Introduction
Surveillance activities and
national security: applicability
of EU Law
Union in 2016. The commissioner’s task is to create
an effective and sustainable Security Union, placing
fundamental rights at the centre of the framework.22
Recent EU-level initiatives with national
security relevance
“National security remains the sole responsibility of each
Member State: but subject to that, any UK legislation
governing interception or communications data is likely
to have to comply with the EU Charter because it would
constitute a derogation from the EU directives in the field.”
Several initiatives have been introduced at EU level since
2015 as part of a broad effort to bolster Member States’
national security. These include:
Anderson, D. (2015), p. 71
The 2015 FRA report gave an overview of privacy and
personal data protection in primary and secondary EU
law. It also referred to the ‘national security’ exemption,
which limits the applicability of EU legal instruments.18
The EU Data Protection Reform adopted in 201619
maintains this exemption in Article 2 (2) of the General
Data Protection Regulation (GDPR) and in Article 2 (3)
of the Data Protection Directive for Police and Criminal
Justice Authorities, which excludes the “processing of
personal data in the course of an activity which falls
outside the scope of Union law” from its scope. This
provision should be read in conjunction with Recital 14
in the Data Protection Directive for Police and Criminal
Justice Authorities, which explains that Article 2 (3)
means that “activities concerning national security,
activities of agencies or units dealing with national
security issues […] should not be considered to be
activities falling within the scope of this Directive.”
The 2015 FRA report demonstrated that the debate
regarding the limits of the ‘national security’ exemption,
particularly in relation to counter-terrorism measures,
involves both intelligence services and law enforcement
authorities. 20 Since 2015, following several terrorist
attacks in Europe, the EU has created a Security Union
to counter terrorism efficiently.21 In that context, the
Council of the EU appointed a Commissioner for Security
18
19
20
21
FRA (2015a), p. 10.
Regulation (EU) 2016/679 of the European Parliament and
of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and
on the free movement of such data, and repealing Directive
95/46/EC, OJ 2016 L 119 (General Data Protection Regulation,
GDPR); and Directive (EU) 2016/680 of the European
Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing
of personal data by competent authorities for the purposes
of the prevention, investigation, detection or prosecution
of criminal offences or the execution of criminal penalties,
and on the free movement of such data, and repealing
Council Framework Decision 2008/977/JHA, OJ 2016 L 119
(Data Protection Directive for Police and Criminal Justice
Authorities).
FRA (2015a), p. 10. For an analysis of the competence of the
EU on national security and intelligence services, see also
Sule, S. (2017), pp. . 16-20.
European Commission, Juncker, J.-C. (2016), ‘Juncker after
Brussels terror attacks: “We need a Security Union”’, Joint
Press Conference with French Prime Minister Manuel Valls,
24 March 2016.
- Policies/policy proposals: European Agenda on Security (2015); European Commission’s suggestion to
open Counter Terrorism Group to ‘interaction’ with
law enforcement authorities through Europol (2016)
- Specialised bodies: appointment of Commissioner for
Security Union (2016); creation of European Parliament special committee to tackle deficiencies in the
fight against terrorism (2017)
- EU agencies: EU Intelligence and Situation Centre
(INTCEN); EU Satellite Centre (SatCen)
- Legislation: adoption of Passenger Names Record
Directive 2016/681 (2016)
Source: FRA, 2017
The exchange of existing intelligence among Member
States for counter-terrorism purposes and access
to such data by law enforcement authorities are
challenging issues for the Security Union. Data collected
by a Member State’s intelligence services fall under
the exclusive competence of that Member State.
The European Commission has stated that solutions
to the lack of clarity in the relationship between
the law enforcement community and intelligence
community should be urgently identified. At present,
exchanges of data among national intelligence services
take place voluntarily and outside the EU’s legal
framework, through – for instance – the Club de Berne
and the derived Counter Terrorism Group (CTG). The
CTG is an intelligence-sharing forum that focuses on
counter-terrorism intelligence and encompasses all
EU Member States, as well as Norway and Switzerland.
The Commission has suggested opening the CTG
to ‘interaction’ with law enforcement authorities,
through the existing Europol framework.23 Meanwhile,
in July 2017, the European Parliament created a special
committee to tackle deficiencies in the fight against
terrorism. The committee is tasked with assessing
the extent of terrorist threats on European soil and
22
23
King J. (2016), ‘Introductory remarks by the Commissionerdesignate Sir Julian King to the LIBE Committee’, Press
release, Strasbourg, 12 September 2016.
European Commission (2016), Communication from the
Commission to the European Parliament, the European
Council and the Council, “Enhancing Security in a world
of mobility; improved information exchange in the
fight against terrorism and stronger external border”,
COM(2016)602, Brussels, 14 September 2016, p. 15.
21