Effectiveness and Procedural Protection in Cross-Border GDPR Enforcement

Enforcement of the General Data Protection Regulation (Regulation 2016/679 or GDPR) is organized mainly alongside decentralized procedures, where national supervisory authorities (SAs) are responsible for monitoring and supervising the diverse market of small and large data controllers and processors. Since processing often has a transnational character, enforcement becomes a transnational affair too. Therefore, the GDPR lays down a (complex) cooperation mechanism according to which national SAs in different Member States shall coordinate the outcome of enforcement procedures, in order to address violations together – potentially with involvement of the European Data Protection Board (EDPB) too. While this procedure was, from the outset, infamous for its complexity, concerns regarding under-enforcement of cross-border cases now seem to materialize in practice. This blogpost highlights a number of recommendations that aim to increase the effectiveness of cross-border GDPR enforcement and the protection of data subjects within these procedures. 

Continue reading “Effectiveness and Procedural Protection in Cross-Border GDPR Enforcement”

Not so flexible? The instrumental usage of soft law in EU telecommunications regulation

What is ‘instrumental usage’ of soft law and why does it matter?

At the hand of a case study in the telecom sector, this blogpost maintains that soft laws can erode the principles of accountability and vertical division of powers when used instrumentally/strategically by enforcers. An example of such strategic use will be the instance when, due to its ineffectiveness, a soft law instrument is converted/leveraged into hard law. The working definition of instrumental use coined by this author is as follows: deploying soft law in order to obtain enforcement outcomes that are consistent with an enforcer’s own vision of the ‘correct’ modus operandi of EU (utility) regulation (and away from public interest/public good considerations).  

Continue reading “Not so flexible? The instrumental usage of soft law in EU telecommunications regulation”

The Jean Monnet Network on enforcement of EU law (EULEN): results and conclusions

By the Network members

The Jean Monnet Network on enforcement of EU law (EULEN) was launched in September 2019. This ERASMUS+ project has been funded for four years; it came to an end in September 2023. This blog post offers a recap of the network’s departing points, results and conclusions. The EULEN network aims at developing further, including holding an annual conference with a call for papers (to be announced in due time), in order to contribute to research and practice in the field of enforcement of EU law.     

 

Continue reading “The Jean Monnet Network on enforcement of EU law (EULEN): results and conclusions”

A “bi-partite” AI Liability framework: Compensatory measures to enforce compliance with preventive measures

Redefining Liability

 

Current regimes and traditional notions of liability, in Europe and elsewhere, have been challenged by the emergence of Artificial Intelligence (AI) and its specific features. On one side, the combination of the features of openness, data-drivenness and vulnerability, enables the harm of further categories of protected interests – such as privacy, confidential information, cybersecurity, etc. – which in turn challenges the notion of damage. On the other side, the characteristics of autonomy, unpredictability, opacity, and complexity, impact the notions of causation and duty of care. All these features render liability assessments difficult, unless AI systems are adequately governed.

 

So far, the EU’s liability framework has only been partially harmonized. For instance, the current Product Liability Directive (Directive 85/374/EC, “PLD”), implemented into Member State law, dates back to 1984 and fails to encompass AI-related harm. Fragmentation in the EU’s existing liability regime call for its revision, to catch up with the rapid changes brought by AI. This is what the proposed framework on AI liability, which can be defined as “bi-partite”, aims to achieve.

 

The proposed AI Act, part of the Commission’s 2021 AI package – and coupled with the proposed Machinery Regulation – constitutes preventive, ex-ante measures adopting a risk-based approach to govern AI systems. Gaps in redress mechanisms under the AI Act, and doubts surrounding its surveillance authority system and AI auditing ecosystem, raise questions regarding the regulation’s enforcement. To face the scenario where a lack of compliance generates damages, the ex-ante legislation has been complemented by two proposals for compensatory, ex-post measures: the revised Product Liability Directive (“revised PLD”) and AI Liability Directive (“AILD”). We look into how the revised PLD and the AILD contribute to the enforcement of the preventive measures, by pushing for compliance with the obligations they introduce.

