctions, 52–67 confiscation orders: mutual recognition principle, 199–200 EU-UK TCA, 712, 714 consistent interpretation, duty of, 315 constitutional identity, 583 constitutionalisation of criminal law, 35, 40–41, 87 mutual trust as a challenge to, 218, 252 ECtHR response, 218–19 national courts’ response, 219–23, 229 constitutionalisation of criminal law, 1, 87–88 CJEU, 30 conferral of competence, 47–48 acquisition and possession of weapons, 48–49 road traffic offences, 49–52 terrorist sanctions, 52–67 constitutional identity, 35, 40–41, 87 data protection law, 606–8 direct effect, 31–32 indirect effect, 32–34 Lisbon treaty CJEU’s role, reforms to, 30 constitutional identity, 35, 40–41 decision-making reforms, 30 direct effect principle, 31–32 effectiveness of EU law, 35, 40–44 European Commission’s role, reforms to, 30–31 indirect effect principle, 32–34 primacy of EU law, 35, 37–38, 40–42 primacy of EU law, 35, 37–38, 40–42 principles constitutional identity, 35, 40–41 effectiveness of EU law, 35, 40–44 direct effect principle, 31–32 indirect effect principle, 32–34 primacy of EU law, 35, 37–38, 40–42 rights distinguished, 45–47

rights principles distinguished, 45–47 see also Lisbon Treaty Convention Implementing the Schengen Agreement (CISA), 150–51, 153–54 enforcement condition, 164–68 Cooperation and Verification Mechanism (CVM): rule of law, 82–84 corpus juris project, 97–98, 196–97, 392, 435–36, 445–46, 454 corruption: globalisation of criminal law international and EU law distinguished, 623–27 Council of Europe: Convention on the Prevention of Terrorism, 628–29 data protection, 374, 497, 535 intergovernmental cooperation, 2, 5–6 ne bis in idem principle, 151–52 regional multilateral treaties, 627–69 disconnection clauses, 630–31 primacy of EU law, 629–30 Court of Auditors, 380 OLAF supervision, 422–23, 424 Report on OLAF (2005), 425–26 Court of Justice of the EU (CJEU), 1 Amsterdam Treaty, 13–17 Brexit, 701 Common Positions, 14–16 conferral of competence, 18–19 constitutionalisation of criminal law, 30 direct/indirect effect, 20–24 Eurojust, role within, 409–10 Europol, role within ambiguity, 377–78 clarification through Lisbon Treaty, 378–79 loyal cooperation, 21–24 primacy of EU law, 18 Kadi I case, 645–49 Kadi II case, 654–55 protection of fundamental rights, 19–20 Pfeiffer judgment, 23–24 Pupino judgment, 20–24 Shrems II case CJEU ruling, 688–91 compatibility of Privacy Shield and EU law, 684–87 effective remedy, 687–88 transatlantic data transfers and applicability of EU law, 681–84

Index 761 third pillar developments, 13–14 effective judicial protection, 14–17 legal principles, 17–18 see also individual case law criminal liability, 21–22, 24, 33–34 age of criminal liability, 275 limitation of, 598 criminalisation competence, see competence to criminalise cross-border investigations: Eurojust, 406 see also European Public Prosecutor’s Office cross-border law enforcement, see Europol cross-border transfer of prisoners, see transfer of sentenced persons Czech Republic v. European Parliament and Council: conferral of competence acquisition and possession of weapons, 48–49 data exchange: Brexit, 700 EU-UK TCA, 716–17, 722 decentralised/national mechanisms, 523–24 automaticity, 547 availability principle, 545–47 criminal records, 524–31 exchange of information between police authorities, 531–36 Prüm Framework, 536–45 privatisation of anti-money laundering, 548–58 data retention, 558–85 electronic evidence, 592–600 passenger data, 585–92 personal data from customers, 600 profiling, 600 data processing and protection: constitutionalisation of data protection, 606–8 EPPO, 455–56 Eurojust, 408–9 Europol, 373–74 basic rules, 374–76 monitoring, 376–77 reform proposals, 387, 388 horizontal data protection instruments sector-specific nature, 601–2 limitations, 601–2 general data protection law, 602–4 Law Enforcement Directive, 603–4 supervision, 605–6

Data Protection Directive (95/46/EC), 601–2, 681 data retention: bulk retention, 558–59 Data Retention Directive, 559–60 Digital Rights Ireland case, 562–68 e-Privacy Directive, 558–59 generalised and indiscriminate surveillance, 562–68 Ireland v European Parliament and Council, 562 Ministerio Fiscal case, 574–75 national constitutional concerns, 560–62 Privacy International case, 575–77 La Quadrature du Net and Others case, 577–85 scrutiny and transparency, lack of, 608–11 security justification, 608–9 Tele2 Sverige and Watson cases, 568–73 Data Retention Directive (2006/24/EC), 48, 559–60, 560–62 Digital Rights Ireland case, 562–68 Ministerio Fiscal case, 574–75 Tele2 Sverige and Watson cases, 568–73 UK adoption of, 694 databases in criminal law, 480–81 access to information systems, 505–6 Entry/Exit System, 513–15 ETIAS, 516 Eurodac, 510–13 VIS, 506–10 access to personal data, 522–23 privatisation of law enforcement, 548–601 Customs Information System, 502–4 limitation clauses, 504–5 EU-UK TCA data exchange, 716–18 Europol analysis work files, 483 big data challenge, 489–90 data processing, 484 data retention, 484 data transfer, 484–85 EIS, 481, 482–83 privacy by design approach, 484–85 privacy concerns, 487–88 private parties, relationship with, 486–87 protection of personal data, 487–88, 490–91 reform proposals, 488–91 research and innovation, 490 respect for private life, 487 sources of data, 485–86 third countries, relationship with, 486, 490

