Friday, 4 August 2017

Transferring personal data outside the EU: Clarification from the ECJ?

Lorna Woods, Professor of Internet Law, University of Essex

Opinion 1/15 EU/Canada PNR Agreement, 26th July 2017


Canadian law required airlines, in the interests of the fight against serious crime and terrorism, to provide certain information about passengers (API/PNR data), which obligation required airlines under EU data protection regulations to transfer data to outside the EU.  The PNR data includes the names of air passengers, the dates of intended travel, the travel itinerary, and information relating to payment and baggage. The PNR data may reveal travel habits, relationships between two individuals, information on the financial situation or the dietary habits of individuals. To regularise the transfer of data, and to support police cooperation, the EU negotiated an agreement with Canada specifying the data to be transferred, the purposes for which the data could be used, as well as some processing safeguard provisions (e.g. use of sensitive data, security obligations, oversight requirements, access by passengers).  The data was permitted to be retained for five years, albeit in a depersonalised form.  Further disclosure of the data beyond Canada and the Member States was permitted in limited circumstances.  The European Parliament requested an opinion from the Court of Justice under Article 218(11) TFEU as to whether the agreement satisfied fundamental human rights standards and whether the appropriate Treaty base had been used for the agreement.


The Court noted that the agreement fell within the EU’s constitutional framework, and must therefore comply with its constitutional principles, including (though this point was not made express), respect for fundamental human rights (whether as a general principle or by virtue of the EU Charter – the EUCFR).

After dealing with questions of admissibility, the Court addressed the question of appropriate Treaty base. It re-stated existing principles (elaborated, for example, in Case C263/14 Parliament v Council, judgment 14 June 2016, EU:C:2016:435) with regard to choice of Treaty base generally: the choice must rest on objective factors (including the aim and the content of that measure) which are amenable to judicial review.  In this context the Court found that the proposed agreement has two objectives: safeguarding public security; and safeguarding personal data [opinion, para 90].  The Court concluded that the two objectives were inextricably linked: while the driver for the need to PNR data was protection of public security, the transfer of data would be lawful only if data protection rules were respected [para 94].  Therefore, the agreement should be based on both Article 16(2) (data protection) and Article 87(2)(a) TFEU (police cooperation).  It held, however, that Article 82(1)(d) TFEU (judicial cooperation) could not be used, partly because judicial authorities were not included in the agreement.

Looking at the issue of data protection, the Court re-stated the question as being ‘on the compatibility of the envisaged agreement with, in particular, the right to respect for private life and the right to the protection of personal data’ [para 119].  It then commented that although both Article 16 TFEU and Article 8 EUCFR enshrine the right to data protection, in its analysis it would refer to Article 8 only, because that provision lays down in a more specific manner the conditions for data processing.  The agreement refers to the processing of data concerning identified individuals, and therefore may affect the fundamental right to respect for private life guaranteed in Article 7 EUCFR as well as the right to protection to personal data in Article 8 EUCFR. The Court re-iterated a number of principles regarding the scope of the right to private life:

‘the communication of personal data to a third party, such as a public authority, constitutes an interference with the fundamental right enshrined in Article 7 of the Charter, whatever the subsequent use of the information communicated. The same is true of the retention of personal data and access to that data with a view to its use by public authorities. In this connection, it does not matter whether the information in question relating to private life is sensitive or whether the persons concerned have been inconvenienced in any way on account of that interference’ [para 124].

The transfer of PNR data and its retention and any use constituted an interference with both Article 7 [para 125] and Article 8 EUCFR [para 126]. In assessing the seriousness of the interference, the Court flagged ‘the systematic and continuous’ nature of the PNR system, the insight into private life of individuals, the fact that the system is used as an intelligence tool and the length of time for which the data is available.

Interferences with these rights may be justified.  Nonetheless, there are constraints on any justification: Article 8(2)  of the EU Charter specifies that processing must be ‘for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law’; and, according to Article 52(1) of the EU Charter, any limitation must be provided for by law and respect the essence of those rights and freedoms. Further, limitations must be necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others. 

Following WebMindLicenses (Case C‑419/14, judgment of 17 December 2015, EU:C:2015:832, para 81), the law that permits the interference should also set down the extent of that interference. Proportionality requires that any derogation from and limitation on the protection of personal data should apply only insofar as is strictly necessary. To this end and to prevent the risk of abuse, the legislation must set down ‘clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards’, specifically ‘indicat[ing] in what circumstances and under which conditions a measure providing for the processing of such data may be adopted’ [para 141], especially when automated processing is involved.

The Court considered whether there was a legitimate basis for the processing, noting that although passengers may be said to consent to the processing of PNR data, this consent related to a different purpose. The transfer of the PNR data is not conditional on the specific consent of the passengers and must therefore be grounded on some other basis, within the terms of Article 8(2) EUCFR. The Court rejected the Parliament’s submission that the meaning of ‘law’ be restricted to ‘legislative act’ internally. The Court, following the reasoning of the Advocate General, found that in this regard the international agreement was the external equivalent of the legislative act.

In line with its previous jurisprudence, the Court accepted that public security is an objective of public interest capable of justifying even serious interferences with Articles 7 and 8 EUCFR. It also noted that everybody has the right to security of the person (Art. 6 EUCFR), though this point was taken no further. The Court considered that PNR data revealed only limited aspects of a person’s private life, so that the essence of the right was not adversely affected [para 151]. In principle, limitation may then be possible. The Court accepted that PNR data transfer was appropriate, but not that the test of necessity was satisfied. It agreed with the Advocate General that the categories of data to be transferred were not sufficiently precise, specifically ‘available frequent flyer and benefit information (free tickets, upgrades, etc.)’, ‘all available contact information (including originator information)’ and ‘general remarks including Other Supplementary Information (OSI), Special Service Information (SSI) and Special Service Request (SSR) information’. Although the agreement required the Canadian authorities to delete any data transferred to them which fell outside these categories, this obligation did not compensate for the lack of precision regarding the scope of these categories.

