Felix Bieker
email: fbieker@wsi.uni-kiel.de

Walther Schücking

The Court of Justice of the European Union, Data Retention and the Rights to Data Protection and Privacy -Where are we now?

Keywords: Data Retention, Privacy, Data Protection, European Union, Fundamental Rights, Court of Justice, Data Retention Directive, Data Protection Directive, e-Privacy Directive. 1

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In Europe, the retention of traffic data for criminal investigations has been and continues to be a subject for much debate as well as litigation. With the long-awaited and substantive judgment of the Court of Justice of the European Union (in the following: CJEU or the Court) in the cases of Digital Rights Ireland and Seitlinger 1 , this article argues that the blanket retention of traffic data for the fight against crime and terrorism has been ruled out. However, there remain questions to be answered, most prominently the scope of the right to data protection under Article 8 of the EU Charter on Fundamental Rights (in the following: CFR or the Charter) and the consequences of the Data Retention Directive's (in the following: DRD or the Directive)2 invalidity for Member States' law.

This article explains the genesis and scope of the Data Retention Directive (2), before briefly summarizing the Court's judgment (3). The Court's reasoning is then assessed with a focus on the interpretation of Article 8 CFR and the Court's role in the European system of fundamental rights protection (4). Section 5 analyzes the consequences of the DRD's invalidity for the Member States' own regulations on data retention. The conclusions (6) provide a brief outlook on future developments.

2

The Genesis and Scope of the Data Retention Directive

The regulation of data retention on a European level gained momentum after the terrorist attacks of Madrid and London in 2004 and 2005 respectively. In the aftermath of these tragic events, there was an endeavor to pass a Framework Decision in the then third pillar of the European Union, the Police and Judicial Cooperation in Criminal Matters. 3 The cooperation of police was governed by ex-Articles 30, 31 and 34 TEU. Under these provisions however, a unanimous vote in the Council was required. When, in the early stages of the negotiations, Ireland threatened to use its veto on the proposal, the legislation was in jeopardy.

Nevertheless, while some Member States did not have any form of data retention, there also were many variations of data retention in other Member States. This provided the impetus to further pursue the subject as a harmonization measure under ex-Article 95 TEC (now Article 114 TFEU). The subsequent Data Retention Directive, due to the change in legal basis, could then be adopted by a majority vote in the Council.

The DRD obliged Member States to order providers of publicly available electronic communication services or of public communications networks (in the following: service providers) to retain data to identify the source and destination of fixed network and mobile telephonyincluding text messagesas well as internet telephony, E-Mail communications and internet access according to its Article 5 para. 1. These data include numbers or user names, date, time and duration, and for mobile telephony the subscriber's IMSI (international mobile subscriber identity), the cell phone's IMEI (international mobile station equipment identity) and the location by Cell ID. These sets of data, at a first glance, might appear rather innocuous, as they do not contain any contents of the communication. In fact, the DRD expressly prohibits the storing of any data which may reveal the contents of a communication in its Article 5 para. 2. However, for two different projects a German and a Swiss politician made their data publicly available and had them visualized in an interactive map showing their location. This was correlated with a list of calls, text messages and internet communications to and from other (identifiable) persons. 4 From this combined information, it is possible to draw comprehensive conclusions about the everyday life of these politicians.

Soon after the Directive's adoption, Ireland filed an annulment action according to Article 263 TFEU before the CJEU, solely attacking the choice of legal basis, which was rejected by the Court in 2009. 5 Simultaneously, the Member States' implementation measures for the DRD were challenged before numerous national constitutional courts and declared invalid in Romania, Germany and the Czech Republic. 6 None of these courts made a preliminary reference to the CJEU under Article 267 TFEU, arguing that the national legislator had not exercised the margin granted by the Directive in a way compatible with the national constitution. 7 While a German Administrative Court in 2009 asked the Court about the Data Retention Directive's validity, the CJEU found the question inadmissible, as it did not bear any relation to the case referred. [START_REF]Joined Cases C-92 and 93/09 Schecke and Eifert[END_REF] In 2012 however, the Austrian Constitutional Court as well as the Irish High Court referred questions concerning the compatibility of the DRD with fundamental rights to the CJEU, which resulted in the present judgment.

The Court's Judgment

In its judgment, the Court stressed that the Directive's wide scope allowed detailed insights into the daily life of all citizens. Even though no contents of the communications were stored, the retention of the data might change the use of these services, which affected the users' and subscribers' right to freedom of expression under Article 11 CFR. The question whether the data of users and subscribers could be retained had to be assessed with regard the right to privacy according to Article 7 CFR. Fur-ther, Article 8 of the Charter, the right to protection of personal data, imposed requirements on the protection of personal data.9

Interference with Fundamental Rights

However, when assessing the interference, the Court no longer referred to Article 11 of the Charter. Instead, it affirmed that for the right to privacy, there was no requirement of sensitivity of the data or any inconvenience for the users or subscribers. In accordance with its own and the jurisprudence of the European Court for Human Rights (in the following: ECtHR), it held that the obligation to retain the data as well as the granting of access for national authorities to this data constituted two independent interferences with Article 7 CFR. Additionally, the processing of personal data in itself interfered with Article 8 CFR. The Court emphasized that due to the mass scale of the data retention, this measure was likely to create a feeling of constant surveillance. 10

Justification of the Interference

Under the horizontal justification clause of Article 52 para. 1 of the Charter, interferences with all rights granted may be justified when they are provided for by law, respect the essence of the rights and are proportionate. The Court started with an assessment whether the DRD respected the essence of the rights concerned. Before the Charter entered into force, the CJEU stated that interferences may not impair the very substance of fundamental rights, but has since adopted the Charter's wording. [START_REF][END_REF] In an earlier decision the Court defined the essence of a right as its 'core content' 12 and thus interpreted it as a principle separate from proportionality. 13 In the case at hand, the Court found that while the retention was a particularly serious interference, it respected the essence of Article 7 CFR as it did not include the retention of any contents of communication. With regard to Article 8 CFR the Court argued that the essence of this right was not concerned, as the Directive itself contained rules on the integrity and protection of the data retained. 14 In the review of the Directive's proportionality the Court found the fight against terrorism and serious crime to be its 'material objective' 15 . Yet, due to the sensitivity of personal communications and the large scale of the retention, the Court held that this measure called for strict judicial review.

Assessing the appropriateness, the CJEU argued that the retained data was a valuable tool for criminal investigation, which was unchanged by the fact, that the measures could be circumvented by taking recourse to anonymous forms of communication. However, the fight against serious crime, did not in itself justify the retention of all communication data with regard to necessity. Rather, the restriction had to be limited in so far as it was strictly necessary, due to the right to data protection's particular importance for the right to private life. As the DRD encompassed traffic data from all means of electronic communication and all subscribers and users, it affected, without any exception, all European citizens using electronic communication. This called for legislation with a precisely defined scope as well as safeguards against abuse and unlawful processing of the data. 16 In particular, the CJEU criticized four aspects:

Firstly, the collection of data neither required a nexus with a threat to public security, nor did it demand any temporal, geographical or personal limitations. Secondly, access to and use of the data retained was not limited: the definition of serious crime as well as the substantive and procedural conditions were left to the Member States. Further, the Directive required no limitation on the persons who were granted access and there was no prior review by a court or other independent body. Thirdly, the range of data retention from a period of six to 24 months was not justified by any reasons and thus arbitrary. These three points constituted grave interferences with Articles 7 and 8 of the Charter. 17 Lastly, the Court criticized the lack of safeguards against abuse and rules for protection of the data retained. The organizational measures to protect the data against loss and misuse were to be weighed against economical interests of the service providers and there was no obligation to store the data within the territory of the EU and thus no supervision by an independent body. This did not conform to the requirements of Article 8 CFR. 18 Therefore, the CJEU found that the data retention was disproportionate and the interference not justified. Consequently, the Court ruled that the DRD was invalid.

Assessment of the Judgment

Keeping in mind the controversy surrounding data retention for years now, which included the CJEU in two instances, it seems as though the Court needed a push to finally assess the validity of the DRD. However, with a view to previous judgments concerning EU legislation and the strict proportionality review conducted by the Court,19 the judgment does not come as a surprise.

The CJEU assesses the rights of the Charter extensively and for the first time scrutinizes Article 8 CFR as a right independent from Article 7 of the Charter. In previous cases, the Court assessed the rights jointly, under the premise that Article 8 para. 1 and Article 7 CFR were closely connected and their scope of protection was a right to respect for private life with regard to the processing of personal data. 20 When stating in Digital Rights Ireland and Seilinger, that the question of the retention of the data affects the scope of Article 7 CFR, while Article 8 of the Charter sets out data protection requirements, 21 the Court allows for a nuanced shift in the assessment of the scopes of these rights.

