Examination of witnesses
Javier Ruiz Diaz and George Wilson.
Q45 The Chairman: Good morning to you both. Thank you very much for agreeing to come and give evidence to us. We are looking at the Government’s proposals to negotiate a treaty between the UK and the EU on security matters. We are looking at internal security, not foreign policy or defence issues. We are very keen to get your views on that.
We are working on the assumption that we are going to leave the European Union, irrespective of whether we think that is a good thing. Therefore, the question before us is: on the assumption that that is the case, what would be the best possible set of arrangements for us? That is the framework within which we are operating the inquiry.
We are very grateful to you for appearing before us and giving evidence. May I ask a question to start with? After you have both introduced yourselves and your organisations, will you say what, in your view, the best form of “closest possible co-operation” between the UK and the EU after Brexit would be, on the assumption that we have left?
George Wilson: I am the EU law and policy specialist at Liberty, which is a domestic human rights organisation that is non-party and cross-party. We did not take a position on the referendum. We campaign for the promotion and protection of human rights through policy work, advocacy and test case litigation.
Javier Ruiz Diaz: I am the policy director of the Open Rights Group. It is a grass-roots organisation dedicated to promoting human rights in the digital environment, so our main focus is on online and digital. Liberty will probably be a lot broader, just so that you understand the difference. We, too, did not take a position on Brexit as an organisation. We decided not to do that and to try to understand what the impact would be either way. In that sense, we are in agreement. We are just looking at what the impacts are. For us, it is fair to say that the main focus in this context is data.
Q46 The Chairman: We have done quite a lot of work in this Committee on data protection, so it is very useful to have that perspective.
Mr Wilson, what, in an ideal world, would Liberty’s vision of “closest possible co-operation” be? Feel free to step outside the constraints of your organisation, if you think that is appropriate.
George Wilson: In an ideal world, we would like to see co-operation on terms very similar to those we currently benefit from.
The Chairman: I ought to say that the acoustics in this room are not good. If both of you could speak slowly and speak up, that would be very helpful to us at this end.
George Wilson: In an ideal world, we would like to see co-operation on terms very similar to those that we currently enjoy with the Union. That co-operation would be based, as it currently is, on respect for the rule of law and fundamental human rights. It would include important safeguards that benefit not only ourselves but EU nationals, when we look at the security and justice tools. In the proposed treaty, if it is agreed, we would like to see fundamental rights prioritised alongside, rightly, the aim of keeping our country and Europe safe from serious organised crime and terrorism.
Javier Ruiz Diaz: For us, too, the closest co-operation should be based fully on a system of rights and the rule of law. In that sense, it is important to see that there is a fundamental difference from the Five Eyes agreements, to which we should come back later.
Maintaining the status quo seems unrealistic, to be honest, in the face of everything. It seems that it will be a big challenge to maintain the same level of co-operation that we currently enjoy. We think that participation in organisations such as Europol is desirable. That brings some level of accountability. Some data sharing should take place, mainly on the basis of suspicion. Our position is that there should not be bulk sharing for general purposes, such as fighting crime in the abstract. We also think that the new regime should be an opportunity to look at what the current arrangements are and where possible problems may lie, and to try to improve them, if possible. We should not just try to ape existing arrangements.
Finally, we are disappointed that the negotiations seem to be focused mainly on securing capabilities. At the moment, fundamental rights seem to be seen as a hurdle to overcome, in some cases—particularly when you look at things like data protection adequacy, which is seen as something that you have to achieve in order to get somewhere rather than as a value in itself.
The Chairman: On the assumption that we do leave, what will be the downsides, if any, from your perspective? What will we be losing? What will we have to make up?
George Wilson: From Liberty’s perspective, the current arrangements benefit from strong fundamental rights protections. Although we did not opt in to procedural rights protections in a similar way to other states, which we would like to see addressed if there is a future treaty, we benefit from the application of the charter, which has provided strong and robust protections for human rights in this area in comparison with other external measures, such as the Council of Europe’s European Convention on Extradition. Although the convention is strong, it is not as strong in rights protection terms as the current arrangements that we have through our justice and home affairs opt-ins.
Javier Ruiz Diaz: I have very little to add. Fundamentally, I agree.
Q47 Lord Kirkhope of Harrogate: Good morning, gentlemen. I have had some dealings in the past in Europe not with Javier Ruiz’s organisation, but certainly with Liberty. We are talking about a potential security treaty here. I am quite interested not only in the sorts of things you would like to see concentrated on in that treaty, but in the areas that may not be suitable for a treaty at all, of which there are quite a lot, and may have to be dealt with in some other way in our arrangements with the EU. I wonder whether you could put your minds a little to that.
You have just mentioned the importance of the charter. On the whole issue of human rights, we have the Human Rights Act 1998 domestically, the European Convention on Human Rights and the supplementary Charter of Fundamental Rights. Not all those issues necessarily have a direct place in a security treaty. Looking ahead, how will we maintain a level of human rights that, on the one hand, is very much under the competence of the UK and its courts, tribunals and so on, and, on the other hand, will mean that we can communicate and have an understanding with the European Union, with some sort of approximation? Do you see problems with this? How would you handle these things? Obviously, you are campaigning groups. I wonder how you see this as a broader concept, either within a security treaty or outside it.