The Court noted that the agreement identified a category of ‘sensitive data’; it was therefore to be presumed that sensitive data would be transferred under the agreement. The Court then reasoned:

any measure based on the premiss that one or more of the characteristics set out in Article 2(e) of the envisaged agreement may be relevant, in itself or in themselves and regardless of the individual conduct of the traveller concerned, having regard to the purpose for which PNR data is to be processed, namely combating terrorism and serious transnational crime, would infringe the rights guaranteed in Articles 7 and 8 of the Charter, read in conjunction with Article 21 thereof [para 165]

Additionally, any transfer of sensitive data would require a ‘precise and particularly solid’ reason beyond that of public security and prevention of terrorism. This justification was lacking. The transfer of sensitive data and the framework for the use of those data would be incompatible with the EU Charter [para 167].

While the agreement tried to limit the impact of automated decision-making, the Court found it problematic because of the need to have reliable models on which the automated decisions were made. These models, in the view of the Court, must produce results that identify persons under a ‘reasonable suspicion’ of participation in terrorist offences or serious transnational crime and should be non-discriminatory. Models/databases should also be kept up-to-date and accurate and subject to review for bias. Because of the error risk, all positive automated decisions should be individually checked.

In terms of the purposes for processing the data, the definition of terrorist offences and serious transnational crime were sufficiently clear. There were however other provisions, allowing case-by-case assessment.  These provisions (Article 3(5)(a) and (b) of the treaty) were found to be too vague.  By contrast, the Court determined that the authorities who would receive the data were sufficiently identified. Further, it accepted that the transfer of data of all passengers, whether or not they were identified as posing a risk or not, does not exceed what is necessary as passengers must comply with Canadian law and ‘the identification, by means of PNR data, of passengers liable to present a risk to public security forms part of border control’ [para 188].

Relying on its recent judgment in Tele2/Watson (Joined Cases C‑203/15 and C‑698/15, EU:C:2016:970), which I discussed here, the Court reiterated that there must be a connection between the data retained and the objective pursued for the duration of the time the data are held, which brought into question the use of the PNR data after passengers had disembarked in Canada.  Further, the use of the data must be restricted in accordance with those purposes. However,

where there is objective evidence from which it may be inferred that the PNR data of one or more air passengers might make an effective contribution to combating terrorist offences and serious transnational crime, the use of that data does not exceed the limits of what is strictly necessary [para 201].

Following verification of passenger data and permission to enter Canadian territory, the use of PNR data during passengers’ stay must be based on new justifying circumstances. The Court expected that this should be subject to prior review by an independent body. The Court held that the agreement did not meet the required standards.  Similar points were made, even more strongly, in relation to the use of PNR data after the passengers had left Canada. In general, this was not strictly necessary, as there would no longer be a connection between the data and the objective pursued by the PNR Agreement such as to justify the retention of their data. PNR data may be stored in Canada, however, when particular passengers present a risk of terrorism of serious transnational crime. Moreover, given the average lifespan of international serious crime networks and the duration and complexity of investigations relating to them, the Court did not hold that the retention of data for five years went beyond the limits of necessity [para 209].

The agreement allows PNR data to be disclosed by the Canadian authority to other Canadian government authorities and to government authorities of third countries. The recipient country must satisfy EU data protection standards; an international agreement between the third country and the EU or an adequacy decision would be required. There is a further, unlimited and ill-defined possibility of disclosure to individuals ‘subject to reasonable legal requirements and limitations ... with due regard for the legitimate interests of the individual concerned’. This provision did not satisfy the necessity test.

To ensure that the individuals’ rights to access their data and to have data rectified is protected, in line with Tele2/Watson, passengers must be notified of the transfer of their PNR data to Canada and of its use as soon as that information is no longer liable to jeopardise the investigations being carried out by the government authorities referred to in the envisaged agreement. In this respect, the agreement is deficient. While passengers are told that the data will be used for security checks/border control, they are not told whether their data has been used by the Canadian Competent Authority beyond use for those checks.  While the Court accepted that the agreement provided passengers with a possible remedy, the agreement was deficient in that it did not guarantee in a sufficiently clear and precise manner that the oversight of compliance would be carried out by an independent authority, as required by Article 8(3) EUCFR.


There are lots of issues in this judgment, of interest from a range of perspectives, but its length and complexity means it is not an easy read. Because of these characteristics, a blog – even a lengthy blog – could hardly do justice to all issues, especially as in some instances, it is hardly clear what the Court’s position is.

On the whole the Court follows the approach of its Advocate General, Mengozzi, on a number of points specifically referring back to his Opinion. There is, as seems increasingly to be the trend, heavy reliance on existing case law and it is notable that the Court refers repeatedly to its ruling in Tele2/Watson.  This may be a judicial attempt to suggest that Tele2/Watson was not an aberration and to reinforce its status as good law, if that were in any doubt. It also operates to create a body of surveillance law rulings that are hopefully consistent in underpinning principles and approach, and certainly some of the points in earlier case law are reiterated with regards to the importance of ex ante review by independent bodies, rights of redress and the right of individuals to know that they have been subject to surveillance.

The case is of interest not only in regards mass surveillance but more generally in relation to Article 16(2) TFEU. It is also the first time an opinion has been given on a draft agreement considering its compatibility with human rights standards as well as the appropriate Treaty base. In this respect the judgment may be a little disappointing; certainly on Article 16, the Court did not go into the same level of detail as in the AG’s opinion [AG114-AG120]. Instead it equated Article 16 TFEU to Article 8 EUCFR, and based its analysis on the latter provision.

As a general point, it is evident that the Court has adopted a detailed level of review of the PNR agreement.  The outcome of the case has widely been recognised as having implications, as –for example – discussed earlier on this blog.  Certainly, as the Advocate General noted, possible impact on other PNR agreements [AG para 4] which relate to the same sorts of data shared for the same objectives.  The EDPS made this point too, in the context of the EU PNR Directive:

Since the functioning of the EU PNR and the EU-Canada schemes are similar, the answer ofthe Court mayhave a significant impact on the validity of all other PNR instruments …. [Opinion 2/15, para 18]

There are other forms of data sharing agreement, for example, SWIFT, the Umbrella Agreement,  the Privacy Shield (and other adequacy decisions) the last of which is coming under pressure in any event (DRI v Commission (T-670/16) and La Quadrature du Net and Others v Commission (T-738/16)).  Note that in this context, there is not just a question of considering the safeguards for protection of rights but also relates to Treaty base.  The Court found that Article 16 must be used and that – because there was no role for judicial authorities, still less their cooperation – the use of Article 82(1)(d) is wrong.  It has, however, been used for example in regards to other PNR agreements.  This means that that the basis for those agreements is thrown into doubt.

