CODE BLUE (29-30 October 2020) is an international conference where the world’s top information security specialists gather to give cutting edge talks, and is a place for all participants to exchange information and interact beyond borders and languages. As technology and society move forward and IoT (Internet of Things) is becoming a reality, security is increasingly becoming an urgent issue. The Internet world also needs to gather researchers to collaborate and think together about ways to respond to emergency situations, and come up with possible solutions. CODE BLUE aims to be a place where international connections and communities form and grow, and will contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans).
This year, Dr Audrey Guinchard (Senior Lecturer in Law, University of Essex) gave a keynote on ‘Reforming cybercrime legislations to support vulnerability research: the UK experience and beyond’.
Cybercrime legislations – or hacking laws- tend to be notoriously broad, resting on a set of assumptions about what ‘unauthorised access’ means, assumptions which hardly match those of the technical or ethical fields. The result is that the offences of unauthorised access and misuse of tools have the potential to criminalise most aspects of legitimate vulnerability research (discovery, proof of concept, disclosure). Independent security researchers are notably at risk of criminal prosecution as they work, by definition, without vendors’ prior authorisation.
The UK is a particular case in point, having drafted its original Computer Misuse Act 1990 in such a way that even switching a computer on can constitute unauthorised access. Further reforms in 2006 and 2015 have expanded even more the scope of the legislation by modifying or adding other offences as broad in scope as the original ones. While the UK is in that respect an outlier, the EU Directive 2013/40/EU on attacks against information systems as well as the Convention on cybercrime n.185 (which is de facto the international treaty) are not without their own weaknesses, despite serious and effective efforts to restrict the scope of criminal law and protect security researchers.
Prosecution guidelines or a memorandum of understanding between the security industry and prosecutorial authorities are a welcome step to avoid outlandish prosecution of security researchers, but I argue that they are not sufficient to protect them once a prosecution starts. Their motive (and the methods used) to improve security will not constitute a legal argument unless a public interest defence exists.
Hence, Audrey’s proposal to reform the cybercrime legislations (UK, EU and the Convention) by incorporating a public interest defence to cybercrime offences, in particular to the ‘hacking’ offence (unauthorised access). Momentum is certainly gathering in the UK. The Criminal Law Reform Now network (CLRNN) has now released a comprehensive study of the UK Computer Misuse Act with a series of recommendations. It is time to make cybercrime legislations fit for the 21st Century, to borrow the slogan of a significant part of the security industry in the UK endorsing the report and the reform.
To read some of Dr Guinchard’s research papers which formed the background of this research, please see here and here.
An Essex legal expert has been recognised in the Queen’s Birthday Honours for her work on internet safety.
Professor Lorna Woods, from our School of Law, has been working since 2017 with William Perrin of the Carnegie UK Trust to develop a workable solution to ‘online harms’, a term that covers a range of internet safety issues. Professor Woods and Mr Perrin are to both receive OBEs.
Professor Woods said: “I am delighted, if a little surprised, by this honour. I’d like to thank Will, of course, but also Maeve Welsh and everyone at the Carnegie UK Trust – without their support, we would not have been able to develop our approach further or undertake the vital, ongoing engagement with those working in this area.
“Recent events have raised new concerns about the role of social media. The need for a statutory duty of care, overseen by an independent regulator, is not going away. In fact, it is more urgent than ever. We look forward to publication of the promised Online Harms Bill, and its consideration in this parliament.”
In October 2017, Professor Woods and Mr Perrin sat down to review the just-published Green Paper on Internet Safety Strategy.
Near-daily stories of bullying, self-harm and extremism had created a febrile debate. The challenge? To reset the online world and reduce the risk of harm.
The pair agreed the government response was inadequate. Drawing on their experience of the sector, they consulted with a range of actors, researched models already in use and started to write.
Across seven co-authored blogs, completed between February and May 2018 (and subsequently collected into a report, with funding from The Carnegie UK Trust), they sought to shift the debate from ”publishing” and the removal of specific content, to harm prevention, developing a detailed plan involving a statutory duty of care, overseen by an independent regulator.
The duty of care approach re-casts social media as a series of “public or quasi-public spaces”. In creating these spaces, the providers’ goal must be not maximising profit, or engagement, but user safety. The more vulnerable an audience, the greater the responsibility.
At a time of significant public concern, their research has been a game-changer, offering a workable solution, inspiring a national newspaper campaign, rallying civil society groups and influencing lawmakers, at home and abroad.
In December 2019, they published their own draft Online Harm Reduction Bill, to maintain momentum. The draft bill was endorsed by organisations including the NSPCC, 5Rights Foundation, The Institute for Strategic Dialogue and the Royal Society of Public Health.
