EUROPOL, INDIVIDUAL RIGHTS AND DEMOCRATIC CONTROL
In the following, Michael Spencer comments on the most recent available draft for the Europol Convention, of 10 October. The author is European consultant for 'Liberty', the British National Council for Civil Liberties and belongs to a European Monitoring Group set up by the British section of the International Commission of Jurists. He is currently working on a book on civil liberties in the EU.
Introduction
The possible involvement of the European Court of Justice (ECJ) has been among the main points of disagreement between the member states. France and the UK were reported as opposing such involvement because it would imply the authority of European Union institutions over an intergovernmental agreement.
It now appears that, as a result of unprecedented concessions by the German presidency of the Council, these differences may be resolved. Nevertheless, the present draft is not likely to be signed by the Netherlands. Indeed, the Dutch parliament appears to be fundamentally opposed to any Convention text not providing for satisfactory parliamentary and judicial control. It is further believed that France is deliberately delaying work on the convention for reasons of its own. As a result, it is unlikely that agreement on a final text will be reached at the next meeting of the ministers of justice and home affairs of the EU-member states, on 30 November.
The concessions made in order to overcome mainly British opposition to any involvement of the ECJ would leave citizens of the UK in particular with a level of legal protection inferior to that guaranteed to those of other member states. This concern is compounded by defects in the convention which leave all individuals liable to potential abuse of their individual rights through the wrongful or erroneous use of their personal data, or misapplication of unreliable intelligence stored in Europol's files. The safeguards laid down seem likely to prove inadequate in practice.
At another level the convention is also highly unsatisfactory. There is no mechanism whatever for control or monitoring by national parliaments, and no guarantee that Europol's power (already wide under the proposed convention) will not be extended in the future to cover operational matters. National sovereignty, which in matters of criminal justice has always been jealously guarded by member states, will inevitably be compromised if the convention goes through in its present form. Parliaments will also be powerless to change the rules incorporated in the convention which apportion the annual budget between member states.
Background
The idea of a "European FBI" with investigative powers was raised in the late 1980s and adopted with particular fervour by Germany's Chancellor Kohl. The response from other member states was mixed, with some of them determined to accept nothing more than a passive information exchange system of the kind operated by Interpol; indeed some (especially France which hosts the headquarters of Interpol) preferred the idea of expanding the activities of Interpol within Europe. Nevertheless, the June 1991 meeting of the European Council agreed in principle to incorporate the basic idea into the Maastricht Treaty on European Union (TEU). Article K.1 (9) duly refers to "the organisation of a Union-wide system for exchanging information within a European Police Office (Europol)". The wording appears carefully chosen not to restrict Europol to that task alone, and the Council's Legal Service gave confidential advice that it would be legally possible to assign operational duties to Europol.(1)
The European parliament approved of the idea of ultimatively giving Europol such powers, but insisted that its creation and control should be entirely within the scope of Community Law.2 To this end it called for the Commission to submit a proposal for setting up Europol under the all-purpose Article 235 EC. This demand was ruled out of order by the Council's legal advisers, and preparatory work went ahead in secret under the direction of the intergovernmental Trevi group.
