17
Examination of witness
Professor Valsamis Mitsilegas and Dr Nóra Ni Loideáin.
Q11 The Chair: We are back in the Lords EU Security and Justice Sub-Committee for the second of our two panels in our inquiry into post-Brexit law enforcement co-operation. I am delighted that we are joined by two real experts in this field, Professor Mitsilegas, who is professor of European Criminal Law and director of the Criminal Justice Centre at Queen Mary University of London, a very warm welcome, and Dr Ni Loideáin, lecturer in criminal law, director of the Information Law and Policy Centre at the Institute of Advanced Legal Studies. Dr Ni Loideáin, also a very warm welcome.
You were kind enough to listen to our first evidence session with Sir Julian King, who comes at these issues from a practitioner’s point of view in responding to the trade and co-operation agreement. I ask you both to start briefly in the same way by giving us your overall impression of the trade and co-operation agreement as it affects these areas, and perhaps pick out one or two particular aspects that struck you as important. Then we will ask a series of questions. I emphasise that you do not both always have to comment on every single subject. You are very welcome to pick an angle that is of particular interest to you, so that we can make maximum use of the time. May we have your broad, overall impressions to begin with?
Professor Valsamis Mitsilegas: Thank you very much, Lord Chair. It is a pleasure to be here, as always. It is a mixed picture, in my view. This has always been a damage limitation exercise, with the parties trying to replicate, to the extent possible, arrangements with the UK as now a third country. From my reading of the security part of the TCA, I would categorise the level of ambition at three different levels.
The first level is the higher ambition that we see in the fields of extradition and data exchange as regards the Prüm system, criminal records and passenger name records, and in the unsung field, which is towards the end of this part of the agreement, of confiscation and exchanges of confiscation orders.
Then there is a medium level of ambition, which is perhaps disappointing in some regards, which has to do with mutual legal assistance, UK participation in Europol and Eurojust, and participation in joint investigation teams. Finally, and unsurprisingly in my view—this has been mentioned in a number of different evidence sessions in different committees—is the lowest level, which is the area where the UK simply cannot participate as a third country.
Sir Julian King mentioned the Schengen Information System, which is big, but also a careful reading on the provisions of data shows that the UK cannot participate in existing European databases, for example the European information systems. As we will discuss in the evidence session, there will be a relationship as a third country with liaison officers in The Hague, but there are limits to the exchange of information.
As we mentioned, there are also limitations on the real-time exchange of data. I will stop here for now, but I am happy to discuss in detail any of these areas during the evidence session.
Dr Nóra Ni Loideáin: Thank you very much, Lord Ricketts, and thanks so much to the committee for the invitation. It is an honour to be able to contribute to this inquiry. I will begin by reiterating what Julian said earlier: this is a hugely important, and very complex, legal agreement. This is especially so with regard to Part 3, the law enforcement and judicial co-operation side of things, and, of course, the supplementary agreement on security data is also relevant to the current conversation.
As a non-member state, and as a legal and political reality, the UK cannot have the same benefits as any other member. But then there is also the operational reality that the UK has played a really huge role in the development of justice and home affairs across the EU, and that its reduced role in these bodies and agencies and in contributing to these databases is a loss to safety of all citizens and residents across the EU and the UK.
In the provisions—particularly Part 3 and the oversight institutional provisions regarding the specialised law enforcement committee, for instance—a compromise has been reached on what access we have been allowed and what access has been reduced. Ultimately, however, the trade and co-operation agreement represent an operational downgrade for law enforcement authorities across the UK. I do not know how else you can put it, really, compared to what we had before, even though, if you look at it from the parameters of any other third country, we have done rather well in the arrangements. However, we are not like any other third country. The UK is in a unique position and we have a land border with the EU. This is a very complex set of arrangements that will take some time to review and assess.
In particular, there will be a huge amount of scrutiny of the data adequacy interim regime that we currently have. There is a lot of legal uncertainty about how this will be assessed. Even if we are granted the continuation of this decision, the Court of Justice of the EU could decide otherwise at a later date. Data adequacy decisions are reviewed periodically, so it is not like after six months we no longer have to worry about the UK legal provisions in law enforcement and security. Given recent judgments of the Court of Justice, national security matters will also come under the scope of that review, since the Schrems judgment and more recent judgments.
I agree with Julian that there are a lot of issues here regarding the bulk transfer and sharing of data concerning EU citizens by the security and intelligence agencies that will be subject to a lot of scrutiny. I think that a lot of focus should be on the role of the specialised law enforcement committee, considering the fact that it has significant powers in the future implementation, review and assessment of Part 3. In mutual consent with parties from the EU we could look to revise or amend some of the trickier provisions in Part 3.
The Chair: Thank you very much indeed. That is a very good bridge to Lord Dholakia, who has a question on that very subject.