As far as the interference is concerned though, the Court relies on its own jurisprudence to hold the storing of the data to interfere with Article 7 CFR and refers to the ECtHR's case law when finding the access to this data as a separate interference with this very provision. 22 While it is to be welcomed that the Court refers to the jurisprudence of the ECtHR, which has developed extensive and long-standing case-law on the right to privacy under the European Convention on Human Rights (in the following: ECHR), the CJEU's adoption of this strand of case law leads to problems with regard to Article 8 CFR. This is due to the fact that the ECHR contains no separate right to data protection. Interpreting the obligation of service providers to store the data and the subsequent access of national authorities to this data as interferences with Article 7 CFR is in line with the ECtHR's jurisprudence on interferences with Article 8 ECHR. 23 As Article 7 CFR guarantees a right corresponding to Article 8 ECHR in the sense of Article 52 para. 3 CFR according to the Explanations to the Charter 24 such an interpretation is sensible. Even though the Explanations are not a legally binding document, they are awarded interpretative force for the Charter by Article 52 para. 7 CFR and Article 6 para. 1 TEU.

When, however, the Court goes on to consider the processing of the data as interference with Article 8 CFR, this leads to overlaps between the scopes of these rights. In order to interpret the notion of processing as laid down by Article 8 para. 2 CFR, recourse can be taken to the Explanations to the Charter. For Article 8 CFR, they refer to the Data Protection Directive (in the following: DPD) 25 Protection Directive, the processing of personal data consists inter alia of their collection, storage and use. Thus, when analyzing the judgment with due regard to the secondary law, the term 'processing' which is used to describe an interference with Article 8 of the Charter has to be interpreted as the collection, storage and subsequent use of the personal data. Then however, the interference with Article 8 CFR is exactly the same as the interferences by retention of the communication data with Article 7 CFR, i.e. the obligation of service providers to store the data and the subsequent access to the data by national authorities.

Although the Court apparently tried to differentiate between the right to privacy and the right to data protection in this case, it ended up with identical definitions for both rights. Consequently, whenever data is stored or accessed, this constitutes simultaneous interferences with the right to privacy and the right to data protection. If this had been an intended outcome, the Court would not have bothered to differentiate between the rights. Therefore, the CJEU's interpretation of the scope of the rights of Article 7 and 8 CFR is not yet convincing and requires further elaboration by the Court.

However, if the current approach of the CJEU is followed and the rights to privacy and data protection are interpreted in the same manner, Article 8 CFR could be regarded as a lex specialis to the more general provision of Article 7 CFR. 26 As the ECHR does not include a separate right to data protection, the ECtHR employed the right to private life in order to develop the right to privacy as one of its facets. With time, the case law evolved and the ECtHR also covered aspects of data protection, as detailed above. While the CJEU could just adopt this case law for its own jurisprudence before the Charter, there is now an express right to data protection, which has to be taken into account. In this regard, the specific right to data protection of Article 8 CFR could be awarded precedent over the more general right to private life in Article 7 of the Charter, whichin its verbatimdoes not contain any reference to either privacy or data protection. This lex specialis interpretation would ensure consistency with the ECHR, while allowing a broader scope for Article 8 of the Charter with regard to the extensive individual rights granted by the DPD. Nevertheless, the existence or non-existence of a distinction between privacy and data protection is a contentious issue in doctrine. 27 The ultimate resolution of this problem is not within the scope of this article, which is instead focused on the discussion of the CJEU's judgment in the Digital Rights Ireland and Seitlinger case.

Yet, the judgment at hand does include a new aspect concerning the right to data protection: that is the Court's interpretation of Article 8 para. 3 CFRwhich states that an independent authority supervises adherence to the provisionas requiring storage of the data within the European Union. This is a very welcome statement. The CJEU thereby demonstrates that it takes the revelations about mass-surveillance by US and UK intelligence services seriously and is not willing to let European law turn a blind eye to these substantial threats to privacy and data protection. In the way the Court assesses this provision as a part of the right to data protection, it adds an element of an individual right to Paragraph 3 of Article 8 CFR, which could have been seen as a merely formal requirement.

Although the interpretation of the rights to privacy and data protection may not be followed in its reasoning, the Court is to be commended for its extensive assessment of the privacy implications of data retention. However, the issue that it took eight years to arrive at the conclusion that the DRD gravely violated fundamental rights remains. Yet, it should be borne in mind that it is a legal obligation of the legislator to draft regulations in a way consistent with fundamental rights. The DRD in its Article 14 para. 1 contained a clause requiring an evaluation of its impact and effectiveness. In the subsequent report the Commission, evaluating its own work, suggested several changes, inter alia to the storage of the data and the reimbursement of service providers, but found the Directive in general to conform to fundamental rights. 28 However, with regard to the measure's fundamental rights implications the report merely summarized the case law of the CJEU and the ECtHR without applying it to the Directive itself. 29 In this regard, improvement is necessary: the Commission needs to take the assessment of fundamental rights implications of regulations more seriously. A two page description of the fundamental rights concerned cannot be sufficient for measures interfering with the rights of the entire European population.

In safeguarding fundamental rights the CJEU comes into play only on a secondary level, when it interprets Union law and rules on the validity of the acts adopted by the legislator according to Article 19 para. 3 TEU. As any other court, the CJEU cannot render decisions by its own motion, but is limited to the cases brought before it. In the aftermath of its first decision on the proceedings instigated by Ireland, the CJEU attracted wide-spread criticism. [START_REF] Cf | Der EuGH und die Vorratsdatenspeicherung oder die verfehlte Kehrtwende bei der Kompetenzregelung[END_REF] However, it could have been anticipated that the Court would only assess the choice of Article 114 TFEU (ex-Article 95 TEC) as legal basis as this was the only claim made by Ireland. [START_REF]Case C-301/06 Ireland v Parliament and Council (note 5)[END_REF] As the infringement proceedings under Article 263 TFEU are based on the French legal system, there is a long-standing practice of the Court to limit its review to the claims of the applicants, rather than conduct an extensive ex-officio scrutiny. 32 The issue of fundamental rights was, however, raised by the Slovak Republic, which supported Ireland's action before the CJEU and questioned the retention's compatibility with Article 8 ECHR. 33 Under Article 130 of the Rules of Procedure of the Court, Member States may be granted leave to join proceedings, but this is limited to supporting the claims of the party according to Article 129 para. 1 cl. 2 of the Rules of Procedure. Even though the CJEU's case law on claims and defences is not always consistent, [START_REF]EU-Prozessrecht[END_REF] the Court does not allow interveners the right to seek forms of order unconnected to those of the party. 35 While the Court's judicial self-restraint in this context as a whole has been 36 and continues to be subject to criticism, especially when it comes to the compatibility of a measure with fundamental rights, 37 the CJEU's limited review cannot be ascribed to an attempt to circumvent an assessment of fundamental rights. Rather, the suggestion that Ireland's annulment action was motivated by the aspect concerning EU competence and the circumvention of a unanimous vote in the third pillar can be considered an explanation for the absence of any claim concerning the compatibility of the DRD with fundamental rights. 38 After this judgment, as noted above, there were several instances where national courts were concerned with the compatibility of the DRD with fundamental rights. Yet, until the reference by the Austrian Constitutional Court and the Irish High Court none of the courts submitted a reference to the CJEU. This is a further point for improvement: in a multi-level system for the protection of fundamental rights, such as the EU, all depends on the cooperation of the various actors. 39

Consequences of the Judgment

As an immediate consequence of the judgment, the infringement proceedings instigated by the Commission against Germany under Article 258 TFEU for failure to implement the Data Retention Directive were dropped, as this obligation no longer exists. 40 Additionally, the Commission will reimburse Sweden, which had already been ordered to pay the costs for the infringement proceedings instigated against it. 41 More importantly however, should the EU legislator opt for a new approach to data retention, it will not be able to employ Article 114 TFEU as a legal basis. As the Court has required it to lay down the details of storage and access to the data, a definition for serious crime as well as procedural safeguards, this is evidently not a measure to harmonize national legislation for the benefit of the internal market. Rather, the measure will have to be based on the police cooperation rules, which with the entry into force of the Lisbon Treaty have been integrated into the former first pillar. Most likely, data retention could be based on Article 87 TFEU, which allows joint measures for police cooperation. 42 Aside from this question of competence, it needs to be assessed, whether Member States, which do not have rules on data retention such as Germany, are now free to pass national legislation. Further, as the CJEU's jurisdiction only covers EU law the national rules implementing the DRD remain in force in many Member States. For these Member States, it is important to know whether they can uphold their national laws. With the DRD declared invalid, the national transposition measures can no longer transpose European law. As the competence of the EU in the Area of Freedom, Justice and Security is a shared competence according to Article 4 para. 2 lit. j TFEU and there no longer is EU legislation with regard to data retention, the Member States are in principle free to exercise their own competences and legislate on the matter. However, as the Court pointed out, the DRD was a derogation from the general EU data protection regime, i.e. the DPD and the e-Privacy Directive (in the following: ePD) 43 , which according to its Article 1 para. 2 complements the DPD for the electronic communications sector. 44 The Court further held that data retention concerns the detection and prosecution of serious crime. For measures concerning cooperation in the area of police and judicial cooperation in criminal matters, there is an exemption clause in Article 1 para. 3 ePD. An almost identically phrased clause is contained in Article 3 para. 2 DPD. In a previous judgment, the CJEU interpreted the latter provision to apply to the transfer of data collected by private operators to a third country. 45 The transfer fell within a framework established by public authorities that related to public security. Applied to the case of data retention this implies that the access of public authorities serves the aim of fighting serious crime and improving public safety. Thus, the exemption clauses apply. However, the 'mere' collection, which served the harmonization of the internal market, is not covered by Article 1 para. 3 ePD and Article 3 para. 2 DPD. While this differentiation might seem artificial, it is 42 Cf. in greater detail Wendel, Wider die Mär von Grundrechtsblinden: Der EuGH und die Vorratsdatenspeicherung, Verfassungsblog, available at: http://www.verfassungsblog.de/wider-maer-vom-grundrechtsblinden-eugh-undvorratsdatenspeicherung/. 43 the only interpretation consistent with Article 15 para. 1 cl. 2 ePD, which exceptionally allows Member States to impose an obligation on service providers to retain communication data for a limited period. If the storage of data by service providers was covered by the exemption clauses, there would be no scope of application for Article 15 para. 1 cl. 2 eDP. 46 Furthermore, the Court already stated in its judgment on the action brought by Ireland that national measures on data retention before the DRD fell under Article 15 para. 1 ePD. 47 Therefore, the storage of communication data falls under the scope of the ePD and the Member States may derogate from the confidentiality of communications guaranteed by Article 5 ePD and the obligation to have traffic data deleted or anonymized by the service providers once they are no longer required under Article 6 ePD. However, the derogation clause of Article 15 para. 1 ePD allows such exceptions only where these restrictions serve public security, the prevention, investigation, detection and prosecution of criminal offences. While this is certainly the case for any national legislation on data retention, the provision further calls for the restriction to be limited to necessary, appropriate and proportionate measures needed in a democratic society. Further, the third clause of Article 15 para. 1 ePD calls for the measures to be in concordance with the general principles of EU law, including those of Article 6 para. 1 TEU. This refers to the fundamental rights of EU law, which are enshrined in the Charter, which has gained binding legal force with the coming into force of the Lisbon Treaty according to Article 6 para. 1 cl. 2 TEU.

