Thursday, 19 January 2017

When is Facebook liable for illegal content under the E-commerce Directive? CG v. Facebook in the Northern Ireland courts

Lorna Woods, Professor of Internet Law, University of Essex


The ubiquity of social media platforms and their significance in disseminating information (true or false) to potentially wide groups of people was highly unlikely to have been in the minds of the European legislators when they agreed, in 2000, the e-Commerce Directive (Directive 2000/31/EC) (ECD). Facebook itself was launched only in 2004. Despite the changing times and technological capabilities, the Commission has decided not to revise the ECD, specifically its safe harbour provisions for intermediaries, in its current single digital market programme.  Although the ECD seems set to remain unchanged, the application of the safe harbour provisions raises many difficult questions which have not yet been fully answered at EU level by the Court of Justice. CG v. Facebook ([2016] NICA 54), a decision of the Northern Irish Court of Appeal, illustrates some of these difficulties and certainly raises questions about the proper interpretation of the ECD and its relationship with the Data Protection Directive.

Intermediary Immunity - Legal Framework

The ECD provides immunity from liability for certain ‘information society service providers’ (ISS providers) on certain conditions.  To gain immunity, the ISS provider must

-          be an ISS provider within the terms of the ECD; and
-          one of the following applies:
-          the provider is a ‘mere conduit’ (Art. 12 ECD);
-          provides caching services (Art. 13 ECD); or
-          provides hosting services (Art. 14 ECD).

Each one of these three categories provides for a different level of immunity, which seems connected with the level of knowledge the ISS provider is assumed to have of the problematic content. Here Article 14, which deals with hosting, is the relevant provision. It provides:

1. Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:
(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or
(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.
2. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider.
3. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information.

The recitals to the ECD give more detail as to the scope of services protected by Article 14 and there is a certain amount of case law on this point, notably Google Adwords (Case C-236/08) and the Grand Chamber decision in L’Oreal v. eBay (Case C-324/09). Recital 42 has been pointed to by the Court in these cases as relevant for understanding the sorts of activities protected by the immunity. Recital 42 refers to services of a

mere technical, automatic and passive nature, which implies that the information society service provider has neither knowledge of nor control over the information which is transmitted or stored.

The ECJ in Google Adwords referred to this as being ‘neutral’ (para 113-4). The Grand Chamber in its subsequent L’Oreal decision suggested that advice in optimising presentation would mean a provider was no longer neutral (para 114).

The provision protects relevant ISS providers from liability in relation to illegal content, provided they have no knowledge (actual or constructive) of the illegal activity or information, and that if they have such knowledge, they have acted expeditiously to remove it. In L'Oreal v eBay the Court of Justice provided a standard or test by which one can measure whether or not a website operator could be said to have acquired an 'awareness' of an illegal activity of illegal information in connection with its services, that is whether "a diligent economic operator would have identified the illegality and acted expeditiously".   The CJEU also held that an awareness of illegal activities or information may become apparent as the result of an investigation by the operator itself or where the operator receives notification of such activity.  Article 14 does not protect ISS providers from injunctions, or the costs associated with any such injunctions (see Recital 45).

Additionally, Article 15 specifies that, for those falling within Articles 12-14, Member States cannot impose a ‘general obligation’ to monitor content to determine whether content is illegal. There has been a considerable amount of dispute as to the relationship between this provision and the scope of immunity, especially given the requirements in L’Oreal.  Recital 40 notes that ‘service providers have a duty to act, under certain circumstances, with a view to preventing or stopping illegal activities’ and that the immunity provisions ‘should not preclude the development and effective operation, by the different interested parties, of technical systems of protection and identification and of technical surveillance instruments made possible by digital technology’. The Recitals also state:

(47) Member States are prevented from imposing a monitoring obligation on service providers only with respect to obligations of a general nature; this does not concern monitoring obligations in a specific case and, in particular, does not affect orders by national authorities in accordance with national legislation.

(48) This Directive does not affect the possibility for Member States of requiring service providers, who host information provided by recipients of their service, to apply duties of care, which can reasonably be expected from them and which are specified by national law, in order to detect and prevent certain types of illegal activities.

The distinction between general monitoring and specific monitoring has yet to be fully elaborated, and is an issued much discussed in the context of intellectual property enforcement, especially as regards keeping pirated copies of materials down after taking it down in the first place.

Facts of CG

McCloskey opened a Facebook page in August 2012 entitled ‘Keeping Our Kids Safe from Predators’ in which he published details of individuals who had criminal convictions relating to sexual offences involving children.  This page was not subject to any privacy settings.  One individual who was so named brought action against Facebook and an interim injunction was issued requiring Facebook to remove the page and related comments, on the basis that the comments responding to the posting were threatening, intimidatory, inflammatory, provocative, reckless and irresponsible. This was the XY litigation. Immediately after the page was removed, McCloskey set up a new page, Predators 2. CG was identified on this page on 22 April 2013; his photograph was published and there were discussions about where he lived. Comments included abusive language, violent language – including support for those who would commit violence against CG and for the exclusion of CG from the community in which he lived.  The disclosure of CG’s residence was contrary to the position taken by the Public Protection Arrangements in Northern Ireland (PPANI), which took the view that such disclosure interferes with the rehabilitation process.

On 26th April 2013, CG’s solicitors wrote to Facebook and its solicitors in Northern Ireland, claiming the material was defamatory and that CG’s life was at risk. A hardcopy of Predators 2 page was enclosed. Facebook’s response was that CG should use the online reporting tool, but CG expressed a desire not to have to engage with Facebook. By 22 May 2013 Facebook removed all postings on Predators 2, but on 28 May, CG issued proceedings. Subsequently, CG’s solicitors wrote to Facebook complaining that the photograph had been shared 1622 times and that other Facebook users had included comments threatening violence. They identified the main URL, but not all such instances which Facebook then requested. This information was provided on 3rd and 4th December and removed on 4th or 5th December. A further reposting of the photographed by RS occurred on 23 December, stating that this was what a “pedo” looked like. A letter of claim was send to Facebook on 8th January 2014, identifying the relevant URLs and the page was taken down on 22 January 2014.  While CG accepted that the defamation claim was without merit, it was accepted that he was extremely concerned about potential violence as well as the effect on his family.

Judgment at First Instance

The trial judge had to deal with claims against McCloskey, as well as claims against Facebook.  The trial judge, having reviewed the evidence, concluded that McCloskey’s conduct constituted harassment of CG. The case against Facebook was based on the tort of misuse of private information. To find that there had been such misuse, there had to be a reasonable expectation of privacy in relation to the relevant information  which should take into account all the circumstances (relying on JR38 [2015] UKSC 42 and Murray v. Express Newspapers [2008] EWCA Civ 446). The judge also accepted the submission that the Data Protection Act, and specifically the category of ‘sensitive data’, provided a useful touchstone as to what information could be seen as private (see Green Corns Ltd v. Claverly Group Limited [2005] EWHC 958). The judge concluded that the use of a photograph or name in conjunction with information which could identify where CG lived and any information about his family members were private information. The judge considered that Facebook was put on notice of the problematic nature of the material by the XY litigation (which mentioned the Predator 2 page) and that simple searches would reveal the page, as it had an almost identical name with identical purposes. The trial judge concluded that it was apparent on the face of the posts that consideration of the lawfulness of the posts was needed. As regards the Electronic Commerce (EC Directive) Regulations 2002, which implement the ECD in the UK, the judge rejected the contention that there was an obligation to give Facebook notice in a particular form. So, neither the ECD nor the 2002 Regulations protected Facebook from the claim of misuse of private information.