Q12 Lord Dholakia: My question relates to oversight and conditionality. The trade and co-operation agreement talks about a specialised committee on law enforcement and judicial co-operation. What is it, who is on it and what does it do? How transparent will this co-operation be?
Professor Valsamis Mitsilegas: I think that this will be a committee of experts and it will focus specifically on security and judicial co-operation agreement matters. It has a number of important tasks, including the monitoring of the implementation and the functioning of the agreement. It has a role in consultations within the framework of dispute resolution in the agreement. This will be the committee that will enable consultations between the parties if there is a breach that might lead or not to a suspension of the agreement.
In addition to the provisions of the agreement, there is a lot in the form of an annexe. There are many annexes on criminal law co-operation. If you look at this, you will see that the committee may also take measures to facilitate co-operation. For example, if the EU acquis evolves, if there is a change in the mandate of Europol and Eurojust, if the list of crimes for which Europol and Eurojust are competent changes or is expanded in the future, then, in order to avoid a new agreement between the two parties, it would be for the specialised committee to decide to extend the mandate as applied to the United Kingdom.
So, it is varied. It has a monitoring role and an implementation role. As my colleague has mentioned, it has an important role in the field of data protection and adequacy, dispute resolution and monitoring, but I will have to wait and see the precise logistics of this committee and exactly how it will function. I presume that it will have members from the Home Office and the Ministry of Justice and perhaps from the Information Commissioner’s Office.
Dr Nóra Ni Loideáin: Briefly, I will reiterate what my colleague mentioned. This is a hugely important body. It is also an evolving body, because it will report to the overall Partnership Council which can decide to expand the Specialised Enforcement Committee’s powers. That is a very significant provision.
On the range of tasks, there a number of quite significant tasks for the Specialised Law Enforcement Committee to review - particularly in the next six months on the data adequacy question being just one example. It has the power specifically to set up a working group that will examine specific substantive issues and challenges that the trade and co-operation agreement present. That is very significant.
I have one concern about the specialised committees and the Partnership Council currently. In the trade and co-operation agreement—the TCA—there is a less than firm commitment to parliamentary scrutiny of these committees. There is a firm commitment that civil society should be consulted about the operation and implementation of the Partnership Council and its work, but when it comes to parliamentary scrutiny this is a conditional unqualified provision stating that the EU and the UK may decide to set up a parliamentary assembly that could then consult and ask questions of the specialised committee. They are quite limited on the publication of their work and their reports at the moment. However, this type of agreement is quite fluid, of course, and given the powers which the law enforcement specialised committee and the Partnership Council have, we could easily add in, by mutual consent, additional provisions on accountability and parliamentary oversight.
Q13 Baroness Hamwee: I want to ask about human rights and, as far as the EU are concerned, fundamental rights, as well as the data protection standards. I also want to ask about the provisions on policing breaches, because breaches can lead to suspension. as we have heard. How effective can these be? Do you have any observations about how these will work?
Professor Valsamis Mitsilegas: Thank you for the question. In the interests of time, I think Sir Julian King gave a very full answer to this question, so I will just add one thing. The EU has managed to get into the text a reference to the requirement for states, which really means the UK, to give effect to the European Convention on Human Rights domestically.
This is an important provision. Remember that we have shared a long-standing debate about whether the UK will abolish the Human Rights Act, and I think you share this view. Cross-referencing this agreement, which I find very important, the EU is really saying that it will be quite a serious matter if the UK decides not to withdraw from the European Convention on Human Rights but even to abolish the Human Rights Act and therefore to change the way ECHR rights are enforced within the UK. So, this is an important provision that shows the willingness and the priority given to human rights monitoring.
The wording is quite similar to the wording used in cases involving the European arrest warrant. There must be monitoring of serious and systemic deficiencies in the field of fundamental rights protection and the rule of law and, of course, in the field of data protection. These will lead to suspension and can be quite serious matters, in a sense.
On your question about enforcement, enforcement operates on two levels. The first level is the level that we are discussing today, which is the level of the agreement. We share mechanisms on monitoring and dispute resolution, and we have the specialised committee and so on.
But do not forget that most of these measures have to do with co-operation between national authorities, so European arrest warrants or extradition will remain a matter for national judicial authorities. It will also be these authorities on the ground that will effectively monitor compliance with fundamental rights. A judicial authority in France, for example, may not issue a European arrest warrant if the court thinks that the fundamental rights of the person would not be fully respected in the United Kingdom, and vice versa.
So, there is the top-down system of monitoring fundamental rights in the agreement, and there is also the inevitable decentralised bottom-up monitoring that will happen once co-operation begins to take place.
Baroness Hamwee: On your point on the Human Rights Act, it would be very good if people who understand all this could feed thoughts into the review taking place at the moment under Sir Peter Gross.