While the Court agreed with its Advocate General to suggest that a double Treaty base was necessary given the inextricable linkage, there is some room to question this assumption.  It could also be argued that there is a dominant purpose, as the primary purpose of the PNR agreement is to protect personal data, albeit with a different objective in view, that of public security. In the background, however, is the position of the UK, Ireland and Denmark and their respective ‘opt-outs’ in the field. While a finding of a joint Treaty base made possible the argument of the Court that:

since the decision on the conclusion of the envisaged agreement must be based on both Article 16 and Article 87 TFEU and falls, therefore, within the scope of Chapter 5 of Title V of Part Three of the FEU Treaty in so far as it must be founded on Article 87 TFEU, the Kingdom of Denmark will not be bound, in accordance with Articles 2 and 2a of Protocol No 22, by the provisions of that decision, nor, consequently, by the envisaged agreement. Furthermore, the Kingdom of Denmark will not take part in the adoption of that decision, in accordance with Article 1 of that protocol. [para 113, see also para 115]

The position would, however, have been different had the agreement be found to have been predominantly about data protection and therefore based on Article 16 TFEU alone.

Looking at the substantive issues, the Court clearly accepted the need for PNR to challenge the threat from terrorism, noting in particular that Article 6 of the Charter (the “right to liberty and security of person”) can justify the processing of personal data. While it accepted that this resulted in systemic transfer of large quantities of people, we see no comments about mass surveillance. Yet, is this not similar to the ‘general and indiscriminate’ collection and analysis rejected by the Court in Tele2/Watson [para 97], and which cannot be seen as automatically justified even in the context of the fight against terrorism [para 103 and 119]? Certainly, the EDPS took the view in its opinion on the EU PNR Directive that “the non-targeted and bulk collection and processing of data of the PNR scheme amount to a measure of general surveillance” [Opinion 1/15, para 63]. It may be that the difference is in the nature of the data; even if this is so, the Court does not make this argument. Indeed, it makes no argument but rather weakly accepts the need for the data.  On this point, it should be noted that “the usefulness of large-scale profiling on the basis of passenger data must be questioned thoroughly, based on both scientific elements and recent studies” [Art. 29 WP Opinion 7/2010, p. 4]. In this aspect, Opinion 1/15 is not as strong a stand as Tele2/Watson [c.f para 105-106]; it seems that the Court was less emphatic about significance of surveillance even than the Advocate General [AG 176].

In terms of justification, while the Court accepts that the transfer of data and its analysis may give rise to intrusion, it suggests that the essence of the right has not been affected. In this it follows the approach in the communications data cases.  It is unclear, however, what the essence of the right is; it seems that no matter how detailed a picture of an individual can be drawn from the analysis of data, the essence of the right remains intact.  If the implication is that where the essence of the right is affected then no justification for the intrusion could be made, a narrow view of essence is understandable.  This does not, however, answer the question of what the essence is and, indeed, whether the essence of the right is the same for Article 7 as for Article 8.  In this case, the Court has once again referred to both articles, without delineating the boundaries between them, but then proceeded to base its analysis mainly on Article 8.

In terms of relationship between provisions, it is also unclear what the relationship is between Art 8(2) and Art 52.  The Court bundles the requirements for these two provisions together but they serve different purposes. Article 8(2) further elaborates the scope of the right; Article 52 deals with the limitations of Charter rights.  Despite this, it seems that some of the findings will apply Article 52 in the context of other rights. For example, in considering that an international agreement constitutes law for the purposes of the EUCFR, the Court took a broader approach to meaning of ‘law’ than the Parliament had argued for.  This however seems a sensible approach, avoiding undue formality. 

One further point about the approach to interpreting exceptions to the rights and Article 52 can be made. It seems that the Court has not followed the Advocate General who had suggested that strict necessity should be understood in the light of achieving a fair balance [AG207].
Some specific points are worth highlighting. The Court held that sensitive data (information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, information about a person’s health or sex life) should not be transferred. It is not clear what interpretation should be given to these data, especially as regards proxies for sensitive data (e.g. food preferences may give rise to inferences about a person’s religious beliefs).

One innovation in the PNR context is the distinction the Court introduced between use of PNR data on entry, use while the traveller is in Canada, and use after the person has left, which perhaps mitigates the Court’s acceptance of undifferentiated surveillance of travellers.  The Court’s view of the acceptability of use in relation to this last category is the most stringent.  While the Court accepts the link between the processing of PNR data on arrival, after departure the Court expects that link to be proven, and absent such proof, there is no justification for the retention of data. Does this mean that on departure PNR data of persons who are not suspected of terrorism or transnational crime should be deleted at the point of their departure? Such a requirement surely gives rise to practical problems and would seem to limit the Court’s earlier acceptance of the use of general PNR data to verify/update computer models [para 198].

One of the weaknesses of the Court’s caselaw so far has been a failure to consider investigatory techniques, and whether all are equally acceptable.  Here we see the Court beginning to consider the use of automated intelligence techniques.  While the Court does not go into detail on all the issues to which predictive policing and big data might give rise, it does note that models must be accurate.  It also refers to Article 21 EUCFR (discrimination).  In that this section is phrased in general terms, it has potentially wide-reaching application, potentially even beyond the public sector.

The Court’s judgment has further implications as regards the sharing of PNR and other security data with other countries besides Canada, most notably in the context of EU/UK relations after Brexit. Negotiators now have a clearer indication of what it will take for an agreement between the EU and a non-EU state to satisfy the requirements of the Charter, in the ECJ’s view. Time will tell what impact this ruling will have on the progress of those talks.

Barnard & Peers: chapter 25
JHA4: chapter II:9

Photo credit:

Sunday, 23 July 2017

The new EU law on refugees takes shape: More Harmonisation but Less Protection?

Professor Steve Peers

At the heart of the contested issue of asylum in the EU – including the current perceived ‘refugee/migrant crisis’ – is the definition of who is a ‘refugee’, or is at least entitled instead to a form of ‘subsidiary protection’ for those fleeing threats of ‘serious harm’. Refugees and people with subsidiary protection receive more legal protection and status than many other non-EU citizens, in particular irregular migrants.