A further claim under the Data Protection Act was added late in the day. The judge concluded that –in the absence of relevant discovery - CG had not established this proposition. Facebook appealed. CG also appealed as regards the data protection point, but did not pursue this point.

Court of Appeal Judgment

The Court noted that there was agreement that McCloskey’s behaviour was unreasonable conduct sufficient to give rise to criminal liability (R v Curtis [2010] EWCA 123), and that the 2002 Regulations do not cover injunctions. The Court agreed that this was an appropriate case in which to make an order taking to down the material to protect CG from continued intimidation [para 40]. The Court noted that the tort of misuse of private information and harassment, while complementary, are not the same and that a finding of harassment did not automatically mean that there had been a misuse of private information.

As regards the tort, the Court noted that there was no dispute between the parties that this case was about an intrusion, but that the tort would come into play only if there was a reasonable expectation of privacy in the information, which is a fact sensitive determination.  The Court of Appeal noted the public interest in knowing about criminal convictions; it also disagreed with the trial court judge about the reading across of the categories of sensitive information in the DPA. It held:

The fact that the information is regulated for that purpose does not necessarily make it private’ [para 45].

Reviewing the material, the Court held that the context of harassment was determinative to the finding that CG has a reasonable expectation of privacy in the material [para 49]. By contrast, RS was protected by principles of open justice which allow citizens ‘to communicate the decisions of the criminal justice systems to others’ and therefore CG did not have a reasonable expectation of privacy in relation to that posting [para 51].

The Court then considered whether Facebook could rely on the safe harbour provisions of the ECD and the 2002 Regulations. It held that the 2002 Regulations need to be understood in the light of Art 15 ECD even though it is not formally implemented in the UK. According to the Court, Article 15 ‘clearly’ applied to Facebook [para 52]. While not expressly stated, the Court’s approach is based on the assumption that Article 14 (safe harbour provisions for those providing hosting services) and Regulation 19 of the 2002 Regulations, which implement it, also apply.

The Court then considered the issue of notice. Facebook argued that CG had not given proper notice, on the basis that CG had not used Facebook’s online submission process. The Court of Appeal agreed with the trial court’s dismissal of this argument, stating, ‘[a]ctual knowledge is sufficient however acquired’ [para 58]. Facebook challenged the approach taken at first instance, that Facebook had the resources to find the material and assess it [High Court, para 61].  It was also argued that the way the High Court approached the question of constructive knowledge also implied a monitoring obligation. The trial judge referred to the XY litigation; that litigation plus the letters of CG’s solicitors; and the litigation together with some elementary investigation of the profile. The Court of Appeal agreed with these concerns.  It stated the question as being:

Whether Facebook had actual knowledge of the misuse of private information … or knowledge of facts and circumstances which made it apparent that the publication of the information was private

before commenting that

[t]he task would, of course, have been different if there had been a viable claim in harassment made against Facebook [para 62].

It did not elaborate the basis or extent of the difference.

The Court concluded that the XY litigation did not fix Facebook with sufficient notice; that it only could do so if Facebook was subject to a monitoring obligation. In any event, knowledge of a propensity to harass did not fix Facebook with notice about the private information. As regards the correspondence, the Court held that this too was insufficient to fix Facebook with notice. While it referred to the problematic content, it did not refer to misuse of privacy. ‘The correspondence did not, therefore, provide actual notice of the basis of claim which is now advanced’ [para 64]. The Court also considered that there was nothing in the letters to indicate that the information was private. So, while ‘the omission of the correct form of legal characterisation of the claim ought not to be determinative of the knowledge and facts and circumstances which fix social networking sites such as Facebook with liability’, it is necessary to identify ‘a substantive complaint in respect of which the relevant unlawful activity is apparent’. 

Here, since there was no indication in the letter of claim that the address was the issue, the Court did not ‘consider that the correspondence raised any question of privacy in respect of the material published’. [para 69] By contrast, in the letter of 26th November, CG referred to the general identification of where CG was living and the threat from paramilitaries. This was sufficient to establish knowledge of facts and circumstances in relation to that particular post. Referring to the Court of Justice in L’Oreal, the Court noted that Facebook is obliged to act as a diligent economic operator. This point was not argued; Facebook was found to be liable in respect of that post for the period 26th November-4/5 December.

The burden of proof is in the first instance on the claimant to show knowledge; thereafter the ISS must prove it did not.

As regards the DPA, it was agreed that Predators contained personal data and sensitive personal data, the issue was whether Facebook Ireland could be seen as subject to the UK DPA.  The ECJ rulings in Google Spain (Case C-131/12) and Weltimmo (Case C-230/14) were argued before the Court. The Court did not accept the submission that Google Spain was limited to its particular facts and the concern that the protection offered by the Data Protection Directive would be undermined if it excluded out of EU data controllers. The Court here noted that Weltimmo in fact built on the approach in GoogleSpain. It concluded that Facebook is a data controller established in the UK for the purposes of the DPA.  Although the Court accepted that the ECD does not cover data protection, and this is reflected in Regulation 3 of the 2002 Regulations, the Court held at para 95:

The starting point has to be the matter covered by the e-Commerce Directive which is the exemption for information society services from the liability to pay damages in certain circumstances …We do not consider that this is a question relating to information society services covered by the earlier Data Protection Directive and accordingly do not accept that the scope of the exemption from damages is affected by those Directives.’


This case is one of a number coming through the Northern Irish court system regarding different types of problematic content and the responsibility of social media platforms to take action against such content.  Shortly before this case was handed down, the High Court handed down its decision in J20 v Facebook Ireland Ltd ([2016] NIQB 98). Other cases are working their way through the system: AY v Facebook (Ireland) Ltd ([2016] NIQB 76), concerning naked images of a school girl on a ‘shame page’; MM v BC, RS and Facebook ([2016] NIQB 60), concerning revenge porn; and Galloway v Frazer and Google t/a YouTube ([2016] NIQB 7) concerning defamatory and harassing videos.  While this case is based in the particular cultural and legal context of Northern Ireland, and raises questions on the meaning of private information, it also leads of questions about the interpretation of EU laws, notably the ECD and DPD.