With the present judgment of the Court, it has been ruled that the DRD did not conform to the fundamental rights of EU law. From this judgment, it follows immediately, that national measures, whichas it has been demonstrated still fall under the ePD and therefore come within the scope of EU lawhave been adopted in order to implement the DRD, do not meet the standards of the ePD and therefore violate Union law. Even where the national legislator has restricted access to and use of the data, the retention period will still be set arbitrarily and there will be no restriction as to the personal scope of the retention. If that would be the case, the national measure would have violated the very provisions it was supposed to implement. Therefore, Member States with rules on data retention are under a legal obligation to repeal them.

In case Member States do not repeal the national laws themselves, affected service providers and citizens can challenge these provisions before national courts claiming a violation of EU law in order to have these provisions set aside in accordance with the primacy of EU law. 48 With the judgment at hand, there should not be any issues as to the interpretation of the DPD's and eDP's provisions. However, if a national court 46 had any doubts or wished to derogate from the CJEU's judgment, at least a court of last resort would be under an obligation to submit a reference for a preliminary ruling under Article 267 para. 3 TFEU. When a national court refuses to make a reference or deliberately deviates from the case law of the CJEU it violates EU law. Thus, the Commission may instigate proceedings under Article 258 TFEU against the Member State. Additionally, the refusal to refer to the CJEU may be a violation of national constitutional law. If in Germany, for instance, a court arbitrarily fails to refer a case to the CJEU, it violates the individual's right to the jurisdiction of his or her lawful judge under Article 101 para. 1 cl. 2 of the Basic Law. [START_REF]Federal Constitutional Court of Germany[END_REF] Such an interpretation of the national law conforms to the Member States' obligation to provide effective remedies in areas concerning Union law under Art. 19 para. 1 cl. 2 TEU.

However, even where Member States repeal their implementing measures, critical review of new data retention legislation is needed. The United Kingdom, in the wake of the CJEU's judgment, has already passed new legislation to continue the retention of users' and subscribers' data with the Data Retention and Investigatory Powers Act 2014 (in the following: DRIP). [START_REF]Data Retention and Investigatory Powers Act[END_REF] Under Section 1 paras. 1 and 2 DRIP, retention may be ordered by the Secretary of State relating to one or multiple service providers. According to Section 1 para. 5 DRIP the maximum period of retention must not exceed twelve months. With regard to details of the retention the Secretary of State is authorized by Section 1 paras. 3 and 4 DRIP to further specify these by means of regulations. Despite its recent enactment, this legislation has already been subject to severe criticism by Members of the UK Parliament, who announced that they would challenge the act before national courts [START_REF] Travis | Drip surveillance law faces legal challenge by MPs, The Guardian of 22[END_REF] as well as several legal scholars, who argued in an open letter to the Home Office that the law was incompatible with the CJEU's criteria for data retention. [START_REF] Basu | An open letter from UK internet law academic of 15th July 2014[END_REF] Indeed, while it does not require default storage of all communications data, the DRIP allows storage of the entire data of one or more service providers, which still entails a very wide range of persons affected without any suspicion or link to criminal activities. Nevertheless, the scope of the retention depends on the subsequent regulations, which shape the requirements for the retention notice and its contents under Section 1 paras. 3 and 4 DRIP. Until these rules are set up, a final assessment of the measure's compatibility is hardly possible, although the wide scope of the DRIP does not seem to be reconcilable with the CJEU's requirements.

Concerning Member States which still wish to implement data retention it is hard to see how this could be accomplished. Although it is unclear to what extent the requirements of the Court are cumulative, [START_REF]For reading the requirements as cumulative cf. Kühling, Der Fall der Vorratsdatenspeicherungsrichtlinie und der Aufstieg des EuGH zum Grundrechtsgericht[END_REF] i.e. whether all of them have to be fulfilled or whether the CJEU would be willing to allow measures, which comply with a minimum core, it seems hardly possible to reconcile the idea of data retention with the requirements set up by the Court. While it stated that the fight against serious crime is of great importance and for this purpose communication data may be retained under certain conditions, it has been made clear, that the blanket retention of data of all citizens without any occasion or relation to serious crime is not in conformity with EU fundamental rights. [START_REF] Roßnagel | Neue Maßstäbe für den Datenschutz in Europa -Folgerungen aus dem EuGH-Urteil zur Vorratsdatenspeicherung[END_REF] Therefore, States will have to settle for alternatives such as the 'quick freeze' process, where law enforcement authorities need to obtain a court order, which obliges a service provider to retain specified data of an individual or a group of individuals linked to criminal or terrorist activities. In a second step, the relevant authorities have to provide evidence within a limited time-frame, to obtain another court order, which obliges service providers to transfer the traffic data to them. [START_REF] Cf | The Federal Commissioner for Data Protection and Freedom of Information[END_REF] This concept addresses the Court's main point of criticism: the blanket retention of data of all European citizens. If implemented with the appropriate procedural and technical safeguards, this process has the potential to conform to the CJEU's requirements.

Conclusions

It follows from the foregoing considerations that the present judgment of the Court has effectively ended the blanket retention of traffic data in the European Union. Although it may take additional time and litigation before national courts to implement this judgment, a system like that envisaged by the DRD has been clearly identified as the grave violation of fundamental rights that it is.

This case is also a step forward in the exploration of the innovative and, from the perspective of EU jurisprudence, yet uncharted right to the protection of personal data as laid down by Article 8 CFR. However, the Court's reasoning in this regard needs further development. So far, the relationship of Article 8 CFR with the right to privacy according to Article 7 of the Charter remains opaque.

  Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ 2002 L 201/37. 44 Joined Cases C-293/12 and 594/12 Digital Rights Ireland and Seitlinger (note 1), para. 32. 45 Joined Cases C-317/04 and 318/04 Parliament v Council and Commission [2006] ECR I-4721, paras. 56-59.

  for conditions and limitations of the right to data protection. According to the definition of Article 2 lit. b Data20 Joined Cases C-92 and 93/09 Schecke and Eifert (note 8), paras. 47 and 52; Case C-468/10 Joined Cases C-293/12 and 594/12 Digital Rights Ireland and Seitlinger (note 1), paras. 29 et seq. 22 Ibid., paras. 33-35. 23 Leander v. Sweden, Judgment of 26 March 1987, no. 9248/81, para. 48; Rotaru v. Romania, Judgment of 4 May 2000, no. 28341/95, para. 46. 24 Explanations Relating to the Charter of Fundamental Rights, OJ 2007 C 303/17. 25 Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ 1995 L 281/31.

ASNEF [2011] I-12181, paras. 41 et seq; Case C-291/12 Schwarz v Stadt Bochum (note 19), paras. 24 et seq; However, in one case between private parties, where according to Article 51 para. 1 CFR the Charter does not apply, the Court mentionedwithout any assessment of its scope or an interferencethe right to data protection safeguarded by Article 8 CFR without reference to Article 7 of the Charter, cf. Case C-70/10 Scarlet Extended [2011] I-11959, para. 50. 21

  Cf. Wagner, Die Vorratsdatenspeicherung in der Grundrechtsunion, Ju-Wiss Blog, available at: https://www.juwiss.de/54-2014/; Lehofer, Nochmals zum VDS-Urteil: auch "autonome" nationale VDS (auf Basis des Art 15 Abs 1 RL 2002/58) muss den Anforderungen des Urteils genügen, available at: http://blog.lehofer.at/2014/04/noch-zwei-kurze-anmerkungenzum.html; dissenting Wendel (note 42).

	47 Case C-301/06 Ireland v Parliament and Council (note 5), para. 67.
	48 Cf. Genna, Messy Consequences for National Legislation following Annulment of EU Data
	Retention	Directive,	LSE	Media	Policy	Project,	available	at:
	http://blogs.lse.ac.uk/mediapolicyproject/2014/04/08/messy-consequences-for-national-
	legislations-following-annulment-of-eu-data-retention-directive/.

Joined Cases C-293/12 and 594/12 Digital Rights Ireland and Seitlinger, Judgment of 8 April

2014, not yet reported.

Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ 2006 L 105/54.

Terhechte, Rechtsangleichung zwischen Gemeinschafts-und Unionsrechtdie Richtlinie über die Vorratsdatenspeicherung vor dem EuGH, Europäische Zeitschrift für Wirtschaftsrecht 2009, 199.

Biermann, Betrayed by our own data, Zeit Online of 26 March 2011, available at: http://www.zeit.de/digital/datenschutz/2011-03/data-protection-malte-spitz/komplettansicht; Digitale Gesellschaft, The life of National Councillor Balthasar Glättli under surveillance, available at: https://www.digitale-gesellschaft.ch/dr.html.

Case C-301/06 Ireland v Parliament and Council [2009] ECR I-593.

Constitutional Court of Romania, Decision no. 1258 of 9 October 2009, available at: http://www.legi-internet.ro/fileadmin/editor_folder/pdf/decision-constitutional-courtromania-data-retention.pdf; Federal Constitutional Court of Germany, Judgment of 2 March 2010, 1

Joined Cases C-293/12 and 594/12 Digital Rights Ireland and Seitlinger (note 1), paras. 28-30.

Ibid., paras.49-58.

Ibid., paras. 59-65.

Ibid., paras. 66-68.

Case C-291/12 Schwarz v Stadt Bochum, Judgment of 17 October

2013, not yet published; Joined Cases C-92 and 93/09 Schecke and Eifert (note 8).

Kingreen, Article 8, in: Calliess/Ruffert, EUV/AEUV, 4th ed., Munich 2011, MN. 1.

Cf. inter alia Tzanou, Data protection as a fundamental right next to privacy? 'Reconstructing' a not so new right, International Data Privacy Law 3 (2013), 88; Kranenborg, in: Peers et al. (eds.), The EU Charter of Fundamental Rights -A commentary, Oxford/Portland 2013, MN. 08.21-08.27; Kokott/Sobotta, The distinction between privacy and data protection in the jurisprudence of the CJEU and the ECtHR, International Data Privacy Law 3 (2013), 222; and even AG Villalón, Joined Cases C-293/12 and 594/12 Digital Rights Ireland and Seitlinger, Opinion of 12 December 2013, paras. 62-67.

Additionally, the relationship of the fundamental right to data protection with the general data protection regime of the Union remains to be explored with regard to the individual rights such as the right to access to data granted by Article 12 DPD. Yet, as this very data protection regime of the EU is currently in a process of reform, the future cannot be ascertained with certainty. While attention has largely focused on the envisaged General Data Protection Regulation 56 , which is currently under discussion in the Council, 57 there is also a proposal for a directive concerning data protection with regard to criminal investigations, 58 which has been partially agreed on after a first reading by the European Parliament and is now under deliberation in the Council. 59 While the last Commissioner for Home Affairs, Cecilia Malmström, announced that she had no plans to introduce any new legislation concerning data retention, 60 her successor in office, Dimitris Avramopoulos, after the tragic attacks of Paris in January 2015 stated that the Commission is monitoring the situation in the Member States and assesses the need for data retention. 61 Similarly, German chancellor Angela Merkel endorsed traffic data retention in conformity with the CJEU's requirements. 62 Thus, the possibility of a recurrence of some form of data retention on the EU level cannot be excluded with certainty. However, the Member States, at least for the time being, are under a legal obligation to implement the Court's ruling immediately.

The enforcement of the present judgment against Member States who are unwilling to abolish or revise their national laws will presumably require more litigation and is thus unlikely to be achieved in the near future. Moreover, as the example of the United Kingdom illustrates, even where a Member State adopts new legislation, the changes may not reflect the spirit of the judgment and also require further scrutiny by the judiciary. Despite these limitations with regard to the short term implementation 56 of the judgment, the ruling at hand, in the long term, further advances the Court's role as a supreme court of the European Union which ensures the protection of individuals' fundamental rights.


Daniel Deibler

Baroness Sarah Ludford

Patrolled by Drones?

Keywords: Privacy, Data Protection, EUROSUR, Surveillance, Border Control, European Convention on Human Rights, Charter of Fundamental Rights of the European Union, European Union, Frontex

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In the above quote baroness Ludford was criticising the 'smart border' initiative of the European Commission which was announced in February 2008. This initiative consisted of two proposed instruments to manage the external borders of the European Union (Entry/Exit System, Registered Traveller Programme) and was complemented by a proposal for the creation of a European External Border Surveillance System (EUROSUR). The subsequent criticism from data protection authorities and privacy promoting organisations concentrated mostly on the smart border initiative while the EUROSUR proposal was implemented without any mayor outcry or public discussion. The little expressed criticism for thein the meantime establishedsurveillance system came mostly from NGOs in the field of migrant and refugee protection. Organisations such as Pro Asyl [5] or the Jesuit Refugee Service [START_REF]Jesuit Refugee Service Europe: Proposals for amendments to EUROSUR Regulation 7 Regulation (EU) No 1052/2013 of the European Parliament and of the Council of 22 October 2013 establishing the European Border Surveillance System (Eurosur), hereinafter: EUROSUR Regulation. 8 European Convention on Human Rights[END_REF] have scrutinised the compliance of EUROSUR with the obligations deriving from the 1951 Geneva Convention relating to the status of refugees as well as other migrant protecting agreements. Consequently this paper sets out to close the existing void and will therefore examine the possible interferences of EUROSUR with the right to privacy and data protection. On the basis of the EUROSUR Regulation [7] the first part of the paper (section 2) will outline the structure and functioning of EUROSUR and describe which information from which sources are imported into the so called 'system of systems'. In addition, the compliance with the rights to privacy and data protection will be examined (section 3). It will be argued that due to the concrete circumstances of the data processing and the large scale of the surveillance, EUROSUR constitutes a serious interference with the right to data protection and privacy (sections 3.1.2 and 3.1.3). In the end this interference is ultimately not justified (section 3.2). In particular, the vagueness in most parts of the regulation and the lack of specific privacy protecting safeguards preclude the fulfilment of the 'quality of law' requirements (section 3.2.1). Furthermore, the necessity of such an additional and intrusive border management tool is highly questionable and raises concerns in regards to its usefulness (section 3.2.3). Last but not least it will be shown that the interference by the current system and the legislation is greater than necessary, since a more privacy preserving version is conceivable (section 4). As a result, EUROSUR is neither in accordance with law, nor necessary, nor proportionate and therefore violates Article 8 ECHR [8] as well as Articles 7 & 8 EUFRCh [9].

EUROSUR -A System of Systems

By establishing a European Border Surveillance System the European Union is attempting to move away from the traditional patrolling of borders to a more risk-based approach to border control. This approach is described in the EUROSUR Regulation as improving the situational awareness and increasing the reaction capability at the external borders. [10] This fairly vague description of EUROSUR and the extent of the surveillance becomes clearer by looking at the definition of 'situational awareness' included in the regulation:

'situational awareness' means the ability to monitor, detect, identify, track and understand illegal cross-border activities in order to find reasoned grounds for reaction measures on the basis of combining new information with existing knowledge, (…) [11] To achieve this improved situational awareness the regulation establishes a common framework for the exchange of information and for the cooperation between the national authorities responsible for border surveillance as well as Frontex [12]. EUROSUR has been described as a 'system of systems' because it does not establish one centralised database but connects the different so-called National Coordination Centres (NCC) of the participating Member States with each other and Frontex via a communication network which allows:

 information exchange in near-real-time;  audio and video conferencing;  handling, storing, transmission and processing of information.

Furthermore, to streamline the information exchange via the National Situational Pictures, the regulation obliges the NCCs to collect the relevant information from a vast array of sources (including national border surveillance systems, liaison officers, border authorities from third countries and ship reporting systems) [START_REF]The list of sources entailed in Art. 9 (2) EUROSUR Regulation includes ten different sources for relevant information; nevertheless by further including 'others' the list is not[END_REF] and to establish and maintain their picture. The Situational Pictures from the different NCCs will be shared which each other and Frontex. Frontex itself, however, will moreover supplement the national information with information from European Union bodies, offices and agencies as well as other undefined sources to create a European Situational Picture, which will subsequently be shared over the network too. Similar sources will be used by Frontex to maintain an additional Common Pre-frontier Intelligence Picture, increasing the knowledge about activities beyond the external borders of the Schengen Area.

The above mentioned range of different sources of information hinders every examination of the information which will be processed in the NCCs. Nevertheless, since the collection of data on a national level as well as the exchange of information between national authorities is regulated by the national law of the Member States, it falls outside the scope of the EUROSUR Regulation and consequently of this paper. However, the data processed in the NCCs is the foundation of the information exchanged in the EUROSUR system and therefore relevant for the Situational Pictures. The regulation itself provides only limited instructions on which information should be included in the Situational Pictures. According to Art. 8 EUROSUR Regulation it consists of an event, an operational and an analysis layer. The event layer shall contain information about incidents regarding unauthorised border crossings, cross border crime and crisis situations. Furthermore the event layer will provide information on unidentified and suspect vehicles, vessels and other craft and persons present at, along or in the proximity of, the external borders of the Member State concerned, as well as any other event which may have a significant impact on the control of the external borders. [14] The operational layer will provide information on the position, status and type of border control assets. Last but not least, the analysis layer consists of analysis and risk assessments for the relevant border sections. However, it also includes reference imagery and analysed information relevant for the purpose of the regulation. Beyond these general descriptions of the exchanged data no concrete information is publicly available. The relevant documents explaining the specifications of the information exchange are not yet available [15], are EU-restricted and government-use-only, or have been presented and discussed in confidential project advisory boards and the EUROSUR Member States' expert group. [16] Nevertheless, presentations by Frontex and the European Commission, such as the infographic EUROSUR [17], allow us to catch a glimpse of the event layer of the European Situational Picture. The included exemplary incident reports of the European Picture show that each event is filed under the location, time, date and type of the incident and illustrated on a map of Europe. Furthermore, each event is described in a free text field (e.g. persons involved, arrests or seizures, additional comments) and the user interface allows attaching images, videos, or other documents as well as to create linkages, or add historical backgrounds. It seems that the National and the Pre-Frontier Situational Picture will also include the above mentioned information since, according to the regulation, they are all structured the same way.

This information exchange will be further complemented by the common application of surveillance tools. According to the regulation ship reporting systems, satellite imagery and any sensors mounted on a vehicle, vessel or craft shall be used to monitor third country ports and coasts, pre-frontier areas and areas in the maritime domain, as well as to track vessels or other crafts in the high seas. Frontex is free to use these surveillance tools on its own initiative and the collected information can also be requested by the NCC of a Member State. For this purpose Frontex shall combine the information from the different sources and analyse the data to create so-called surveillance information on the external borders and on the pre-frontier area. [18] 3 EUROSUR and the Right to Privacy and Data Protection EUROSUR is in its core a mass-surveillance tool combined with a large-scale exchange of data. Consequently, the activities under the EUROSUR regulation raise questions in regards to its compliance with the fundamental rights of respect for private life and protection of personal data (Art. 7,8 EUFRCh and Art. 8 ECHR). While the EUFRCh differentiates between the right to privacyas part of the right to respect for private lifeand the right to data protection, both fundamental rights are embraced in the broad term of 'private life' in the ECHR.[19] However, since both rights inter-relate strongly the ECJ[20] favours a joint reading of Art. 7 and 8 EUFRCh and relies heavily on the jurisprudence of the ECtHR [21]. [START_REF][END_REF] Therefore, based on the jurisdiction of the ECJ and the ECtHR, this section will examine if EUROSUR interferes with these fundamental rights.

Interference with the Right to Privacy

Regarding the legality of surveillance the ECtHR stated in the Peck case [23] that the monitoring of the actions of an individual in a public place by the use of photographic equipment which does not record the visual data does not, as such, give rise to an interference with the individual's private life. [24] Nonetheless, while the mere act of monitoring will not interfere with one's right, the recording of such data can constitute an interference.[25] Furthermore, the Court decided in the Amann case [26] as well as in the Rotaru case [27] that the compilation of data by security services on particular individuals can affect the private lives of the victims,[28] even if only public information is systematically collected and stored in files.[29] Consequently, the interference is independent from the way of surveilling[30]covert or overtbut dependent from the storing and further processing of the data. Besides the fact that data has to be collected, an interference further presupposes that personal data is processed. Therefore, the right to private life in form of the right to privacy and the right to protection of personal data do not just inter-relate in this context but overlap mostly.

Personal Data

In European law personal data is commonly understood as 'any information relating to an identified or identifiable natural person.' [START_REF]Working Document on the Processing of Personal Data by means of Video Surveillance[END_REF] The element of 'any information' shows the broad concept of personal data and evidently includes images or other data from CCTV, surveillance sensors or other surveillance tools.[32] However, more problematic is, in the context of surveillance information, the question of whether a person is recognisable or identifiable. [33] This problem will be ascertained in detail below.

The second element requires that the information is relating to someone. However, the concept of 'relating to' is broader than the common understanding of the notion and therefore, data is not only relating to a person if the content of the data is explicitly about this person. According to the Article 29 Working Party, a relationship between data and a specific person can also result from the purpose or the result of the data processing. When data is used "with the purpose to evaluate, treat in a certain way or influence the status or behaviour of an individual" [34] the processed information relates to a specific person. Similarly, data is relating to a person if the use of the information is likely to have an impact on a certain person's rights and interests, however small the impact is.[35] "It is sufficient if the individual may be treated differently from other persons as a result of the processing of such data." [36] According to the next element of the definition data has to be relating to an identified or identifiable person. While the term 'identified' is self-evident, particular explanations are necessary for the notion of 'identifiability'. In general a person is identifiable if he or she is "described in the information in a way which makes it possible to find out who the data subject is by conducting further research." [START_REF]European Union Agency for Fundamental Rights: Handbook on European Data Protection Law[END_REF] Consequently, it is not necessary to identify a person by finding out his or her name, but it suffices to combine different criteria of personal attributes so that the group, the person belongs to, can be narrowed down and the person can be distinguished from other individuals.[38] Furthermore it is not necessary that the data processor has all the relevant information and significant criteria to identify the individual, since the decision regarding the question if data is personal data is made objectively. Even if only friends or family members can recognise a person on a video due to e.g. his or her figure, haircut and cloth, the data in form of a surveillance tape has to be categorised as personal data.[39] Moreover, the period of data storage becomes relevant in this context. Even if identification is not possible today, data will be personal data if identification becomes possible during the 'lifetime' of the data, due to new information or new technical possibilities. Last but not least, the purpose of the processing also affects the concept of 'identifiability'. In cases where the purpose of the data processing is the identification of specific individuals, the purpose implies that the processor will be able to identify persons and therefore the processed data has to be categorised as personal data again. The Article 29 Working Party explains this concept by the example of video surveillance:

As the purpose of video surveillance is, however, to identify the persons to be seen in the video images in all cases where such identification is deemed necessary by the controller, the whole application as such has to be considered as processing data about identifiable persons, even if some persons recorded are not identifiable in practice. [40] Consequently, identification is highly dependent on the particular situation and circumstances of the processing, the additional information that is or will be available, and the purpose of the processing. In particular the issue of contextualisation has to be considered regarding depersonalised or statistical data since even if only aggregated data is processed, it might enable the identification of persons if the original sample is too small or additional information is available.

Lastly, the information has to relate to a natural person. Even though the term is self-explanatory, it has to be mentioned that information which seems to relate to objects might also contain personal data. Data about objects such as boats or cars can also contain personal data about the captain or owner of the vessel in question.

[41]

EUROSUR and Personal Data

In a next step these general considerations about the concept of personal data have to be applied to the EUROSUR surveillance and data exchange.

Concerning the common application of surveillance tools the European Commission regards the use of modern surveillance technology as a key element of EUROSUR and stated that in particular the fusion of data received from ship reporting systems and satellite imagery plays an essential role. [42] As previously discussed, the data from vessel monitoring systems may already on its own contain personal data relating to the captain or owner of a vessel.[43] Nevertheless, this personal data is furthermore complemented by satellite imagery or data from any sensor mounted on any vehicle, vessel or other craft.[44] While those sensors might not be designed to identify or track natural persons, the images the system takes when monitoring vessels, beaches or ports will also depict individuals.[45] Depending on weather conditions, light, distance, range, and resolution of photographs the data from the surveillance tools can allow identification of individuals and therefore may constitute personal data. Furthermore, the necessary soft-and hardware already exist to post edit imagery and increase its resolution. [START_REF] Zöller | Rechtliche Rahmenbedingungen des polizeilichen Flugdrohneneinsatzes[END_REF] While this possibility is less likely when using satellites for monitoring, since they only allow detection of objects larger than 50 cm, [START_REF] Ludwig | Frontex und Eurosur -Umweltsatelliten der Esa helfen bei Jagd auf Flüchtlinge[END_REF] the EUROSUR Regulation also permits the use of Remotely Piloted Aircraft Systems (RPASs). Currently the use of Unmanned Aerial Vehicles (UAVs) is prohibited in European civil airspace, however, using Optional Piloted Aircrafts (OPAs) is allowed when someone is on board as an additional safety feature, even if the real pilot is operating the craft from a ground station and Frontex is already interested in acquiring an OPA for the surveillance of external borders. [START_REF] Nielsen | EU looks to 'hybrid drones' for legal shortcut on migration[END_REF] As RPASs can be equipped with different sensors (e.g. high-resolution cameras and microphones or thermal imaging equipment) [START_REF]European Commission regarding Remotely Piloted Aircraft Systems (RPAS) -Response to the Questionnaire[END_REF] including some that can zoom into 50 cm they would certainly allow the identification of persons from the high resolution images. [START_REF] Hayes | Borderline -EU Border Surveillance Initiatives -An Assessment of the Costs and Its Impact on Fundamental Rights[END_REF] The EUROSUR regulation permits the use of such sensors and therefore the processing of such personal data. Furthermore, the regulation obliges Frontex not only to gather this surveillance information but also to supply the NCCs with the information. Consequently, the application of common surveillance tools in the EUROSUR Regulation foresees and permits the processing of personal data and thus, interferes with the right to privacy and protection of personal data.

The second element of EUROSUR, relevant regarding the processing of personal data, is the data exchange via the Situational Pictures (National, European and Pre-Frontier). According to the Commission, EUROSUR does not intend to regulate the storage or cross border exchange of personal data[51] and therefore the "possibility for exchanging personal data in EUROSUR is very limited: At European level, Member States and Frontex are entitled only to exchange ship identification numbers." [52] Nevertheless, the limitation to the exchange of ship IDs has only found its way into the regulation regarding the European and the Pre-Frontier Situational Picture. [START_REF]13 EUROSUR Regulation. 54 European Union Agency for Fundamental Rights: Fundamental rights at Europe's southern sea borders[END_REF] Furthermore, the processing of personal data is envisaged in the regulation in specific circumstances, even if they are described as exceptional.[54] Nonetheless, closer scrutiny reveals that the exchange of personal data was broadly enabled by EUROSUR and might even become the norm. A questionnaire regarding the use of personal data in the NCCs showed that nine NCCs were already processing personal data and one NCC was planning to do so in the future. Furthermore, while only two Member States responded that they were not planning on handling personal data for border surveillance purposes, the rest of the states did not reply to the question. [55] In the context of data exchange and provision of supposedly anonymised data, another statement of the Article 29 Working Party has to be observed: Thus, it is critical to understand that when a data controller does not delete the original (identifiable) data at event-level, and the data controller hands over part of this dataset (for example after removal or masking of identifiable data), the resulting dataset is still personal data. Only if the data controller would aggregate the data to a level where the individual events are no longer identifiable, the resulting dataset can be qualified as anonymous. For example: if an organisation collects data on individual travel movements, the individual travel patterns at event level would still qualify as personal data for any party, as long as the data controller (or any other party) still has access to the original raw data, even if direct identifiers have been removed from the set provided to third parties. [56] Additionally, it has to be noted that the perception of personal data differs between European Member States and that for example the relevant authorities of Spain or Romania do not categorise surveillance images as personal data.

[57] Furthermore, the EUROSUR Regulation does neither entail any restrictions on the data exchanged between the NCCs nor does the user interface limit the possibilities of the NCCs.

Events uploaded in the system are essentially text boxes where information on persons could be shared. There are no alert pop-ups or other safeguards to ensure that personal data are not inadvertently included or that text boxes are anonymised. Furthermore, EU Member States are also encouraged to report "information on unidentified and suspect platforms and persons present at or nearby the external borders". The system also allows for video and picture attachments to an event. [58] While these considerations concern only the National Situational Picture, it also affects the European and Pre-Frontier ones, since the latter two are based on the information provided from the different NCCs.

Secondly, data might have to be categorised as personal data because different NCCs have additional information and can, by linking different information and data, identify an individual. In this context the storage period also has to be considered. In most cases the shared information should lead to an interception of vessels or another legal or administrative measure. Consequently, at least the acting state will gather further information about the individuals and therefore be able to identify the persons and relate the previous information (such as the port of departure) to them.

Finally, the purpose and the result of EUROSUR, make it necessary to categorise parts of the exchanged data as personal data. If the purpose of the data processing is the identification of the surveilled individuals or the use of the information will impact the rights and interests of these individuals,[59] the whole application as such has to be considered as processing data relating to identifiable persons, even if some persons are not identifiable in practice.[60] When examining the creation of EUROSUR the European Commission stated as one of the objectives for the new system the reduction of irregular -'illegal' according to the Commissionmigration. Further explanatory remarks show that the purpose of EUROSUR is to provide the authorities responsible for border control in the Member States with more timely and reliable information, so they are able to detect, identify and intercept those attempting to enter the EU.[61] Therefore, the identification of irregular migrants is one of the objectives of EUROSUR and thus, one of the purposes of the data exchange. Moreover, the data exchange will impact the interests of specific persons, since EUROSUR shall improve the ability to monitor, detect, identify, track and understand cross-border activities in order to find reasoned grounds for reaction measures on the basis of combining new information with existing knowledge. [62] Reaction measures will include interceptions, controls, arrests, etc. and consequently affect person's rights and interests.

In conclusion, while there is no hard evidence available that personal data is exchanged in the EUROSUR Network, since the relevant documents are not publicly available, the examples from the user interface, the data processed in the NCCs as well as the objectives of EUROSUR support the presumption that personal data is exchanged between the NCCs themselves as well as Frontex and the NCCs. Consequently, it will be assumed that the data exchange element of EUROSUR also interferes with the right to privacy and protection of personal data.

Seriousness of the Interference

Since both core elements of EUROSUR interfere with the right to privacy and data protection, it has to be established how serious the interference is. While there are several problematic points concerning EUROSUR, the most concerning one is the sheer amount of different data and data sources that are compiled in EUROSUR. The regulation only entails a non-exhaustive list of sources and therefore provides Frontex and the responsible national authorities with a margin of appreciation to include all data and data sources which they deem necessary for achieving the objectives of the regulation. Furthermore, Frontex is obliged to intensify their cooperation with international organisations and European Union bodies to make use of existing information and available capabilities and systems. While some of the examples stated in the regulation are obvious, such as EUROPOL or the Maritime Analysis and Operations Centre -Narcotics, others are not, such as the European Fisheries Control Agency. Furthermore, the European Space Agency (ESA) is now cooperating with Frontex and ESA's programme Copernicus [63], which was founded to provide information regarding the environment and climate change, is now providing Frontex with satellite imagery. [START_REF] Ludwig | Frontex und Eurosur -Umweltsatelliten der Esa helfen bei Jagd auf Flüchtlinge[END_REF] Similar cooperation is encouraged on a national level, and Member States shall increase their cooperation and data exchange with third countries and regional networks. [START_REF]Communication from the Commission to the European Parliament and the Council on the work of the Task Force Mediterranean[END_REF] Correlating to the amount of sources is the amount of affected persons. The satellite used in the Copernicus programme is able to capture an area as wide as 290 km [START_REF] Ludwig | Frontex und Eurosur -Umweltsatelliten der Esa helfen bei Jagd auf Flüchtlinge[END_REF] and the OPA Frontex is interested in has the capability to surveil an area for 12,5 hours without refuelling. [START_REF] Nielsen | EU looks to 'hybrid drones' for legal shortcut on migration[END_REF] Furthermore, it has to be considered that in particular the southern European Coasts and the Mediterranean Sea, were most of the surveillance is taking place, is frequently used for leisure purposes during the summer months by many tourists. [START_REF]Fundamental rights at Europe's southern sea borders, Luxembourg[END_REF] Additionally, the regulation does not only oblige Frontex to monitor the sea itself but also third country ports and coasts. Since satellites do not enable a specific and targeted surveillance, but create a general image of an area it can be assumed that the common application of surveillance tools will constitute a general surveillance of the area around the European external borders.[69] Consequently, it will include the collection of excessive information concerning everyone present at or around the external borders.

A similar open approach is taken in the regulation regarding the recipients of information.[70] Besides Frontex and all participating states the information shall be shared with European Union bodies, offices and agencies, and international organisations[71] as well as with regional networks and, under certain circumstances, with neighbouring third countries.

[72] On a national level the NCC shall distribute the information to all authorities with a responsibility for external border surveillance as well as with law enforcement, asylum, and immigration authorities. Furthermore, EUROSUR entails the possibility to process special categories of data, which are normally stronger protected in European Data Protection Laws.[73] These categories include information regarding racial or ethnic origin, political opinions or religious or other beliefs, as well as personal data concerning health and sexual life or criminal convictions.[74] Surveilling ports or towns, or tracking vesselsincluding photographic surveillancefor an extended period of time might reveal information regarding person's habits to visit religious institutions or to pray and thereby disclose one's religious beliefs. Furthermore, the incident reports of the situational picture may reveal criminal convictions, and descriptions of the involved persons can entail their ethnic origin.