George Wilson: One of the main issues that we have seen in that regard raises its head when we look at the European Union (Withdrawal) Bill. Our judiciary is fantastic at looking to judgments in other jurisdictions as they pertain to fundamental rights instruments, for example. If we do not retain the charter, which we think is critically important, we would like our judiciary to be able to look to jurisprudence of the Court of Justice that relates to the charter and to apply it in some way, shape or form in our own jurisdiction. Because these instruments are based on European law and were drafted against the charter, we think that it is critically important that, if there are issues in the future, our judges can look to Court of Justice jurisprudence.
Lord Kirkhope of Harrogate: May I ask you a supplementary before your colleague comes in? There was quite a lot of controversy when the charter was being mooted. Indeed, there was controversy when the Human Rights Act was being mooted, because of the effect it might have on our own law—in other words, the common law in this country, which dealt with remedies in a very broad way. We ended up with these prescriptive rights that, some would argue, are somewhat contradictory, between human rights and fundamental rights. We certainly had that discussion in Brussels. I wonder whether, without the EU being in the background any more, we will be on our own, with a whole lot of rights that will be very difficult to interpret through our courts. Should we be more rational about this and rationalise? How will we look at this in future?
George Wilson: Those are questions we have not looked to, because we believe that questions that relate to the future of our human rights framework should be dealt with after withdrawal and after the status quo is, hopefully, maintained. When we look to the withdrawal Bill, we think that the omission of the charter is a major problem. The Government have said that the withdrawal Bill is a copy-and-paste exercise. We would like to see all EU law copied over, so that we can look at these issues more closely after we have maintained close co-operation with the Union.
Lord Kirkhope of Harrogate: What is your view, Mr Ruiz Diaz?
Javier Ruiz Diaz: We have not looked at this level of detail. In general, we have found that the charter provides a unique advantage, particularly on data protection. More broadly, we have heard concerns on the European side that the UK pulling out may change the way in which Europe looks at rights and the whole legal framework in Europe. We have not had the same discussion in relation to the UK.
For us, the fundamental question is that we are not sure that a single treaty covering what is currently spread over possibly around a dozen legal instruments, from regulations to directives to opinions, will work, or that it will be feasible to build it in under two years. You may have to keep separate threads.
We also find the Government’s proposal to model the treaty on a trade agreement quite problematic, because our experience with trade agreements is that they generally have a very low level of public accountability. Even parliamentarians have to go into closed rooms to read trade treaties and are not able to take a pen with them. The proposed general arbitration mechanisms in trade treaties are also quite deficient, compared with proper courts. We find the whole approach that the Government have set out in their position paper—to have a single deal, modelled on trade—quite worrying.
When you look at the detail, you find that the problems raised by different areas are very different. The impact on human rights and the practical operations are quite different. For example, participation in organisations such as Europol brings a high level of accountability. The details there may be operational, to do with live access to databases and how you control that. That is already a problem with the Five Eyes and other international intelligence data sharing, where there is very little oversight. I recommend that you look at Privacy International’s recent report on intelligence sharing, which found that there was very little oversight in the 42 countries that it checked.
When you look at co-operation instruments, such as the arrest warrant, the issues may be different. It will be important to look at what the rights impacts there would be. After Brexit, for example, what is the impact on family life of sending people to a country to which their family cannot go, because they cannot migrate there, in order to have regular visits? Trying to reproduce an arrest warrant raises a completely different set of issues from trying to reproduce the arrangements in Europol.
For data, our problems are mainly with some of the arrangements that are already in place, such as passenger name record sharing, which we already find disproportionate. We would be quite concerned about how that would work in a system with even fewer rights. Access to databases that is based on individual suspicion and evidence and that is quite targeted is okay, but our understanding of the way in which surveillance technologies work is that they are moving more and more towards bulk sharing and data mining. That would be quite worrying. As we all know, the Court of Justice has struck down the PNR deal with Canada, so we expect that problems will lie ahead for something like that with the UK.
To summarise, we think that some of the existing problems with the EU regime need to be looked at before we try to reproduce it wholesale. I also recommend that you look at the Fundamental Rights Agency report on biometrics and asylum, which has already highlighted quite a few problems. Obviously, with the UK outside, we will need to see how that would work.
Baroness Browning: May I ask you briefly about your comments on PNR? I know that Lord Kirkhope has a great deal of experience in this area, but, as a former Home Office Minister, I was briefly involved with it. Will you explain the level at which something like PNR is so intrusive? Are you saying that you do not think that it should be included in the treaty that the Government are going to negotiate?
Javier Ruiz Diaz: Yes. We do not think that PNR should be included in the treaty.
Baroness Browning: It should be excluded.
Javier Ruiz Diaz: Yes. First, we are not sure that a single treaty is the right approach, because of the different risks and issues involved that will probably require specific consideration. When it comes to data, I think that there is a fundamental difference between individual access to a database of fingerprints, for example, when there is clear suspicion of a particular crime and the kind of sharing involved in sending wholesale passenger information from millions of people to, quite frankly, God knows what type of machine-learning technologies.
Baroness Browning: Is the issue the way in which the data are not used initially? Quite clearly, they are used, as we know, to make sure that, when somebody is on an aircraft, the airline knows that they are on that aircraft and the receiving country knows who is coming into it. Is your main concern the principle of the security at that point, or is it the retention of data and what happens to them thereafter?
Javier Ruiz Diaz: Our concern with PNR is simply our general concern with what has now become a normalised form of bulk data transfer and processing, which means that large numbers of innocent people will have their movements completely tracked. Although we understand that some suspicion-based intelligence sharing around people travelling would be useful, we are not completely sure that sharing travel information, which is a lot more than just a name—PNR includes much more than that—is completely proportionate. What you are saying is that it may be necessary in a democratic society to share some information around travel. We do not think that it is proportionate to share the information of every single person—
Baroness Browning: The Americans do it, do they not?