Unsurprisingly then, the proposed revision of the EU legislation on this issue forms part of the broader overhaul of all EU asylum laws proposed in 2016, as a response to the perceived crisis. Recently the EU governments agreed their position on the proposal, which must now be negotiated with the European Parliament (its negotiating position is set out here).

Most of the other 2016 proposals are still under negotiation (I’ll discuss them as part of an update of recent EU immigration and asylum developments, coming soon). But since the ‘qualification’ rules are a cornerstone of EU asylum law, the latest development calls for a more in-depth analysis. In particular, will the new law meet the Commission’s objectives for dealing with the ‘crisis’: more harmonisation, an overall reduction in protection standards, and deterrents for ‘secondary’ movements between Member States?

The proposal aims to implement the UN Refugee Convention (which the EU refers to as the ‘Geneva Convention’) in more detail, as regards both the definition of ‘refugee’ and the rights which refugees receive. It also defines ‘subsidiary protection’ and sets out the rights which subsidiary protection beneficiaries are entitled to.

It will replace the existing EU law on the subject. As part of the ‘first phase’ of the Common European Asylum System (CEAS), an initial Qualification Directive was adopted in 2004. A ‘second phase’ Qualification Directive replaced it in 2011. (I analysed the negotiation of the latter Directive here; there’s also a lengthy analysis of it by Madeline Garlick and Violeta Moreno Lax in EU Immigration and Asylum Law: Text and Commentary). The UK and Ireland opted in to (and are still bound by) the first phase Directive, but not the second phase Directive or the 2016 proposal; Denmark is not bound by any of them. After Brexit, UK citizens will be able to apply for asylum in the EU.

Basic legal framework

To give effect to the objective of further harmonisation, the 2016 proposal will replace the 2011 Directive with a Regulation, with the consequence that EU law on this subject will be directly applicable, rather than applying through the medium of national legislation giving effect to a Directive. To the same end, the Regulation will also eliminate Member States’ power in the current law to set more favourable standards as long as they are compatible with the Directive – although this power has already been curtailed by the ECJ’s judgments in B and D and M’Bodj (the latter ruling is discussed here). The new Regulation will reflect that case law, by noting that Member States are free to retain or establish a separate status of humanitarian protection, as long as there is no confusion with the (EU harmonised) notions of refugee or subsidiary protection status.

This shift toward harmonisation is also manifested by a removal of most options under the Directive, with the effect of lowering standards overall, since most of the options are possibilities for Member States to offer less protection than under the standard rules. On the other hand, the Commission’s desire to have the new law play a role in immediate ‘crisis management’ would be thwarted by Member States, who want the law to apply in two years’ time – rather than the six months desired by the Commission. (Note that the EP wants it to apply even more quickly than the Commission, though).

Turning to the details of the proposal, there are four main elements to the law: common rules (applying to both refugee and subsidiary protection status); the definition of ‘refugee’; the definition of subsidiary protection; and the content of status (ie the benefits people with status receive).

Common rules

Family members of refugees and people with subsidiary protection will be given extra rights in the new law (see below), and they will be defined slightly more broadly. A ‘family member’ will now include relationships formed outside the country of refuge, not just those formed inside the country or origin. This means, for instance, that the spouse of a Syrian refugee who married him while in Turkey or Lebanon, and the children of that couple born in such countries, would now be defined as ‘family members’.

The rules on assessment of asylum applications will be extended to include refugees resettled directly from non-EU countries, assuming that a separate proposal on resettlement is agreed. It will now be mandatory, not optional, for the main burden of proof to rest upon the applicant to show why the claim for refugee or subsidiary protection status is justified; and a new clause in the preamble will reflect the ECJ’s 2014 case law (discussed here) which limits the intrusiveness of Member States’ questioning of the credibility of LGBTI asylum-seekers.  

Next, the new law will harmonise the use of an exception to the rules – and lower the standards of protection. While the Regulation will retain the notion of an application for refugee or subsidiary protection status ‘sur place’ – meaning the asylum seeker left the allegedly unsafe country of origin before it became unsafe – the exception to this rule will become mandatory. At present, this exception gives Member States an option to ‘normally’ refuse refugee status to an asylum seeker who has made a repeat application for asylum and created her own risk of persecution due to her activities after leaving the country of origin. The Commission proposal would extend this to subsidiary protection applications, and Member States want to go further – extending the (now mandatory) exception to initial applications as well, subject to a new threshold (the asylum-seeker’s activities were for the ‘sole or main purpose’ of making a claim for protection). For its part, the EP would keep the exception optional and limited to repeat applications, while also adding a safeguard for those asylum-seekers who (for example) ‘come out’ after arriving in the EU, having been previously afraid to express their sexuality.

Similarly, the option to refuse claims because the asylum seeker had an ‘internal flight alternative’ – ie he could have fled to a safe part of the country of origin, like a supposed ‘safe zone’ in Syria – would become mandatory. (The possibility of rejecting a claim because an asylum seeker would arguably have been safe in a different country is the subject of other proposals). The proposal makes this subject to safeguards: more elaborate explanation of the substance of the idea; applying the main rules on qualification first; shifting the burden of proof to the authorities; and not requiring the asylum seeker to show that he exhausted all possibilities to move within the country of origin. However, the Member States’ position would drop the latter two safeguards. For its part, the EP would keep this clause optional, drop the ‘sequencing’ rule, but add further safeguards.

Definition of ‘refugee’

The EU is bound by the Treaties to follow the UN Refugee Convention, so the proposed law retains the basic idea from that Convention that a ‘refugee’ is someone persecuted because of their race, religion, political opinion, nationality or particular social group, elaborating upon each of these concepts. The Commission proposal would clarify in the preamble that LGBT people can form part of a ‘particular social group’ (confirming ECJ case law), while the main text would confirm case law that asylum seekers can’t be expected to hide (for instance) their sexuality or religion in their countries of origin. The proposal would also tighten the definition of ‘particular social group’ in that asylum-seekers would have to show in all Member States that they both perceived themselves as part of a distinct group and were perceived as different by the rest of society. This would quash the discretion that Member States now have to set higher standards, so that only one of those elements is necessary to prove refugee status. Member States agree with this latter change, but the EP is resisting it.