The next point of concern relates to transparencyor rather the lack of itas well as the supervision of EUROSUR. Most of the documents revealing the exact scope of data exchange are not publicly available and therefore an exact scrutiny is not possible. Furthermore, since the system is running 24 hours a day, 7 days a week and includes inter alia the possibility of audio and video conferencing this unrecorded exchange of information complicates the general difficulty of supervising large-scale international, interconnected databases even more. [START_REF]European Data Protection Supervisor: Preliminary Comments of the European Data Protection Supervisor on: COM(2008) 69 final; COM[END_REF] From the point of view of the data subject, transparency would be of upmost importance to ascertain which authority has which information about oneself. Nonetheless, this seems rather illusory in the context of EUROSUR. Once a NCC inserts information into its National Situational Picture it will be automatically shared with Frontex and the other NCCs, including all the national or international authorities they are further connected with. Only the transfer of information to third countries requires the consent of the NCC which provided the original information. Consequently, not even the NCCs know to which authorities in Europe the information is disclosed. Further concerns are raised by the planned as well as deployed surveillance tools, such as RPAS and satellites. While the use of these tools is openly communicated, data subjects would hardly be aware of this kind of processing as it is difficult to notice RPAS, because of their small size and the altitude of operation. Furthermore, it is difficult, if not impossible, even for individuals noticing such devices, to know who is observing them, for what purposes and how to exercise their rights. [76] This combination of abstract knowledge regarding surveillance in a certain area but further uncertainty can, according to the ECJ, "generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance." [77] A further problem of secret surveillance was pointed out by the ECtHR in the Klass case [78]:

The Court points out that where a State institutes secret surveillance the existence of which remains unknown to the persons being controlled, with the effect that the surveillance remains unchallengeable, Article 8 (art. 8) could to a large extent be reduced to a nullity. It is possible in such a situation for an individual to be treated in a manner contrary to Article 8 (art. 8), or even to be deprived of the right granted by that Article (art. 8)

, without his being aware of it and therefore without being able to obtain a remedy either at the national level or before the Convention institutions.[79]

A further factor that elevates the intensity of the interference is the potential abuse of stored data. [80] Notwithstanding the data protection obligations entailed in the EUROSUR Regulation, the system itself and the large-scale collection of data increase the risk of misuse of personal information. As explained before, the user interface allows data exchange via text boxes and does not include any privacy enhancing or depersonalising safeguards. Furthermore, neither the system itself nor the EUROSUR Regulation hinder or permit that the description of an event is illustrated with attached images or videos. As asylum and immigration authorities shall also be provided with relevant information, these might run an asylum seeker's photo against all the uploaded EUROSUR pictures of arrivals by sea to ascertain where he/she first landed or authorities in charge of tracing unaccompanied minors' family members may wish to consult EUROSUR pictures to see if the child arrived accompanied by adults. While both examples are unintended by the regulation they are not only technical possible but also not prohibited by it. [81] Last but not least, the general application of surveillance or the lack of reasoned grounds for surveillance aggravates the intensity of the interference. EUROSUR aims at finding reasoned grounds for reaction measures on the basis of combining new information with existing knowledge.[82] However, while the objective might be justified, the definition shows that there does not have to exist any initial suspicion or indication. Consequently, all persons who stay, roam or sail in a certain area will be put under a general suspicion until they are categorised as unsuspicious. This can also be seen in the regulation itself, since according to Art. 9 (3) (d) the event layer shall contain information on unidentified and suspect vehicles, vessels and other crafts and persons at, along or in the proximity of the external border. The ECJ categorised the Data Retention Directive[83] as a particular serious interference with the right to private life partly because it applied even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime. [84] In summary, it can be argued that EUROSUR constitutes a rather serious interference with the right to privacy, even though no personal data in the traditional sense of the termmeaning information about an already identified personis processed. [START_REF] Villalon | [END_REF] It has to be reiterated that "to establish the existence of an interference with the fundamental right to privacy, it does not matter whether the information on the private lives concerned is sensitive or whether the persons concerned have been inconvenienced in any way." [86] In particular the general application of surveillance without any reasoned grounds combined with the vast range of data sources and data recipients aggravate the interferences. However, this already grave interference is further intensified by the lack of transparency and the correlating exclusion of data subjects' rights.

Justification of EUROSUR

After establishing that EUROSUR interferes with fundamental rights it further has to be ascertained if the interference is justified. According to Art. 8 (2) ECHR an interference is justified if it is in accordance with law, if the restriction targets one of the listed legitimate aims, and if the interference is necessary in a democratic society. A set of similar requirements apply to interferences with rights of the EUFRCh.

Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms laid down by the Charter must be provided for by law, respect their essence and, subject to the principle of proportionality, limitations may be made to those rights and freedoms only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.[87]

Accordance with law

To be in accordance with law, the interference has to not only be based on a national or European law, [88] which is accessible to the citizens, but the law also has to be formulated with sufficient precision, allowing citizens to foresee the consequences which a given action may entail.[89] While this so-called test of foreseeability does not require that the law stipulates every detail of surveillance, the legal foundation should not give the executive authorities an excessively broad discretion. "The law must indicate the scope of any discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity to give the individual adequate protection against arbitrary interference." [START_REF] White | The European Convention on Human Rights[END_REF] The Court must be satisfied that, whatever system of surveillance is adopted, there exist adequate and effective guarantees against abuse. This assessment has only a relative character: it depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering such measures, the authorities competent to permit, carry out and supervise such measures, and the kind of remedy provided by the national law. [91] When applying these guidelines towards the EUROSUR Regulation the following conclusion can be drawn. Firstly, every inclusion of personal data in the European Situational Picture or the Common Pre-Frontier Intelligence Picture that is not concerning ship identification numbers is illegal, since there is no legal foundation.[92] However, there are sufficient safeguards in place for personal data concerning ship IDs. Secondly, personal data in the National Situational Picture is hardly safeguarded in the regulation, since the only provision concerning the protection of personal data is a general cross reference to European and national provisions on data protection. Consequently, there are no EUROSUR specific safeguards in place. This, however, appears as a surprise, since the Commission stated in 2008 that:

The processing of personal data within the context of EUROSUR must therefore be based on appropriate legislative measures, which define the nature of the processing and lay down appropriate safeguards. [93] Furthermore, the Commission was encouraged in this endeavour by the Article 29 Working Party, which states that even the exchange of personal data to a limited extent would require specific boundaries concerning the scope and categories of personal data, and its limited use and retention.[94] Moreover, the possibility that personal data is processed in the common application of surveillance tools is not mentioned once in the regulation. As a result, it has to be concluded that the limitations to the right of privacy based on the EUROSUR Regulation cannot be justified due to the vagueness of the provisions and the lack of safeguards. As it has been explained above, the data sources and recipients are specified in non-exhaustive lists, the information exchanged is only described vaguely, there are no specific safeguards or remedies, and all relevant decisions are made by the executive authorities in the Member States or Frontex without any direction provided by the regulation. Consequently, the EUROSUR Regulation is not formulated precise enough to qualify as justifying law. In this context it also has to be noted that the legal basis for EUROSUR was negotiated after or at least parallel to the creation of the system. After running pilot projects between 2008 and 2011 by year-end of 2012 Frontex signed a Memorandum of Understanding with 18 Member States and connected them to EUROSUR, one year prior to the adoption of the regulation.

The Essence of Fundamental Rights and Legitimate Aims

Furthermore, it is questionable if the regulation respects the essence of the right to privacy and data protection as required by Art. 52 (1) EUFRCh. European data protection organisations have declared that:

The monitoring of travellers has to be well founded and can only be allowed in exceptional cases and for justified and specific purposes. Any general surveillance poses unacceptable risks to the freedom of individuals. [95] From its analysis, the Working Party concludes that secret, massive and indiscriminate surveillance programs are incompatible with our fundamental laws and cannot be justified by the fight against terrorism or other important threats to national security. [96] Nonetheless, EUROSUR does not include a targeted surveillance of people entering Europe, but rather a surveillance of specific areas. Furthermore, the surveillance does not interfere with the core personal sphere but rather with individuals in public or in transit. "Such an individual in transit may well expect a lesser degree of privacy, but not expect to be deprived in full of his rights and freedoms as also related to his own private sphere and image." [97] As EUROSUR does not deprive individuals fully of their privacy, it does respect the essence of their data protection right.

Furthermore, the purposes of EUROSUR of "detecting, preventing and combating illegal immigration and cross-border crime and contributing to ensuring the protection and saving the lives of migrants" [98] are legitimate aims (national security, public safety, prevention of crime, amongst others).

Necessary in a Democratic Society

Last but not least, the interference has to be necessary in a democratic society. According to the jurisdiction of the ECtHR this necessity test consists of two elements: [99]  Does the interference correspond to a pressing social need?  Is the interference proportionate to the legitimate aim? / Is the interference no greater than necessary to address the pressing social need?

Therefore, each of the purposes has to constitute a current pressing social need. While the European Union has a certain margin of appreciation in determining pressing social needs, there has to be at least factual evidence that an issue exists that needs to be addressed with a view to protecting public security. Furthermore, EUROSUR actually has to contribute to tackling the issue.

In general, it cannot be questioned that an effective management and control of the external borders of the European Union is necessary and a social need. Nonetheless, justification of interferences with fundamental rights requires that the tool in question corresponds to a specific issue which requires an urgent response.

According to the EUROSUR Regulation and the correlating documents the main goal of EUROSUR is to combat irregular migration into the EU, while the prevention of loss of life at sea as well as fighting cross border crime are only added advantages.

[100] However, already in 2008when the EUROSUR Regulation was firstly initiatedthe European Data Protection Supervisor criticised the proposal for the lack of evidence of the necessity and the lack of evaluation of existing systems.