Javier Ruiz Diaz: Yes.
Baroness Browning: You cannot go into the United States without giving this information. If you do not, they do not let you in.
Javier Ruiz Diaz: Yes. It is a practical problem. I do not agree—
Baroness Browning: They are a democracy.
Javier Ruiz Diaz: I understand. I do not think that we should change our principles as an organisation just because something has happened. Every day we hear the same thing in relation to Facebook. Actually, we were hearing about Facebook for years, but only now are we starting to understand the problems.
Baroness Browning: I think that I see the level at which you think that that should not be included in the treaty and what your concerns about it are.
Q48 Lord Soley: You have both been very clear in indicating, I think rightly, that we cannot include everything, particularly just now, in a proposed treaty. I would like to hear from you whether there are two or three particular items or issues that you would certainly like to see in the proposed treaty in order to ensure that we protect the civil rights of citizens.
George Wilson: We have not taken a position on which internal police, security and justice tools should be included in the treaty. We have erred towards suggesting that the majority of tools we participate in should be carried over.
We question whether data would be best dealt with in a separate, stand-alone treaty. Fundamental rights—especially those that are embryonic or developing, such as rights to digital privacy—are best dealt with in clear, accessible frameworks. In the light of some of the discussion that has been going on surrounding national security and whether our own data protection standards are equivalent to those of the Union, it would be in the best interests of those rights, which are really at the cutting edge—they are third-generation rights—to be clearly visible and accessible in a separate document.
We have to remember that some of the other treaties that are concluded will also relate to data. Therefore, we would like a separate data treaty, or would question whether a separate data treaty would be a better approach than rolling data into what is going to be a massive treaty.
Lord Soley: I understand that. It is a perfectly logical position. Does that mean that you have no view on what should be in the proposed treaty?
George Wilson: At the moment, no.
Lord Soley: You do not.
George Wilson: No, just that the status quo should be maintained. We have not looked at it in sufficient detail to suggest whether ECRIS or SIS II should or should not be included. I cannot give you our position on that, I am afraid.
Javier Ruiz Diaz: Quite frankly, we have not taken a position at that level of detail, to decide whether Europol or Eurojust should be maintained. Our general approach is that a high level of co-operation seems to be desirable. Maintaining the status quo exactly as it is right now seems unrealistic, in the face of evidence, but of course we would like to see successful co-operation just to maintain security, particularly in areas around bulk data and some of the complex technologies on intelligence, where we have some misgivings, but we have not decided on a specific list of things that we would put in or out.
Lord Soley: Until an outline treaty is proposed, both of your organisations are saying, “We cannot offer you an opinion on this”. I understand your position and your difficulty. What you are saying, in fact, is that you do not think that the treaty is the best vehicle to protect civil rights. Is that right?
Javier Ruiz Diaz: We are not sure that a single, monolithic treaty is feasible. It is probably not desirable if you want, as George said, to understand the very different impacts of things like an arrest warrant, bulk data sharing and fingerprint access. For us, the fundamental problem is with the approach of having a treaty based on trade. We think that that could be problematic in itself.
Fundamentally, what we would like to see at the moment is a good process, with very high levels of transparency and accountability, and with some level of public engagement. For us, those would be the priorities at this stage, rather than deciding what the specific contents of any treaty or treaties should be.
Lord Soley: Presumably, when the outlines of such a treaty become clearer, if they ever do, you will develop a view on what should or should not be in it. Is that right?
Javier Ruiz Diaz: Quite possibly, but there may be a point where the level of detail is too high for us to be able to analyse the specifics. There are quite a few databases. The Home Affairs Committee in the other House focused on the arrest warrant, Europol and data, but, when you look behind it, there are lots of other instruments. Eurojust was not mentioned. We may not have the resources to look in detail at every specific database, but we will definitely have a position on the broad traces. It would definitely be helpful for the Government to set out the position more clearly.
Baroness Pinnock: May I explore this, if you do not mind? Currently, we are all benefiting from protection of our human rights through the charter. If that is not encompassed in UK law, there will clearly be some losses of our human rights. Which elements do you think are particularly at risk from a proposed treaty? I have heard you talk about different elements of it, but which do you think are the priority rights that we risk losing as citizens of the UK by not being protected by the charter?
George Wilson: With regard to security and justice co-operation, the charter provides clear protections on effective remedies that are relevant and on data protection. Those protections are provided in a visible document you can go to. You can see your rights and have them directly enforceable in our courts.
Our fear is that, unless the treaty contains a separate title or chapter on procedural rights protections, the individual will have to find that title or chapter. They will also have to look at domestic implementing legislation. Something will also have to be done to ensure that the protections are directly enforceable in UK courts. It is a lot messier than it would be if the charter were retained and applied only to the category of retained EU law that is created by the withdrawal Bill, for example.
At the same time, as I have already touched on, not retaining the charter as it applies to the instruments that were drafted before we left will cause legal uncertainty, because the instruments refer to charter rights. You fall into a difficult situation if you do not retain the charter. If a case that pertains to one of these instruments comes before him, a judge will have to look to an analogue right in another instrument. The Government’s suggestion at the moment is that rights can be read over from the convention. As we have argued with regard to our withdrawal Bill work, it is not as easy as that. For example, the charter right to an effective remedy is far broader than that provided for under the convention. If there is an agreement, legal certainty is certainly an issue as regards how we view those instruments that are based on EU law.