762 Index immigration control Entry/Exit System, 481 Eurodac, 481 ETIAS, 481 VIS, 481 interoperability of information systems, 516–17 API, 521 BMS, 519 CIR, 519–22 debates and improving interoperability, 517–18 ESP, 519 legislative proposals, 518 MID 519–21 PNR, 521 national authorities, 523–24 criminal records, 524–31 enhanced exchange, 547 exchange of information between police authorities, 531–36 principle of availability, 545–47 Prüm Framework, 536–45 SIS, 491–93 2018 amendments, 498–502 access and use of data, 496–97, 501 alerts, 495–96, 499–500 data retention, 501–2 Europol alerts, 502 nature and use of personal data, 494–95 processing personal data, 497–98, 500–1 SIS II, 493–4 see also privatisation of information exchange decriminalisation: entry, transit and residence reform proposals, 142–46 defendants’ rights: effective enforcement, 289–90 implementation deficits, 290–92 interpretation, role of, 292–94 EU law CFREU, relationship with, 287–89 ECHR, relationship with, 287–89 national law, relationship with, 284–86 Lisbon Treaty judicial cooperation, 257 mutual recognition principle, 257–58 pre-Lisbon, 255–57 procedural rights, 257–58, 259–60 access to a lawyer, right to, 258, 265–70 children’s rights, 274–76 information, right to, 258, 262–65 interpretation and translation, right to, 257, 261–62

legal aid, right to, 270–74 presumption of innocence, 277–82 pre-trial detention, 282–84 democratic deficit, 31, 66–67, 72, 102 Digital Rights Ireland case: Data Retention Directive data security, 566–67 fundamental rights, relationship with, 562–64, 567–68 modalities of access and use, 565–66 personal scope of the Directive, 565 proportionality of, 564–65 retention period, 566 fundamental rights, protection of, 562–64, 567–68 proportionality of data retention, 564–65 generalised and indiscriminate surveillance, 562–68 direct effect, 20–24, 87–88 constitutionalisation of criminal law, 31–32 DNA, see biometric data drug trafficking, 2–3, 4, 114–15, 127, 160, 338–39 FATF Recommendations, 631–32 Palermo Convention, 613 Vienna Convention, 613–15 see also Europol; organised crime dual criminality, 135, 136 EAW Framework Decision, 202–3, 206–7, 329 equality principle, relationship with, 203–4 legality principle, relationship with, 202–3 non-discrimination principle, relationship with, 203–4 surrender and arrest warrants, 704, 706 Dzivev case, 44 e-Privacy Directive (2002/58/EC), 558–59 Ministerio Fiscal case, 574–75 Privacy International case, 576–77, 578–79 Tele2 Sverige and Watson cases, 568–71 EAW Framework Decision, 26, 77, 200–1 Advocaten voor de Wereld VZW case, 203–6, 222, 323 CFREU mutual trust, 212–14 citizenship law, 320–21 immigration and criminal law confused, 326–27 mutual recognition principle, 323, 325–26 national discretion, limits on, 327–28 non-discrimination principle, 323, 328 refusal to surrender, 323–25 residence concept, 321–22, 323 residence threshold, 325–26 staying concept, 321–22

Index 763 dual criminality, 202–3, 206–7, 329 enforcement, 241–42 equality principle, 203–7 fundamental rights, protection of, 207–9 German Constitutional Court, 220–23 Grundza case, 206–7 immigration and criminal law confused, 326–27 migration and migration control, 326–27 non-discrimination principle, 203–7 proportionality principle, 209 minor offences, 212 proportionality of detention, 209–11 effective judicial protection, 14–17, 19, 246–47, 249–51, 430, 452, 455, 465 Kadi II case, 651–55 Schrems II case, 690 effectiveness of Community law: national criminal law, impact on, 92–93 effectiveness of EU law: constitutionalisation of criminal law, 35, 40–44 Melloni case mutual recognition principle, 212–16 EIO Directive (2014/41/EU): e-evidence, 593, 695 judicial authority, 251 proportionality, 251, 705 UK participation, 697–98 EU-UK TCA, 708–9 mutual legal assistance, 708–9 electronic evidence: private sector involvement in evidence transfer, 592–94 concerns, 599–600 e-evidence proposals, 594 EPOC, 594–97 EPOC-PR, 594–97 necessity, 595–96 proportionality, 595–96 remedies, 598–99 third countries, 597–98 emergency preliminary ruling procedure, 16–17 enforcement: agencies, 477–79 CISA enforcement condition, 164–68 defendants’ rights, 289–90 implementation deficits, 290–92 interpretation, role of, 292–94 EAW Framework Decision, 241–42 mutual recognition principle, 201–2 enhanced cooperation, 8, 10, 68–69, 76, 86, 458 EPPO, 459, 463, 465 establishment of, 437–38, 464, 695

enhanced protection of fundamental rights, 207 children’s rights, 276 citizenship, 337, 342 see also Lisbon Treaty Entry/Exit System (EES), 481 access to information systems, 513–15 Environmental crime case, 100–4, 139–42 judgment, reactions to, 104–8 equality principle: EAW Framework Decision, 203–7 EPPO, 177–78 EU Counter-Terrorism Coordinator, 349, 468–69, 474–75, 478 EU enlargement, 4, 78–79, 81, 131, 624–25, 659 EU Intelligence Analysis Centre (IntCen), 349, 467–68, 474–75, 479 EU Joint Investigation Teams, 106, 364, 367–69, 415, 697–98, 699 EU Joint Situation Centre (SitCen), 467–68, 478 EU-UK Trade and Cooperation Agreement (EU-UK TCA), 702 anti-money laundering and confiscation cooperation, 711–15 see also money laundering benchmarks, 718–21 bodies, offices and agencies, 715–16 dispute resolution, 721 exchange of criminal records, 710–11 governance, 721 mutual legal assistance, 708–10 operational cooperation and data exchange, 716–18 surrender and arrest warrants, 702–8 see also surrender and arrest warrants EU–US Agreement on Extradition, 333, 660–62 EU–US Agreement on Mutual Legal Assistance, 660–62, 663 EU–US Agreements on the Terrorist Finance Tracking Programme (TFTP), 660–63, 691–92 mutual trust, 664–65 global security standards, development of, 677–78 internalisation, 674–77 monitoring and review, 667–70 operational oversight, 664–66 post-Schrems, 681–91 presumption of adequacy, 670–74 reciprocity, 674–76 transatlantic privacy framework, development of, 678–81 EU–US Agreements on the Transfer of Passenger Name Record (PNR) data, 660, 661, 663