The first point to note is that the Court does not directly address the question of the applicability of Articles 14 and 15 ECD, beyond stating the Article 15 clearly applies. Article 15 is dependent on the ISS provider providing services that fall within one of Article 12, 13 or 14 ECD, with Article 14 being relevant here. So the question is whether Article 14 ECD (and consequently Regulation 19 of the 2002 Regulations) applies here. While the text of Article 14 ECD refers to ‘the storage of information provided by a recipient of the service’, the case law makes it clear that not any storage will do. Rather, the service provider must be neutral as regards the content, technical and passive.  In this regard, services Facebook provide regarding information of interest to Facebook users (News Feed algorithm and content recommendation algorithm, as well as Ad Match services), may mean that the question of neutrality and passivity here is at least worthy of investigation, in that Facebook may promote certain content (in the term of L’Oreal, para 114). Of course in Netlog (Case C-360/10), the Court of Justice held that a social media platform could benefit from Article 14, but this does not mean that all will – much will depend on the facts (see eg Commission 2012 Working Paper on trust in the digital single market (SEC(2011) 1641 final, accompanying COM(2011) 942 final).

Assuming Article 14 (and its UK equivalent, Regulation 19) applies, the next question is whether Facebook was on notice.  The ECD is silent on the nature of any formalities, leaving it to Member States and industry (via self-regulation per Recital 40) to fill in the detail.  In its 2012 Working Paper, the Commission acknowledged that there were diverging views as to what notice required, ranging from those who argued that nothing less than a court order should be accepted (seemingly thereby focussing on just actual knowledge) through to those who suggested that general awareness of the use of the site for illegal content was sufficient (which covers constructive knowledge) (p. 33-34). It seems there are three main issues here:

- Whether notice has to be given in any particular format;
- Whether notice has to identify the illegality or whether identifying the problematic content will do; and
- The relationship between constructive notice and Article 15, also bearing in mind the obligations of the diligent economic operator.

Facebook argued of course that a person complaining about content should use the tools provided by Facebook and provide rather precise information.  The Court, rightly, held that to require a particular format to be used but run counter to the aim (particularly with reference to the 2002 Regulations) of facilitating the ability of users to make complaints. It is less clear the position of the Court with regard to the need to provide URLs. The need to provide specific URLs makes it difficult for claimants especially those who seek orders for content to be taken down and to stay down (seen particularly in the field of intellectual property enforcement, for example even in L’Oreal). In this case, where the Court found Facebook liable CG had provided specific URLs, but the Court is silent on whether the lack of specific URLs was a determinative factor in the other instances.  It is submitted that, provided sufficient identifying information about the content is provided, precise URLs should not be required especially for a diligent economic operator (discussed below).

The Court focussed on the question of whether CG sufficiently identified the reason why the content is illegal. In this, the Court observes that the omission of the correct legal characterisation is not determinative; to have held to the contrary would undermine the ability of claimants without lawyers to have material taken down. The Court moves on to suggest that the relevant unlawful activity has to be apparent. It does not consider to whom such unlawfulness must be apparent, or indeed the prior question of whether the ECD requires just notification of content or activity perceived as illegal by the complainant, rather than a justification of why the complainant thinks that. While on the facts of this case there are concerns that CG referred to causes of action that were clearly wrong (e.g, defamation), it is arguable that the Court’s position needs further refinement. Certainly the Court’s approach on this aspect seems generous to Facebook in terms of what it needs to be told.

In this regard a number of comments can be made.  While, an operator would need to make an assessment about the legitimacy of a take down request, that is a separate issue from the fact of being notified that someone thinks some content is problematic. Further, there may a world of difference between what a man on the street might so recognise and that which the diligent economic operator should recognise and the detail required for that. Indeed, in L’Oreal, the ECJ held:

although  such  a  notification  admittedly  cannot  automatically  preclude  the  exemption  from  liability  provided  for  in  Article  14  of  Directive  2000/31,  given  that  notifications  of  allegedly  illegal  activities  or  information  may  turn out to be insufficiently precise or inadequately substantiated, the fact remains that such notification  represents,  as  a  general  rule,  a  factor  of  which  the  national  court  must  take  account  when  determining,  in  the  light  of  the  information  so  transmitted  to  the  operator,  whether  the  latter  was  actually  aware  of  facts  or  circumstances  on  the  basis  of  which  a  diligent economic operator should have identified the illegality (para 121-2).

This suggests that a diligent economic operator may not just rely on what a complainant said, but may have to take steps to fill in the blanks.  As the Commission reported in 2012, it has been suggested by some that the degree to which it is obvious that the activity or information is illegal should play a role in this assessment.  Some content is more obviously problematic than others. This position is not incompatible with the approach of the Court here: the problem for CG is that an address is not usually that problematic in privacy terms, it was the context (not apparent on the face of it) that made it so [para 69].  This distinction may have relevance for the AY litigation, if not the revenge porn case – depending on the nature of the images.

The final point of concern relates to general monitoring. The rejection by the Court of the possibility becoming aware of a particular type of content (as from the XY litigation) and being on notice as a consequence deserves further examination. This depends on what is meant by ‘general monitoring’ as opposed to a ‘specific’ monitoring obligation, accepted by recital 47 ECD, and recognised by the Commission in its 2012 Working Paper (p. 26).  It is unfortunate that the Court did not give this more attention. While case law has made clear that filtering of all content, for example, constitutes general monitoring (SABAM v Scarlet (Case C-70/10)), it has been argued- principally in the context of IP enforcement -that searching for a particular instance of content (re-occurring) is not.  Such a broad view of general monitoring as the Court here adopted also seems to decrease the space in which the diligent economic operator acts, raising questions about the meaning of L’Oreal.  Note also that the Commission in its recent review noted ‘there are important areas such as incitement to terrorism, child sexual abuse and hate speech on which all types of online platforms must be encouraged to take more effective voluntary action to curtail exposure to illegal or harmful content’ (COM/2016/0288 final).  This suggests that the Commission may expect such platforms to be proactive and not merely reactive. 

Perhaps the most significant point, and one on which a reference should perhaps have been made, is the relationship between the ECD and DPD, a point yet not dealt with in English law (see Mosley v Google [2015] EWHC 59 (QB)).  The Court accepted fairly readily that Facebook (Ireland) falls under the UK DPA, but then insists that despite the fact that data protection is excluded from the field of application of the ECD, that Facebook pages and comments fell within the “matter covered by the e-Commerce Directive” which provide a “tailored solution for the liability of [ISS providers] in the particular circumstances” set out in the ECD. It did not explain why, beyond asserting that the ECD safe harbour provisions do ‘not interfere with any of the principles in relation to the processing of personal data, the protection individuals ... or the free movement of data’ [para 95]. In this assessment, the Court overlooked the fact that under the DPD a remedy must be provided to individuals, so as to make effective their rights and, that the protection awarded to data subjects should not vary depending on the mechanism used for that processing.  Furthermore, Recital 14 to the ECD elaborates that

The protection of individuals with regard to the processing of personal data is solely governed by Directive 95/46/EC …..the implementation and application of this Directive should be made in full compliance with the principles relating to the protection of personal data.