There is also the issue of the visibility of these rights. At the same time, you have to think about remedies. If these instruments are carried over, they are pieces of retained EU law. They could be pieces of retained EU law, with only minor modifications, to make some changes that need to be made as a consequence of agreeing this treaty.
The charter provides a directly enforceable right, but, as I am sure you are all aware, it also provides for a stronger remedy of strike-down, which is far weaker than a declaration of incompatibility that is made under the Human Rights Act. Really, it is about legal certainty. It is about remedies, because rights without remedies are not rights. It is also about the visibility that this document provides. If the charter is not retained, it is about ensuring some form of visibility, whether these rights are provided for in a separate chapter or not.
Baroness Pinnock: Thank you. That is very clear.
Baroness Janke: You said that you thought that a stand-alone treaty would be a better arrangement for the protection of human rights. Are you saying that, if the Charter of Fundamental Rights is not part of the withdrawal Bill—if it is omitted, as has been the case so far—you do not want safeguards, limits and constraints for the protection of human rights to be included in a security treaty?
George Wilson: Liberty’s position is that a raft of procedural rights protections we did not opt in to were introduced to the Union around 2008 to 2010. This was not too big an issue for the Union because we had the charter, which provided a high level of protection. If the charter is not retained, we would like those rights protections that do not map directly on to legal instruments in this country such as PACE or do not have domestic equivalents to be included in the charter. For example, there is a right to legal aid. When you think of the effects that LASPO has had on legal aid, that is incredibly important.
There is also a right, or a safeguard in provision, that is provided to vulnerable suspects and children. That was not too large an issue when we had the charter, but, if we do not have the charter and it is not carried over, we think that the Government should look very closely at whether exactly the same protections that are provided in those instruments we did not opt in to are provided in our own domestic legislation. If there is not a clear case for saying, “Yes, there is equivalence”, they need to be included in a separate title or chapter to the treaty.
Importantly, in order for them to be relied on directly, they have to be provided for in some form of domestic implementing legislation. That could be done as easily as by making changes to things such as PACE by way of delegated powers—using delegated powers as they should be used, unlike some of the suggestions that have been made with regard to the withdrawal Bill, the Data Protection Bill and even the Trade Bill.
Baroness Janke: You are saying that a separate chapter or something of that nature should be part of the security treaty.
George Wilson: Yes. It is something that we think should be looked at very closely.
Javier Ruiz Diaz: Just to be clear, it would be less preferable than having those rights implemented in proper legislation. Many of the things that would have to be there would affect areas other than security. Data protection, for example, is a much broader issue. We would not look a gift horse in the mouth, if we encountered it—if that was the last option and we were told that there would be protections in it—but it would not be our first preference to bring any form of rights into a treaty that is modelled on a trade deal.
George Wilson: It sounds silly to say this, but I do not think that you can ever have too many rights. If we retained the charter and managed to include procedural safeguards, that would be fantastic.
Baroness Janke: My concern is that we are looking at a security Bill. You may believe that there need to be protections, but we do not have any proposals for anything separate at the moment. It seems to me that we need to get a view on how they should be put in.
Javier Ruiz Diaz: It will be very important to include many operational protections that will emanate from those rights. The fundamental right probably cannot come from a clause in an annexe or a section of a treaty, but the treaty or documents should probably spell out how these things should work. They should probably provide protections against trawling on databases, protections for the rights of people who are deported or transferred to other country, and many things like that. That would obviously be useful. The big dilemma is whether that should be the only place where people can go if they have to enforce those rights or whether they can go somewhere higher.
Q49 Lord Watts: Good morning. I think you have touched on this, but I will press you on it a bit more. What fallback options would be available to the Government if they failed to reach an agreement on security co-operation with the EU?
George Wilson: I will probably pass over to Javier, because we have not looked at it very closely. Broadly, the options available to the Government would be to conclude individual treaties or arrangements similar to those that the Union is making with Canada on PNR, which have been mentioned. As a stopgap—something that would not be desirable but would be a fallback—it appears that they could move back to prior arrangements such as the European Convention on Extradition, which I have mentioned, under the Council of Europe system. The options would be individual treaties or arrangements and falling back on existing arrangements.
Javier Ruiz Diaz: It is a bit unclear what the failure and the fallback would be. Extradition is not our main focus, but if you needed a bespoke system you could fall back on the Iceland model. That could be considered as a fallback by the Government, but they could fall back on the 1957 convention. There are many different forms of failing here and many points of fallback. It would be important to look at the detail of what was being proposed.
When it comes to data, in particular, there are many points where things could fail. There could be a failure to have a whole framework for data transfer or specific arrangements could be struck down by a court, as on PNR. It is almost impossible to see what would be right without looking at the detail. For us, an umbrella agreement similar to the EU-US data treaty would need to have much higher levels of protections—things like the right to redress and proper judicial co-operation. It could not just cover data sharing.
Lord Watts: Just to be clear, the fallback position is to start negotiations with the EU on a whole batch of areas. You mentioned Canada as an example. Will you remind us how long it took to negotiate the agreement with Canada on that one issue?
Javier Ruiz Diaz: I do not know off the top of my head, but you are looking at years for pretty much everything here.
Lord Watts: Do you have any idea how many separate agreements we will probably need if we do not have an agreement?
Javier Ruiz Diaz: A good indication would be the number of existing items of European legislation, plus international agreements that are in place. I think that there are over a dozen of those.
Lord Watts: A dozen.
Javier Ruiz Diaz: At least. I have not counted, but I can look at all the different reports that we have been preparing and our own checklist. You have the Prüm database, Europol and Eurojust—you name it. There are at least 12 or 13 different items that will need to be looked at and introduced in a single treaty.