Dr Nóra Ni Loideáin: I have to say, Baroness Hamwee, you beat me to it in mentioning the review of the Human Rights Act. A point to highlight here about the impact of human rights compliance under the TCA is it is very much linked to the data adequacy question, because data adequacy, as part of its very lengthy and far-reaching set of criteria, also includes assessing the rule of law compatibility of UK legal laws and the overall legal constitutional system, human rights and powers used for law enforcement and security.
If any issue were to be found in the practical implications, specific titles, such as the provisions on the transfer of passenger name records, which were mentioned earlier, or DNA exchanges under Prüm, could be suspended. That would really disrupt a lot of ongoing serious investigations for law enforcement authorities and security officials, or it could be even more significant: the entire part could be suspended. It is a very significant provision that makes all the other arrangements under Part 3 extremely vulnerable.
To give some practical examples of what could imperil the Part 3 provisions or specific titles, there is the Human Rights Act review. If the review comes back and denounces the Human Rights Act—I must admit that I would be surprised if that happened, but in the event that it did—and if the Government agreed with that, it would immediately imperil Part 3 in its entirety, because it would be a denunciation of the European Convention on Human Rights, which is incredibly serious. This would also imperil the data adequacy agreement, because data adequacy will also assess our international obligations under human rights law and the rule of law. It is a very significant provision and it casts quite a significant spectre of legal uncertainty. However, if we remain a member of the Council of Europe and a member of the European Convention on Human Rights, we are meeting that very significant obligation.
Another significant example to bring up is what exactly constitutes serious and systematic deficiencies. The devil really is in the details there in terms of the TCA provision. One red flag in that respect—there are certainly others with regard to data adequacy—is that we have had situations where our domestic courts have called into question current laws concerning law enforcement.
I draw the committee’s attention to the recent Bridges judgment delivered by the Court of Appeal last year concerning the use of automated facial recognition by the South Wales Police. Specifically, our own Court of Appeal stated that we have critical defects in the current legal framework governing the use of automated facial recognition. I am not saying that this equates to a serious and systematic deficiency, but it could entirely be taken as an example of one that would constitute a serious and systematic deficiency if that is an area of law the Government do not address in the ongoing evaluation of our human rights standards and data adequacy in the next six months that is so critical.
The Chair: Thank you so much. We will come back to the data adequacy point at the end of the session, but we now move to extradition, and I will ask Lord Rowlands to put the next question.
Q14 Lord Rowlands: The EU has described the UK-EU surrender agreement as unprecedented for a non-Schengen third country. In what way is it unprecedented, given that it seems to be closely based on the Norway and Iceland agreements?
Professor Valsamis Mitsilegas: Norway and Iceland are, of course, full Schengen members, so the comparison is really between the UK and countries like the US, for instance, where the UK has an extradition agreement. Extradition is perhaps the area where the two parties should try their hardest to replicate as much as possible what exists today—not 100%, of course, because we must always remember that the UK is a third country now, but if you look at the provisions there is a significant ambition to provide some continuity rather than rupture of what we have—or had, I should say; the European arrest warrant is all in the past now. It was called the European arrest warrant in the previous treaty, and there are a number of elements of it that are also visible in the current treaty.
I will focus on some of the elements which I think are important. First, the extradition arrangements remain judicialised. The European Arrest Warrant is a co-operation between courts. One of the concerns with Brexit was that this would move back to the Executive and we would have Ministers trying to deal with this, which would be very slow and cumbersome. This is not the case, so we continue to have judicialised extradition between the UK and the EU member states.
The time limits remain very ambitious, so the speed element remains. Also, there is a form. If you look at the annexes on page 1,400 or something of the agreement, there is an annexe pro forma of the arrest warrant that is more or less the same as the pro forma of the European arrest warrant. This shows the willingness to continue to have an exchange on the basis of pro forma forms with a minimum of formality in a sense, so not too much red tape. The abolition of the requirement to verify dual criminality remains to make it easier, and there are also limited grounds to refuse to execute a warrant. This is unprecedented in relation to the EU’s relationship with non-Schengen, non-EU third countries.
There are a number of interesting aspects in the arrangements that have to do with proportionality, which may be the subject of another question. I understand that this was also promoted by the UK Government, and proportionality is there to underpin the operation of the system now. One element where the UK will lose out is that now member states are allowed under their own constitutional arrangements to stop extraditing their own nationals. Germany, among other countries, introduced a declaration even during the transitional period. But if you read the agreement the spirit is pro co-operation. It says that in principle member states should extradite their own nationals unless there are serious constitutional requirements.