Whilst a Member State was free to provide more far-reaching to protection to intermediaries, this freedom reaches its limit when it conflicts with another harmonised area of EU law, such as data protection. The Court’s position on this point, and especially its reasoning, in the light of the terms of both directives, is not convincing.

In sum, the outcome – liability for Facebook on one aspect of the content posted – sounds on the face of it a narrowing of immunity.  The reality points in a different direction. While there are a number of problematic issues with which the court had to deal, the impact of this judgment lies in the statements of general principle which the Court made. Significantly, these fell into areas ultimately governed by EU law, rather than purely domestic matters.  It is far from certain that those issues are clearly determined at EU level, nor that the Court’s assessment here is free from doubt.

Photo credit: 

Tuesday, 17 January 2017

Brexit: the Prime Minister sets the wrong course

Steve Peers

Today’s speech by Prime Minister Theresa May gave a number of indications as to the government’s intentions as regards implementing Brexit. Overall, while the speech contained some welcome parts, it made fundamentally the wrong decision about the country’s future.

Welcome parts of the speech

The welcome parts of the speech include the argument that it ‘remains overwhelmingly and compellingly in Britain’s national interest that the EU should succeed’. Indeed, any ‘unravelling’ of the Union between these neighbouring states is not in the economic or security interests of the UK. Her suggestions about what the EU should do next contain much common sense – although it is doubtful that the remaining EU is very interesting in listening to the leader of a country that is intending to leave. In particularly, her complaints about too much ‘uniformity’ and not enough ‘diversity’ will strike some as bizarre – coming from a country with opt-outs on the single currency, Schengen, justice and home affairs (and previously social policy) plus a budget rebate.

The commitment to retain status for EU citizens in the UK is not new, but still welcome. It is disappointing however that there was no commitment to entrench their rights unilaterally, as recently proposed by a group of Leave and Remain supporters in a British Future report. There could be compromise ways to address this: publishing a draft Bill to this effect, or entrenching the rights in law conditional on EU reciprocity. One can only hope that the issue will be addressed at an early stage of the negotiations.

The interest in continued collaboration on research, police cooperation and foreign policy is also welcome, since the UK still has joint interests with other Member States in these fields. But it is content-free: what exactly would the UK like to participate in? How does this square with her assertion that the UK will not be involved with ‘bits’ of the EU?

Single market and customs union

The Prime Minister declared her opposition to ‘partial membership of the European Union, associate membership of the European Union, or anything that leaves us half-in, half-out.’ But there is no such thing as ‘partial’ or ‘associate’ membership of the EU. May is slaying straw dragons in her own imagination here.

She goes on to confirm her opposition to single market membership (as distinct from single market access) for the UK, for several reasons. It is striking that she makes no assertion that the UK will be better off out of the single market economically. Indeed, the IFS has estimated that the UK will lose 4% of GDP if it leaves the single market without a free trade deal, due to the loss of market access that this entails. While May goes on to say that she seeks a free trade deal, this is bound to entail less trade between the UK and the EU than single market membership, as free trade deals do not remove as many non-tariff barriers as the single market rules.

So what are her reasons? One is control of immigration – and free movement of persons is a non-negotiable condition of the EU for participation in the single market.  Here she fails to consider that the European Economic Area (EEA) treaty includes a safeguard on free movement which could be invoked in order to control it. May’s description of free movement includes overstated claims about its effect on public services, ignoring the impact of limited government funding of health and education in recent years – while she cannot bring herself to mention the overall economic benefit derived from EU migrants.

Another is budget contributions. She rules out any budget contributions except for participation in individual programmes. There is no consideration of whether the EEA option – giving money directly to poorer EU countries, with more control over the spending by the contributor – would be desirable in return for increased market access.

Next, there is the role of the ECJ. May states that single market membership ‘would mean accepting a role for the European Court of Justice that would see it still having direct legal authority in our country.’ Let’s not mince words: this is not true. The EEA states are not subject to the ECJ at all, but to the separate EFTA Court. That court has less jurisdiction than the ECJ, and a large number of its rulings are not binding at all. It is only obliged to follow ECJ rulings delivered before 1991.

More broadly, May states that this ‘would to all intents and purposes mean not leaving the EU at all.’ Again, this is not really true. EEA members are not subject to EU rules on agriculture, foreign policy, fisheries, justice and home affairs (except via separate treaties, in part) or trade with non-EU countries – the very issue which May devotes a large part of her speech to.

This brings me to a false dichotomy on which her speech rests: that there is some sort of choice to be made between EU membership and ‘Global Britain’. In fact, barriers to trade with non-EU countries have been coming down, both due to EU membership of the WTO and due to bilateral trade deals between the EU and non-EU countries. The share of UK trade with non-EU countries has therefore been rising – as Leavers are often quick to point out. Many other EU countries trade more that the UK does with non-EU states – as May herself pointed out last year. So it’s not EU membership that significantly holds back trade with non-EU states.

It is true that inside the EU’s customs union, the UK cannot sign its own trade deals with non-EU states. But the UK could seek to remain in the single market (like Norway) but leave the customs union. Indeed, Norway and other EEA countries have a number of their own trade agreements. In effect, this would be the best of both worlds – maintaining the maximum possible access to the EU’s internal market via means of full participation, while simultaneously having the freedom to sign additional trade deals with non-EU countries.

She also argues that both sides in the referendum made clear it was about the single market. But the single market was not on the ballot paper and was not often mentioned. When it was mentioned, some Leavers, like Dan Hannan, expressly declared that single market membership would not be affected. I recall well a common cut-and-paste statement from Leave supporters in Facebook posts beginning ‘The UK will not be leaving the EEA…’. Although David Cameron stated that leaving the EU meant leaving the single market, why should anyone be bound by his falsehood? And why should one claim made during the campaign be treated as politically binding, while others – notably those which appeared on the side of a bus – are not?

As for the customs union, May proposes a ‘have your cake and eat it’ version – a special deal simplifying border crossings, while being free to sign the UK’s separate international trade deals. Time will tell if this idea interests the EU.

A transitional deal

The Prime Minister accepts that the UK cannot switch immediately to a new arrangement, but cannot bring herself to support a transitional deal, saying ‘[i]nstead, I want us to have reached an agreement about our future partnership by the time the 2-year Article 50 process has concluded’. Such an arrangement would then be phased in. This time frame is unlikely, given that she wants a bespoke deal, involving special arrangements on customs and comprehensive free trade.  So what happens if the Brexit Fairy does not deliver by this deadline?

The role of parliament

Early on in the speech, May states that ‘the principle of Parliamentary Sovereignty is the basis of our unwritten constitutional settlement’. Unfortunately, these are empty words. A Martian reading this would assume that she had gone to court to try to ensure parliamentary involvement in the triggering of Article 50 – rather than to block it.