Q50 Baroness Janke: In the event of there being no agreement with the EU, can you suggest practical ways of protecting human rights that could be introduced? Can you give us any practical suggestions? We can understand the ideal position, but we are dealing with a reality that may not even be acceptable to us. What practical measures would you put forward?
George Wilson: You have to look to protections that are currently provided in EU law and at the protections that will be provided when it becomes retained EU law. I do not think that it is a case of looking forward and saying what we can do; it is about protecting what we have. I have already mentioned the withdrawal Bill and delegated powers. It is vitally important that this Government’s movement towards using hugely broad delegated powers and relying on Henry VIII clauses in legislation is scotched. Unless that happens, retained EU law will become a special category of law that is open to anything and everything whenever anybody wants to do something for which they do not want or have to seek parliamentary approval. We would say, “Protect what we have, ring-fence it and ensure that it cannot be changed at the whim of a Minister”.
I will give you an example. As I mentioned, this is what is incredibly alarming. You would expect the withdrawal Bill to allow for changes to be made for this category of law, and the Data Protection Bill, which implements the GDPR, to allow for changes to be made to that piece of EU legislation. But you would not expect the Trade Bill to provide an explicit power for Ministers to make changes not just to secondary EU law but to primary EU law, for the purpose of implementing or rolling over trade agreements that are completely unrelated to what we are discussing today. There has to be a serious effort to check this movement, as there is the potential for the standards that we have currently to be seriously downgraded.
Javier Ruiz Diaz: I broadly agree. There is a real concern. Given the importance of the UK for security in the European and international context, there is a worry, which has been expressed by people such as RUSI, that, in the absence of an agreement, we may see back-door sharing agreements for data, through informal contacts, emergency provisions—the kind of clause that you find at the bottom of a treaty and thought would never be used—or intelligence agency sharing, where you go through MI5 or MI6, rather than through the police. Those could become the main avenues to continue the practicalities of day-to-day security. Obviously, that would be quite worrying. As we said earlier, it would lower hugely the level of accountability. We think that it is important to find some form of agreement with the EU, so that we do not fall back on that.
We are also concerned that any failure to agree, particularly if there is a large failure—for example, on adequacy—may be seen as carte blanche to say, “Okay, let us go totally the other way from co-operation”, as has been threatened a bit on trade. That would be quite worrying. It is hard to see what else we can say at that very general level, other than that we should try to restrict the powers of Ministers at the moment. Obviously, anything that we can bolt on at every level will be important.
The Chairman: We are discussing Henry VIII clauses in the withdrawal Bill this afternoon.
Q51 Lord Ribeiro: Mr Wilson, in your introductory comments in particular you expressed the view that fundamental rights should be safeguarded. You went on to say that their omission from the withdrawal Bill was a disastrous thing. Will you spell out what the consequences of the UK withdrawing from the Charter of Fundamental Rights would be? What effects would that have on the security treaty and the rights of individuals? Both of you may address the issue.
George Wilson: As I covered previously, we believe that not retaining the charter will lead to legal uncertainty as these instruments are interpreted by our own judiciary after we leave the EU. We believe that they will be less visible and that, as a consequence of being less visible, they will perhaps be less readily applied and relied on. At the same time, one of the issues that we have with the non-retention of the charter or with changes to the charter that have been suggested in order for it to apply in UK law after we leave is that we will lose the strong remedy that is currently available of strike-down for rights infringing domestic primary legislation. That would not be available otherwise.
If new tools, or revisions to tools, were bolted on to the treaty, I do not think they would concern the charter, but the charter will and should be applicable to existing instruments that we want to roll over. It is about maintaining the standards that we currently have; it is not about adding more or less. We want purely to keep what we have or, if we cannot retain the charter, to ensure that the levels of protection that we enjoyed while we were a member are exactly the same when we have left.
Javier Ruiz Diaz: We would lose specific rights, such as data protection, that would need to be reproduced. There is also the impact that would be felt on the wider understanding of legislation that refers to a charter currently, including many of the current arrangements.
One area that we do not fully understand and that should be explored is the relationship between the charter and the jurisprudence of the Court of Justice. For example, some time ago we looked at the right to good administration, which in the charter is applied directly only to European institutions. When we tried to understand how it works, we found that it is based on jurisprudence of the court. There is a dynamic relationship between the charter and the court that is not very clear at the moment. It has not been explored properly. We think that it will be very important to understand how those two elements will work in the future. If you are going to have regard to some elements of the court and some jurisprudence, but not to the charter, and those things are connected, that will bring uncertainty.
Lord Ribeiro: Considering that the UK was party to some of the early work on human rights in Europe—from a legal point of view, it actually wrote some of it—do you not have any confidence that our present legal teams will be able to interpret these provisions in the same way?
George Wilson: I have the utmost confidence. If the charter is not retained, it is about ensuring that our judiciary feels comfortable referring to the charter and developing its own jurisprudence, as it does with regard to other jurisdictions. From our organisational point of view, for issues of legal certainty and for remedies, which are as important as the rights themselves, the charter has to be maintained. Article 8 of the charter has been interpreted in a far broader and more expansive way than the analogue right under the convention. That is fine; that is what we want. If we do not retain the charter, it is incredibly important to say that we have the utmost faith in our own judiciary, which does an absolutely fantastic job. It is just about making it feel comfortable about being able to refer to that instrument. You will debate that in the withdrawal Bill, in a small amendment to Clause 6.