764 Index Eurojust, 417–19 accountability, 410–11 CMS, 408 coordination meetings, 407 data protection, 408–9 establishment, 26, 391–97 exchange of information, 407–8 Eurojust Regulation, 391, 397–98 European National Coordination System, 400 Joint Parliamentary Scrutiny Group, 411 judicial control CJEU, 409–10 mandate and powers concurrent jurisdictions issue, 403–4 coordination of investigations and prosecutions, 401–2 cross-border crimes, 401 EU budget crimes, 401 Eurojust Regulation, 400–6 forum shopping, 403–4 intervention by Eurojust, 404–5 lack of certainty, 405–6 national authorities, relationship with, 402–3 single member crimes with cross-border repercussions, 401 partners, relationships with EJN, 416–17 EPPO, 459–60 European Judicial Training Network, 412 Europol, 414–16 Frontex, 412 OLAF, 413–14 third countries, 412 strategic activities, 408 structure, 398–400 Tampere Conclusions, 393–94 offences falling within remit of Eurojust, 393–94 relationship with other bodies, 394–95 status and powers of Eurojust, 394 US-Eurojust agreements, 660 European Anti-Fraud Office (OLAF), 74 accountability, 422–23 Supervisory Committee, 423–24 actions for annulment of OLAF acts, 427–29 actions for damages for OLAF acts, 428–29 ambiguity of status, 424–25, 431–32 data protection, 422 EPPO, relationship with, 432–35, 460–62 Eurojust, relationship with, 413–14 Franchet and Byk case, 430 investigations, 421–22 judicial control, 427–31

origins legislative framework, 420–27 objective, 421 Task Force for Coordination of Fraud Prevention, 419–20 UCLAF, 419 procedural guarantees, 425–27 role, 431–32 Tilliack case, 428–29 Violetti case, 430 European Arrest Warrants (EAWs): effectiveness of EU law, 196 mutual recognition, 196 see also mutual recognition principle mutual trust, 196 see also mutual trust see also EAW Framework Decision European Asylum Dactyloscopy Database (Eurodac), 481 access to information systems, 510–13 European Border and Coast Guard Agency (Frontex), 469–72 Eurojust, relationship with, 412 European Border Surveillance System (EUROSUR), 471 European Commission, 10 Communication on European Criminal Policy, 128–29 European Parliament’s response, 129–30 constitutionalisation of criminal law, 30–31 European Convention on Human Rights (ECHR): accession of the EU to ECHR (Opinion 2/13) autonomy of EU legal order, 216–17 fundamental rights, protection of, 216–17 mutual recognition principle, 216–17 mutual trust, 216–17 defendants’ rights, 287–89 ne bis in idem principle, 148, 151–52 European Council, 10 Action Plans, see Action Plans right of initiative, 69–71 European Court of Human Rights (ECtHR): ne bis in idem principle, 193–94 constitutional identity, 218–19 mutual trust, 226–28 see also individual case law European Data Protection Supervisor, 356, 375–77, 378–79, 386–87, 417, 456, 476, 484–85, 487–90, 496, 605–6, 665, 718 European External Action Service (EEAS), 467

Index 765 European Investigation Orders (EIOs): mutual recognition principle, 199–200, 592–93, 695 proportionality, 212, 705 see also EIO Directive European Judicial Network, 391–92 Eurojust, relationships with, 416–17 European Judicial Training Network: Eurojust, relationships with, 412 see also Eurojust European Ombudsman, 382–83, 426, 428–29, 430 European Parliament, 10 response to Commission’s Communication, 129–30 European Police Chiefs’ Task Force, 466 European Preservation Order Certificate (EPOC-PR), 594–97, 599 European Production Order Certificate (EPOC), 594–97 European Protection Orders (EPOs): mutual recognition principle, 199–200 European Public Prosecutor’s Office (EPPO), 73–75, 464–65 accountability, 456–58 choice of forum, 172, 176–80, 195, 444, 454 competence and territoriality, 445–49 data protection, 455–56 enhanced cooperation, 437–38, 459, 463, 464, 465, 695 EPPO Regulation choice of forum, 176–80 ne bis in idem principle, 176–80, 194–95 equality principle, 177–78 establishment, 435–37 opt-outs, 438 subsidiarity concerns, 437–38 independence, 456–58 judicial review, 451–55, 465 choice of forum, 177–78, 195, 439, 444, 479 legal certainty principle, 123–24 OLAF, relationship with, 432–35, 460–62 opt-outs, 438 partners, relationship with EPPO Regulation, 458 Eurojust, 459–60 OLAF, 460–62 non-participating member states, 462–64 third countries, 462–64 PIF Directive, 123, 447–48 pre-trial detention, 451 preliminary references, 453–54 choice of forum, 177–78

procedural safeguards judicial review, 451–55 suspects and accused persons, rights of, 449–51 structure and powers, 439–45 subsidiarity principle, 437–38 supervision, 439–40, 442 data processing activities, 456 third countries, relationship with, 462–64 European Search Portal (ESP), 519 European Travel Information and Authorisation System (ETIAS), 481 access to information systems, 516 European Union Agency for Law Enforcement Training (CEPOL), 465–66 European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), 472–73 Europol, 388–90 accountability, 379–81 administrative inquiries, 382–83 scrutiny, 381–82 transparency, 382–83 analysis work files, 370 CJEU’s role ambiguity, 377–78 clarification through Lisbon Treaty, 378–79 data processing and protection, 373–74, 480–81 analysis work files, 483 basic rules, 374–76 big data challenge, 489–90 data processing, 484 data retention, 484 data transfer, 484–85 EIS, 481, 482–83 monitoring, 376–77 privacy by design approach, 484–85 privacy concerns, 487–88 private parties, relationship with, 486–87 protection of personal data, 487–88, 490–91 reform proposals, 488–91 research and innovation, 490 respect for private life, 487 sources of data, 485–86 third countries, relationship with, 486, 490 establishment, 5–6, 350–51 Eurojust, relationship with, 414–16 Europol Convention, 351–52 Europol Council Decision, 353–54 European Information System, 370