Furthermore, her speech comes in place of any white paper or any other public consultation on the best course to follow after Brexit. She ‘concedes’ that parliament will vote on the final deal, but this is not much of a choice – a free trade deal or nothing – unless there is an option to negotiate a different deal (not enough time) or to stay in the EU on the basis of another referendum on the exit terms (ruled out by the government).  In any event, it’s not a real concession: the Constitutional Reform and Governance Act of 2010 makes a form of parliamentary control a legal requirement in principle for most treaties. She made no commitment for a full Act of Parliament to approve the final deal – even though one is required for even minor changes to EU Treaties, and even for the approval of some EU legislation.

So May seeks credit for doing something she was anyway legally required to do. In fact, she deserves blame for previously threatening to ignore the law, and even now involving Parliament as little as possible and planning to offer it a fait accompli.

As for EU legislation converted to UK law, by the future Great Repeal Bill, she states that it will only be changed ‘after full scrutiny and proper Parliamentary debate’. This sounds nice superficially, but falls short of a commitment to use Acts of Parliament on key issues. Rather it sounds like an intention to use Statutory Instruments, which can’t usually be amended by Parliament and are rarely blocked. Without a commitment to use Acts of Parliament, her guarantee to uphold workers’ rights derived from EU law is worth rather less than she suggests; and there is no such commitment as regards environmental law.

The devolved administrations

The Prime Minister states that ‘we will put the preservation of our precious Union at the heart of everything we do’ and that she will ‘strengthen our precious Union’. However, her plan necessarily rejects the detailed suggestions of the Scottish government from December (discussed here) for the future EU/UK trade relationship.  So not only is the Scottish (and Northern Irish) public’s view on the desirability of Brexit is overridden, but also the Scottish government’s later views on how Brexit should take place are ignored. The Scottish government paper can hardly be ‘considered’ if it has already been overruled.

There’s a pledge not to weaken existing powers of devolved bodies, but there will surely be battles ahead over which level of government should exercise powers over devolved competences returned from the EU.  Conversely, there’s no suggestion of any granting any additional devolved powers, which might have been appropriate to address the obviously highly divergent views of Scotland, Northern Ireland and the rest of the UK. There’s another pledge to maintain the Common Travel Area between Northern Ireland and the Republic of Ireland, but this is content-free.

In short, there’s nothing here to ‘strengthen’ the Union at all. Its ‘preservation’ depends solely upon the continued argument that Scotland would be worse off outside the UK’s economic union – while simultaneously maintaining that the UK is better off outside the European version of the same.

Unity and Brexit

The Prime Minister declares that the referendum ‘victors have the responsibility to act magnanimously’, and the losers to accept the result. But she has not shown the slightest magnanimity in her speech today. She dismisses the arguments for staying in the single market made by those – like the Scottish government – who sought to remain in the EU but who believe that single market membership would be a reasonable compromise for a badly divided country.

More broadly, her emollient tone today cannot erase the memory of her conference speech in October – full of sneering references to ‘citizens of the world’ and the dreaded ‘liberal elites’ (cue the Star Wars Imperial March music). It’s a strange world in which Alexander Boris de Pfeffel Johnson – graduate of Eton and Balliol College – dismisses people like me – the grandson of a miner, the son and stepson of factory workers – as part of the ‘elite’.

Still less can her speech erase the memory of her Lord Chancellor failing in her statutory duty to defend the independence of the judiciary from screeching headlines about the ‘Enemies of the People’. And if she really believed in magnanimity in concrete terms, she could have announced a unilateral decision to let EU citizens stay in the UK.


Some of the Prime Minister’s speech is valuable – setting the right overall tone on relations with the EU, implicitly rejecting the more harmful 'WTO-only' option, and eschewing (hopefully genuinely) future derision of the 48% who took a different point of view in the referendum. But ultimately she has made the wrong decision on single market participation, putting politics ahead of the country’s economic interests. And key parts of the speech are vague, incorrect, misleading, hypocritical or fantasist. Perhaps we were better off with ‘Brexit means Brexit’.

Barnard & Peers: chapter 27
Photo credit: BBC

Saturday, 14 January 2017

Non-refoulement: is part of the EU’s qualification Directive invalid?

By Pieter Boeles, visiting professor migration law, VU University Amsterdam, emeritus professor University Leiden


The absolute character of the principle of non-refoulement – the ban on removal to an unsafe country – is widely acknowledged. Still, there is confusion and insecurity on this point with regard to the Qualification Directive, which defines how to determine if someone enjoys refugee or subsidiary protection status within the EU. On 14 July 2016, a Czech Court (the Nejvyšší správní soud) asked the Court of Justice EU whether Article 14(4) of the EU Qualification Directive, allowing for revoking, ending or refusing to renew refugee status for reasons of criminal behaviour or a security risk, is invalid in the light of the principle of non-refoulement (Case C-391/16). In its explanation, the Czech Court points out that ‘the binding nature of the prohibition on the return of persons in contravention of the principle of non-refoulement forms part of the obligation not to subject anyone to torture or inhumane or degrading treatment or punishment under Article 3 ECHR and Article 4 and Article 19(2) of the Charter, and it applies whenever there is a real risk of such treatment occurring as a result of forced deportation or extradition’.

The question of the Czech court is important. In my view, a well-reasoned answer can only be given if the ambivalent structure of the Qualification Directive on this point is acknowledged and addressed.  In this comment I will try to analyse the problems to be solved. 

One sole principle of non-refoulement in EU law

Basically, the dogmatic point of departure is simple: the EU principle of non-refoulement is anchored in Article 19(2) of the Charter of Fundamental Rights of the EU, which contains a prohibition to remove, expel or extradite any person to a State where there is a serious risk that he or she would be subjected to the death penalty, torture or other inhuman or degrading treatment or punishment. The Charter should govern the uniform interpretation of the principle of non-refoulement in Union law, both in the Treaties and in secondary legislation (like the Returns Directive and the Qualification Directive). As the prohibition of refoulement is absolute in the ECHR, it should universally be interpreted to be absolute regardless of the legal context of EU law in which it appears. Article 19(2) of the Charter corresponds to Article 3 ECHR, and so must be interpreted the same way (Article 52(3) of the Charter). See the ECtHR ruling in Chahal, and more case law in Kees Wouters, International Legal Standards for the Protection from Refoulement, Intersentia, 2009, p. 307 – 314. The Court of Justice has recognized the absolute nature of the rule in its judgment in Aranyosi (paras 85-87).  

Article 19(2) Charter, derived from Article 2 and 3 ECHR, is not only relevant for persons with subsidiary protection but equally for refugees. Refugees are protected against a danger, formulated (in Article 1.A of the Refugee Convention, as well as the EU Qualification Directive) as persecution on grounds of race, religion, nationality, political opinion or membership of a particular social group. The persecution feared must be of a certain level of severity, which will normally coincide with death penalty, torture or other inhuman or degrading treatment or punishment. Under the uniform meaning of non-refoulement in Article 19(2) of the Charter, absolute protection against refoulement must be granted on an equal basis to both refugees and subsidiary protected persons. As the principle of non-refoulement is a prevailing general principle of EU law in the sense of Article 6 TEU, secured by the Charter, it follows that the Qualification Directive grants stronger protection to refugees than the Refugee Convention alone does.  This is also what the Czech court asserts.