Baroness Janke: On security, can you say what items are not covered by existing legislation—the Human Rights Act or the European convention? Lots of arguments have been put that the rights and remedies are there already. You have mentioned the confidence of the judiciary. Are there specific issues in relation to security that are not covered by existing law?
George Wilson: We have mentioned Article 8, which clearly provides a digital right to privacy that cannot be found in Article 8 of the convention system. We have also mentioned effective remedy, which is subtly different. It has been interpreted to provide or to require that legal aid be provided to people where not doing so would not provide them with an effective remedy. Those are two charter rights that are different and relate specifically to the issues we are discussing.
Away from the charter, there are the procedural rights protections we did not opt in to, which I have mentioned. There are questions about whether they are or can be found in domestic legislation. I am happy to provide you with a list afterwards.
Baroness Janke: Okay. It would be very good to have written evidence.
Lord Watts: Can you give us some indication of the infrastructure and the capacity of our courts to take over the role? We have not been involved with that so far, so I suspect that it will need some sort of structure and focus. Do you have any idea about that?
George Wilson: In our view, it is a function that they are performing already. When we think about the withdrawal Bill, debates around that and the ability for the charter to be used to strike down legislation or for court action to be brought based on the general principles of EU law that were discussed on Monday, we find that those are things that our judiciary is already doing, and already doing well. This is not a foreign piece of law that we will have to learn to use. We have been using the charter since its inception—initially, with some difficulty, but, in the last couple of years, very well. You only have to look to the UNISON case on employment tribunal fees. We have been using the general principles for a long time here. There would be no change. The courts, especially the Supreme Court, are using these rules already.
I do not think that having regard to the jurisprudence of the court if we do not retain the charter will be an issue, either. It is just a question of confidence.
Lord Watts: Is that not based on the fact that the court will accept the previous rulings of the European court? If the idea is that there is some independence in the system, that will make a difference, will it not?
George Wilson: There is a bind here, is there not? If we continue these tools or give effect to them in the future, and we have to give effect to a pronouncement that is made by the Court of Justice in order to continue co-operation, does that bind our own court system or Government? We cannot disregard that ruling, can we? That is a practical issue I do not know a great deal about. I do not know how it can be resolved.
Lord Kirkhope of Harrogate: Can we just get this correct? The original position we were in was that we were reliant on human rights, certainly under the Convention on Human Rights, but the convention was not applicable within domestic law, which was based on common law and our own courts’ flexibility in making the right decisions. Then, in 1998, the Government brought in the Human Rights Act, which brought just the convention rights into domestic law. From then on, they were used in interpretation within the courts. It was not until 2009 that the charter took effect, under the treaty of Lisbon. That was only in relation to implementing European Union law—nothing else.
When we leave the European Union, we will, effectively, still have the Convention on Human Rights, unless we take a separate view, because that is not an EU provision. Some people think that it is, but we will still have that. We will still have an interpretive capability of our courts, using what is left of common law to interpret. What we will not have is the charter, which relates only to implementing EU law. As we are not going to implement any more EU law, it cannot be in effect. Can you not live with that in maintaining human rights and our own flexibility within our courts? Would that not be advantageous to certain litigants or people who go before the courts?
George Wilson: It is certainly something we have to live with in leaving the European Union. The point that I want to make is that we do not want the charter to remain and to have applicability to our whole corpus of law. We want it to remain and to be effective for retained EU law, which could include some of the measures we want to copy over. I am not saying that we should keep it for everything. I am saying that we have to keep it and that it has to be applied to this category of retained EU law, until such time as that changes. Over time, it will fall away, but it is about maintaining existing levels of protection. It is incredibly important that the charter is retained for that purpose and applies to retained EU law.
Q52 Lord Crisp: Good morning. Can you see any advantages for security co-operation once the UK no longer comes under the jurisdiction of the European court? Mr Ruiz Diaz, right at the beginning, in your opening remarks, you said something about opportunities for resetting arrangements. I do not know whether that was relevant, but could we talk about any advantages that you see?
Javier Ruiz Diaz: Frankly, it is hard to see many direct advantages. Some of the issues that would be worth exploring are not necessarily dependent on the jurisdiction of the court itself. They are about the content of the arrangements. Organisations working in the field of surveillance, in particular, rely extensively on the Court of Justice of the European Union when it comes to things like data retention. Right now, pretty much every aspect of the Investigatory Powers Act is being challenged by Liberty and other organisations. Most cases end up in the court in Luxembourg. That practical impact is going to be felt, for sure. I do not think that it is so much about some of the specific bits of content or the advantages that there may be. I think that the impact will be felt in the process, in particular.
Lord Crisp: Mr Wilson, can you see any advantages?
George Wilson: I would echo what Javier has said.
The Chairman: We now have one or two questions largely on data. We have already had a rather good discussion about the relationship between data and security, which I found rather illuminating, but let us move on.
Q53 Baroness Browning: How likely do you think it is that there will be an agreement with the EU on data sharing, just for security co-operation? What do you see as the main barriers to such an agreement? Earlier you mentioned that it would be best to go forward with a separate data treaty. How broad would that treaty be in terms of the data that it took under its wing, if that is the way you see it going forward?
George Wilson: I am not too sure, to be honest. Although we have not looked explicitly at barriers, we see securing an adequacy decision from the Commission, or its equivalent in a treaty, as a major issue. There has also been a movement in the Union more recently towards looking at national security, although it is not a competence of the EU, when it decides whether to grant a third country an adequacy decision. We saw that recently with the privacy shield with the US. Javier can speak to that, but we would say that the main barriers would be adequacy decisions and the influence of national security considerations, including the ability of national security services to access personal information of Union citizens. I think that those would be the two main issues.
