Brexit and police and judicial co-operation: Too little, too late?

The EU and the UK will find an agreement on extradition and Europol. But both parties are further apart on data protection than it may seem. Data transfers will be a problem in the future relationship.

Three and a half years ago the CER published the first in a series of pieces on Brexit and EU justice and home affairs (JHA). Post-Brexit JHA co-operation was a neglected issue then. Unfortunately the political and media debate, almost exclusively focused on whether the EU and UK will agree a trade deal by the end of the year, still largely ignores the subject. For all the drama and the millions of words devoted to tariffs, rules of origin or electric batteries, few people are thinking about what will happen if the UK and the EU cannot agree on police and judicial co-operation.

For all the drama and the millions of words devoted to tariffs, rules of origin or electric batteries, few people are thinking about what will happen if the UK and the EU cannot agree on police and judicial co-operation.

There are several reasons for this: perhaps the most obvious is that justice and home affairs is a complex, technical field. But that is also true of trade policy. And yet, even the minutiae of a prospective trade agreement have been covered by the media over the past few months. More convincing is the argument that unlike their visions for the future trade relationship, EU and British positions on the matter of JHA co-operation have changed very little since the Brexit vote. While the British Parliament pondered what sort of economic relationship it wanted to have with the EU, the UK’s red lines on police and judicial co-operation have barely moved since Theresa May’s 2017 Lancaster House speech. The same is true for the European Union. 

Even back then, three things were clear: the UK wanted a ‘bespoke’ agreement with the EU, but rejected the jurisdiction of the European Court of Justice (ECJ); the EU’s negotiators insisted that a non-EU country, however important as a security partner, should not have more rights and fewer obligations than a member-state (or even a non-EU member of the EU’s passport-free Schengen area); and both parties wanted an agreement to cover three priorities: access to databases, extradition and co-operation with EU agencies like Europol. None of these things have changed since 2017.

The other reason why JHA has been under-reported during the negotiations is because of the negotiators themselves. Both parties have exploited JHA’s relative un-sexiness to advance under the radar. The negotiators’ self-imposed purdah was somewhat lifted two weeks ago. After the October 15th European Council, Michel Barnier, the EU’s chief Brexit negotiator, told the European Parliament: “We have made progress on the question of the European Convention on Human Rights, on data protection, Europol, Eurojust and extradition. In these areas we can clearly see the outline of an agreement.”

And yet, a few days before, briefing the House of Commons on the looming possibility of no deal, Cabinet Office minister Michael Gove seemed to suggest that JHA negotiations were stuck, as the EU was insisting on the UK accepting ECJ jurisdiction as a condition of access to databases. Gove also claimed that no deal on security was better than a bad deal, as there are “many, many areas in which we can co-operate more effectively to safeguard our borders outside the European Union than we ever could inside.” Former Prime Minister and Home Secretary, Theresa May, was not impressed.

So are the parties on the verge of ending up with no deal on security? Or has progress indeed been made? And, most importantly, what will happen on January 1st if the UK and the EU indeed fail to agree on justice and security?

First, the good news: whether or not the parties conclude a security deal, according to the Withdrawal Agreement cases and investigations which are ongoing at the end of the implementation period should be covered by existing arrangements until their conclusion. Suspects will not be able to greet the New Year by rushing across the UK/EU border unhindered. And Barnier is probably closer to the truth than Gove: the EU and the UK will likely agree on future co-operation in at least two of the three priority areas (extradition and Europol).

According to officials, the main breakthrough on JHA came when the UK decided (reluctantly) to re-affirm its commitment to the Council of Europe’s European Convention on Human Rights (ECHR). Though the ECHR is unpopular in parts of the Conservative Party, the UK now seems to accept that pledging to stay in is necessary if Britain is to strike a JHA deal with the EU.

The not so good news: there may be a gap between the end of the transition period and the entry into force of any JHA agreement between the EU and the UK. Whatever deal they make on things like extradition and Europol will need to be ratified by both the UK and the European Parliament. And the European Parliament is known for its scepticism about international agreements on police and intelligence co-operation.