The stronger protection does not undermine any of the rights for refugees granted in the Refugee Convention.  But it may mean that non-refoulement has a wider meaning for refugees within the scope of EU law. Although the wording of Article 14(4) of the Qualification Directive matches the exception to the non-refoulement rule in the Refugee Convention, the Charter sets a higher standard for non-refoulement (as confirmed by reference to Chahal).

This is not unequivocally visible in the text of the Qualification Directive  The seminal Article 21(1) of the Directive, which deals with non-refoulement directly, does not say straightforwardly that Member States shall respect ‘the absolute principle of non-refoulement’, or ‘the principle of non-refoulement in accordance with Article 19(2) the Charter of Fundamental Rights’. True, the present text of the first paragraph of this article, stating that Member States shall respect the principle of non-refoulement ‘in accordance with their international obligations’, can be interpreted that way, especially because the ‘international obligations’ must be deemed to include those under Article 2 and 3 ECHR. But if that is the correct interpretation, it is difficult to understand what the reasonable meaning can be of the second paragraph of Article 21, stating that refoulement of a refugee is nevertheless allowed in some cases, ‘where not prohibited by the international obligations’. In suggesting that refoulement would nevertheless be allowed under certain conditions, Article 21(2) Qualification Directive is confusing. Obviously, Article 21(2), like Article 14(4) of the Directive, implicitly refers to the exception to the non-refoulement rule set out in Article 33(2) of the Refugee Convention, as it is phrased nearly identically.  Article 21 thus begs the question what must be considered  to be the prevailing norm informing the ‘principle of non-refoulement’. The absolute norm of Article 19(2) in the Charter - or the non-absolute norm of the Refugee Convention?

I cannot help suspecting that the Court of Justice was captured in this confusion, when earlier answering the questions asked in the case of H.T. (C-373/13), discussed here. The Court of Justice described the system of Article 21 Qualification Directive in paragraphs 41 – 44 of that judgment. In that description any explicit referral to the absolute character of the principle of non-refoulement is lacking. Strictly, the Court says nothing wrong, stating in paragraph 42 that Article 21(2) Qualification Directive, ‘whose wording essentially repeats that of Article 33(2) of the Geneva [Refugee] Convention, nevertheless provides for a derogation from that principle, allowing Member States the discretion to refoule a refugee where it is not prohibited by those international obligations (…)’.

It may be telling that the Court notes in para 65 that the principle of non-refoulement is guaranteed as a fundamental right by Articles 18 and 19(2) of the Charter of Fundamental Rights of the European Union. But the Court does not elaborate on that. Then again, I do not understand the extensive attention drawn to the alleged leeway granted by Article 21(2) of the Directive. Why suggest that there can be meaningful room for refoulement at all? Why make mention of ‘Member States, enjoying the discretion whether or not to refoule a refugee’ in paragraph 43? Why talk of a ‘derogation’ in paragraphs 42, 55, from this non-derogable principle? Why state in paragraph 72, that the consequences of applying Article 21(2) may be “very drastic” because the refugee ‘might be returned to a country where he is at risk’? Why keep secret that the whole exercise of explaining Article 21(2) is essentially futile because of the absolute character of the principle at stake?

Crucial impact of the case

The answer of the Court of Justice to the Czech court’s questions will be crucial for the future development of EU law. If the absolute character of the principle of non-refoulement is not clearly upheld now, we might be witnessing a gradual process of interpreting away the absolute character of non-refoulement. The first step could be, to frame the refugee status in the Directive as the primary status. The protection granted by Article 3 ECHR could then be downgraded as subsidiary and less important and only to be used as a safety net for persons who are not eligible for the first class protection. In such a construction, it could be argued that the international obligations referred to in Article 21 Qualification Directive are essentially obligations under Article 33 of the Refugee Convention.  This would grant Member States room for refoulement of refugees under Article 21(2) of the Directive in cases of criminal behaviour or security risks.  Then, if the ‘primary’ status would not be deemed connected to an absolute protection of non-refoulement, it could be considered weird to grant any better protection to the ‘lesser’ status.  

On the other hand, such a downgrading process may less easily develop if the importance of Article 19(2) of the Charter in this respect is acknowledged. In that respect, it is striking that the referral to the principle of non-refoulement in point 3 of the preamble of the Qualification Directive is solely linked to the Refugee Convention and not to Article 19(2) Charter. It is further conspicuous that point 16 of the Preamble mentions a whole range of relevant Charter provisions except for precisely Article 19(2).  

Complications: status, residence permit, expulsion

The discussion on this topic is complicated by a number of circumstances. First, refoulement only refers to deportation to the country where the person is in danger. Non-refoulement as such does not stand in the way of expulsion to other countries (as can be seen in Article 32 of the Refugee Convention allowing a limited possibility of removals to other countries, even if a refugee is ‘lawfully in [the] territory’). Further, the protection granted by the Qualification Directive takes the form of issuing statuses and residence permits, among other things, to protected persons.  What follows from this? Status and residence permit are two different things, as can be seen in Article 24 Qualification Directive. Revoking a residence permit cannot lead to the revocation of the refugee status (H.T. judgment, para. 74). Neither will the status of subsidiary protection be affected by revocation of the residence permit. What does the distinction between status and residence permit mean? And what is the relationship between a status and the obligation of non-refoulement?


Principally, a status is recognition. Under Article 2(e) Qualification Directive, ‘refugee status’ means the recognition by a Member State of a third-country national or a stateless person as a refugee, and under Article 2(g) ‘subsidiary protection status’ means the recognition by a Member State of a third-country national or a stateless person as a person eligible for subsidiary protection.  As a status is equated with recognition, a status can only be terminated together with the recognition. The status intrinsically comprises recognition of the existence of an obligation of non-refoulement with respect to the person concerned.

(When I use the term ‘recognised refugee’ I am only dealing here with recognised refugees under the Qualification Directive. A recognised refugee under the Qualification Directive is in a different position from a person who is not recognised but who might still be a refugee under the Convention of 1951. It is the recognition under the Qualification Directive which puts beyond doubt that an the absolute EU principle of non-refoulement is applicable to the refugee as well).

Now, if a ‘status’ should be equated with ‘recognition’ of the danger threatening the person involved, it would be an anomaly to revoke a status in cases where the danger continues to exist, just because of criminal behaviour. That would amount to an arbitrary refusal to acknowledge the real and continuing risk against which the person seeks protection. More or less like revoking the medical acknowledgement of pregnancy of a woman because she stole a book, not because the pregnancy was over. However, under the Qualification Directive, termination of a status is made possible in cases where it is not established that an absolute prohibition of refoulement is no longer applicable to the person concerned. This is especially so with refugees. On the same grounds as set out in Article 21(2), but without the proviso of the ‘international obligations’ override, Article 14(4) Qualification Directive allows for revoking, ending or refusing to renew a refugee status. 