Javier Ruiz Diaz: It is likely that some form of agreement will be found. I do not know whether it will be the one that the UK Government have put forward in their proposal, but it is highly unlikely that the European countries and the European Union will want to stop any form of data sharing co-operation with the UK.
You asked how broad that would be. Again, we are looking at very different issues. Live access to a Europol database by a police officer on the front line is very different from getting PNR information. The legal instruments behind that are also very different, so I am not sure that even the European Union will be able to sign the same piece of legislation for something that is about one of its core agencies and for an external deal. It is quite difficult to see how broad a single treaty would be.
As regards obstacles, at the moment the UK position is that all that is needed is a wider agreement on data protection and possibly, almost as if forced to, some form of alternative to strict rule by the Court of Justice: some sort of dispute resolution and a wider data-sharing framework. I think that the problem runs a bit deeper. Our experience is that there is deep mistrust of the surveillance activities of the UK, maybe not in the Commission or in Governments, but definitely in the European Parliament and across Europe. We have to understand the context of what is taking place.
With regard to the data framework that has been proposed, we have a problem with what seems to be a proposal to bypass the adequacy process in the GDPR in order to create a bespoke deal for the UK that would allow it, potentially, to bypass any scrutiny of national security activities. Frankly, from the outside, that is what it seems the proposal would look like. That would be a problem because, as people campaigning on surveillance issues, we would want to keep that scrutiny.
The adequacy decision for law enforcement is new. It is not exactly the same as the GDPR. The problem is that we do not really know how it is going to work. This is completely uncharted territory, as we understand it. The UK will probably be the first case where this takes place. On the basis of the current regime for adequacy, we think that there will be problems. Obviously, there are the arguments around mass surveillance, bulk and data retention. For example, we do not believe that the UK has complied fully with the data retention ruling. It has definitely tightened up elements of access to data, but it is still collecting indiscriminately. There are also things like notification. That case will go back and will be legally challenged by someone, almost certainly, so mass or bulk surveillance activities will definitely be a problem.
The exemptions in the Data Protection Bill around immigration that have been mentioned are causing severe concern in Brussels, because they will affect European citizens. More broadly, the way in which the exemptions in data protection in the UK have been constructed, based on the previous data protection legislation, means that they are simply too broad. The GDPR points at narrow exemptions that derogate from specific aspects, for very narrow purposes, and provides lots of safeguards around Article 23 of the regulation.
Immigration is the most egregious example, but many of the other exemptions for the police follow a similar framework. We think that will be open to challenge, because those exemptions affect the fundamental rights we were talking about. They go to the fundamental right to data protection in the charter, so we think that that will definitely be an issue.
Even if the European Union as an institution is absolutely willing to accommodate the UK, we cannot forget that there will be many individuals and civil society organisations across Europe that will probably take any form of agreement with the UK to court—not in the UK, but from the European side. People will query why their citizens’ data are being sent to the UK; that is similar to what happened with the EU-US agreement. That is not to say that this kind of framework will not happen, but there are quite a few hurdles. It is not a stroll in the park.
Q54 Lord Ricketts: I will carry on into uncharted territory. I want to look at the data-sharing arrangements between the UK and third countries outside the EU when, as we are assuming, the UK leaves the EU. Obviously, the US is the primary one, but there are many others. I want to understand how you think that would work and what the problems would be. In other words, if our data-sharing arrangements at the moment flow through the EU—I refer to the EU-US privacy shield and so on—should we assume that we will have to negotiate separate UK-US, UK-Canada and UK-Australia bilateral agreements, et cetera, or should we try to have something in the EU-UK agreement that also covers UK access to third countries, which seems to me to be very unlikely? How will data-sharing provisions with third countries work, in your view, once we are outside the EU?
George Wilson: It is an area where we do not have any expertise, so I cannot answer.
Javier Ruiz Diaz: Obviously, the short answer is that no one knows for certain. I think it is highly likely that the UK will have to secure a form of agreement with the US, but we are looking at a broader agreement for commercial data sharing in general. Again, it is not clear how an agreement for security data would work. We are not looking at direct correspondence and overlap here. There are two sides and two levels, and we are going diagonally.
I think that Switzerland has a privacy shield agreement. I cannot see why the UK would not secure such an agreement. Actually, I understand that right now UK government officials in Washington are looking at the implications and discussing this issue.
One problem, of course, will be if the UK tries to incorporate data in other trade deals. I do not think that a privacy shield with the US would be a challenge. But if the UK goes around, as we have been told to expect, signing lots of trade deals with countries around the world and tries to incorporate data—personal information—in those deals, we may hit some problems, because the European Union itself has said that it does not want to see data included in trade. We do not know to what extent that would spill over into the adequacy decision, but it would probably be a bigger problem.
Lord Ricketts: Even outside the area of trade and security we would need other bilateral agreements beyond those with the US. I suppose we would need to negotiate bilateral agreements with many other countries currently working with the EU, Europol and so on, not just the US.
Javier Ruiz Diaz: There are not many other countries outside the European area that have an adequacy decision from the European Union: Uruguay and very few others. The expectation of the European Union is certainly that GDPR will trigger massive adoption; lots of countries will ask the EU for adequacy and will implement GDPR-like provisions, so in that sense one should expect the UK to have to build quite a few other deals. At the moment it is not a first-line priority; it will be a problem, but probably further down the line.
