Tamara Fischer, LLM Candidate in General Law, The University of Edinburgh 

Winning entry for the EU Immigration Law Prize 2018/19

In times of crisis one can count on the hyperactivity of the EU legislator. A prominent example is given by the recently approved Regulation (EU) 2017/2226 establishing the EES at the EU’s external borders which registers automatically entry and exit of third-country nationals admitted for a short stay to the territory of the Member States – visa-exempt or not – and calculates the duration of their authorised stay. As laid down in Article 2(1) of the Regulation, all those who do not enjoy the right to free movement are within the scope of application. The EES finds itself in good company, with a number of other large-scale IT systems under the umbrella of eu-LISA. The Regulation, which will be operational in 2020, is part of the Union’s answer to the massive influx of migrants and the increase in travellers coming to Europe. It is intended to meet the increased security concern within the Union and mirrors the recent trend in EU law towards lumping together internal security and migration.

The Regulation is perceived as reinvigorating ‘free movement’ within the AFJS, adversely affected by the temporary internal border controls put in place by Member States in 2015. In this regard, manual stamping of passports does not do the trick. Instead, an interoperable database will help to identify ‘overstayers’ on the territory of the Member States, meaning third-country nationals who do not or no longer fulfil the conditions relating to their authorised stay. Allegedly but questionably, the EES thereby tackles the most prevalent cause of irregular migration that is the phenomenon of ‘overstaying’. If the AFSJ is far and foremost designed to serve the citizens, this might pose challenges to the fundamental rights of non-EU-citizens.

1. “Smile, you’re in Europe”?

With the massive amount of sensitive personal data indiscriminately stored, and the possibility of access for border, visa, immigration and law enforcement authorities, the EES constitutes an interference with the Charter-rights to respect for the private life of individuals (Article 7) and the right to the protection of personal data (Article 8). Furthermore, the data processing and the automated decision-making risks of interfering with the right to non-discrimination (Article 21 of the Charter) and the principle of human dignity (Article 1 of the Charter). Consequently, the Regulation must comply with the conditions set up by the ‘limitation clause’ in Article 52(1) of the Charter.

a. Sufficient and precise safeguards

The Regulation sets out separate and clear substantive and procedural conditions regarding the use of data by border, immigration and law enforcement authorities, whose staff will be trained in the protection of data and fundamental rights, and whose activities will be seamlessly supervised by (EU- and national) data protection authorities, the FRA and the Commission. However, the control of compliance with the conditions for access are to be carried out by central access points, which may be part of the same organisation as the designated authorities (cf. Article 29(3)). How will it be ensured that their independence not only exists on paper?

In order to exercise the Charter-rights to good administration (Article 41) and to an effective judicial remedy (Article 47), the third-country national must be in the position to get information and access to his/her data in the face of false registration and identification. The magnitude of a mistake in the data becomes particularly apparent if one considers that a missing ‘exit’-record will lead to the presumption that the person connected therewith is ‘illegal’.

Through interoperability, this applies not only within the EES, but also within the VIS, with – as a possible consequence – the automatic refusal of a visa application. On the basis of the EES, the remedies available include the complaint or legal action before the authorities or courts of a Member State against the decision not to grant access to or rectify, complete or erase personal data allegedly wrong or unlawfully recorded, and the claim for compensation against the Member State responsible for the damage resulting from unlawful processing or non-compliance with the Regulation. However, because of the reference to national law in Article 45(3) and 54(1) of the Regulation, the effectiveness of the remedies will depend on the law of the Member State concerned. Thus, the individual could de facto be deprived of the legal actions prescribed by Union law provided that they are not enshrined in or excluded pursuant to national procedural law.

The communication of data to third countries for the purpose of facilitating the identification of a third-country national on EU territory in view of his/her return or for law enforcement purposes is another point of criticism. Surely, the transfer is framed as a strictly circumscribed derogation from the in-principle prohibition of communication of EES data to third-countries, international organisations or private entities (cf. Article 41(1)) in accordance with the conditions posed by the Court (cf. here and here) and must respect the principle of non-refoulement aimed at the protection of the ‘rights of applicants for and beneficiaries of international protection’ (cf. Article 41(4)). However, the derogations entailed in Article 41(2) and 41(6) may allow for extensive interpretation. For instance, border and immigration authorities have a certain margin of appreciation with regard to the interpretation relating to the data transfer ‘necessary, in order to prove the identity of third-country nationals for the purpose of return’ justified by ‘important reasons of public interest’ pursuant to Article 41(2)(c) of the Regulation.

b. Necessity and proportionality

Another question concerns the real capacity of the identification of ‘overstayers’ for tackling irregular migration. The EES cannot determine the exact location of the third-country national after his/her registration at the point of entry into the EU. Furthermore, the effective return depends on the co-operation by third-states and, more generally, on an overdue exhaustive EU return policy. This raises doubts about the suitability and necessity of the measures prescribed by the Regulation. Admittedly, the EES by ways of interoperability with other large-scale IT-systems may help detecting identity-fraud committed in an asylum procedure by third-country nationals not eligible for international protection, and thus establish a link between the identification of ‘overstayers’ and the combat against irregular migration.

The explicit objectives against which the recording and storing of data and the granting of access to designated authorities must be measured with in regard to their adverse effect on fundamental rights (“strictly necessary”) are meticulously specified (cf. Article 6 of the Regulation). The potential interferences with the Charter must according to the principle of proportionality be necessary and genuinely attain the respective ‘legitimate aim’. In this case, the objectives are the management of the EU external border and the internal security in the area without internal frontiers. In conformity with the ‘purpose limitation principle’, the co-legislators quite rightly distinguished between the conditions and safeguards applicable to the data access by border and immigration, on the one hand, and law enforcement authorities, on the other. However, the interference with the right to respect for private life resulting from the data collection and access in view of gathering statistics allowing for evidence-based migration policy goes beyond what is necessary to achieve the objective, as the compilation of anonymous statistical data would be equally appropriate.

Lastly, concerning the purpose of preventing, detecting and investigating terrorism (cf. Article 6(2)(a) of the Regulation), the Regulation does however not tackle the prevalent terrorist danger arising from radicalized former ISIL fighters returning from war-zones in Syria with EU citizenship. Insofar, too much confidence is placed by the co-legislators on a European passport. As the application of the EES has not been expanded to EU citizens, they will continuously benefit from fast-track entry to the EU after 2020.

2. Conclusion

All in all, the EES is not a “win-win”. The system’s advantages come at a cost for third-country nationals, all potential irregular migrants (Britons possibly included after Brexit). Serious doubts can be raised as to whether the EES will more efficiently tackle illegal immigration while at the same time facilitating legal immigration policy. Rather, the EES enforces the idea of the “Fortress Europe” protecting those who are ‘in’ to the detriment of those who are behind the moat. By strengthening the feeling of security – both physically and culturally – for EU citizens the Union intends to regain support for the EU project. However, it remains, that the end does not justify the means!