As for exclusion from refugee status, where the current Directive elaborates a little on the relevant provisions of the Refugee Convention, the new Regulation would enshrine the basic elements of ECJ case law on the special status of some Palestinians (Bolbol and El Kott), and on the exclusion of persons strongly linked to terrorism (B and D; the preamble Member States’ version also takes account of the recent ECJ judgment in Lounani on the exclusion of foreign fighters, discussed here).

In contrast, the proposals on withdrawal of refugee status would tighten the existing law, making withdrawal mandatory in more cases and clarifying the link with similar provisions in the rest of the law (on that point, see the ECJ’s T judgment, discussed here). There would be a grace period to apply for another legal status and a mandatory review of status at least the first time a refugee’s residence permit came up for renewal. However, Member States reject the latter ideas (and the EP also rejects the review clause).

Definition of subsidiary protection

The core definition of subsidiary protection (a threat of serious harm deriving from the death penalty, torture or similar treatment, or facing a specified threat from armed conflict) would not be affected by the 2016 proposal – although the preamble would entrench the relevant ECJ case law (Elgafaji and Diakité). However, the rules on exclusion from and withdrawal of subsidiary protection status would be amended to (for the most part) match the parallel changes related to refugee status; and the Council and EP take a comparable view of these proposals. On one distinct point – withdrawing subsidiary protection status due to less serious crimes – the Member States reject the Commission’s proposal to make this ground mandatory, preferring to leave it optional for Member States.

Content of status

The 2016 proposal would make a number of interesting changes in this area. First of all, the Commission’s ambitious attempt to overturn the ECJ judgment in T, and make all benefits for refugees and persons with subsidiary protection contingent upon getting a residence permit, has been rejected by Member States and the EP.

Secondly, an amendment in the opposite direction: the family members of refugees or persons with subsidiary protection who don’t qualify themselves for international protection would be entitled to a residence permit. This would replace an ambiguous reference in the current law to preserving ‘family unity’. However, there are already special rules concerning the admission of family members of refugees set out in the EU’s family reunion Directive. So do two new sets of rules conflict? No, because a clause in the preamble to the agreed Qualification Regulation says that the family reunion Directive applies in the event of overlap (ie if the family member is ‘within the scope’ of the Directive).

Usually, the two laws will not overlap, for several reasons. A) the family reunion Directive does not apply to family reunion with sponsors with subsidiary protection, at least if that protection was granted on the basis of national or international law (sponsors with subsidiary protection on the basis of EU law are not expressly excluded, however). B) that Directive in principle only applies to family members who are outside the territory, whereas the Regulation conversely will only apply to family members who are present on the territory. However, Member States have an option to apply the Directive where family members are already present; only in that case would there be an overlap, decided in favour of the Directive where the family members are within the scope of it.

Thirdly, the Commission aimed for more harmonisation of the rules on renewal of residence permits, although the Member States prefer to leave themselves with more flexibility. It will be expressly mandatory to use the EU’s standard residence permit format for refugees and others covered by the Regulation though.

Fourthly, there will also be more harmonisation of the rules related to travel documents, which are issued by Member States to beneficiaries of international protection in place of passports, given that it would probably be unsafe for them to contact officials from their country of origin. They will be valid for at least one year and will be expressly subject to the EU’s passport security rules.

Fifthly, the provisions on movement within the territory and benefits would be redrafted, to take account of the ECJ case law in Alo and Osso (discussed here), which permits a link between limiting movements and the grant of benefits in some cases.

Sixthly, the rules on access to employment are strengthened by an obligation to ensure equal treatment as regards work-related matters, including taking account of experience in an occupation obtained outside the country of refuge.

Finally, there are further changes designed to entrench control over beneficiaries of international protection: Member States may make integration measures compulsory, and any unauthorised movement between Member States can be punished by ‘resetting the clock’ on acquisition of long-term residence status under the relevant EU law. Both Member States and the EP aim to soften these proposals by ensuring that integration courses are accessible and by allowing Member States to make exceptions from the changes to the long-term residence rule.


What impact will the agreed proposal (still subject to further negotiation) have on the perceived ‘refugee crisis’? Will it meet the objectives of deterring protection-related migration as well as secondary movements, while harmonising national law further?

Certainly there are significant steps towards harmonisation: the use of a Regulation; the removal of the right to set more favourable standards; the disappearance of many options; and the integration of relevant ECJ case law into the legislative text (making it more visible for national authorities, courts, and legal advisers). However, the European Parliament is still battling to keep some key rules optional, rather than mandatory.

This goes to the second point: will the new Regulation reduce standards as much as the Commission had hoped? Here, the result is a mixed bag: some of the changes in the definition of refugee will have that effect – unless the European Parliament successfully resists them. However, the idea of mandatory reviews of status has been dropped.

As for sanctioning secondary movements, the reset of the clock as regards obtaining long-term residence status might have some impact, although the main thrust of the planned sanctions against secondary movement are found in separate proposals for amendment of other asylum laws.

The deferral (at least by Member States) of the impact of the new law for two years means that the new law would (if this delay is accepted) have no immediate impact on the current perceived crisis. However, the changes it would make to the definition of refugee status may lead to fewer refugees being recognised – although again this is subject to the success or failure of the EP’s attempts to resist such changes. In any event, since many of the plans to deter both the initial and secondary movement of people arguably needing international protection appear in other 2016 proposals (on reception conditions, the Dublin system and procedural rules), the overall assessment of whether the EU is moving in a dramatically more restrictive direction as regards asylum law depends more upon what happens with those proposals over the months to come.

Barnard & Peers: chapter 26
JHA4: chapter I:5
Photo credit: Pinterest

*Disclaimer: I was an independent adviser for a consultancy advising the European Commission on the implementation of and possible amendment of the current Directive.

Wednesday, 19 July 2017

A Vanishing Breed? Walker v Innospec Ltd - The UK Supreme Court Disapplies a Statutory Provision on the Grounds of Incompatibility with EU Equality Law

Colm O’Cinneide, Professor of Law, UCL

Last week’s decision of the UK Supreme Court (UKSC) in the same-sex pension rights case of Walker v Innospec Ltd [2017] UKSC 47 generated plenty of excited commentary in the UK media. This mainly focused on the UKSC’s finding that it constitutes direct discrimination on the basis of sexual orientation – and thus a breach of EU law - for the rules of a employer’s contributory benefit scheme to deny payment of a ‘spouse’s pension’ to a surviving member of a same-sex married couple, in circumstances where such a pension would be paid to the surviving member of an opposite-sex married couple. This finding is obviously significant, both for its application at national level of the prohibition on direct discrimination on the basis of sexual orientation set out in Article 2 of the Framework Equality Directive 2000/78/EC, and also its concrete impact on the acquired pension rights of same-sex married couples in the UK. However, the media coverage glossed over two other important elements of the judgment, which are of especial interest from the perspective of EU law.

One of those elements relates to the complex issue of the temporal effects of a finding that national law is incompatible with EU legal requirements – namely the Court’s conclusion that, in Lord Kerr’s words at para. 56, ‘the point of unequal treatment occurs at the time that the pension falls to be paid’ and not when the benefit in question was accrued, and that no basis existed for limiting the retrospective effect of the judgment in line with the ECJ’s approach in Case C-262/88, Barber v Guardian Royal Exchange Assurance Group [1990] ECR I-1889.

The other neglected dimension to the case is of more general interest, especially in the run-up to Brexit – namely how the case resulted in the Supreme Court disapplying the provisions of Schedule 9 para. 18 of the UK Equality Act 2010, insofar as they permitted the type of discriminatory treatment at issue in the circumstances. In other words, in Walker, the obligation on national courts to give direct effect to the requirements of EU anti-discrimination legislation resulted in incompatible national legislation being set aside – perhaps one of the last times this happens before Brexit insulates UK parliamentary legislation from legal challenges based on EU law or other fundamental rights standards.

The case involved a legal challenge by a former employer of Innospec Ltd against their refusal to agree to pay a survivor’s pension to his same-sex spouse if he died first, even though such a benefit would have been paid out to Mr Walker’s spouse had she been a woman. Innospec Ltd justified this exclusion in part by reference to the provisions of Schedule 9 para. 18 of the 2010 Act, which permitted employers to restrict access to occupational benefits where the right to that benefit accrued before 5 December 2005 (the date same-sex couples became legally entitled to enter into civil partnerships).

At first instance, Mr Walker won his claim that he had been subject to direct and indirect discrimination on the grounds of sexual orientation, with the Employment Tribunal concluding that Schedule 9 para. 18 could be applied in a manner compatible with the relevant requirements of Directive 2000/78/EC. Subsequently, however, Innospec appealed successfully against that decision, with the Court of Appeal concluding that Mr Walker had been subject to direct discrimination on the basis of his sexual orientation but that the principles of ‘non-retroactivity’ and ‘future effect’ as developed in the case-law of the CJEU meant that the prohibition on discrimination applied only to benefits accruing after the transposition of the Directive in December 2003. (Mr Walker had taken early retirement in March 2003.)

This conclusion was criticised by Robert Wintemute amongst others, in particular in a case-note in the Industrial Law Journal in 2016 (‘Unequal Same-Sex Survivor’s Pensions: The EWCA Refuses to Apply CJEU Precedents or Refer’ (2016) 45(1) Ind Law J 89-100), and his criticisms were subsequently explicitly cited by Lord Kerr in giving the judgment of the majority of the Supreme Court reversing the decision of the lower court.

In brief, the Supreme Court initially applied the established case-law of the CJEU in cases such as Case C-267/06, Maruko [2008] 2 CMLR 32 and Case C-147/08, Römer [2011] ECR I-3591, and confirmed that less favorable treatment by an employer of same-sex partners as compared to opposite-sex partners who have entered into the same or equivalent type of legally recognised relationship will constitute direct discrimination on the grounds of sexual orientation.

Turning to the question of the remedy and by extension the legal effect of Schedule 9 para. 18, the UKSC went on to survey the relevant case-law of the CJEU dealing with issues of the retrospective effect of judgments. It concluded that the ECJ’s decision to restrict the temporal effect of its finding of sex discrimination in the occupational benefits case of Barber was a judicial technique that should only be applied ‘in the most exceptional circumstances and where the impact [of a judgment] would be truly “catastrophic”’ (para. 44).

The Supreme Court further concluded that the CJEU case-law established that the discriminatory treatment in question should be viewed as taking effect at the time when the pension was due to be paid, in part because it was only at that point of time that the spousal obligations at issue crystallised into tangible form. In so doing, they rejected suggestions by counsel based on views expressed by AG Van Gerven in Case C-109/91, Ten Oever [1993] ECR I-4879 that pension entitlements accrued as they were earned, and therefore that any discrimination occurring would have predated the date of transposition of the Directive. The UKSC therefore concluded that the provisions of Schedule 9 para. 18 of the 2010 Act could not be applied insofar as they precluded liability arising for the discriminatory behaviour in question, which was incompatible with the requirements of Directive 2000/78/EC and the general principle of equal treatment as confirmed to exist by the CJEU in case C-555/07, Kücükdeveci [2010] 2 CMLR 33.

The Walker judgment is thus particularly interesting for three reasons: (i) the faithful application by the UKSC of the case-law of the CJEU in relation to discrimination against same-sex partners; (ii) the Supreme Court’s interpretation of the relevant CJEU case-law relating to the temporal effect of findings of discrimination in the context of occupational benefits, which gives strong effect to the principle of non-discrimination; and (iii) the way in which it illustrates how parliamentary legislation can be disapplied if its conflicts with fundamental rights secured under EU law, in particular the right to non-discrimination.

After the process of Brexit is complete, this form of legal protection of equality is likely to fall away, along with the supremacy of EU law in general. Walker may thus mark one of the last instances where EU law takes effect as a trump card within the British legal system; as such, it is striking that its effect was to disapply a statutory provision designed to limit liability for discriminatory behaviour.

Photo credit:
Barnard & Peers: chapter 27, chapter 20, chapter 6

Friday, 7 July 2017

All of life is changed: The impact of Brexit on UK nationals living in other EU Member States

Sarah McCloskey and Tamara Hervey, Sheffield Law School

After a series of cataclysmic political events, most people can empathise with the stress and anxiety born out of the subsequent uncertainty. At this time, the people who are enduring the greatest burden are those who have enjoyed a right to free movement exercised in good faith without concern that it might be taken away. Such is Brexit: the source of frustration, a nuisance of the daily news to many, but for EU citizens in the UK and UK nationals living in other Member States, it holds the potential to fundamentally change their very way of life. Without for a moment disregarding the (moral and economic) significance of the former group, we focus here on the latter.

What do the UK government’s proposals mean for UK nationals in the EU-27? What does it mean for their “right to remain, healthcare arrangements under the EU social security agreements, and pension entitlements and payments”? As Strumia highlights, the UK’s offer focuses on EU citizens in the UK. But in a negotiation, the offers made on one side have implications for those on the other. We seek to deduce from the UK’s negotiating position what it might mean for UK nationals in the EU-27.

UK’s Negotiating Position

Despite the hopes for "a magnanimous gesture on the part of the Prime Minister,” the UK government has maintained its stance that a unilateral offer to EU-27 nationals resident in the UK on ‘Brexit Day’ would compromise its negotiating position. Thus, its proposal is founded on the condition of reciprocity. Of course, we remain uncertain as to the outcome of the negotiations. Nevertheless, we can consider the extent to which the UK’s position is a “fair and serious” offer (as the UK government has portrayed) by comparison with the EU’s prior counterpart proposal.

According to the UK negotiating position, upon the UK's exit from the EU, EU citizens in the UK will be required to apply for a new residence status within a grace period of two years. Despite promises of a “streamlined” procedure with incurred fees set at a “reasonable level”, the proposal has faced criticism for subjecting even those who have already obtained a certificate of permanent residence to this new application process. Reciprocity on these terms would dictate that UK nationals in the EU-27 must therefore expect analogous treatment under their post-Brexit status of “third country nationals” (TCNs). They would need to apply for a new residence status under the immigration law of the EU Member State in which they reside. And again, if reciprocity applies, while those who arrive before the yet-to-be-specified date will be granted a temporary status that allows them the opportunity to accrue the vital 5 years of residence, those who arrive at any time thereafter will have no such protection or special treatment. Instead, they would be subject to ordinary immigration law.

Further, any disputes would have to be settled through national courts in the EU-27 country, without any recourse to a supranational authority (such as the CJEU) for a definitive settlement. It would be significantly more difficult to enforce residence and other rights than it is at present.

Under the UK negotiating position, those EU nationals who are successful will be granted what is referred to as "settled status" in UK law pursuant to the Immigration Act 1971. This is subject to certain criteria, including that the applicant must have been resident in the UK before an (as yet un-) specified date (that will fall between 29 March 2017, when the Article 50 letter was sent, and Brexit Day) and have completed a period of 5 years’ continuous residence. It is worth noting here that the UK government has not outlined its definition of “continuous residence” and, given the Prime Minister’s hostility towards the CJEU, it cannot be presumed that it mirrors that accepted in EU law.

Again, if applied reciprocally, UK nationals currently resident in the EU-27 (as EU-27 nationals currently resident in the UK) would be potentially precluded from relying on the benefits of free movement to visit family or for work-related events, for example, in case such visits interrupt their period of continuous residence for longer than permitted under the relevant law. Further, as Strumia notes, this means that the UK’s present protection of free movement is meaningless for EU citizens living in the UK, as any such exercise could be to the detriment of their post-Brexit application.  Like so many other issues, the devil is in the detail and thus, it remains to be seen just how “smooth and simple” acquiring these new rights will be.

Turning to the more specific issues of pensions, child benefits, education, and healthcare, the UK’s negotiating position offers a little more information. On pensions, the UK’s position is explicit that ‘the UK will continue to export and uprate the UK State Pension within the EU’. Given that 21% of UK nationals in EU-27 countries are over the age of 65, this is a significant commitment. Likewise, the current position on child benefit continues: individuals resident before Brexit Day will be able to export any child benefit to which they are entitled in their country of residence, which is of great importance for divorced and separated families. On education, the right of UK students to remain in the respective EU-27 country applies up until course completion (and not beyond) and those with residence rights have the same access to tuition fees and any maintenance grants as nationals of the host country.

Healthcare, however, poses more complexities. The UK government has proposed a new arrangement ‘akin to the EHIC scheme’ (i.e. the European Health Insurance Card, which currently entitles those covered by their home health care system like the NHS to medical treatment in another EU country).  There are non-EU states incorporated within the EHIC scheme, so in theory the UK could join post-Brexit. But in practice, free movement rights will have to be included. Otherwise, the technical and administrative logistics, outside of the current arrangements for coordination of social security, may prove insuperable. The EU coordination of social security is a rules-based system: it is not a matter of politically negotiated bespoke arrangements. A reciprocal deal (to be part of the rules-based system) may be feasible. Access to health care outside such a system (without free movement, without the possibility of CJEU oversight) is unlikely to be so. If that is so, in principle a reciprocal deal would leave UK nationals resident in the EU to fall back on national law to determine their health care entitlements.

The UK’s negotiating position does not explicitly address a host of other practicalities for UK nationals resident in the EU-27 (and vice versa): equal access to housing; equal tax benefits; entitlement to move to and reside in other EU Member States; and equal entitlements to union membership. This is far from offering the claimed reassurance in the face of uncertainty.

In the absence of such details, the only guiding light is: "After we leave the EU, the UK will no longer be subject to EU law. Free movement rights will come to an end and therefore cannot be carried forward, as an EU legal right, into the post-exit UK legal regime.”

If this is the default, and reciprocity is the basis for future entitlements, the effects for UK nationals in the EU-27 would be to face the same prospect of rights reduction as their EU citizen counterparts in the UK.

Applicable EU law

However, this analysis on the basis of reciprocity ignores the fact that the EU itself already has rules concerning the treatment of non-EU TCNs resident in its Member States. The UK’s rejection of an ‘acquired rights’ approach or, indeed, a bespoke proposal of any kind marks an intention to simply align the status of EU nationals with UK immigration law, with all the procedural and substantive implications that entails. But that approach is not available to the EU-25 (Ireland and Denmark have opted out of this law), who are bound by EU law on non-EU migrants, in particular by the EU’s Long-Term Residence (LTR) Directive. The LTR Directive brings the position of UK nationals resident in the EU-25 within EU law as it provides legal protection to some TCNs. This is a Directive that can be - and has been - enforced before national courts, and is subject to the jurisdiction of the CJEU. (There is also some EU legislation on the position of non-EU citizens who don’t yet qualify for LTR status).