The elephant in the room here, and this was mentioned in the previous session, is how the system of speed will operate in practice with the UK no longer having access to the Schengen Information System alerts, because this hinders a lot of the speed in the process. A French liaison magistrate once explained to me that if, for example, a suspect is getting into the Eurostar in Paris, the SIS alerts will enable them to be stopped immediately after crossing the border or even before crossing the border. If you do not have this real-time access, things become much more complicated in practice.
The other area that is true in this field and in the general field of mutual legal systems is that the UK will depend on the good will of its EU partners in order to execute extradition requests with the same speed. The agreement puts these very tight deadlines in place, but, in reality, member states are bound by the same deadlines under EU law vis-à-vis the other EU member states. In terms of political reality and practitioners’ reality, the key challenge is to keep the UK requests prioritised in the same way as they were when the UK was an EU member state. This is worth monitoring when these arrangements come into place.
Lord Rowlands: I find that very reassuring in many ways, because, in earlier evidence we were given, the absence of the European Arrest Warrant was a purely judicial process that somehow needs to become increasingly politicised. Do you think the agreement has avoided that possible politicisation?
Professor Valsamis Mitsilegas: I think that in the text of the agreement, if you read it, they have made every effort possible to avoid politicisation, first by keeping the judicial character of extradition, which is a big innovation in international law, where extradition is mostly a matter for the Executive. Also, if you read the quite complex provisions on political offence exceptions, there was an effort to link political offence exceptions to extradition as much as possible in order to make extradition easier in terrorism cases, for instance. There is a little provision in the agreement on that.
The grounds for refusal are to a great extent nearer to the grounds of refusal in the current European Arrest Warrant system. This remains a judicial process, and either the hinderances will be with regard to concerns about fundamental human rights protection, which is for the courts to establish, or they will be more practical.
The Chair: I need to play my Chair’s role of moving this along, given the time. I turn to Lord Anderson of Swansea next, still on the issue of extradition.
Q15 Lord Anderson of Swansea: Building on Lord Rowlands’ question, our witnesses have variously described the agreement as a whole as “an operational downgrade” and “damage limitation”. To what extent does this apply to the extradition arrangements? We know from our police witnesses in the past just how much they value the speed and efficiency of the European arrest warrant, so what is your overall assessment? Is it fast, although it is probably better than we expected and many of the deficiencies have been met? What, in the view of our witnesses, are the positive and negative features of this agreement, which clearly could have been much worse but is still short of the provisions of the European Arrest Warrant?
Dr Nóra Ni Loideáin: I do not have much to add to Valsamis’s quite comprehensive assessment of the new arrangements. I would mention only that it helps in considering the impact on overall co-operation and data transfers between law enforcement authorities. All the different systems have possibilities of data transfers holistically. While it is a loss to no longer have that access to the Schengen database, where there is a real and immediate need such as a high-level security emergency situation and, for example, classified information needs to be shared in relation to an arrest warrant, there are provisions in the security data agreement that could address those kinds of data transfers.
That is more on a case-by-case basis. It by no means replaces the value of the real-time alerts that the Schengen system would have provided, but it is somewhat of a silver lining in the spirit of co-operation that still very much continues between the UK and the EU law enforcement authorities.
Lord Anderson of Swansea: Building on that spirit of co-operation, I suppose the reason for optimism is that there is a mutuality of interest and hopefully good will as a result that will lead to a certain dynamic in favour of smooth operation of this new facility.
The Chair: You are getting nods from our witnesses on that, Lord Anderson. Thank you very much. Baroness Goudie will follow up on extradition.
Q16 Baroness Goudie: A number of rights on an individual subject to surrender warrant are issued under the provision. How could these rights be enforced, and is the enforcement mechanism adequate?
Professor Valsamis Mitsilegas: As I mentioned earlier, the key avenue for enforcing rights is at the level of the practical operation of extradition. This is a procedure that happens in judicial authorities in states and it is there both in the UK and in the other EU member states for the defence to be given adequate safeguards. The current agreement is quite elliptical on defence rights. It mentions a few of them, but we need to rely on member state systems. EU member states are bound by detailed provisions on minimum standards on the rights of the defendant there. The monitoring there will be by judicial authorities that still have the right to refuse to execute an extradition request, an arrest warrant, if they feel that the fundamental rights of the suspect will be breached if the arrest warrant is executed.
There will be ongoing scrutiny by national courts, and this is how the system will operate, as today, and I would like to make another point there. I know that the role of the Court of Justice has been downplayed, at least in the text of the agreement, but the Court of Justice will remain hugely relevant, because EU member states, in their relationship with the UK, must at all levels comply with EU law. EU law is also the law as interpreted by the Court of Justice, and this applies to extradition and, as I am sure my colleague will expand on further, in the field of data exchanges. That is why the court’s case law on data adequacy, but also the court’s case law on mass retention of personal data, is so important. I think we will come back to that later in the session.