The wordings of Article 14(4) obviously refer to Article 33(2) Refugee Convention which also inspired the creation of a possibility of ‘refoulement’ under Article 21(2). In the beginning of my exploration, I stated that a correct interpretation of Article 21(1) compels non-application of the second (and consequently the third) paragraph. So, if the second and third paragraphs of Article 21 should be declared ‘dead letters’, is there still room for applying Article 14(4)?

The answer may depend on how consistency of the system of the Directive is valued. It is strange to refuse or terminate a status on grounds that have nothing to do with the danger against which the status is meant to offer protection. But, as long as there is no refoulement, the refusal or termination of the refugee status as cannot violate the principle of non-refoulement. 

Residence permit

In the H.T. judgment, para. 95, it is claimed that, even without his residence permit, the person concerned remains a refugee and as such remains entitled to the benefits guaranteed by Chapter VII of the Qualification Directive to every refugee, including protection from refoulement, maintenance of family unity, the right to travel documents, access to employment, education, social welfare, healthcare and accommodation, freedom of movement within the Member State and access to integration facilities. The same must be true for a person with the status of subsidiary protection (Article 20(2)).

However I have some difficulties with this passage. A number of rights mentioned in Chapter VII – like travel documents for travelling abroad, freedom of movement within the territory of the host state, access to employment -  would, under the Refugee Convention only be granted to ‘lawfully’ present refugees. I doubt it whether the Court took this aspect fully into account. In Chapter VII no clear distinction has been made between the rights correlating to the ‘status’ alone and rights specifically connected to ‘lawful residence’.  

I am therefore not convinced that para. 95 of the H.T. judgment is tenable. Is it really true that a ‘status’ alone already implies lawful presence? Is it not rather so, that a ‘status’ differs from a ‘residence permit’ precisely because a ‘status’ does not in itself regulate a right to lawful presence on the territory?

Whatever the right answer to that question is, even if we fully accept para. 95 of the H.T. judgment, a ‘status‘ only protects against refoulement, not against any form of expulsion to a safe country. That is why the residence permit offers more security. As long as a residence permit is granted to a status holder, the Member State guarantees not only non-refoulement to the country of origin but also non-expulsion to any other country and a full right to inclusion in society. This applies both to refugees and to subsidiary protected persons. With a residence permit the legal position of the person may become stronger through time and eventually lead to a permanent status or to nationality of the host state.

The principle of non-refoulement is, at least in abstracto, reconcilable with revoking, non-extending or refusing a residence permit.  Under Article 24 Qualification Directive, as explained in the H.T. judgment, a non-renewal or revocation of a residence permit is possible both for a refugee and for a subsidiary protected person in case of compelling reasons of national security or public order, while the status remains unaffected. So, measures to protect public order and public security may take the form of terminating or refusing a residence permit, but they may, according to what I said above never lead to refoulement as long as it is prohibited under Article 19(2) Charter.


A thorny issue is how the concept of exclusion (as distinct from revocation of refugee status, and/or a residence permit) must be positioned under an absolute norm of non-refoulement.

The exclusion clauses of the Refugee Convention are transposed in Article 12 of the Qualification Directive. Further, in Article 17 of the Directive, the concept of exclusion is also applied to persons with subsidiary protection – a novelty. According to the wording of the Directive, exclusion may mean something different for refugees compared to subsidiary protected persons. In Article 12, a third-country national or a stateless person is excluded from being a refugee.  Thus, an excluded person ‘is’ not a refugee.  He is excluded from the definition. In the wording of the Court of Justice in B and D (paras 89, 91, 98, 100, 104 and 106), the person is excluded from refugee status. In contrast, under Article 17, a third-country national or a stateless person is excluded from being eligible for subsidiary protection. Here, the person is excluded from the ’eligibility’ to be protected, which may not be exactly the same as a status. However, for reasons of consistency with the language of the B. and D. judgment, it is perhaps preferable to see Article 17 as dealing with exclusion of the status of subsidiary protection, just like Article 12 is about exclusion from the status of refugee.

Anyhow, regardless of the potential differences between the two provisions, their common effect is that they prevent or undo the creation of a legal moment in which it must be assessed under the Qualification Directive whether the person concerned is in a situation where refoulement is prohibited, either because of well-founded fear for persecution or because of a real risk for life or of torture, inhuman or degrading treatment or punishment. Of course, non-assessment of a risk does not mean that it does not exist. Therefore, exclusion under the Qualification Directive leaves open that the principle of non-refoulement may still apply to excluded persons. Under Article 5 of the Returns Directive they still are protected against refoulement. So, it is not a priori allowed to send excluded persons back to their countries.

Above, I stated that the status embodies a recognition of an obligation of non-refoulement with regard to the person concerned. Accordingly, an exclusion from a status is equivalent to exclusion from recognition of an obligation of non-refoulement. As a consequence, there is no right to a residence permit either.

In fact, excluded persons are thrown out of the field of application of the Qualification Directive and are referred to the Returns Directive for further protection against refoulement. In accordance with the Abdida judgment, Court of Justice 18 December 2014, C-562/13, para 50 (discussed here), they must be able to avail themselves, in such circumstances, of a remedy with suspensive effect, in order to ensure that the return decision is not enforced before a competent authority has had the opportunity to examine an objection alleging infringement of the principle of non-refoulement laid down in Article 5 Returns Directive and Article 19(2) of the Charter.


In spite of its confusing content, Article 21 Qualification Directive is not invalid because it can be interpreted in accordance with the absolute prohibition of refoulement thanks to the words ‘in accordance with their international obligations’  in the first section. The effect of the correct interpretation is that refoulement of refugees is not allowed even in the cases formulated in paragraph 2. Consequently, neither the third paragraph of Article 21, dealing with revoking, ending or refusing to renew or to grant the residence permit of (or to) a refugee to whom paragraph 2 applies, can ever be applied. Correctly interpreted, the second and third paragraph of Article 21 must be regarded dead letters.

It is difficult to conclude what the ‘dead letter’ position of Article 21(2)(3) means for the validity of Article 14(4) which was based on the same Article 33(2) Refugee Convention. At any rate, Article 14(4) is not invalid for violating the absolute prohibition of refoulement as long as Article 21(2) is not applied. Still, there is something anomalous about Article 14(4). It compels Member States (‘shall’) to refuse or terminate a refugee status in cases where there is still an obligation to acknowledge the absolute prohibition of refoulement. If it would be accepted that a ‘status’ is equivalent to ‘recognition’, the ‘status’ should be maintained, also for persons committing crimes, as long as the ‘recognition’ has solid ground.    

In answering the questions of the Czech Court, the Court of Justice may also have to clarify (as it did in Abdida) how the protection against refoulement is divided between the Qualification Directive and the Returns Directive. Exclusion in the sense of Articles 12 and 17 of the Qualification Directive has the effect of throwing the applicants out of the protection system of the Qualification Directive and leaving their protection against refoulement to the Returns Directive, which entitles them to a remedy with suspensive effect for the examination of a claim of non-refoulement.