In January 2020, the authors and the Carnegie UK Trust also supported Lord McNally in the preparation of a short paving Bill to require Ofcom to prepare for the introduction of an Online Harms Reduction Regulator. The paving Bill was introduced into the Lords on 14 January 2020 and is currently awaiting a second reading.
Four Essex graduates have also been recognised in this year’s Queen’s Birthday Honours:
Dr Philip Orumwense (MA Political Behaviour, 1991) will receive a CBE for public service. Philip was Commercial Director of IT at Highways England and is recognisesd for his work across the public sector.
Sir David Attenborough (Honorary Graduate), has received a GCMC for his services to broadcasting and conservation.
Miss Carrie Anne Philbin (BA History, 2002) has received an MBE for services to education, championing diversity and inclusion in computing.
Ms Clare Woodman (BA Government & Sociology, 1989) has received a CBE for services to finance in her role as Head of EMEA and CEO of Morgan Stanley & Co. International PLC.
This story originally appeared on the University of Essex news webpage and is reproduced here with permission and thanks.
Lorna Woods, Professor of Internet Law, University of Essex
Background
This case concerns the collection of bulk communications data (BCD) from network operators by the security and intelligence agencies (SIAs). It formed part of an action brought by Privacy International challenging the SIAs’ acquisition, use, retention, disclosure, storage and deletion of bulk personal datasets (BPDs) and BCD which started in 2015 before the Investigatory Powers Tribunal (IPT). Privacy International’s claim is based on its understanding of the safeguards required by the Court of Justice in Tele2/Watson – a 2016 CJEU judgment on UK data retention law, discussed here.
In Tele2/Watson the Court of Justice held that any data retention obligation must be targeted and limited to what is strictly necessary in terms of the persons affected, the sorts of data retained and the length of retention. It also suggested that access to retained data should be subject to prior review by an independent body and that parties affected should be informed of the processing (unless this would compromise the investigations); and that the data should be retained within the EU. The authorities must take steps to protect against misuse of data and any unlawful access to them. Privacy International argued that the safeguards provided by British law are insufficient. The British government claimed that the SIAs’ activities fell outside the scope of EU law and that the rules were compliant with Article 8 ECHR. It argued that providing the safeguards as required by Tele2/Watson would undermine the ability of the SIAs. The IPT referred two questions – but only in relation to BCD not BPD – to the Court of Justice. This was the basis for the Court’s judgment handed down yesterday.
Questions in Issue
The two questions referred were:
whether the activities of the SIAs fall within the scope of EU law bearing in mind Art 4 TEU and Art 1(3) of Directive 2002/58 (ePrivacy Directive);
if the answer is that the situation falls within EU law, do any of the “Watson Requirements” (as above) (or any other requirements) apply?
The Court of Justice decided to deal with this case with two other cases that had been referred to it: Joined cases C-511/18 and C-512/18 La Quadrature du Net & Ors and Case C-520/18 Ordre des barreaux francophones et germanphone & Ors, which were also the subject of a separate judgment yesterday. The cases also dealt with the bulk collection of communications data but in addition the court in La Quadrature du Net also asked whether real-time measures for the collection of the traffic and location data of specified individuals, which, whilst affecting the rights and obligations of the providers of an electronic communications service, do not however require them to comply with a specific obligation to retain their data are permissible. It also asked whether the Charter required persons concerned by surveillance to be informed once such information is no longer liable to jeopardise the investigations being undertaken by the competent authorities, or may other existing procedural guarantees which ensure that there is a right to a remedy suffice? Ordre des barreaux francophones et germanphone & Ors raised the question of whether a general obligation might be justified to identify perpetrators of secual abuse of minors. If national law has not usfficiently guaranteed human rights may the effects of that law be temporarily retained in the interests of certainty and to achieve the objectives set down in the law.
The Advocate General handed down separate opinions on each of the cases (see here, here and here) but all on the same day (15 January 2020) to similar effect, that:
the e-privacy directive (and EU law in general) applies in this situation because of the required co-operation of private parties;
limitations on the obligation to guarantee the confidentiality of communications must be interpreted narrowly and with regard to the rights in the EU Charter on Fundamental Rights;
the case law in Tele2/Watson (summarised above) should be upheld: general and indiscriminate retention of traffic and location data of all subscribers is an interference with the fundamental rights enshrined in the Charter but real-time collection of traffic and location data of individuals suspected of being connected to a specific terrorist threat could be permissible provided it down not impose a requirement on communications service providers to retain additional data beyond that which is required for billing/marketing purposes; and that the use of such data for purposes less serious than the fight against terrorism and serious crime was incompatible with EU law.
Note that there are two more cases pending Case C-746/18 H.K. v Prokurator (Opinion handed down by AG Pitruzzella 21 Jan 2020) as well as references from Germany from 2019 and Ireland from 2020.