There are two ways around this problem: one would be an expedited ratification procedure. That would be more likely if the parties agreed to a deal on trade, as the Commission would like to package the JHA and trade elements together so it is easier for the European Parliament to approve them in time. MEPs are already complaining about the short time they would have to scrutinise the agreement, even if the parties manage to find a compromise by their self-imposed deadline of mid-November. On paper, the European Parliament could speed up ratification of the agreements on extradition and Europol even if there is no deal on trade. But a fall-out on the economic side of negotiations would give sceptical MEPs a strong argument to delay ratification of what will be, at any event, legally complex texts.

Alternatively, the parties could be creative. They could, for example, extend the provisions in the Withdrawal Agreement governing ongoing extradition cases. This would be difficult for some Constitutional Courts to swallow – Germany’s Bundesgerichtshof and Italy’s Corte Costituzionale, for example, have been trying to get more control over extradition, particularly of their own nationals. But Realpolitik may prevail: the parties could agree to exempt their own nationals for the time being, in the hope that a watertight extradition treaty would be in place before any legal challenge had to be decided.

There are two provisions in the Withdrawal Agreement covering ongoing co-operation between the UK and the EU within the framework of Europol at the end of the transition period: one refers to UK participation in Europol’s Joint Investigation Teams which will still be operative on January 1st 2021. British police officers should be allowed to continue being members of those teams until they complete their tasks. The other article refers to the UK’s access to Europol’s message-exchange system SIENA, which should continue for a year if the information requested by Britain refers to ongoing cases. Beyond that, there are no clauses in the Withdrawal Agreement that the parties could use to prevent a cliff-edge on Europol if there is no deal in place on December 31st. That is why officials think that the negotiators could use an obscure clause in Europol’s own regulation (Article 25.6) to stop the screens from going black at midnight on December 31st. According to this article, the Management Board, Europol’s governing body, could, in agreement with the European Data Protection Supervisor, authorise the transfer of Europol’s data to Britain even in the absence of an agreement. But this transfer would be limited in time (for one year, renewable) and could only happen under stringent conditions. Also, such an agreement would not ensure the physical presence of UK staff at Europol – which is one of the British government’s main asks, echoed by many at Europol.

Both parties want an agreement to cover three priorities: access to databases, extradition and co-operation with EU agencies like Europol.

The future relationship
On extradition, the UK and the EU will probably agree to a deal similar to the one the EU has with Norway and Iceland. This agreement is similar to the European Arrest Warrant but with two important exceptions: countries can refuse to extradite their nationals and can decide not to surrender someone they think is wanted for a political crime (surrender of terrorist suspects to and from EU countries was difficult before the European Arrest Warrant came into force, as some countries, like Ireland, or France, would argue that suspects were wanted for political crimes and refused to extradite them to the UK or Spain, for example).  

The Norway/Iceland deal is attractive to the UK because it does not involve the ECJ. The agreement works around the problem of judicial oversight by setting up an autonomous dispute resolution mechanism. The agreement has only recently entered into force, and it is still unclear how the mechanism will work in practice since only courts can rule on issues such as whether or not to extradite somebody. Perhaps the most daunting fact about this agreement is that it took almost 20 years to construct: the negotiating mandate was adopted in July 2001, the agreement was first published in the EU’s official journal in 2006 and it only entered into force in November 2019 following ratification by all countries involved.  

The UK and the EU may seal an extradition deal more quickly. But if they cannot agree and ratify one before December 31st, or if they do not find creative ways to extend current arrangements, then as of January 1st new extradition cases will be governed by the less efficient 1957 Council of Europe Convention on extradition, which regulated extradition in Europe before the European Arrest Warrant entered into force in 2004. It takes 18 months on average to surrender a suspect under the Convention, during which the requested state has to pay for detention.