Although the TEU did not come into force until November 1993, a nucleus for Europol had already emerged in April of that year in the form of the European Drugs Unit (EDU). At the end of November 1993 it was finally agreed, after intense competition between member states, to base Europol (incorporating the EDU) in The Hague. In the absence of a convention ratified by member states it still lacked a legal existence. Jürgen Storbeck, formerly of the BKA (federal office of criminal investigation) was officially confirmed by the Justice and Home Affairs Council as "coordinator" of the EDU in June 1994, with a budget of 3.7 million ECU to start work in 1995.3 Well before this he had talked openly to a Swiss newspaper of his belief that even before a convention was set up, Europol should expand its activities "pragmatically" beyond its official remit of working on drug trafficking.4
Current status of the draft convention
The first draft was produced in November 1993 5, and later released with no publicity whatever to the parliaments of some at least of the member states for scrutiny (though not for open debate and approval). It attracted surprisingly little attention even within these bodies, and only reached the public domain in the middle of 1994.6
Other more detailed drafts leaked out later in the year; their existence was officially made known to a few bodies such as the Dutch parliament, whose ministers are obliged under national law to obtain approval before agreeing to the final draft of a convention affecting the rights of citizens. It was clear throughout that the German government, which held the presidency of the Council in the second half of 1994, was extremely keen to get agreement during its term of office. There were, however, strong differences of opinion between member states that made this difficult to achieve, and negotiations continued over several months. The comments that follow are based on a German text (not a final draft, which remains to be agreed) produced in October 1994.7
Elastic definition of broad objectives
The objective of Europol is broadly stated in Article 2(1) as that of aiding member states in preventing and combatting "terrorism, drug trafficking and other serious forms of international crime" - a far cry from the limited role of the EDU. Terrorism had been a particular preoccupation of the Spanish government. However, continuing differences over whether to make this a priority and what else to classify as "serious international crime" led to a compromise under which Europol's primary tasks are stated in the main text, and other possible options are listed in an annex to the convention. Article 2(2) lists the main targets as
- drug trafficking,
crimes connected with nuclear and radioactive substances,
smuggling of illegal migrants,
motor vehicle crimes such as illegal sale in other states and theft of cargo, and
associated money laundering operations.
The annex lists a further 22 items, any of which the Council may add to the list on a unanimous vote. The first is "terrorism", and 19 other types of crime are grouped under three headings:
- Crimes against life, bodily integrity and freedom: homicide, grievous bodily harm, abduction and hostage-taking, illegal traffic in human organs, profiting from prostitution.
Crimes against the interests of the state: illegal traffic in arms, ammunition and explosives; illegal technology transfer, traffic in human beings, arranging illegal labour, forging official documents, crimes against the environment, illegal traffic in works of art and antiques.
Crimes against property: rackets and extortion; counterfeiting of money, cheques and securities and their dissemination; credit card crimes, product privacy, investment fraud, computer crime, international fraud as defined in Article K.1(5) TEU.
The final two items, which can be associated with any of the above crimes, are "illegal money laundering" and "membership of a criminal organisation".
A blank cheque for the Council
This comprehensive catalogue will give the Council a free hand to direct Europol in almost any direction. The items involving illegal labour and document forgery, like the reference in the main text to "smuggling in" people, are clearly designed to allow the involvement of Europol in matters relating to immigration. While the agencies implementing the external frontiers convention will use the European Information System to deal with the exclusion of unwanted immigrants, Europol will be able to target those who are suspected of helping them to slip through the net or obtain work after they arrive.
The rest of the convention deals in detail with many other aspects of Europol such as its basic structure, the automated information system (Europol's own system, not identical with the EIS) and what it may contain, data protection, personnel and administrative control, confidentiality, parliamentary control, financial regulation, establishment in The Hague, judicial control, immunity from prosecution for its employees, relations with other organisations and third countries, modification of the convention, and reserves (opt-outs) by member states. Only the more important or controversial points will be discussed here.
Europol's information system: facts and intelligence
Article 1 lays down that Europol and its computer system will be connected to national units run by a single agency in each member state (a subject of fierce competition between the police and security forces of certain countries). Under Article 3, Europol is to facilitate information exchange between member states and is also to collect, collate and analyse both factual information and intelligence. This is to be shared with the national units to keep them informed of links established between punishable acts. Europol will also help national units with research, "strategic intelligence", training and general support for their investigations. In return, national units are to supply all necessary information to Europol.
Article 5 specifies that each national unit can appoint liaison officers to work at Europol headquarters. They will have access to data from Europol's information system that concern their country of origin, and can transmit both personal data and intelligence to their national units; they thus provide a channel of communication that is less restricted than the automated system.
Articles 5a, 6 and 7 describe what information can be held by Europol. Its computerised information system, which can be supplied with data and interrogated directly by national units, will contain basic personal data on suspects, persons already liable to imprisonment, and those "for whom certain facts justify the presumption that they will commit crimes". Other data will relate to the facts of their alleged offences.