Barnard & Peers: chapter 9, chapter 26
JHA4: chapter I:5

Photo credit: Bryan Denton, New York Times

Tuesday, 10 January 2017

A Threat to Human Rights? The new e-Privacy Regulation and some thoughts on Tele2 and Watson

Matthew White, Ph.D candidate, Sheffield Hallam University


In a follow-up to last Christmas’s post, on 10 January 2017, the European Commission released the official version of the proposed Regulation on Privacy and Electronic Communications (e-Privacy Regs). Just as the last post concerned the particular aspect of data retention, this post will too.

Just as the former leaked version maintained, the proposal does not include any specific provisions in the field of data retention (para 1.3). This paragraph continues that Member States are free to keep or create national data retention laws, provided that they are ‘targeted’ and that they comply with European Union (EU) taking into account the case-law of the Court of Justice of the European Union (CJEU) and its interpretation of the e-Privacy Directive and the Charter of Fundamental Rights (CFR). Regarding the CJEU’s interpretation, the proposals specifically refers to Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others, and Joined Cases C-203/15 and C-698/15 Tele2 Sverige AB and Secretary of State for the Home Department. Aspects of the latter case is the focus of this post; the case itself has been thoroughly discussed by Professor Lorna Woods.

So, when is the essence of the right adversely affected?

Before discussing certain aspects of Tele2 and Watson, it is first important to draw attention to the provision which enables data retention in the new e-Privacy Regs. Article 11 allows the EU or its Member States to restrict the rights contained in Articles 5-8 (confidentiality of communications, permissions on processing, storage and erasure of electronic communications data and protection of information stored in and related to end-users’ terminal equipment). From Article 11, it is clear that this can include data retention obligations, so long as they respect the essence of the right and are necessary, appropriate and proportionate. In Tele2 and Watson the CJEU noted that any limitation of rights recognised by the CFR must respect the essence of said rights [94]. The CJEU accepted the Advocate General (AG)’s Opinion that data retention creates an equally serious interference as interception and that the risks associated with the access to communications maybe greater than access to the content of communications [99]. Yet the CJEU were reluctant to hold that data retention (and access to) adversely affects the essence of those rights [101]. This appears to highlight a problem in the CJEU’s reasoning, if the CJEU, like the AG accept that retention of and access to communications data is at least on par with access to the content, it makes little sense to then be reluctant to hold that data retention adversely affects the essence of those rights. The CJEU does so without making any distinction or reasoning for this differential treatment, and thus serves to highlight that perhaps the CJEU themselves do not fully respect the essence of those rights in the context of data retention.

The CJEU’s answer seems only limited catch all powers

The thrust of the CJEU’s judgment in Tele2 and Watson was that general and indiscriminate data retention obligations are prohibited at an EU level. But as I have highlighted previously, the CJEU’s answer was only in response to a very broad question from Sweden, which asked was:

[A] general obligation to retain traffic data covering all persons, all means of electronic communication and all traffic data without any distinctions, limitations or exceptions for the purpose of combating crime…compatible with [EU law]?

Therefore, provided that national laws do not provide for the capturing of all data of all subscribers and users for all services in one fell swoop, this may be argued to be compatible with EU law. Both the e-Privacy Regs and the CJEU refer to ‘targeted’ retention [108, 113]. The CJEU gave an example of geographical criterions for retention in which David Anderson Q.C. asks whether the CJEU meant that ‘it could be acceptable to perform “general and indiscriminate retention” of data generated by persons living in a particular town, or housing estate, whereas it would not be acceptable to retain the data of persons living elsewhere? This is entirely possible given the reference from Sweden and the answer from the CJEU. In essence the CJEU have permitted discriminatory general and indiscriminate data retention which would in any event respect the essence of those rights.

Data retention is our cake, and only we can eat it

A final point on Tele2 and Watson was that the CJEU held that national laws on data retention are within the scope of EU law [81]. This by itself may not raise any concerns about protecting fundamental rights, but it is what the CJEU rules later on in the judgment that may be of concern. The CJEU held that the interpretation of the e-Privacy Directive (and therefore national Member State data retention laws) “must be undertaken solely in the light of the fundamental rights guaranteed by the Charter” [128]. The CJEU has seemingly given itself exclusive competence to determine how rights are best protected in the field of data retention. It is clear from the subsequent paragraph that the CJEU seeks to protect the autonomy of EU law above anything else, even fundamental rights [129]. This is despite the ECHR forming general principles of EU law and is mentioned in Article 15(1) (refers Article 6(3) of the Treaty of the European Union (TEU) specifically referring to the ECHR as such). Article 11 of the e-Privacy Regs refers to restrictions respecting the ‘essence of fundamental rights and freedoms’ and only time will tell whether the CJEU would interpret this as only referring to the CFR. Recital 27 of the e-Privacy Regs just like Recital 10 and 30 of the e-Privacy Directive refers to compliance with the ECHR, but as highlighted previously, Recitals are not legally binding.

Is the CJEU assuming too much?

A further concern, is that had the European Commission added general principles of EU law into Article 11, the CJEU may simply have ignored it, just as it has done in Tele2 and Watson. The problem with the CJEU’s approach is that it assumes that this judgment offers an adequate protection of human rights in this context. The ECHR has always been the minimum floor, but it appears the CJEU wants the CFR to be the ceiling whether it be national human rights protection, or protection guaranteed by the ECHR. What if that ceiling is lower than the floor? The AG in Tele2 and Watson stressed that the CFR must never be inferior to the ECHR [141]. But I have argued before, the EU jurisprudence on data retention is just that, offering inferior protection to the ECHR, and the qualification by the CJEU in Tele2 and Watson does not alter this. This position is strengthened by Judge Pinto De Albuquerque in his concurring opinion in the European Court of Human Rights judgment in Szabo. He believed that:

[M]andatory third-party data retention, whereby Governments require telephone companies and Internet service providers to store metadata about their customers’ communications and location for subsequent law-enforcement and intelligence agency access, appeared neither necessary nor proportionate [6].

Of course, Judge Pinto De Albuquerque could have been referring to the type of third party data retention which requires Internet Service Providers (ISPs) to intercept data from Over The Top (OTT) services, but his description is more in line with data retention of services’ own users and subscribers.


Although the CJEU has prohibited general indiscriminate data retention, the CJEU does not seem to have prevented targeted indiscriminate data retention. If the European Court of Human Rights (ECtHR) were to ever rule on data retention and follow its jurisprudence and the opinion of Judge Pinto De Albuquerque, this may put EU law in violation of the ECHR. This would ultimately put Member States in a damned if they do, damned if they do not situation, comply with the ECHR, and violate EU law autonomy; comply with EU law and violate the ECHR. When the minimum standards of human rights protection in this context are not adhered to, because of EU law, the ECHR should prevail. As anything less is a threat to human rights, meaning that the (even if well intentioned) CJEU can also be.

JHA4: chapter II:7

Photo credit: