As the UK/EU negotiations enter a crunch period much of the focus, understandably, is on the future economic relationship. But there’s another area that still needs to be settled: what kind of cooperation, if any, are the two sides going to have in future on security issues?
There’s a deal to be done here, which would be in both sides’ interests. The UK has a lot to offer, and to gain, from continued cooperation with law enforcement and security authorities across 27 member states.
It’ll be very much a dialled down relationship, compared to the cooperation built up over the recent years. But it’s still worth doing.
Failure to find agreement will only help those who wish us – UK and EU – harm.
It means overcoming three hurdles: how to protect Fundamental Rights; what happens about the ECJ; and how to ensure the protection of personal data.
These cross-cutting issues are particularly relevant to cooperation on law enforcement and justice, which after all ultimately involves prosecuting and locking up criminals.
Managing these hurdles isn’t easy, but it can be done.
The EU sought to make these issues preconditions for cooperation in this area, which hasn’t always been the case with other third countries.
The UK argued that the different areas of practical cooperation on security – law enforcement agencies, data bases, individual pieces of legislation – should be considered on their merits. In practice the two sides need to advance in parallel to find a balanced way forward on these cross cutting issues, which matches the level of practical cooperation envisaged.
Respect for Fundamental Rights goes to the heart of our shared values, in the UK as much as the EU. Initially the EU sought to get agreement on exactly how these values would be respected in UK law, again going beyond what’s been done with other third countries.
But it appears to have reconsidered, perhaps in the light of the UK government’s statements about respect for the ECHR.
The point is both sides can set out their expectation that the other will uphold Fundamental Rights, while respecting the independence of the different legal systems, by making it a condition of continued cooperation.
This is an example where a break clause – creating the possibility for either side to suspend security cooperation – could work.
The ECJ is at the centre of the EU legal system and plays a key role in security cooperation between EU member states.
But Barnier, on behalf of the EU, has now recognised the UK government’s position that the ECJ’s writ should not run in Britain after the end of 2020.
So this sets the framework of any future security cooperation: it need not block agreement, but it will necessarily limit what is possible, over access to law enforcement data bases for example.
Which brings us to data protection. The process of whether, or not, to grant UK data adequacy goes on in parallel to the negotiations and obviously has wider economic implications beyond security.
But it also goes to the heart of security cooperation, because much of the practical security cooperation built up over recent years involves sharing personal data, with the consequent protections.
This is also important because one of the considerations in granting data adequacy to a third country is how that country’s security agencies carry out surveillance of EU nationals, as underlined again in the recent Schrems II case which struck down the latest version of the EU adequacy framework with the US.
This is a big issue. Sufficiently big that I believe a solution will have to be found, as the EU has managed in the past with the US.
This doesn’t mean that it will be easy: various ECJ judgements continue to raise the bar not only around what constitutes effectively equivalent data protection in third countries, but also around the constraints on law enforcement activity in the EU – to the point that law enforcement and security agencies across the EU are increasingly frustrated, and starting to question how to strike the right balance.
None of which is going to be sorted out by the end of 2020. As far as UK/EU cooperation is concerned, at least in the short to medium term, the two sides need to focus on the starting point: the UK operates the GDPR today as effectively as other member states, and the UK protections around law enforcement and security activity in particular are, in my view, at least as effective as in other member states.
If these issues can be managed, what kind of practical security cooperation might be possible? It will necessarily be much thinner than the cooperation that has built up over recent years.
For the key law enforcement agencies, Europol and Eurojust (platforms for sharing data and information, and mounting joint investigations, operations and prosecutions), the UK will go from playing a leading role to being on the outside.
But there are some effective third country partnerships (notably US cooperation with Europol) that could be built upon to maintain as much of the practical investigative and operational cooperation as possible.
For the legal frameworks that underpin law enforcement and judicial cooperation, in particular for extradition (the famous European Arrest Warrant that put an end to the Costa del crime), the exclusion of the ECJ means that these arrangements can’t be reproduced as such.
But there are precedents for cooperation with non-EU countries that could be built upon, notably the surrender agreement with Norway and Iceland.
Crucially this relies on political dispute settlement (and if necessary suspension) rather than ECJ arbitration, but such an approach will make extradition more political and less automatic than at present.
For the key law enforcement databases that have been central to reinforcing police cooperation across Europe in recent years, even assuming some form of data adequacy decision, the constraints on the role of the ECJ will limit how far the UK can work with such data bases in future.
For some of the data sharing networks that grew out of intergovernmental cooperation, like Prüm (sharing information on vehicles, finger prints, DNA), it should be possible to find a way of cooperating.
But for the big central databases, like the Schengen Information System (consulted by police and border guards across Europe over five billion times a year), built and run centrally by the EU institutions, the ECJ exclusion pretty much rules out access for UK law enforcement – at least for the time being.
I think there is a longer term challenge for the EU to work out how to deepen cooperation with like-minded third countries, partners and allies on a range of these law enforcement and justice issues. But, again, that’s for another day, and is probably best thought about separately from Brexit.
So, if something on these lines is it, is the game worth the candle? The answer must be yes. If the two sides find a way forward on future UK/EU relations, it needs to cover security cooperation.
Those seeking to cause us harm aren’t going away. Make no mistake, they are watching, looking for new opportunities if old friends fall out with each other. We shouldn’t give them that satisfaction.
By Sir Julian King KCVO CMG, Oxford Internet Institute and RUSI fellow and ex-European Commissioner for the Security Union.