Under Article 10, Europol will also maintain its own data bank (not necessarily computerised, and not automatically accessible by national units) for intelligence and analysis. This will contain data on persons other than those described above: potential witnesses, possible future victims, contacts and companions of suspects, informers and other sources of information. There will be an index system containing key words for looking up information in the analysis files, and the data (but not the analysis) will be accessible to national liaison officers. Information can be requested from other inter-state and supranational organisations (including Interpol) and from non-EU states; automatic information exchange with their computerised systems will also be allowed where this is covered by other agreements (Articles 10(4) and 16).
Hard times ahead for data protection commissioners
Detailed rules are laid down in various articles to order compliance with standards of data protection based on the 1981 Council of Europe convention on data protection; national units and Europol are responsible for applying these rules to the data that they themselves collect or transmit. The Council of Europe's Recommendation R (87) 15 on personal data held by the police is to be 'taken into account'. Shared data are supposed to be utilised only by national units, nut "other national authorities" may do so with the agreement of the originating national unit (Article 15(3)). Supervision of data protection is divided between national authorities (which have the power under Article 21 to inspect the offices and documents of their country's liaison officers) and a joint authority (Article 22), made up of two representatives of each national authority; this has the task of monitoring Europol's own adherence to the rules.
Individuals who have cause for complaint about the use of their personal data have various rights. Under Article 17 they can ask for details of the data held about them, though this is subject to the usual exceptions for subject access to police data. Where access is refused, the joint data protection authority can be asked to check the data on the person's behalf but may not be allowed to reveal the contents to the applicant. Article 35 offers a limited right of compensation (no more than 100,000 ECU) for financial loss or "serious violation of personal rights". claims have to be against the national unit under national law; if the harm to an individual arose in another state, the latter is obliged to reimburse that of the complainant. Europol may not (as in earlier drafts) be directly claimed against for the consequences of its own mistakes.
All power to the executive?
Article 25 lists the functions of a Management Board comprising one representative of each member state. The Commission of the EC can attend but has no voting rights, and the Board "can decide to meet in its absence" (implying its possible exclusion). The Council retains control over all major decisions, and is given the power to decide various matters (usually by unanimity) relating to rules of procedure and data protection that are not detailed in the convention. The servants of Europol may be subject to security vetting (Article 28) and have a lifelong duty of confidentiality (Article 29); they may not give evidence to an extrajudicial enquiry without permission from Europol's Director. Under Article 38 they will have privileges and immunities that remain to be specified in a later protocol to the convention. An earlier proposal to give them the blanket immunity from prosecution accorded to all EU employees (a little known feature of a protocol to the Brussels Treaty of 1965) was evidently thought too sweeping to apply to police officers.
The European Parliament may ask questions...
Article 31 defines a very limited procedure for keeping the European Parliament informed and listening to its views, without giving it any real control over Europol. The Council's Legal Service had advised that to do any less than this would constitute a clear violation of Article K.6 TEU. The article therefore promises that the President of the Council will give an annual but confidential report to the Parliament, accept questions from it, inform it in advance of major decisions and "bear in mind" what it has to say. Since Article K.6 TEU makes no mention of consulting national parliaments, they are simply assured in Article 31(6) that the rights of national parliaments "remain untouched".
Article 33 leaves open some alternatives (to be resolved in the final draft) for the auditing of Europol's accounts. The obvious course of using the EC's court of Auditors is one option, but this has been strongly resisted by France and the UK on the grounds that it would imply Community competence over Europol. The second option is the creation of a joint board of examination, drawn in rotation from the auditing authorities of three member states at a time.
Judicial control: continuing disagreement
Article 37 concerns judicial control, another source of continuing disagreement between negotiating states. For disputes between member states or between a state and Europol over application of the convention there are currently three alternatives: jurisdiction by the European Court of Justice (ECJ), jurisdiction by a court of arbitration headed by the President of the ECJ (or his representative) with two other suitable persons chosen by the Council, or settlement within the Council with a two-thirds majority vote as last resort. For other disputes between Europol and member states or between Europol and its employees there are different sets of alternatives, again leaving open whether judicial institutions of the Union are involved or not.