766 Index Europol Regulation Danish opt-out, 355–56 Brexit, 356–57 information-related tasks, 362 information analysis, 364 information exchange, 363 Secure Information Exchange Network Application, 363 investigations, 366–67 joint investigation teams, participation in, 367–69 judicial control, 377–79 legal personality, 357 mandate, 361–62 member states, relationship with, 358–60 objectives, 360–61 operational support, 362, 364–65 organisation and structure, 357–38 partners, relationships with, 385–86 exchange of personal data, 383–86, 484–85 international organisations, 384–85 other EU bodies, 384 private parties, 385, 486–87 third countries, 384–85, 486, 490 reform proposals, 386, 488–90 data processing, 387 data protection, 388, 490–91 enhanced cooperation with EPPO, 387–88 enhanced cooperation with private parties, 386 research and innovation, 387, 490 third countries, relationship with, 486, 490 Stockholm Programme, 354–55 strategic intelligence, 371–73 threat assessments, 371–72 EU Policy Cycle, 372–73 training, knowledge and expertise-related tasks, 362, 365–66 US-Europol agreements, 660 Europol Information System (EIS), 370, 481, 715 evidence warrants: mutual recognition principle, 199–200 exchange of information: enhanced exchange, 547 Eurojust, 407–8 Europol, 363 partners, relationships with, 383–86, 484–85 Secure Information Exchange Network Application, 363 exchange of criminal records EU-UK TCA, 710–11 police authorities, between, 531–36

privatisation anti-money laundering law, 548–58 electronic evidence, 592–600 everyday information and profiling, 600 passenger data, 585–92 retention of electronic communication metadata, 558–85 see also privatisation of information exchange see also data exchange expulsion of EU citizens, 45, 115–16, 326, 329–30, 347–48 PI case sexual exploitation of a minor, 340–46 Tsakouridis case imperative grounds of public security, 337–40 extradition law, 45, 220–22, 234, 321 EU–US Agreement on Extradition, 333, 660–62 extradition requests by third countries, 331–36, 462 see also European Arrest Warrants fall of the Berlin Wall, 3–4 Financial Action Task Force (FATF), 612 anti-money laundering recommendations, 549–51, 615 EU law, relationship with, 631–38 Financial Intelligence Units (FIUs), 384 anti-money laundering, 548–58 cooperation between, 619, 625, 636–37 financial penalties, 166 mutual recognition principle, 199–200, 310 fingerprints, see biometric data foreign fighters, 655–56 SIS legal framework, 498 PNR system, 677 forum shopping, 128, 155, 191–93, 403–4, 479, 535 Fransson case, 35–36 CFREU, 41, 46–47 ne bis in idem principle, 182–84, 185–86, 187–88, 193 fraud, fight against, 35–39, 42–43, 74–75, 86, 93–94, 97–100, 122–25 see also European Anti-Fraud Office free movement rights, 2–3, 8–9, 49, 77, 91–92, 128, 149, 259, 618–19 balance, 155, 331–33 victims’ rights as, 298–99 see also Schengen Agreement free movement of data, 603 freezing orders: mutual recognition principle, 199–200

Index 767 Frontex, see European Border and Coast Guard Agency (Frontex) functional criminalisation, 39, 49, 52, 89–90 environmental crime, 139–42 post-Lisbon, 114, 117–19, 125, 146–47 fundamental rights: CJEU protection, 19–20 EAW Framework Decision, 207–9 Lisbon Treaty, 45–47 Opinion 2/13, 216–17 see also Charter of Fundamental Rights of the EU; European Convention on Human Rights; individual rights General Data Protection Regulation (GDPR), 557, 682–85 Schrems case, 688 German Constitutional Court: constitutional identity, 221–23 EAW Decision, 220–23 fundamental rights, protection of, 219–20 mutual trust, 221–23 Aranyosi case, 228–30 global administrative law, 638–39 counter-terrorism normative standards, 638–41 preventive counter-terrorism sanctions, 639–40 Global Forum on Transparency and Exchange of Information for Tax Purposes, 636 globalisation of criminal law, 612–13, 656–57 FATF anti-money laundering recommendations, 549, 551, 615, 631–38 EU law, relationship with, 631–38 terrorist financing, 633–64 see also Financial Action Task Force foreign fighters, 655–56 global administrative law, 638–39 counter-terrorism normative standards, 638–41 preventive counter-terrorism sanctions, 639–40 see also UN Security Council global multilateral treaties, 613 corruption, 623–27 money-laundering, criminalisation of, 613–15 transnational organised crime, 615–23 see also United Nations regional multilateral treaties Council of Europe, 627–29 disconnection clauses, 630–31 primacy of EU law, 629–30 see also Council of Europe

transatlantic counter-terrorism cooperation see transatlantic counter-terrorism cooperation Grundza case: EAW Framework Decision, 206–7 Hague Action Plan (2004), 25, 27–28, 69, 70, 255–56, 371 availability principle, 531, 545–46 information exchange, 608–9 interagency cooperation, 473–74 interoperability of databases, 517 migration, 505–6 security emphasis, 27 harmonisation of victims’ rights, 301–5, 311–15 hate speech: criminalisation, 135–39 human trafficking, 2–3, 114–15, 127, 145–46, 351, 696 Palermo Convention, 615–16, 622–23 see also organised crime illegal immigration, 107–8, 620 see also organised crime in absentia trials, 157–58, 162, 200, 212–16, 233–34, 286, 292–93 EU-UK TCA, 704, 712–13 presumption of innocence, 277, 280–81 indirect effect, 20–24 constitutionalisation of criminal law, 32–34 information, right to Directive, 249, 258, 262–65, 287, 290–91, 293–94, 450 information sharing, see data exchange; exchange of information infringement actions, 85–86 initiatives, 12 inter-agency cooperation, 27, 473–75 internal market law, development of, 2–3 internalisation of US border security norms, 674–77 International Covenant on Civil and Political Rights (ICCPR): ne bis in idem principle, 148 interoperability of EU databases, 516–17 API, 521 BMS, 519 border management, 518–19 CIR, 519–22 debates and improving interoperability, 517–18 ESP, 519 Hague Action Plan, 517 legislative proposals, 518 MID, 519–21 PNR, 521