Specifically, on your question about extradition, I think the rights will be enforced and monitored at the decentralised bottom-half level, largely by the authorities that have to operate the arrest warrant. At the treaty level, there is the element, which we mentioned, on systemic deficiencies in the protection of fundamental rights and the rule of law, but in the field of extradition we are quite far from that, at least as far as the UK is concerned currently.
The Chair: Dr Ni Loideáin, did you want to add to that? We will come back to the whole data adequacy angle of that shortly.
Dr Nóra Ni Loideáin: In the interests of time, I have nothing further to add to that question.
The Chair: We will have plenty of time for a closing discussion of the data issues. Next, I come to Lord Kirkhope on Europol and Eurojust.
Q17 Lord Kirkhope of Harrogate: Good morning, again. Can I turn to the whole question of Europol and Eurojust? Obviously, they are interlinked in their activities. We have historically had an enormous amount to do with the development of these organisations. We have not only had the director in place for a long time, but Europol in particular has adopted many of the good practices from the British policing system, for instance. All of that is important. As Europol and Eurojust go forward, there is an issue on which we were in disagreement, which is the appointment of the European public prosecutor, which now seems to have come to the very front of their agenda.
How are we going to exert influence on those bodies, particularly as they move forward and to some extent change their status? How are we going to do this? Are we going to do it in line, as I was saying earlier to Sir Julian King, with the whole question of being observers, as the Americans are currently at the headquarters, influencing from that point of view the practical side but not being part of the board, for instance, or part of decision-making?
How do you really see it? They are critical. People are talking of Interpol as an alternative, and my own view is that it is probably not a very good alternative. It certainly does not make up for the very detailed, comprehensive arrangements that are in place with Europol and Eurojust. Could I have your observations on this and how you see our future relationship with those organisations?
Professor Valsamis Mitsilegas: I agree with what I see as the undertone of your question, Lord Kirkhope. I do not think it will be the same, which it is a great shame, because, as you said, Europol is a great example of the UK’s influence in justice and home affairs. It is the model of intelligence-led policing that has largely been exported from the UK to the EU, and now, sadly, you are a third country. There are avenues, but we have to be pragmatic about it. The UK is a third country. You cannot go beyond that, currently, so there needs to be a course of engagement. I am sure EU member states will be happy to engage with the UK’s views and expertise, which is not going to go away, but there are formal limits, as you mentioned, to UK participation in these agencies.
Operationally, I find it interesting that there are some avenues in the agreement, for example allowing the UK and Europol direct contact beyond the national contact points in specific cases. This shows the willingness, at least at the operational level, to have some sort of enhanced co-operation. With regard to your question about strategy, however, things are much more difficult because you are no longer an EU member state. You are probably more influential than the US as a third country, but there are still institutional limits to what the UK can do.
Another element that you may find of interest is that in the provisions for mutual legal assistance the agreement specifies that EU agencies may act as contact points for the UK authorities. This gives an interesting flavour of European integration for the future. You may have an instance where a mutual legal assistance request from the UK will go straight to Eurojust rather than to individual member states and, in 10 years from now, probably straight to the European Public Prosecutor’s Office. Gazing into my crystal ball, I think that in 10 or 15 years it will largely be placed in Eurojust, at least for the participating countries.
Lord Kirkhope of Harrogate: Before your colleague comes in, do you therefore think that, in our relationship, Europol and Eurojust are divisible?
Professor Valsamis Mitsilegas: You mean in terms of different kinds of influence?
Lord Kirkhope of Harrogate: You mentioned approaching directly on Eurojust and so on. The closeness between Europol and Eurojust in the EU states will continue, but our position may be slightly different. Would we be able to have some kind of not bilateral but different connection with Eurojust that does not affect the relationship with Europol? Are they separable at all?
Professor Valsamis Mitsilegas: I think they are. I do not see them as seamlessly linked. Europol has developed into a much bigger agency than Eurojust. It does many more things and it is quite powerful now. Eurojust currently has a kind of existential crisis in its relationship with the European Public Prosecutor’s Office, and for Eurojust I think that the next few years will be crucial to the way we develop the EU legal framework.
Dr Nóra Ni Loideáin: I agree with Valsamis that it will not be the same. This is a clear demonstration of that operational downgrade, and it is particularly unfortunate in the context of Europol, because the UK has played such a significant role in the future direction and intelligence-led policing focus of Europol.
At the same time, Europol is also hugely reliant on the co-operation and support, and specifically data transfers from EU member states, so the UK will still have a lot to contribute to co-operation there. We are highly valued in the capacity and the resources that we contribute at the law enforcement and security level, the national DNA database being the second largest in the world, and our huge involvement in exchanges like Prüm are good evidence of that.
On the institutional roles of initiating investigations, for instance, we are developing the scope and focus of these bodies. We are limited, of course, because ultimately, while we are a unique third country, we are still a third country.