For claims by individuals that any of their rights relating to personal data have been infringed by Europol or another member state, Article 37(2) prescribes only one course: to take a case under national law against the national Europol unit before a national court or competent tribunal. If there then arises a question of interpretation of the convention, the court or tribunal may ask the European Court of Justice for a preliminary ruling which may in some circumstances be binding.
Extraordinary clause: 'Opting out' of judicial control
Here, one might think, would be the point at which governments resisting ECJ competence would have to concede the principle involved, after which it would be impossible for them to oppose a similar provision in other conventions. However, the draft includes an extraordinary concession to their position: an option in Article 41 that on acceding to the convention, any state may decline to be bound on this point and this point alone. The reservation, which can later be withdrawn, lasts initially for three years but can then be unilaterally renewed. Citizens of such a state will thus be left to the vagaries of their national courts in the interpretation of an international convention which is not incorporated into domestic law, and whose detailed provisions have never previously been tested. The insertion of the reservation clause can only be attributed to the desperation of the German presidency faced with the prospect of not seeing its favourite project come to fruition during its term of office.
Lack of any meaningful democratic control
This is perhaps the most surprising defect of a convention which shows other signs of having been rushed through without due consideration of the implications for individuals. The lack of any meaningful democratic control is, of course, a danger in this as in all intergovernmental agreements going through under Title VI of the TEU. There are also far too many items left for later decision by the Council, and in all but one case (the protocol on privileges and immunities) there will be no need for even token approval by national parliaments.
The provisions on data protection are comprehensive in theory, but fatally undermined by the difficulty that is likely to arise in enforcing them. This is inevitable in view of the scope of Europol's remit. Under Article 14 it may use personal data supplied by non-EU countries, and Europol is responsible for ensuring that the data were collected and transmitted according to the high standards of data protection laid down in the convention. This seems an impossible task when one considers the total absence of data protection in many non-EU states. A comparable problem arises under Article 16: Europol may transmit personal data to non-EU states after seeking assurances on data protection from the recipients and assessing their value "taking account of all the circumstances". The pressure to exchange data with such countries in the interest of mutual assistance might well in practice outweigh considerations of strict data protection. This is precisely why (among other reasons) Interpol, with its range of subscribing states, was not considered to be a suitable vehicle for the development of European police cooperation.
Extension of Europol's power: who decides?
An even more serious question that is left unresolved by the convention is the possible extension of Europol's powers at some time in the future to a more operational role. The trend has already been set by allowing Europol, on its own initiative, to collect and analyse data from everywhere in the world. A logical development would be the power to send investigating officers to member states and non-EU countries; within member states they could also be given powers of arrest, in a manner already introduced in the Schengen convention for "hot pursuit" across internal frontiers by national police officers. The convention rules none of this out, though presumably a protocol of amendment would have to be brought in to legitimate it. The pressure on member states to approve this might prove to be irresistible.
Had an organisation like this been set up in any one member state, it would presumably have been the subject of a detailed bill presented to the country's parliament. This would have required lengthy debates and committee hearings before it was approved. It remains deeply disturbing that in the present case the matter may be agreed in secret between the executives of the member states, with very little chance for their legislatures to influence the outcome.
Michael Spencer
Notes:
- Advice from the legal Service of the Council, 5527/93 (19.3.93).
Committee on Civil Liberties and Internal Affairs (rapp: L. van Outrive), Report on the setting up of Europol, A3-0383/92 (European Parliament, 1992).
The Week in Europe (European Commission, London), 23.7.94).
FECL No.21, p.5
Communication 9757/93 from the Presidency to the Steering Group II of the K4 Committee.
FECL No.24, p.1; Statewatch, May-June 1994.
Draft Convention on Europol, 10.10.94 (in German), confidential; available from FECL.
Contact: Michael Spencer, 34 Bayham Rd., Sevenoaks, Kent TN13 3XE, UK; Tel/fax: +44/ 732 455561.