768 Index interpretation and translation, right to, 71, 257, 260, 261–62, 268, 287, 291, 293–94, 303, 450 joint actions, 6, 7, 11–12 joint supervisory bodies (JSBs), 601 Europol Joint Supervisory Body, 376–77, 379 data protection, 475–76, 487, 668–69, 671 oversight, 668 terrorist finance tracking, 668, 671 judicial authority: autonomous concept of, 242–43 consistency of definition, 244 EAW, 243–44 OG and PI case, 246–48 levelling the playing field, 249–51 national public prosecutors, 244–45 German public prosecutor, 245–46 judicial control and accountability, 477–79 Eurojust, 409–11 Europol, 377–81 administrative inquiries, 382–83 scrutiny, 381–82 transparency, 382–83 OLAF, 422–23, 427–31 Supervisory Committee, 423–24 judicial cooperation, 2–3 Amsterdam Treaty, 7–8 Brexit, 699–700 data protection, 700–1 dual criminality, 706, 713 EU-UK TCA, 716, 718–21, 723 human rights, 700 mutual legal assistance, 708–9 surrender of own nationals, 706–7 terrorist offences, 705 CFSP, 63–64 defendants’ rights, 256–57 dual criminality, 135 EAW, 238–39, 255 forum shopping, 128 Fundamental Rights Agency, 476 hate speech, 136–37 mutual recognition, 196–99, 232–33, 257–58, 599 UK, 695 victims’ rights, 299–301, 302, 306–8, 310 mutual trust, relationship with, 84–85, 232–33 organised crime, 615–16 protection of personal data, 601–4 rule of law, relationship with, 84–85 SIS legal framework, 498–501 subsidiarity principle, 72–73 see also Eurojust; European Public Prosecutor’s Office

judicial independence, 238–39 effective remedy, relationship with, 248–49 judicial review: access to lawyers, 270 EDPS complaint, 378–79 EPPO actions, 451–55, 465 choice of forum, 177–78, 195, 439, 444, 479 European databases, 520 Europol actions, 388–89 Kadi I case, 645–49 Kadi II case, 649–55 OLAF actions, 427–28 jurisdictional conflicts: ne bis in idem principle EU financial interests, 171–80 Justice and Home Affairs pillar (third pillar): Action Plans, 24–25 action within EU framework, 25–28 action outside EU framework, 28–29 Amsterdam Treaty AFSJ, development of, 8–9 background, 7–8 CJEU’s role, 13–17 Common Position, 10–11 decision-making, 9–10 decisions, 11 European Commission, 10 European Council, 10 European Parliament, 10 Framework decisions, 11 institutional framework, 9–17 joint actions, 11–12 member states, 10 right of initiative, 12 Schengen acquis, development of, 9 conferral of competence, 18–19 European Council, 25–27 fundamental rights, protection of, 19–20 indirect effect, 20–24 loyal cooperation, 21–24 Maastricht Treaty, 1 cooperation policy, 6 deficiencies, 7–8 Europol establishment of, 5–6 limited role of third pillar, 6–7 primacy of EU law, 18 transparency, lack of, 27–28 Kadi I case: autonomy of EU legal order, 645–48, 654–55 conferral of competence internal and external dimensions, relationship between, 645–49 judicial review, 645–49 primacy of EU law, 645–49

Index 769 UNSC EU implementation of UNSC Resolutions, 645–49 Kadi II case: effective judicial protection, 651–55 listing procedure for asset freezings, 649–55 judicial review, 649–55 security argument, 653–64 primacy of EU law, 654–55 UNSC EU implementation of UNSC Resolutions, 649–55 Law Enforcement Directive (2016/680/EU), 490, 542, 603–4, 610 FIUs, 557 legal aid, right to, 270–74, 304–5 legal certainty principle, 33–34, 159 choice of forum decisions, 178–79 Community law, 94 EPPO activities, 123–24 minimum rules, relationship with, 119–20, 121 ne bis in idem principle, 148–49, 158–59, 163–64, 192–95 protection of the environment, 141–42 victims’ rights, 311–12, 319 legality principle, 35, 38–42, 44 dual criminality, relationship with, 202–3 EAW, 204–6, 222 Lisbon Treaty, 1, 87–88, 254 conferral of competence, 114–15 functional criminalisation, 117–19, 139–42 minimal rules, 119–20 securitised criminalisation, 115–17, 131–35 constitutionalisation of criminal law, 29 CJEU’s role, reforms to, 30 constitutional identity, 35, 40–41 decision-making reforms, 30 direct effect principle, 31–32 effectiveness of EU law, 35, 40–44 European Commission’s role, reforms to, 30–31 indirect effect principle, 32–34 primacy of EU law, 35, 37–38, 40–42 defendants’ rights access to a lawyer, right to, 258 information, right to, 258 interpretation and translation, right to, 257 judicial cooperation, 257 mutual recognition principle, 257–58 fundamental rights, protection of, 45–47 mutual recognition, 294–95

Lissabon-Urteil case, 125–27 loyal cooperation, 11, 21–24, 35–36, 92, 100–2, 227, 231, 233–35, 696 Maastricht Treaty: third pillar, 1, 5–7 deficiencies, 7–8 Melloni case, 35, 40–42 CFREU, 46 effectiveness of EU law mutual recognition principle, 212–16 mutual trust, 212–16 primacy of EU law, 212–16 migration and migration control: cooperation developments, 469–73 databases Entry/Exit System, 481 ETIAS, 481 Eurodac, 481 VIS, 481 EAW Framework immigration and criminal law confused, 326–27 Hague Action Plan, 505–6 illegal immigration, 107–8, 620 Ministerio Fiscal case: e-Privacy Directive, 574–75 money laundering: EU-UK TCA, 711–12 central (responsible) authority, 714–15 deadlines, 712 freezing/confiscation orders, 713–14 investigative assistance, 712 refusal to cooperate, 712–13 EU law, 614–15 globalisation of criminal law Vienna Convention and EU law distinguished, 613–15 Money Laundering Directives, 614 Money Laundering Directives, 96–97, 99, 549–52, 555–58, 614–15, 696 FATF, relationship with, 632–36 MONEYVAL, 632, 634, 637–38 Multiple Identity Detector (MID), 519–21 mutual legal assistance: EU-UK TCA, 708–10 EU–US Agreements on Mutual Legal Assistance, 660, 663 Mutual Legal Assistance Convention 2000 joint investigation teams, 367–69, 709–10 mutual recognition principle, 86 application, 198 automaticity in interstate cooperation, 199 citizenship law, 323, 325–26 defendants’ rights, 257–58