 

Continue reading “A “bi-partite” AI Liability framework: Compensatory measures to enforce compliance with preventive measures”

EU-law in practice: Compliance of the Netherlands with EU-law 2010-2020

As a member of the EU, the Netherlands is obliged to implement and comply with EU law.  The European Commission investigates non-compliance of EU-law, for example by means of a formal infringement procedure. The Dutch ministry of Foreign Affairs informs parliament every three months about infringement procedures, and cases before the Court of Justice of the EU (CJEU). However, not much is known about what happens behind the scenes. For example, how often are there EU Pilot procedures, i.e. informal pre-infringement procedures? And do informal procedures help to resolve possible non-compliance and prevent the Commission from starting a formal procedure? A 2018 report by the European Court of Auditors makes an inventarisation of enforcement instruments of the Commission, but it does not provide empirical evidence. On 15 June 2023 the Netherlands Court of Audit published the report EU-law in practice. It examined all formal and informal procedures between the Commission and the Netherlands regarding incorrect or incomplete implementation of EU-law (2010-2020). It also investigated government coordination regarding compliance with EU-law, and what lessons were drawn from closed procedures. In addition, nine cases were analysed to determine how procedures were conducted in practice, and to understand the problems that arose. The nine cases included such topics as the enforcement of Water Framework Directive, Corona Flight Vouchers, Residence Permit Fees for third-country nationals and the European Arrest Warrant. In this post the main results of the report are discussed.

Continue reading “EU-law in practice: Compliance of the Netherlands with EU-law 2010-2020”

The CJEU Judgment in C-46/21 P, Aquind v ACER: Boards of Appeal as expert mechanisms of conflict resolution to conduct a ‘full review’ of contested decisions.

On 9 March 2023, the European Court of Justice delivered its long-awaited judgment in the Aquind-case shedding light on the intensity of review conducted by the boards of appeal of European Union agencies. This case concerned the Board of Appeal of the European Agency for the Cooperation of Energy Regulators (ACER) which limited itself to assessing manifest errors of assessment in its decision-making. The Court struck down this limited approach; the ACER Board of Appeal consists of both legal and technical experts and therefore must, in principle, conduct a full review of the agency’s decision. This judgment is significant as it relates to the quality of (quasi-)judicial control of administrative decision-making. This blog post aims to discuss this judgment and its implications for the system of judicial review in the EU.

Continue reading “The CJEU Judgment in C-46/21 P, Aquind v ACER: Boards of Appeal as expert mechanisms of conflict resolution to conduct a ‘full review’ of contested decisions.”

Frontex and Fundamental Rights Protection – Much Ado About Nothing

By Yanfui, Ana, Clara and Sebastian

As the European Union agency for “European integrated border management”, Frontex is the centre for border control activities at the EU’s external borders, sharing intelligence and expertise with all Member States and with neighboring non-EU countries affected by migratory trends and cross-border crime. It plays an active role in return operations. Under Article 3 of Directive 2008/115, return decisions are taken when the stay of the third-country national is declared illegal, which occurs when the person does not fulfill the requirements of that Member State, not carrying the required visa or residence permit.

Regarding the critics to Frontex, according to a report from 2020, Frontex faces two main challenges concerning pushbacks: accountability and transparency. These issues have become increasingly visible in recent years. Nevertheless, the protection of Fundamental Rights has still not been sufficiently improved. This is particularly paradoxical, as this topic has been the subject of countless publications in the legal literature and the EU legislator is also aware of the problematic situation, given that the protection of Fundamental Rights is mentioned more than 230 times in the corresponding Regulation. In the context of this blogpost, we will show where the greatest deficits exist regarding transparency and accountability, and thus where the greatest need for legislative action exists. To wake up the legislator and ultimately to push the legislator to real sustainable action, we will suggest that the Ombudsman could take on a decisive role

When Borders Become Barriers: The Unintended Consequences of Europe’s Approach to Border Control

In February, the sinking of a vessel carrying 59 refugees from Turkey to Italy was blamed on Greece. With regards to Frontex, it has cooperated in protecting the coast, which made refugees decide on circumventing the Greek islands and taking the more life-risking approach by attempting to reach Italy. Consequently, both Greece and Frontex have been accused of taking part in those deaths, and we still lack information on their participation in this incident during their border protection activity.