Summary of Judgment
Privacy International
In its Grand Chamber judgment, the Court confirmed that requirements on communications service providers to retain data fell within the scope of EU law and specifically the e-Privacy Directive. The Court argued that the exclusion in Article 1(3) e-Privacy Directive related to “activities of the State or of State authorities and are unrelated to fields in which individuals are active” (para 35, citing Case C-207/16 Ministerio Fiscal, discussed here, para 32), whereas Art 3 makes clear that it regulates the activities of communications service providers. As held in Ministerio Fiscal, the scope of that directive extends not only to a legislative measure that requires providers of electronic communications services to retain traffic data and location data, but also to a legislative measure requiring them to grant the competent national authorities access to that data.
The legislative measures, permissible as a derogation under Article 15, “necessarily involve the processing, by those providers, of the data and cannot, to the extent that they regulate the activities of those providers, be regarded as activities characteristic of States” (para 39). given the breadth of the meaning of ‘processing’ under the GDPR, the directions made under s 94 Telecommunications Act fall within the scope of the ePrivacy Directive. The Court re-affirmed (para 43) the approach of its Advocate General in this case (and in La Quadrature du Net) that ‘activities’ in the sense of Art 1(3) cannot be interpreted as covering legislative measures under the derogation provision; to hold otherwise would deprive article 15 of any effect (following reasoning in Tele2/Watson) and Article 4(2) TEU does not disturb that conclusion (despite the Court’s reasoning in the first PNR case (Cases C-317/04 and C-318/04, paras 56 to 59). For the e-Privacy Directive (by contrast to the former Data Protection Directive in issue in the PNR case), what is important is who does the processing; it is the communications providers. The Court took the opportunity to confirm that the GDPR should not be interpreted the same way as the Data Protection Directive but in parallel with the e-Privacy Directive.
As regards the second question, the Court re-stated the scope of s. 94 orders thus:
That data includes traffic data and location data, as well as information relating to the services used, pursuant to section 21(4) and (6) of the RIPA. That provision covers, inter alia, the data necessary to (i) identify the source and destination of a communication, (ii) determine the date, time, length and type of communication, (iii) identify the hardware used, and (iv) locate the terminal equipment and the communications. That data includes, inter alia, the name and address of the user, the telephone number of the person making the call and the number called by that person, the IP addresses of the source and addressee of the communication and the addresses of the websites visited.
Such a disclosure of data by transmission concerns all users of means of electronic communication, without its being specified whether that transmission must take place in real-time or subsequently. Once transmitted, that data is, according to the information set out in the request for a preliminary ruling, retained by the security and intelligence agencies and remains available to those agencies for the purposes of their activities, as with the other databases maintained by those agencies. In particular, the data thus acquired, which is subject to bulk automated processing and analysis, may be cross-checked with other databases containing different categories of bulk personal data or be disclosed outside those agencies and to third countries. Lastly, those operations do not require prior authorisation from a court or independent administrative authority and do not involve notifying the persons concerned in any way.
Paras 51-52
The Court stated that the purpose of the e-Privacy Directive was to protect users from threats to their privacy arising from new technologies. It ‘gave concrete expression to the rights enshrined in Articles 7 and 8 of the Charter’ (para 57) and the exceptions thereto under Article 15(1), ie necessary, appropriate and proportionate in the interests of purposes listed in Art 15(1): national security, defence and public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system. The exceptions cannot permit this exception to become the rule (citing Tele2/Watson, but also the ruling in La Quadrature du Net). Restrictions must also comply with the Charter. This is the same whether the legislation requires retention of the transmission of data to third parties (citing EU-Canada PNR Agreement, discussed here, paras 122-123). Drawing on Schrems II, discussed here, the Court held:
any limitation on the exercise of fundamental rights must be provided for by law implies that the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned.
Para 65
It also re-iterated that derogations from the protection of personal data any restriction on confidentiality of communications and traffic data may apply only in so far as is strictly necessary and “by properly balancing the objective of general interest against the rights at issue’ (para 67). Proportionality also requires the legislation to lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, to protect effectively against the risk of abuse. The legislation must set down conditions for the application of the measures so as to restrict them to those ‘strictly necessary’; the legislation must be binding. Automated processing gives rise to greater risks. These considerations are the more pressing in the context of sensitive data.
The Court noted that the transmission of data to SIAs constituted a breach of confidentiality in a general and indiscriminate way and thus:
has the effect of making the exception to the obligation of principle to ensure the confidentiality of data the rule, whereas the system established by Directive 2002/58 requires that that exception remain an exception.
Para 69
it also constitutes an interference with Articles 7 and 8 of the Charter, no matter how the data are subsequently used. Re-iterating its approach in EU-Canada PNR Opinion, the Court stated that:
it does not matter whether the information in question relating to persons’ private lives is sensitive or whether the persons concerned have been inconvenienced in any way on account of that interference.