770 Index dual criminality, 202–3 enforcement, 201–2 Framework Decisions, 199–200 Hague Action Plan, 197 introduction, 196–97 judicial authority, see judicial authority mutual trust, relationship with, 202 ne bis in idem principle, relationship with, 149–50 Opinion 2/13, 216–17 Tampere Action Plan, 197 Transfer of Sentenced Persons Framework, 328–29 victims’ rights, 299–301, 309–11 mutual trust: Aranyosi case, 223–26 ECtHR response, 226–28 German Constitutional Court’s response, 228–30 autonomous concepts judicial authority, 242–51 constitutional identity, as a challenge to, 218 ECtHR response, 218–19 national courts’ response, 219–23 EAW Framework Decision, 26, 77, 200–1 Advocaten voor de Wereld VZW case, 203–6 citizenship law, 323, 325–26 dual criminality, 203, 206–7 equality principle, 203–7 fundamental rights, protection of, 207–9 Grundza case, 206–7 minor offences, 212 non-discrimination principle, 203–7 proportionality of detention, 209–11 proportionality principle, 209–12 Radu case, 208, 210–12 judicial authority, see judicial authority Melloni case, 212–16, 234–35 mutual recognition and blind trust, 202 concerns, 218–19 Opinion 2/13, 216–17 opt-outs, impact of, 75–77 post-Aranyosi, 230 fundamental rights limits, 230–35 Dorobantu case, 232–35 ML case, 230–32 rule of law limits, 235–42 rule of law, relationship with, 77–86, 235 Aransyosi test, 235–42, 252–53 LM case, 235–37 transatlantic counter-terrorism cooperation, 658–59, 663–64, 691–92 EU values, impact on, 661–63 EU–US Agreements on Extradition, 660

EU–US Agreements on Mutual Legal Assistance, 660, 663 EU-US Agreements, 659–63, 691–92 EU–US PNR Agreements, 660–61, 663 EU–US TFTP Agreement, 660, 661, 663 executive/operational agreements, 660 global security standards, development of, 677–78 internalisation, 676–77 monitoring and review, 667–70 operational oversight, 664–67 post-Schrems II, 681–91 presumption of adequacy, 670–74 reciprocity, 674–76 transatlantic privacy framework, development of, 678–81 US-Eurojust agreements, 660 US-Europol agreements, 660 national criminal law: Community law, impact of assimilation principle, 93–94 effectiveness of Community law, 92–93 limits, 91–92 proportionality, 91–92 Community law, impact on legal certainty principle, 94 retroactive application principle, 94–95 ne bis in idem principle: CFREU, 148, 151 compatibility with CISA enforcement condition, 164–68 CISA, 150–51, 153–54 enforcement condition, 164–68 concurrent jurisdiction, 171 conflicts of jurisdiction, 171–80 ECHR, 148, 151–52 external consistency, 193–94 forum shopping, 155 human rights function, 148–49 ICCPR, 148 internal consistency, 194–95 mutual recognition, relationship with, 149–50 non-lieu decisions, 156–57 parameters, 149 prosecutions on same facts, 153–54, 159–64 criminal and administrative proceedings, 180–91 rule of law function, 148–49 time-barred prosecutions, 155 transposition from national to EU law, 168–71 Turansky principle, 157–58 transnational ne bis in idem, 152 bis/twice element, 153–59 idem/offence already judged element, 159–64

Index 771 necessity principle, 127–28 non-discrimination principle, 45, 91–92 citizenship law, 323–24, 328, 335 criminal record information, 527, 530–31 EAW Framework Decision, 203–7, 321, 323–24, 328 processing data for research and innovation purposes, 387, 490 nullum crimen sine lege, see legality principle Opinion 2/13 (EU accession to ECHR): autonomy of EU legal order, 216–17 fundamental rights, protection of, 216–17 mutual recognition principle, 216–17 mutual trust, 216–17 opt-outs: EPPO, 438 Europol Regulation Denmark, 355–56 UK and Ireland, 356–57 Schengen membership, 76–77 Denmark, 75–76 UK and Ireland, 76 organised crime: human trafficking, 622–23 penalties, 134 securitised criminalisation, 131–35, 615–16 transnational organised crime Palermo Convention and EU law distinguished, 615–23 Palermo Convention, see UN Convention against Organised Crime Palma Document, 3 parliamentary oversight: Europol, 380–82 OLAF, 424–25 Passenger Name Records (PNR), 521 private sector involvement, 585–89 airline carriers, 589–90 data transfer, 591 privacy, data protection and citizenship concerns, 590, 592 respect for private life, 592 risk assessment, 590–91 PI case: expulsion of EU citizens sexual exploitation of a minor, 340–46 PIF Directive (2017/1731/EU), 41–42, 123, 180–81, 447–48 see also Protection of the Union’s Financial Interests police cooperation, 3–4, 26, 70–71 Brexit, 693–94 CEPOL, 465–66

CFSP, 63 databases, 481–82, 523–24 SIS, 499–500 supervision, 605–6, 609–10 VIS, 507–8 e-evidence, 609–10 exchange of information between police authorities, 531–36 Fundamental Rights Agency, 476 Maastricht Treaty, 5–6 PIF Directive, 554–55 Police Chiefs’ Task Force, 465–66 Prüm Convention, 536–45 Road Traffic Offences Directive, 49–50 Schengen Implementing Convention, 169 subsidiarity principle, 72–73 transnational organised crime, 615–16 see also Europol political stability, fears for: Soviet Bloc, collapse of, 3–4 pre-trial detention, 284 corpus juris, 454 e-evidence, 595–96 EPPO activities, 451 European Evidence Warrant, 199–200, 442–43 procedural rights, 259, 269, 273 children’s rights, 274–75 defendants’ rights, 282–84 victims’ rights, 316 proportionality, 704–5 preliminary references: EAW Framework Decision, 203–4, 208 citizenship issues, 321–22, 337 mutual recognition and mutual trust, 218, 223–26, 228–30, 235 effective judicial protection, 15–17 emergency preliminary ruling procedure, 16–17 EPPO acts, 453–54 choice of forum, 177–78 EU-UK TCA, 721 Europol Convention, interpretation of, 351–52, 377–378 indirect effect, 32–33 jurisdiction, 30 legality principle, 39–40 money laundering, 503 mutual recognition and mutual trust, 218, 223–26, 228–30, 235, 681 GDPR, compatibility with, 688 Privacy Shield, compatibility with, 684 ne bis in idem principle, 149–50, 162, 189 PNR Directive, 591–92