[101] In the following years, the relevant authorities have neither responded to the existing criticism nor have they considered the changes in migration flows. Consequently, several arguments can be produced that question the necessity of EUROSUR.

Firstly it seems that the European Union has a disproportionate focus on irregular arrivals by land and sea.

[102] Statistics show, that only a very small percentage of migrants enter Europe irregularly by sea or land, while the majority of migrants without the required documents overstay their visas. [103] Furthermore, it has to be considered, that a vast majority of the migrants arriving by sea are in the need of protection and apply for asylum or another form of protection. [104] In this context it also has to be stressed, that within the European Union irregular migration is still considered a security problem and linked to terrorism and cross border crime. [105] Similarly does the term 'illegal migration'as used in the EUROSUR Regulationsuggest that irregular migration is a criminal offence in line with human trafficking. Nonetheless, the UNHCR[106] has emphasised repeatedly that irregular migration does not constitute a criminal offence and that the 1951 Geneva Convention[107] explicitly prohibits penalties relating to the illegal entry of refugees. Moreover, the terminology is not only regrettable, [108] but "defining persons as illegal can also be regarded as denying their humanity" [109] and challenging their fundamental rights as human beings. Consequently, the issue of irregular migration should not be approached with the same means as the smuggling of humans or contraband. Furthermore, there is no reliable data linking irregular migration to terrorism or proving that the majority of those entering irregularly are serious criminals [110] and the perception of 'migrant criminality' is wrong in most cases. [111] Secondly, the statistics of the last decade have shown, that the number of migrants entering into Europe is decliningexcept a short incline resulting from the Arab spring and ongoing civil unrest and war. [112] Nonetheless, the proposal for the EUROSUR Regulation from 2008 has not been abandoned or changed. Furthermore, it is unlikely that migration will be stopped by reinforcing border control or other border management measures. So far statistics have proven that increased surveillance or control measures in one area of the border do not result in a cease of migration but in a shift of migration routes, and consequently longer and more dangerous trips for migrants.[113] Furthermore, experiences have already been made with a large-scale high-tech surveillance network (SBI-net) at the border between Mexico and the US since 2006. As a result, the funding of the project was frozen in 2010 and the initiative consequently stopped and seriously altered since the project in its original form did neither meet its capacities nor provide the authorities with the necessary assistance. [114] According to the Commission EUROSUR will also affect the fight against serious crime in Europe, since "criminal networks involved in the smuggling of migrants are often using the same routes and methods for cross-border crime activities, such as trafficking in human beings, illicit drug trafficking, illicit arms trafficking, trafficking in radioactive and nuclear substances, and terrorism." [115] While the linkage between migrants and terrorism has already been discussed above, the described 'use of the same routes' can also be questioned. Since 2003 testimonies of arriving migrants show that normally one of the migrants themselves operates the vessel. [116] Due to increased surveillance and interceptions and a heightened risk of being arrested on sea or upon arrival smugglers are hardly ever on board of the boats. [117] Moreover, it has to be stressed that so far the UN Smuggling Protocol, which is part of the Organised Crime Convention, has never been invoked as legal basis for interceptions during Frontex missions. Therefore, it seems not only questionable that these routes are also used for the trafficking of other goods but also that any arrests would be foreseeable. In the context of serious cross border crimes it further has to be mentioned that abetting or facilitating 'illegal' immigration, which carries a penalty of up to 15 years imprisonment in Italy, is also applied to fishermen or other sailors who render assistance to migrant boats. [118] The Cap Anamur case[119] and other cases proved that even though the law contains an exemption if assistance is given to those in need, the exemption is applied restrictively and that it is not clear if it is also valid in cases where the assistance is given outside of the Italian territorial waters. [120] Finally, it is questionable how much EUROSUR can actually contribute towards protection and saving the lives of migrants. [121] While the high number of migrants' deaths on the way to the Europe is caused in various waysincluding suffocation in trucks, car accidents, frostbite, police violence, hunger strikes, landmines, or suicide in detention[122]the majority loses their lives at sea. Even though the Mediterranean Sea is already one of the closest surveilled maritime spaces in the world, it is estimated that since the mid-1990s at least 20.000 migrants have died there. [123] Consequently, organisations such as the International Federation for Human Rights consider not the lack of information responsible for the death toll at European borders but rather the lack of legal possibilities to reach Europe, the shifting towards more hazardous routes, the reluctance of patrol and fishing vessels to render assistance, the conflicts over search and rescue responsibilities, and the unwillingness of the EU to tackle the root causes of migration.[124] Yet, besides a general statement to contribute towards search and rescue of migrants in distress, the EUROSUR Regulation does not entail any provisions on how exactly this contribution will look like. Currently there are no official procedures detailing how to proceed after a distress-call nor is there an obligation to include national authorities responsible for search and rescue into EUROSUR or the NCC. [125] Additionally, it has to be stressed that surveillance measures on their own are not capable of saving lives. This can be illustrated by a report from a Major of the Maltese Armed Forces in front of the UK House of Lords: After a distress call of a vessel a Maltese aircraft was send to the scene but after some time "the aircraft was withdrawn for refuelling and sent again to the position. On arriving it did not find a boat either in the position where it had been initially sighted nor within a substantial radius around it." [126] In conclusion, the UN Special Rapporteur on the human rights of migrants "fears that EUROSUR is destined to become just another tool that will be at the disposal of member States in order to secure borders and prevent arrivals, rather than a genuine life-saving tool." [127] In sum, the introduction of the EUROSUR does not seem necessary in a democratic society. While the aims of the regulation are comprehensible, the accompanying documents do not show how EUROSUR will be able to contribute towards achieving these goals. Furthermore, there is no hard evidence that an additional surveillance tool is necessary at the European borders. Neither the proposal of the EUROSUR Regulation nor the following documents have evaluated the already increased surveillance and interception operations of Frontex, the intensified cooperation of Member States in regional networks and with third countries, or the decrease of migrants. However, this would have been necessary to prove that additional measures were necessary in 2008 and still are.

Finally, each interference has to be proportionate, meaning that an interference should not be greater than necessary. From the regulation itself as well as from the accompanying documents and press releases it can be concluded that the EU deems the collection, storage and exchange of personal data generally as not necessary for achieving the goals of EUROSUR. Consequently, the current version of EUROSUR is not proportionate since it gives the actors the possibility and the legal grounds to process personal data. Several properties of the current user interface as well as the common application of surveillance tools could have been implemented less intrusive by following a privacy-by-design approach. Furthermore, this would have limited the possibilities of misuse. The current regulation obliges Member States and Frontex to process data in accordance with the European and national provisions on data protection. However, it does not foresee any specific legal, organisational or technical safeguards. Nonetheless, in particular the latter one would have been desirable, since it can already be observed in the context of border control management "that where strong human rights standards are incorporated into European Union policy and legislation, there is often a wide discrepancy between the texts and member-State implementation." [128] In conclusion, the interference by the current EUROSUR system is greater than necessary since a more privacy protecting version seems possible.

Conclusion

A more privacy protecting system and regulation would have to observe the following recommendations. Firstly, the regulation should include provisions outlining the exceptional reasons and circumstances in which the processing of personal data is permitted as well as which data will be collected and shared. Furthermore, it should exhaustively list all data sources. This list should result from a thorough evaluation of each source under necessity considerations which should be included into the accompanying documents of a new regulation. A similar procedure is advisable for the recipients of data. Moreover, after the actual exchange of data, the recipients -European and national authoritiesshould be recorded in the system itself. Additionally, the inclusion of obligatory deletion deadlines as well as organisational and technical measures to protect the personal data is necessary. Concerning the system itself, the EU should abstain from using free text boxes to prevent misuse. Furthermore, the possibility to add historical or photographic information to an incident should be abandoned, since it increases the likelihood of persons being identified via the system. Moreover, when applying common surveillance tools, the possibility to identify individuals should be precluded. Therefore, no sensors or cameras should be used that provide a high resolution or zoom capabilities enabling the identification of persons from the recorded images. These improvements could contribute towards a regulation that is more compliant with the right to privacy not only in consideration of the proportionality requirement but also under the aspect of the precision of the legal foundation. Nonetheless, even these improvements will not resolve the issues regarding the necessity of a new surveillance system at the European borders. Furthermore, this paper analysed EUROSUR only from a privacy protection point of view and all the existing issues concerning other fundamental rights of migrants have been left aside.

While there are currently no drones securing European borders, Baroness Ludford was, nevertheless, right, when she warned about the route the European Union is taking in the context of border management. The EUROSUR Regulation is just one of the examples that prove that due to security concernsjustified or notthe Member States are willing to neglect fundamental rights when balancing these competing interests. Furthermore, it shows that the tragedies of irregular migrants at sea are often used as an excuse for interfering with fundamental rights of refugees, asylum seekers, migrants as well as 'normal' travellers. While the deaths at sea of countless migrants are disgraceful for Europe it is very questionable that EUROSUR will improve this situation. Therefore, the criticism of the International Federation for Human Rights seems justified in the context of privacy protection, when they were stating:

The deaths in Lampedusa, like those from yesterday and from tomorrow, are the victims of a Europe that is locked to the point of obliviousness into a securitarian logic, which has renounced the values that it claims to defend. [129]