Lord Kirkhope of Harrogate: A lot of the talk in Britain is always about what we are losing as a result of not being part of the decision-making with Europol, for instance. Turning it on its head, Europol will be losing some very valuable advice, guidance and information from us. To what extent will our rule makers here be more to blame if we do not have a good arrangement in future, as opposed to the European rule makers?
Dr Nóra Ni Loideáin: A consistent concern has been that now that our role in Europol in terms of access and our role as an influential member are diminished, we will be reduced to having to deal with Interpol and we will have to rely on it. Actually, in the spirit of looking for silver linings and being constructive, this is perhaps a moment of opportunity for our current role in Interpol and how we can arguably do the same for Interpol as we did for Europol in terms of resources and future leadership and strategy. That will take time. In the short term, this is still an operational downgrade, but in the medium to long term there is certainly an opportunity there.
On the point about continuing to be constructive, I suggest that there is certainly considerable scope in the trade agreement to potentially expand our role within Europol. Of course, there are limits; we are still a third country. But we should keep in mind that we are a unique third country with an awful lot that we can contribute to law enforcement and security.
There is scope there to expand our role somewhat further within Europol and Eurojust in future, and that kind of investigation could be explored by the specialised law enforcement committee. I do not think this is the end of the matter at all.
The Chair: Thank you very much. It is good to have a positive note injected into the discussion. Next is Lord Anderson of Ipswich on the whole issue of sharing and access to data.
Q18 Lord Anderson of Ipswich: Although we do not have SIS II, we have retained some access to a number of other systems that you both know well: notably, passenger name records; Prüm, for DNA, fingerprints and vehicle information; and the European criminal record exchange service, ECRIS. Is it possible to say from the agreement precisely how the new arrangements compare with those we enjoyed as a member state, particularly for real-time access to data, or is it a case of everything to play for in the specialised law enforcement committee and the Partnership Council? To the extent that it is possible to say, are we looking here at another operational downgrade, or something better?
Professor Valsamis Mitsilegas: Thank you for the question. We can see the glass as half full or as half empty. Sir Julian King covered the issue about real-time access. How far can a third country have the same access to these systems as an EU member state? If you see the glass as half full, you can say that for a third country the UK has done quite well in these areas, because you have a very detailed part of the agreement on Prüm, with very detailed rules, and rules that envisage what happens if the EU develops its rules further in the future and whether the UK needs to align with these rules, and there are mechanisms for that as well. Maybe it is not what Lord Kirkhope would have wished for on PNR, but still there is something there. As Sir Julian King said, in the implementation of this it may become obvious that there must be some timeliness in the exchange of information, because the aim of this system is preventive.
On criminal records, the way I see it is that the UK does not have access to ECRIS as such, because ECRIS is European. But again, if you read the annexes, the system is built on the ECRIS infrastructure for EU member states. It says that the UK must build its own infrastructure and it will interact with a member state’s infrastructure, which in turn will be built up on the ECRIS infrastructure. I know this is very complex, and this is for the specialised committee to look at and those who look at the implementation. What I am trying to say here is that you cannot have the same as an EU member state, but in these specific areas there is an effort to have as much as legally possible as a third country, and the question now is whether this would be operationally possible.
Dr Nóra Ni Loideáin: Valsamis is absolutely right: we need to take on board our limitations now as a third country with regard to these systems, but we still play a very significant role in Prüm in pushing it forward under the TCA, and we will carry that through. We decided to play a more significant role in Prüm from 2015, and now we will move from the exchange of DNA profiles to fingerprints and palm prints. We have been leading the charge in that respect, and to a certain extent that will continue under Prüm. Prüm is arguably one of those glass-half-full situations. It is still a significant area where we have influence and can still contribute to law enforcement and day-to-day exchanges.
Of course, the major significant loss is SIS, the Schengen database. At the same time, we can look for other opportunities. Operationally day to day for police officers across the UK, real-time access will be a blow. That is what will hit officers in the short to medium term immediately. There will also be delays with ECRIS, because even though in the spirit of the agreement we still have access, we have to set up new systems now to ensure that we make that access a real possibility every day for our law enforcement authorities. That will take some time, and I think investigations will face some delays because of that. Looking forward, we are doing very well for a third country in our access to these databases.
The Chair: Thank you very much indeed. We now come back to data adequacy.
Q19 Baroness Hamwee: We have heard that the CJEU remains hugely relevant—that is what I wrote down earlier—in the way it operates, which is with period reviews. The TCA has interim provisions regarding the transfer of data, and the interim is quite short—only four or six months. Can you help us with the compatibility of the interim provisions, particularly with the CJEU’s case law on data protection? Is the arrangement vulnerable to legal challenge in the European court?
Professor Valsamis Mitsilegas: I will hand over to my colleague to comment on that, if you do not mind.