772 Index privatisation of information exchange, 585 Digital Rights Ireland case, 562–63 Privacy International case, 576 La Quadrature du Net and Others, 576 Tele2 Sverige and Watson case, 568–69 right to make a reference, 15 treaty framework, 13–14 validity of administrative decisions, 194 presumption of innocence, 277–82 primacy of EU law, 18 constitutionalisation of criminal law, 35, 37–38, 40–42 Kadi I case, 645–49 Kadi II case, 654–55 Melloni case, 212–16 privacy: data retention e-Privacy Directive, 558–59 Europol databases, 484–88 privacy by design approach, 484–85 privacy concerns, 487–88 Privacy International case, 575–77 La Quadrature du Net and Others case, 577, 580, 583–84 Ministerio Fiscal case e-Privacy Directive, 574–75 PNR concerns, 590, 592 Privacy International case, 575–77 privatisation of information exchange FIUs, 556 retention of electronic communication metadata, 558–59, 575–77 La Quadrature du Net and Others case, 577, 580 e-Privacy Regulation negotiations, impact on, 583–84 transatlantic privacy framework, development of, 678–81 see also data protection Privacy International case: use of bulk communication data, 575–77 privatisation of information exchange: anti-money laundering, 548–49 diversity of national models, 549–50, 556–57 FATF recommendations, 549, 551 FIUs, 549–57 FIUs, 549–51 diversity of national models, 549–50, 556–57 enhanced powers, 553–54 EU FIU, proposals for, 557 functioning and cooperation rules, 555–56 limits to cooperation, 552–53 mutual recognition principle, 552 obstacles to access to information, 554–55 privacy and protection of personal data, 556 shortcomings, 551–52

Panama Papers incident, 553 passenger data, 585–92 retention of electronic communication metadata, 558 bulk retention, 558–59 Data Retention Directive, 559–60 Digital Rights Ireland case, 562–68 e-Privacy Directive, 558–59 generalised and indiscriminate surveillance, 562–68 Ireland v European Parliament and Council, 562 Ministerio Fiscal case, 574–75 national constitutional concerns, 560–62 Privacy International case, 575–77 La Quadrature du Net and Others case, 577–85 Tele2 Sverige and Watson cases, 568–73 probation orders: mutual recognition principle, 199–200 profiling: data collection, processing and retention private sector involvement, 600 proportionality principle: CFREU, 129–30 Community law national criminal law, impact of, 91–92 Digital Rights Ireland case Data Retention Directive, 564–65 fundamental rights, protection of, 564–65 EAW Framework Decision, 209 minor offences, 212 proportionality of detention, 209–11 EIOs, 212, 705 mutual trust EAW Framework Decision, 209–12 national data retention schemes, 568–70 proportionality assessments, 570–71 pre-trial detention, 704–5 private sector involvement in evidence transfer, 595–96 surrender and arrest warrants, 704–5 terrorist sanctions, 56 Protection of the Union’s Financial Interests (PIF Directive), 41 criminal law and administrative law combined, 180–81 EPPO competences, 123, 447–48 legality principle, 42 Prüm Convention, 28–29 biometric data, 543 data exchange, 536–45 police cooperation, 536–45

Index 773 La Quadrature du Net and Others case: retention of telecommunications traffic and location data, 577 admissibility in criminal proceedings, 581 duration of retention, 579–80, 582 e-Privacy Regulation negotiations, impact on, 583–84 general and indiscriminate retention, 579, 582–83 isolation of IP addresses, 581–82 national security ground, 578 public interest objective, 580–81 public security ground, 578–79 rights to privacy, data protection and freedom of expression, 580 racism and xenophobia: hate speech, criminalisation of, 135–39 Radu case: EAW Framework Decision, 208, 210–12 rehabilitation of offenders, 328–30, 338–40, 347 religious hatred, 136–37 res judicata, 189–90 retroactivity principle, 21, 24, 33–34, 41, 94–95, 130, 654 right not to be tried or punished twice, see ne bis in idem principle right of access to a lawyer, see access to a lawyer, right to right of initiative, 12, 69–71 right to legal aid, see legal aid, right to rights of suspects and defendants, see defendants’ rights Road Traffic Offences Directive (2011/82/EU): conferral of competence criminal law and transport policy, relationship between, 49–52 rule of law: Aranyosi case challenges to rule of law, 237–42 LM case, 235–37 Central and Eastern Europe, 78–80 Cooperation and Verification Mechanism, 82–84 ex post monitoring, 83–84 implementation concerns, 81–82 infringement procedures, 84–86 prevention and sanction mechanisms, 84–86 safeguard clauses, 80 conditionality and trust, 78 Cooperation and Verification Mechanism, 82–84 implementation of EU budget, 86 judicial cooperation, relationship with, 84–85 mutual recognition principle, 86

mutual trust, relationship with, 77–86 Aransyosi test, 235–42, 252–53 LM case, 235–37 rule of law test, 235–42, 252–53 ne bis in idem principle, 148–49 sincere cooperation principle, 86 Schengen acquis: EES, 518 ETIAS, 518 Frontex, 472 integration into EU law, 3–4, 8–9, 28, 79–80 ne bis in idem principle, 149, 151, 153–54 opt-outs, 76–77 SIS, 518 UK and Ireland, 76 VIS, 507–8, 518 Schengen Agreement (1985), 3 opt-outs, 76–77 Schengen Information System (SIS), 77, 491–93 2018 amendments, 498–502 access and use of data, 496–97, 501 alerts, 495–96, 499–500 data retention, 501–2 Europol alerts, 502 nature and use of personal data, 494–95 processing personal data, 497–98, 500–1 SIS II, 493–4 surrender and arrest warrants, 707–8 scrutiny and transparency: data retention, 608–11 Europol, 381–83 see also accountability Shrems II case: CJEU ruling, 688–91 compatibility of Privacy Shield and EU law, 684–87 effective remedy, 687–88 transatlantic data transfers and applicability of EU law, 681–84 Secure Information Exchange Network Application (SIENA), 363 securitised criminalisation, 4, 27, 115–17, 612–13 reforms organised crime, 131–35, 615–16 Ship-Source Pollution case, 108–13 sincere cooperation principle, 70, 83, 86, 167, 231, 332, 463–64, 479 Soviet Bloc, collapse of, 3–4 Spanish Constitutional Court: fundamental rights, protection of, 219–20 spill-over effect, 2–3, 27, 52, 198, 468