Unfortunately, this is only one of numerous examples in which migrants coming in seek of asylum are subject of violence, detained, stripped, confiscated of their belongings, and pushed back to their territory.

No transparency in reality

Despite being an extremely regulated agency, the observable deficits in Frontex’s way of functioning raise doubts about its role as a border control agency. The lack of transparency and accountability in Frontex’s activities has been subject to debate since the Agency was created, with several calls demanding a solution to this issue at a national and European level, with no significant changes to this date.

When Frontex does not meet its transparency obligations, holding it effectively accountable for its actions is further complicated by the non-accessibility of all information. Even though a transparency mechanism can be found in Regulation 1049/2001 -to which Frontex is subject to- access to Frontex’s documents remains highly restricted on account of the nature of the information they contain. This cult of secrecy is further increased by the requisites prescribed in the Regulation: To access Frontex’s documents the person must be a citizen of the European Union. This reduces many potential information requests, as those primarily affected by Frontex’s actions do not meet this requirement.

Moreover, from an accountability point of view much has been reviewed and promised yet no noticeable changes can be seen. Being an EU Agency, Frontex is bound by the Charter, which consequently shields migrants from refoulement and collective expulsions. It also prohibits the conduction of push backs, as well as any sort of participation in them and the omission of acting against them. At first sight, the law is clear, and the system should work. Yet it is still extremely complicated to hold Frontex accountable when it does not comply with said obligation, even when tools created with significant effort such as the ‘individual complaint mechanism’ exist. The reason is not surprising: Frontex’s is formed by multiple actors from quite diverse backgrounds which makes it particularly challenging to allocate responsibility in case of wrongdoing, specifically in the context of pushbacks.

Enhancing political attention as the way forward in addressing the non-accessibility hurdle

The main changes needed to improve accessibility are more or less obvious. The right of access to information must be made more effective by also granting it to non-EU citizens. In addition, the requirements for refusing the right to information on public security grounds must be made more stringent, so that this straightforward way of denying access is no longer available. Since the EU legislator, despite frequent and repeated criticism, has so far not genuinely chosen to strengthen the fundamental rights protection at the expense of less effective border protection, the question arises how the legislator can be pushed to such legislative changes.

For this purpose, the European Ombudsman should be involved to a greater extent by receiving complaints about Frontex activities. The broad mandate from Art. 228 (1) TFEU would allow the Ombudsman to deal with such complaints, to make them public and to enter into an accountability dialogue with Frontex. It is true that here, too, only natural persons residing within the EU can file a complaint, which will probably never be the case in practice regarding persons who have been pushed back. However, legal persons located within the EU can also file corresponding complaints and thus draw the attention of the Ombudsman to deficiencies in the work of Frontex at the border. Such legal persons are non-governmental organizations (NGOs), most of which have a registered office within the EU. These could serve here as a spokesperson for the third-country nationals who have been pushed back. The Ombudsman can then forward the submitted complaints to the European Parliament through so-called special reports, which would ensure that the issue is debated and thus gains political attention.

Even if an EU institution would not be obliged to comply with the Ombudsman’s recommendations, it can be pressured towards compliance through public ‘naming-and-shaming’. Even if immediate changes would fail to materialize due to the lack of far-reaching powers of the Ombudsman, the Ombudsman’s activities and demands could prepare the ground for later secondary legislation changes by increasing political pressure by highlighting the deficiencies to the public. The Ombudsman’s ability to persuade the legislator to amend the legislation has been proven, for instance, by the introduction of the complaint mechanism in Art. 111 of the Frontex Regulation, which was ultimately also based on the suggestion of the Ombudsman.