Articles 7 and 8 of the LTR Directive govern the scheme by which long-term resident status is acquired and the residence permit granted. The LTR Directive holds the process to a certain standard, imposes common criteria, requires the grant of LTR status where conditions are satisfied (Article 7 (3), Iida para 39), and guarantees certain rights where applications are successful. Article 7(2), for example, requires applications to be processed within 6 months, and Article 10 states that reasons must be given for decisions.

Subject to certain conditions (outlined below), the Directive confers equal treatment of TCNs to nationals in the host country in numerous areas. These include: access to employment; self-employment; recognition of qualifications; tax benefits; and pensions. The UK’s negotiating position, inasmuch as it fails to offer these matters on a reciprocal basis, appears to assume that this aspect of EU law does not exist.

The entitlements under the LTR Directive (and possibly parallel national laws on long-term residence) are extensive. Assuming that it would be the applicable law if the UK’s proposals were to succeed, or indeed if the UK were to leave the EU without successfully negotiating a withdrawal agreement, this raises a question. The position of UK nationals in the EU-27 would obviously be better if the EU proposal prevailed (particularly for those who do not have long-term residence yet). But how much worse off would UK nationals in the EU-25 be under the UK proposals as compared to the EU’s offer? (The position of UK nationals in Ireland will presumably be a special case because of the common travel area; UK nationals in Denmark would have to rely on Danish law.)

Comparison of EU Proposal and EU Law Position: Long-Term Residence Directive

The EU proposal seeks to maintain the current status of EU citizens in the UK and UK nationals in the EU-27, but without the framework of EU citizenship which is conditional on membership of the EU. By comparison, the LTR Directive has been described as creating a “subsidiary form of EU citizenship”.

The LTR Directive offers TCNs a wide range of rights equal to that of nationals in their host country. It removes Member States’ direct control by outlining that where conditions are met and where there is no Article 6 exception (for public policy or public security), long-term resident status must be granted (Article 7(3)). Ordinary immigration law is not subject to those kinds of external oversights or constraints. However, LTR status remains far from parity with EU citizenship status and, in turn, the EU’s proposal. The material rights are less, the scope is more restrictive, and the acquisition process more arduous.

Equal treatment in respect of social assistance and social protection can be confined to core benefits (Article 11(4)), as defined in the ECJ ruling in Kamberaj. Retention of restrictions to access to employment or self-employed activities where these activities are lawfully reserved to nationals, EU or EEA citizens is also permitted (Article 11(3)(a)). Further, acquiring LTR status does not confer the free movement rights within the EU that its citizens are accustomed to; Article 14 outlines the conditions which must be met to acquire the right to reside in a second Member State for a period exceeding three months. The right to family reunification represents another stark contrast: for TCNs, the highly restrictive Directive 2003/86/EC applies, while the EU proposal guarantees that the Withdrawal Agreement would apply to family members, ‘regardless of their nationality, as covered by Directive 2004/38’. This covers both current and future family members.

Turning to scope, the EU proposal is unequivocal: it captures all 'UK nationals who reside or have resided in EU27 at the date of entry into force of the Withdrawal Agreement', UK nationals who work or have done so in EU27 at that date whilst residing in the UK or another EU27, UK nationals covered by Regulation 883/2004, and (in all cases) their family members. Conversely, Article 3(2) of the LTR Directive outlines numerous exclusions, including TCNs resident due to pursuit of studies or vocational training, seasonal workers, and cross-border service providers.

Further, in exchange for this more limited status, there are a greater number of conditions to satisfy. Beyond its mutual basis with the EU proposal’s requisite 5 years continuous legal residence, the LTR Directive also sets out that TCNs need to: provide evidence that they possess sufficient stable and regular resource to maintain themselves and their family members without recourse to the host Member State's social assistance system; have adequate sickness insurance; and, in some cases, demonstrate compliance with integration conditions imposed by national law. Necessarily, implementation of the UK proposal would therefore subject UK nationals in the EU-27 to a much more demanding application process with likely lower success rates than the more black-and-white EU proposal.

Undoubtedly then, the EU proposal is far more favourable to that offered by the UK. This is not unexpected; while the EU recognises the valuable contribution made by TCNs to the Member States in which they reside, inevitably a proposition vested in the interests of the 3.15 million EU citizens in the UK will comprise a better deal than the residual LTR Directive position. And, for negotiating purposes, offering identical conditions for UK nationals in the EU-27 was necessary.

Nonetheless, were the UK proposal to prevail, its nationals are still afforded better protection than their EU citizen counterparts in the UK. The LTR Directive and Article 7(3) in particular represent a safety net to which the EU-25 are held to account. There is no such equivalent for EU citizens in the UK who, post-Brexit, would be entirely at the mercy of ordinary immigration law were the UK’s position adopted.


There is an undeniable gap between the EU negotiating position and the LTR Directive. However, it is to some extent quantifiable. In contrast, the extent of the chasm between the current position of EU nationals in the UK and the UK’s proposal for their post-Brexit future is not yet known. Moreover, the UK’s silence on numerous existing rights does not bode well. While the comparable certainty of the LTR Directive is enough to be relatively reassuring to UK nationals, those who do not yet qualify for the status will be subject only to national immigration law and thus face the same level of uncertainty as EU citizens in the UK.

It might seem surprising that the UK’s response to the EU proposal is so weak. But perhaps this is somewhat accounted for by the difference in numbers: in comparison to the 3.15 million EU citizens in the UK, there are an estimated 900,000 UK nationals in the EU-27. Most of them do not vote in UK general elections. Perhaps they are the ‘sacrificial lambs’ of these negotiations. But this fails to account for the 60% of UK nationals who want to keep their EU citizenship. (Notably, this number increases by 20% for the up and coming political force that are the 18-24 year olds.) If these polls are to be believed, the UK government has a greater investment in a good deal than their proposals implied they thought to be the case. Lest it further alienate the electorate, the UK government should reconsider the EU’s position, taking into account applicable EU law, and provide an injection of reality into its negotiating stance.

Barnard & Peers: chapter 27

Photo credit: Irish Times