774 Index state sovereignty, 1 sovereignty concerns, 67 emergency brake, 68–69 see also subsidiarity principle Stockholm Programme, 27, 69–70, 127–28, 130, 260, 277 EU Counter-Terrorism Coordinator, 469 Europol, 354–55 inter-agency cooperation, 473–74 victims’ rights, 317 subsidiarity principle, 72–75 EPPO, 437–38 judicial cooperation, 72–73 police cooperation, 72–73 terrorist sanctions, 56 supervision: EPPO, 439–40, 442 data processing activities, 456 OLAF investigations, 424–25 personal data processing see European Data Protection Supervisor supremacy, see primacy of EU law surrender and arrest warrants: EU-UK TCA dual criminality, 706 forms, 703 grounds for refusal, 704 judicialization, 703 political offence exception, 705 proportionality, 704–5 scope, 703 SIS II participation, 707–8 surrender of own nationals, 706–7 terminology, 702 time limits, 703 SWIFT system, 661, 664, 667, 691 Tampere Action Plan (1999), 25–26, 27 Eurojust, 393–94 offences falling within remit of Eurojust, 393–94 relationship with other bodies, 394–95 status and powers of Eurojust, 394 mutual recognition principle, 197 Taricco case, 35–36, 38–44 technological advancements: data protection, 607 security, 492–93, 607, 611 SIS II, 492–93 see also databases Tele2 Sverige and Watson cases: national data retention schemes, 568–70 compatibility with EU law, 570–73

proportionality assessment, 570–71 terrorism: cooperation developments, 466–69 terrorist financing: Europol, 666 money laundering, relationship with, 548–58, 633–38 EU-UK TCA, 711–15 FATF, 631, 633–38 UNSC Resolution, 15, 640–54 counter-terrorism normative standards, 638–41 Kadi I case, 645–49 Kadi II case, 649–55 preventive counter-terrorism sanctions, 639–40 terrorist sanctions: conferral of competence, 52–54 third countries: EPPO, relationship with, 462–64 EU-US Agreements, 691–92 EU values, impact on, 661–63 EU–US Agreements on Extradition, 660 EU–US Agreements on Mutual Legal Assistance, 660, 663 EU–US PNR Agreements, 660–61, 663 EU–US TFTP Agreement, 660, 661, 663 executive/operational agreements, 660 US-Eurojust agreements, 660 US-Europol agreements, 660 Eurojust, relationship with, 412 Europol, relationship with, 384–85 extradition requests from third countries, 331–36 UK as a, 693, 701 see also EU-UK Trade and Cooperation Agreement transatlantic counter-terrorism cooperation: mutual trust, 658–59, 663–64, 691–92 EU values, impact on, 661–63 EU–US Agreements on Extradition, 660 EU–US Agreements on Mutual Legal Assistance, 660, 663 EU-US Agreements, 659–63, 691–92 EU–US PNR Agreements, 660–61, 663 EU–US TFTP Agreement, 660, 661, 663 executive/operational agreements, 660 global security standards, development of, 677–78 internalisation, 676–77 monitoring and review, 667–70 operational oversight, 664–67 post-Schrems II, 681–91

Index 775 presumption of adequacy, 670–74 reciprocity, 674–76 transatlantic privacy framework, development of, 678–81 US-Eurojust agreements, 660 US-Europol agreements, 660 transfer of sentenced persons, 321, 329–30 mutual recognition principle, 199–200, 328–29 TREVI, 2, 350 Tsakouridis case: expulsion of EU citizens imperative grounds of public security, 337–40 ultima ratio principle, 127–30 UN Convention against Corruption 2003, 613, 623–27 UN Convention against Drug Trafficking 1988, 613, 613–15 UN Convention against Organised Crime (Palermo Convention) 2000, 613 Palermo Convention and EU law distinguished, 615–23 UN Office on Drugs and Crim (UNODC), 384, 486 UN Security Council (UNSC): EU implementation of UNSC Resolutions, 640–54 Kadi I case, 645–49 Kadi II case, 649–55 global administrative law, 638–39 counter-terrorism normative standards, 638–41 preventive counter-terrorism sanctions, 639–40 United Nations: Convention against Corruption 2003, 613, 623–27

Convention against Drug Trafficking 1988, 613–15 Convention against Organised Crime (Palermo Convention) 2000, 613, 615–23 United States: EU-US Agreements, 691–92 EU values, impact on, 661–63 EU–US Agreements on Extradition, 660 EU–US Agreements on Mutual Legal Assistance, 660, 663 EU–US PNR Agreements, 660–61, 663 EU–US TFTP Agreement, 660, 661, 663 executive/operational agreements, 660 US-Eurojust agreements, 660 US-Europol agreements, 660 victims and victims’ rights, 296–97, 318–19 constitutional implications, 305–8 defendants’ rights, impact on, 304–5 EU law’s impact on national law, 308–9 harmonisation, 311–15 mutual recognition, 309–11 establishing victims’ rights, 297–98 free movement rights, 298–99 harmonisation of national systems, 301–5, 311–15 minimum standards, 302–3, 308 mutual recognition principle, 299–301 provision of information and support, 303 specific protection needs, 303 standing of victims, 301–2, 307–8 strengthening of victims’ position, impact of, 315–18 Vienna Convention against Illicit Trafficking in Narcotic Drugs and Psychotropic Substances (1988), 613–14 Visa Information System (VIS), 481 access to information systems, 506–10 World Customs Organization, 384, 486

776