Q55 Lord Soley: Leaving aside the issue of data and focusing just on security, one of the things that puzzles me is that the UK has incredibly close co‑operation under the so-called Five Eyes—New Zealand, Australia, Canada, the US and UK—yet it also has incredibly close co‑operation on security with the EU. Somehow or other, we have an arrangement with these other countries and the EU that works. What is your response to that?
Javier Ruiz Diaz: In relation to the Five Eyes arrangements, there is concern across civil society organisations working in all the Five Eyes countries—I can almost certainly speak for any one—about the lack of transparency and accountability of that treaty, which started at the end of the war and the Cold War to deal with Russia and Soviet countries, and has ended up covering not just terrorism but lots of things that affect citizens directly much more than when it started. That is probably the way the general surveillance regime has operated.
The level of secrecy that was permissible in the 1940s and the Cold War is not socially acceptable today. Looking at the whole model of co‑operation, every time we read that there is an alternative to the European framework, which is Five Eyes, we are quite concerned because we do not think there is. We cannot compare the two regimes in the level of accountability.
Lord Soley: It is not the comparison that interests me. What interests me is that it has been working for a long time while we do the European Union security bit and the Five Eyes bit, so somehow or other—by nods and winks or some legislative process that I have never been able to identify—it works.
Javier Ruiz Diaz: Not only that. Our understanding from some of the leaked Edward Snowden documents is that the level of co‑operation is very broad. It is not just the Five Eyes and the European Union; there are the Fifteen Eyes and the Twenty Five Eyes. There are many levels of co‑operation. Clearly, the UK and the US form the core of that alliance.
Intelligence sharing is a very complex pattern. There are also data-sharing agreements in Europe with Morocco and Egypt, which we find quite concerning given the level of human rights abuses by the Egyptian Government on a daily basis.
On international co‑operation more broadly, it probably cannot be reduced to a binary choice between Europe and the Five Eyes, but it is important that, whatever new place the UK chooses to take so that fundamental respect for human rights prevails, the European framework as it is right now clearly provides a much, much higher level of accountability and protection.
Lord Watts: I am trying to be clear about the implications for dealing with data sharing in this part of the trade deal with third countries. It seems to me that that will be a very difficult thing to do on the basis that, if you have an agreement with the US and Europe, there is compatibility between the two of them. If you enter into an agreement with a third party, they gain access to your data sharing. I would not have thought that the Americans and Europe are over-keen on that. Why do you raise the prospect of data sharing being part of an agreement with a third party as part of a trade deal?
Javier Ruiz Diaz: It is a general trend to see data being pushed into trade deals and then being pushed back. The trend is to try to include data. The digital economy is an increasingly important part of the global economy, so it is not just about sending cars around. We think that the temptation and pressure will be there to include data in trade deals, but if you have an expansion of the European GDPR model to many other countries it should be fairly easy for the UK. If the UK maintains a high level of protection and has an adequacy decision, it should be able to have parallel arrangements. At some point you may even see an international treaty where half the world ends up having some sort of GDPR arrangement with Europe. At some point they will be asking, “Why can’t we just share data among ourselves directly and more easily?”
Lord Watts: I accept the fact that the UK will maintain standards that comply with both America and Europe, but I am thinking about a third party. You are now adding new players to the game that may not meet those standards. That is where there might be a problem, unless the European or American model was enforced as part of that data-sharing agreement.
Javier Ruiz Diaz: I agree that it would probably be problematic for the UK to try to have something like an adequacy system that applied to countries that did not have such a regime from the European Union. That would probably be unlikely, given all the work that would need to take place. Any adequacy decision normally takes years. It is a possibility, but I am not sure it is a very likely scenario in the short term. Further down the line, the European regime, or adequacy framework, would probably be a lot broader, so we would be in a very different situation.
Q56 Baroness Pinnock: You have not referred to safeguards for personal data in your answers to the questions. Thinking about the protection of personal data, do you think the UK Government might more easily access personal data without protections? You talked about the possibility of bypassing GDPR and how that might impact on individuals.
Javier Ruiz Diaz: For us, the evidence in the past seven or eight years, but particularly since the Snowden leaks and the discussion under the Investigatory Powers Act, the UK is unique both in its capabilities around surveillance and, to the credit of the Government, in trying to regulate it. It is regulating some things that should not be there, but at least they are trying to regulate it.
Brussels as a whole—the whole European population—has been a safeguard for us or a place where we could go. As I said before, most cases end up in the European courts. Pretty much the whole surveillance framework, apart from data sharing and data retention, is currently being challenged in a European context. We think that once we are outside Europe the Government will feel empowered to carry on with the view that, as there is no impact in the short term on many people, bulk surveillance is about systemic capabilities—not that there is no problem—while the European understanding is that the inclusion of fundamental rights starts the moment the data are collected. The UK doctrine, if you want to call it that, is that inclusion happens when someone is actually affected—if you want, at the end of the process. That is a very different way to look at how surveillance operates. We think that without the European influence the UK perspective will be implemented in breach of that.
The Chairman: That has been extremely helpful; we have benefited a lot from your advice. Is there anything you would like to say to us that you think we ought to have asked you but have not?
George Wilson: Not from me.
The Chairman: I should have said at the beginning—I expect you guessed—that this is a public hearing. We will shortly send you a copy of the transcript of your evidence for you to correct if necessary. We are very grateful to you for giving evidence to us today. Thank you very much.
Javier Ruiz Diaz: Thank you. If you have any more questions individually or as a Committee, we will answer them.
The Chairman: Thank you. There is one piece of extra evidence you are going to send us, I think.
George Wilson: I will send it.