The UK should also get a good deal on Europol, an agency it has done much to shape. Based on both negotiating positions, a close partnership between Europol and the UK should be fairly straightforward to agree. Britain could follow any of the available models (Norwegian, Swiss, American or Canadian, amongst others), which allow countries to exchange information and to post liaison officers to Europol. But none has direct access to Europol’s databases, making operational co-operation harder. Britain could also consider the Danish model (despite being an EU member, Denmark opted out of Europol in 2015). Denmark’s partnership with Europol allows Copenhagen to request information from the agency. But Danish police and security services can no longer interrogate databases directly: they need to ask Danish liaison officers stationed at Europol to access the Europol Information System (EIS) for them, which means that searches take more time. And in exchange for having limited access to Europol’s data, Copenhagen has to pay into the agency’s budget and accept the oversight of the ECJ.  The UK is unlikely to retain direct access to Europol’s EIS and SIENA databases, as the EU has not only denied this option to an EU country (Denmark), but has also tightened its data protection rules – compliance with EU privacy laws is a condition to grant access to databases.

In fact, data protection is the biggest sticking point in the JHA negotiations. The UK has insisted on a ‘bespoke’ data transfer arrangement, as London says it has no intention of deviating from EU data protection rules, embedded in Britain’s legal order since they were first adopted in 1995. But the EU does not agree with that: even if the EU’s 2018 revamped general data protection regulation (GDPR) is indeed part of British law (EU regulations are directly applicable to member-states), there are major concerns in Brussels about other bits of the UK’s privacy rules. The ECJ has repeatedly said that Britain’s spy laws (like the defunct 2014 Data Retention and Investigatory Powers Act or the more recent Investigatory Powers Act) breached EU law.

Data protection is the biggest sticking point in the JHA negotiations. The UK needs to obtain an EU  adequacy decision for both trade and security data transfers.

All this matters for the UK because, before giving access to security databases containing European citizens’ data, like the Schengen Information System, SIENA or the EU Passenger Name Record (PNR), the EU needs to accept that Britain’s privacy regime provides equivalent protections to its own. The EU does this by granting so-called adequacy decisions, which are usually limited in time and can be annulled at any time by either the European Commission (at the request of the European Parliament or the Council of Ministers) or the ECJ, if they consider standards to have dropped. On this basis, the ECJ has twice struck down transatlantic data transfer agreements (the Safe Harbour agreement in 2015 and its successor, the Privacy Shield treaty in 2020) because it thinks that the US government’s national security powers mean that EU citizens’ data are not safe.

An adequacy decision is also crucial for trade. As COVID-19 related restrictions tighten around the world, more businesses rely on data transfers for their day-to-day operations than ever before. Without an adequacy decision, Britain and the EU will have to resort to inefficient legal mechanisms to share data, like standard contractual clauses, which are open to legal challenges.

Contrary to the assumption of many UK officials, it will not be easy for the UK to get an adequacy decision. And even if it does, it could easily be annulled before long. This is because both parties are taking radical stances on privacy standards. On the British side, Dominic Cummings, the prime minister’s chief advisor, and others like International Trade Secretary Liz Truss, believe that the UK would be better off outside of any data deal with the EU, so that it can develop cutting-edge technologies like Artificial Intelligence more quickly. On the EU side, there is a push for data localisation to help create European champions – the idea, backed by Internal Market Commissioner Thierry Breton and the French government is to repatriate data collection to European soil, in order to counter the growing influence of US and Chinese big tech. This is what the Commission’s much-awaited Digital Services Act (DSA), to be unveiled on December 2nd, will try to do. If UK Prime Minister Boris Johnson decides, for example, to push for a less regulated approach to British high-tech start-ups, the European Parliament can ask the Commission to revise an adequacy decision on the grounds that the UK has deviated from GDPR standards. And a more protectionist digital environment created by the EU DSA will raise privacy thresholds beyond current levels, making a UK adequacy decision open to legal challenges.

Nothing precludes the EU and UK agreeing on police and judicial co-operation, even if they fail to seal a trade deal. But there would be difficult legal obstacles to overcome, to enable the two sides to work together on extradition and information exchange. If Johnson walks away from negotiations on trade, the resulting acrimony may make the EU less willing to put extra effort into reaching an agreement on security co-operation. Even if the two sides can agree, however, the new deal will never be as good as the one they had when Britain was part of the club.

Camino Mortera-Martinez is a senior research fellow at the Centre for European Reform.