 

Frontex: more powers and less responsibilities?

By Juliette, Ahmed, Katrin and Tom

(Source: European Commission, Migration and Home Affairs, available at: https://home-affairs.ec.europa.eu/agencies_en)

The shared administration, intended as the division of tasks between national authorities and Frontex regarding the protection of the European external borders, has changed over time with the enlargement of Frontex’s powers. This has raised issues of responsibility when a Fundamental Right (hereinafter FR) violation occurs. One possible solution for Frontex to escape this issue is the use of Article 46 of Regulation 2019/1896 (hereinafter the Regulation). We argue that this Regulation lacks a real distinction of responsibility between Frontex and the national authorities. This lack is then profitable to violations of FR because it is hard to sanction and prevent violations if it is not possible to correctly identify a “guilty party”.

Evolution of Frontex’s enforcement powers and shared administration

The recent evolution of Frontex, the European and Coast Guard Agency (EBCG) by the most recent Regulation illustrates a remarkable development in the EU’s institutional landscape with the transformation of Frontex into a new type of organisation equipped with direct decision-making powers. In fact, while the original operational mandate was limited to the planning, coordinating and evaluating the operations, this all changed with the new Regulation which created the permanent staff of the Agency whose executive powers are exercised under the command and control of the Member State hosting the operation. The permanent new staff of Frontex is a new resource to support national border management authorities in exceptional circumstances and in day-to-day operations. This novelty changed the very basic principle and former division of tasks between the Agency and the Member States, according to which the implementation of EU policies, such as the application of the Schengen Borders Code rules, was strictly the responsibility of national border guards or border police.

This increase in Frontex’s mandate and the modified shared administration do not include a specific accountability system between the national authorities and Frontex when the operations are wrongly conducted. The only important addition of the new Regulation is the Article 46 which provides Frontex with the possibility to suspend, terminate or not launch activities especially when there is a risk of a FR violation. This possibility exists when the dignity of its own actions, in the sense of upholding FR, cannot be guaranteed adequately. Frontex has already invoked Article 46 once in the case of Hungary in 2021. While this was an important step, the invocation only occurred after five years of pressure from the Fundamental Rights Officer and a CJEU ruling. This phenomenon clearly shows that Frontex is not prone to withdraw its actions by invoking Article 46.

Fundamental Rights violations

Frontex is required by law to ensure that human rights are upheld during operations under both EU and international law. Nevertheless, OLAF discovered that Frontex repeatedly took active actions to ensure that the human rights crimes that were occurring would not be seen, documented, investigated, or accounted for. More specifically, it demonstrates how Frontex misled the European Commission and Parliament as well as how the Fundamental Rights Officer was side-lined and internal reports on human rights abuses were distorted. Frontex was aware of FR violations by the national authorities and sometimes even participated in it. The EU Agency failed to address and effectively follow up on these violations as to prevent similar foreseeable violations in the future.

Some authors have proposed that Frontex should be held responsible both directly and indirectly, especially concerning the misuse of Article 46 when FR are violated. However, the CJEU has not ruled on this matter yet.

Lack of effective responsibility mechanism under the Regulation of 2019

Hence, while direct enforcement powers of Frontex have grown, methods for holding Frontex accountable and responsible for its actions and violations of FR have not. In the existing system, any wrongdoing by Frontex can effectively be concealed due to its reliance on national authorities who oversee the actions of Frontex’s staff during ground operations.

However, even if Frontex is dependent on the command of national authorities, this does not alleviate the European and Coast Guard Agency from the obligation to respect FR as prescribed in Article 3, paragraph 2 of the Regulation.