Dr Nóra Ni Loideáin: Thank you, Valsamis. Again, I would reiterate what was mentioned earlier: that the CJEU still plays a significant role. For quick clarification, if we are granted the continuation of the data adequacy agreement, that period review will be undertaken by the European Commission, and it is a very wide-ranging and detailed assessment. The European Commission fell foul of the Court of Justice of the EU for not undertaking sufficiently detailed assessments in the past, so the European Commission will no doubt be undertaking quite rigorous periodic reviews.
On concerns regarding compatibility in light of recent Court of Justice judgments, there is some concern regarding a number of areas within the UK legal system. I mentioned one concern earlier: what might be considered to constitute serious and systematic deficiencies in our rule of law and human rights compatibility in specific law enforcement powers. I gave the specific example of the use of automated facial recognition and our current legal framework. International courts, including the European Court of Human Rights, for instance, and of course the Court of Justice of the EU, are particularly sensitive to when domestic courts have deemed there to be defects or shortcomings with the rule of law or particular rules within a national member state, and for third countries.
I think the Bridges Court of Appeal judgment is a significant red flag here. To give you a bit more detail, one of the specific issues there was that the current legislation lacks clear and precise rules for giving guidance to police officers as to who should be on automated facial recognition watchlists and where such systems should be deployed. That lack of clear and precise rules is very relevant to the rule of law principle. The rule of law principle requires that there be accessibility and foreseeability of those kinds of rules, and automated facial recognition has been recognised as highly sensitive and highly intrusive by the courts here. That is an issue that could fall within the question of data adequacy.
On the most serious issue, there will be quite a lot of scrutiny about the powers that the intelligence agencies are currently granted with regard to their access to bulk retention and bulk access to data. The Investigatory Powers Act 2016 permits a number of systems whereby indiscriminate and general retention and transmission of electronic communications are made available for the safeguarding of national security. We certainly fall short, if you consider our position in light of recent Court of Justice EU judgments, in the strictly necessary safeguards that we should have in place. The two most serious ones are the fact that most, if not many, of the surveillance programmes and data gathering programmes permitted under the Investigatory Powers Act are not strictly targeted. The Court of Justice has established very high standards for judgments that are now highly relevant to us as a third country. The Schrems judgment of 2015 and the recent Schrems II judgment of 2020 also confirm that these particular safeguards and requirements now apply to us as a third country.
We arguably also fall short with respect to some of the safeguards we put in place regarding passenger name record data in the trade and co-operation agreement. Our standards are not as strict as one of the set of standards that were set out by the Court of Justice in a recent judgment concerning a draft agreement on passenger name record data exchanged between Canada and the EU. There was a very specific provision there regarding what requirements are in place for the onward transfer of data. It was mentioned earlier that the onward transfer of data, the arrangements that we have with the US—I do not believe that particular agreement has come into force yet, but once it does—will be subject to review for our compatibility for data adequacy, but also for the rule of law and for human rights, particularly if it allows for the bulk transfer of data. There are very high standards that we have to meet now because of the judgments set down by the Court of Justice.
We have to be mindful of the fact that we are being subject to standards that are even higher than the standards that are imposed on EU member states, because as a third country we are no longer being given that margin of appreciation which the European Court of Human Rights accorded us, for instance in the Big Brother Watch judgment in 2018 with regard to the bulk and generalised access that intelligence authorities and security agencies have to that kind of data. There are some very serious questions about how much weight the European Commission will give to these issues, because at the moment it does very much appear that we fall short of these criteria.
Another key criterion in this respect is the prior authorisation for the combating of serious criminal offences regarding access to retained data and retained communications data. That is the traffic and location data, not the content of communications. We arguably also fall short in that respect with regard to the independent authorisation that we provide there. There have been some questions regarding whether the Investigatory Powers Commissioner can be described as an independent oversight body, because it has that double authentication role with the Secretary of State. When we set up an independent body to authorise communication data access, we set up an entirely different body, the Office for Communications Data Authorisations, that would be recognised as completely independent. That would seem to imply that the Investigatory Powers Commissioner and the judicial commissioners are in effect not independent to meet the standards of the Court of Justice of the EU. There are a number of concerns.
To be constructive on what the specialised committee on law enforcement can do, it would be prudent to start exploring what legal basis for appropriate safeguards we could rely on if we are not granted this data adequacy decision. One of the possible appropriate safeguards is to have a legally binding framework—a statutory framework—that would set out the obligations and safeguards that we would ensure for data transfers for law enforcement purposes, and this is set out under the Law Enforcement Directive, as mentioned in the TCA.