Also, as stated above, Article 46 gives the possibility for Frontex to suspend, terminate or not launch activities especially when there is a risk of FR violation. Nevertheless, notwithstanding the numerous reports filed by the Fundamental Rights officer, Frontex did not make use of Article 46 in the 2021 crises affecting the eastern borders of the EU. Frontex was aware of the ground-breaking legislative amendments of the alien’s laws in Lithuania at the time of their deployment. As a matter of fact, these amendments were in complete breach of the European Convention of Human Rights (ECHR) considering that they introduced limitations on accessing asylum procedures; extended the use of detention (up to six months); and restricted individuals’ access to information, interpretation, medical care and legal aid. It is only in July 2022, following a CJEU’s decision which concluded that the above-mentioned amended Lithuanian migration and asylum laws were in breach of EU law, that Frontex decided to terminate its operations when it could have triggered Article 46 much earlier.

It can thus be argued that the lack of real distinction of responsibilities between Frontex and the national authorities, combined with the practice of Frontex to not rely on Article 46, further worsens the underlying tension between the protection of FR and the protection of the external borders of the EU.

 

OLAF and the EPPO: does team work always make the dream work?

Blog post by Nicole, Thirza, Enes

As reiterated by President von der Leyen in her 2021 State of the Union speech: “The EU needs to ensure that every euro and every cent is spent for its proper purpose and in line with rule of law principles. EU funds are not allowed to seep away into dark channels”. If you have wondered which EU bodies are at the forefront of the protection of the Union’s financial interests (PIF) and how their cooperation works, you have come to the right place. In the almost two years the EPPO has been operational, the two Offices have had the first chance to interact and cooperate, as prescribed by their respective Regulations. In this blogpost, we outline the current updated EPPO and OLAF operational cooperation and its future possibilities to find out if teamwork can make the dream work.

PIF: A new player in the game

For more than 20 years, the European Anti-Fraud Office (OLAF), an administrative investigatory body with the mission to “detect, investigate and work towards stopping fraud involving European Union funds”, has been a preeminent actor in the PIF fight. However, in 2017 a new player entered the scene, the European Public Prosecutor’s Office (EPPO). For the first time in EU history, an independent European body has the power to investigate and prosecute PIF crimes (see Figure A). As a result, we have two EU bodies with different sets of powers but with one common goal in mind: “to better protect EU taxpayers’ money and to bring all crimes against the EU budget to justice as quickly as possible.”

Figure A: Missions and Tasks of EPPO. Source: https://www.eppo.europa.eu/en/mission-and-tasks

OLAF and the EPPO in a nutshell

OLAF’s mandate encompasses investigation of fraud and corruption involving EU funds and serious misconduct within the European institutions as well as development of anti-fraud policy for the Commission. OLAF carries out both ‘internal’ or ‘external’ investigations, depending on whether or not they are conducted within institutions, bodies, offices and agencies of the EU (IBOAs). While conducting its investigations OLAF cannot exercise any coercive powers, so it has to rely on cooperation with national competent authorities. At the end of these investigations, OLAF cannot sanction the suspect or bring them to court. Instead, it can draw a report, binding on the IBOAs but not on national prosecutorial or judicial authorities of the Member States (MSs), and issue recommendations. In practice, the indictment rates following OLAF’s recommendations are low and vary significantly among MSs. That is because in some jurisdictions national prosecutors tend to prioritise the national aspects of cases, neglecting their European dimension, for instance, due to their lack of expertise.

In contrast, the EPPO has criminal powers through which it can investigate and also decide to bring a case to judgement before competent national courts until it has been finally adjudicated. Moreover, since the EPPO’s legal basis, Art. 86 TFEU, allows for the mechanism of enhanced cooperation, MSs could choose whether or not to join. Therefore, currently the EPPO counts only 22 “participating” MSs.

The implementation of these powers creates a complex legislative and organisational structure (here you can find a full explanation). Despite being a single office, the EPPO is composed of a central and a decentralised level, where different authorities play a role (see Figure B). As for the legal framework in which the EPPO operates, the EPPO Regulation provides only minimum rules, referring often to national laws especially in regards to its investigatory powers.