There is also perhaps the possibility of using a code of conduct, although it states in the general data protection regulation that this does not apply to public authorities, but this could perhaps be a useful instrument for us to rely on when it comes to the responsibilities of communication service providers. An area of clarification for the specialised law enforcement committee to be tasked with could be the interplay between what constitutes the rules of data adequacy under the GDPR and the Law Enforcement Directive, because the criteria that they both have are the same. If we fall short on a data adequacy agreement under the GDPR, we also fall short under the Law Enforcement Directive.
Baroness Hamwee: You have both given us a huge amount of material to think about. I had better hand over to the next.
The Chair: Thank you very much indeed. We are coming to the end now. If we could just ask for five minutes extra time so that Baroness Primarolo can wrap up our very important discussion on data.
Q20 Baroness Primarolo: I think Dr Ni Loideáin has answered the question, because the first question was: what is the possibility of the European Commission not reaching a decision on data adequacy later in the year? I think she just gave us a very long list of why that might not happen.
Rather than thinking of not getting a data adequacy agreement, would I be right in saying there is a possibility, given the interaction with all the European Court of Justice work and the points that you have made, that the Commission might not come to a decision at all and might have to push it further back?
Dr Nóra Ni Loideáin: It is always interesting to consider the crystal ball gazing prospect. We have an incredibly short time period for this assessment. Four months is not long at all, particularly when we are all dealing with a global pandemic. Of course, it will be six months. I think it is unlikely that the EU would object to us having that extra two months, as is provided under the TCA for this particular assessment. It will be particularly useful to take into consideration what points the European Parliament might raise regarding the data adequacy assessment. I think many of the committees there will scrutinise quite closely where the UK legal system currently falls short, in line with the standards that the Court of Justice of the European Union has set out.
I know that some commentators have highlighted that the Privacy International judgment delivered by the Court of Justice of the EU last year somehow gives us a clean sheet, because the particular legislation being reviewed was part of the 1984 Telecommunications Act. However, the court very clearly said that any national legislation permitting the indiscriminate and general retention or transmission of data is precluded under the ePrivacy Directive and Articles 7, 8, 11 and 52 of the EU Charter of Fundamental Rights. I think it would be misleading to say that those same criteria are not going to be applied to the Investigatory Powers Act in the European Commission’s assessment, and in the assessment by the European Parliament in the months to come.
Baroness Primarolo: The defence that is often used by government spokespersons here in the UK is, “Well, of course we’ll get adequacy, because we comply with the GDPR”. Am I right in thinking that you are saying that it is much more complicated than that? First, we are a third country and there will be a raised bar as to what we have to comply with, because some latitude is lost. Secondly, there is so much going on in this area that we might not get the data adequacy within even the six-month period. Is not the data adequacy the absolute lynchpin of all the security and policing work now and in the future? How do we get around a situation where we do not have proper data adequacy from the Commission?
Dr Nóra Ni Loideáin: You have summed up the situation incredibly well. In the way in which Part 3 of the TCA is framed, so much hinges on data adequacy. It seems like the silver bullet that will deal with all our data protection and rule of law compatibility issues. It would be prudent to consider the other avenues for a legal basis for data transfers, given the legal uncertainty that surrounds our assessment for data adequacy by the European Commission.
Professor Valsamis Mitsilegas: I concur with the analysis and just want to make three points very briefly. First, as was mentioned, it is not enough for the Government to say that the GDPR is transposed into the UK law and this is enough. We need to look at the bigger picture, including the elephant in the room—the bulk retention of data and access to this data by national security and intelligence authorities for the UK. This is a big issue, and it is currently contrary to the Court of Justice case law.
Secondly, even if an adequacy decision is adopted, and it may be adopted, it is subject to a challenge to the European Court of Justice. This is something that we need to bear in mind.
Thirdly, as has already been mentioned, adequacy is assessed on an ongoing and periodic basis. This is a very live area for the Court of Justice and even concerns EU member states themselves. For example, there are currently a number of pending cases before the Court of Justice on the compatibility of the retention of PNR data with the Charter of Fundamental Rights. When the court comes to give these judgments—who knows when, maybe this year—they will also be relevant to the assessment of the UK system. Although the UK is a third country, it is subject to ongoing monitoring by the EU and its institutions with regard to the adequacy of its data protection arrangements. It cannot really be a clean break if you want to have close co-operation in this way.
Baroness Primarolo: So, basically, you are saying that we have sidestepped all the problems of data adequacy in this agreement and that it will come back and bite us. Is that what you are saying?
Professor Valsamis Mitsilegas: One step at a time. We need to continue with the exchange of data in this very important field and try to deal with the consequences as they come, I think.
The Chair: Thank you. We have slightly run overtime, but it has been a really interesting and important session. You have given us a great deal of food for thought in all the areas we have covered. Thank you, Professor Mitsilegas and Dr Ni Loideáin, for some very interesting, frank and wide-ranging answers to our questions. I draw this meeting to a close.