 

Figure B: Structure of the EPPO. Source: Fabio Giuffrida, The European Public Prosecutor’s Office: King Without Kingdom? CEPS Research Report No. 2017/03, February 2017

Abbreviations: ECP: European Chief Prosecutor, EP: European Prosecutor, DCP: Deputy Chief Prosecutor, EDP: European Delegated Prosecutor.

The EPPO and OLAF cooperation: ensuring no case goes undetected

The EPPO’s creation has definitely marked the transition into a new era for European enforcement in the area of PIF. However, in order for its potential to be fully exploited, the “new player” will have to play alongside its well-experienced team-mate OLAF. That’s why, expanding on the few ad hoc provisions contained in their respective Regulations, in 2021 OLAF and the EPPO further specified their obligations to cooperate by signing a Working Arrangement (WA). Considering this combined legal operational framework, let’s describe the most important aspects. First, in line with the principle of non duplication, OLAF needs to terminate its investigation if the EPPO is conducting one into the same facts. However, OLAF may support the EPPO in its investigations by means of operational, forensic, and analytical expertise and tools. Importantly, when providing this support, OLAF needs to respect the stricter criminal procedural safeguards contained in the EPPO Regulation. Additionally, under its own initiative or upon the EPPO request, OLAF can conduct parallel complementary investigations to address essential aspects of the protection of the EU’s financial interests, such as speedy recovery or the adoption of administrative precautionary measures.

Figure C: OLAF and EPPO Joint Enforcement

Moreover, the EPPO and OLAF can mutually exchange information, which enriches the capacities of both offices, enabling them to avoid duplicate investigations, and streamlining their operations. Additionally, the WA sets up a system for the reporting and transmission of potential cases. Since the mandates of OLAF and the EPPO do not fully overlap, this exchange is crucial to ensure that illicit activities detected by the EPPO in non-participating MSs do not escape OLAF’s investigation. Moreover, it guarantees that the EPPO is informed about any criminal offence falling under its mandate even when it was first detected by OLAF. In short, the exchange of both information and cases ensures that the EU’s resources are spent effectively and that every case is tackled by the appropriate authority.

Towards a joint enforcement mechanism?

A closer look at the envisioned OLAF and the EPPO cooperation supports the conclusion that the EU legislator aimed to create more than just two separate EU agencies. On the contrary, it seems that this could be the first step towards a comprehensive joint EU law enforcement system (see Figure C). Indeed, an integrated end-to-end cycle starting with OLAF investigations and ending with the EPPO indictments could be the future of the PIF enforcement in the EU.

Years of cooperation will be necessary to find out if teamwork will make this dream work or if it will remain but a distant dream. So far, it seems that both offices got off on the right foot and the EPPO 2022 annual report enthusiastically highlights the achieved results. Nonetheless, if a lasting relationship is to be built on these foundations, one must not forget that this increase in the powers of EU authorities should be accompanied by both guidance to and cooperation with national authorities and by appropriate guarantees for private individuals.

How and why is expert knowledge used by the Commission in antitrust decisions against Google?

Even though the digital economy has been around for some time now, there are still doubts concerning, e.g., the way that law should be enforced in the digital context. Hence, the crucial role of expert knowledge in providing relevant insight is understandable. Due to its importance, the question of which sources, and for what reasons, should be considered as providing the relevant expertise is worth examining. In the post, I present the results of an analysis of references from the Commission’s decisions in three cases concerning Google published recently in the form of an article. The goal of the analysis was to identify references to expert knowledge, provide a classification of the roles played by these references, and confront them with the standards that the evidence used by the Commission should fulfil, as presented in the case law of the Court of Justice of the European Union (CJEU) and in doctrine. The results show that due to the variety of roles played by references to expert knowledge in the Commission’s decisions, the importance of following CJEU’s remarks on standards concerning expert knowledge is especially crucial when these sources are:

  • used to support authoritative claims about digital technologies and markets, and
  • in other cases, when they are indispensable for substantive analysis of the infringement itself or are not corroborating other types of evidence.

Continue reading “How and why is expert knowledge used by the Commission in antitrust decisions against Google?”