Para 70
Here, given the potential to create a personal profile of individuals the intrusions was particularly serious and “no less sensitive than the actual content of communications” (para 71). The court also emphasised the impact of the feeling of being under constant surveillance, following its reasoning in Digital Rights Ireland (discussed here) and Tele2/Watson. Such surveillance may have an impact on freedom of expression, especially where users are subject to professional secrecy rules or are whistleblowers. The Court also note that given the quantity of data in issue, their “mere retention” entails a risk of abuse and unlawful access (para 73).
The Court distinguished between ‘national security’ understood in the light of Article 4(2) TEU and ‘public security’ and matters within Article 15 ePrivacy Directive. While measures safeguarding national security must still comply with Art 52(1) of the Charter, given the seriousness of threats comprised in ‘national security’ in principle the objective of safeguarding national security is capable of justifying more intrusive measures that those would could be justified by other objectives (cross referring to its reasoning in La Quadrature du Net).
Even in relation to national security, the underlying national legislation must also lay down the substantive and procedural conditions governing use of the data and not just provide for access. National legislation must rely on objective criteria in order to define the circumstances and conditions under which the competent national authorities are to be granted access to the data at issue. Here, the national legislation requiring providers of electronic communications services to disclose traffic data and location data to the security and intelligence agencies by means of general and indiscriminate transmission exceeds the limits of what is strictly necessary and cannot be considered to be justified, within a democratic society even in the interests of protecting national security.
La Quadrature du Net/Ordre des barreaux francophones et germanophone
The Court’s approach to Article 15 and the sorts of activities in the service of which surveillance may be undertaken by contrast with Article 3(1) was, unsurprisingly, the same as can be seen in Privacy International, as was its approach to interpreting the directive – emphasising the confidentiality of communications as well as Articles 7 and 8 EU Charter. Again, the Court took the approach that the exception to communications confidentiality should not become the rule and that exceptions must be strictly necessary and proportionate to their objectives. Retention of communications data is a serious interference with fundamental rights – including freedom of expression. The retention of the data constitutes such an interference whether or not the data are sensitive or whether the user was inconvenienced.
In similar terms to Privacy International, the Court again came to the conclusion that the general and indiscriminate retention of data was impermissible under the Charter and Article 15. The Court also re-stated the limitations on derogating measures made under Art 15. The point of difference in this analysis is that the Court recognised the conflicting rights that might need to be reconciled – particularly with regard to crimes against minors and the State’s positive obligation to protect them. This does not mean that the limits as regards necessity and proportionality may be overlooked.
The Court then considered the meaning of national security – approaching the matter in the same terms as it did in Privacy International. This higher threshold meant that neither the directive nor the Charter precludes recourse to an order requiring providers of electronic communications services to retain, generally and indiscriminately, traffic data and location data. This however is only so when the Member State concerned is facing a sufficiently serious threat to national security (which includes matters more serious than those listed in Art 15), a threat that is genuine and actual or foreseeable. In such a case retention can only be for a period of time limited to that which is strictly necessary. If any such order is to be renewed it must be for a specified length of time. The retained data must be protected by strict safeguards against the risk of abuse. The decision must be subject to effective review by an independent body (court or administrative), whose decision is binding, in order to verify that such a situation exists and that the conditions and safeguards laid down are observed.
The Court observed that general and indiscriminate surveillance refers to that which covers virtually all the population. The Court recognised the duties of the State under positive obligations and the need to balance potentially conflicting rights. It then held that in situations such as those described at paras 135-6 of its judgment, that is those falling in Article 4(2) TEU, the e-Privacy Directive and the Charter do not preclude measures for targeted retention of traffic and location data. Such measures must be limited in time to what is strictly necessary, and focused on categories of persons identified on the basis of objective and non-discriminatory factors, or by using geographical criteria. It then relied on similar reasoning in relation to the fight against crime and the protection of public safety.
Similarly, IP addresses may be retained in a general and indiscriminate manner subject to a requirement of strict necessity. Further, the directive also does not preclude the retention of data beyond statutory data retention periods when strictly necessary to shed light on serious criminal offences or attacks on national security, when the offences or attacks have already been established, or if their existence may reasonably be suspected. Real-time data may also be used when it is limited to people in respect of whom there is a valid reason to suppose that they are involved in terrorist activities. Such use of data must be subject to prior review by an independent body to ensure that real-time collection is limited to what is strictly necessary. The Court notes that in urgent cases that the review should take place promptly (presumably rather than after the event).
Finally, a national court may not apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality which declaration the national court must make in respect of national legislation due to incompatibility with the e-Privacy Directive, and evidence obtained illegally should not be relied on in court.
Comment
The common theme across the cases was the acceptability of the retention and analysis of communications data generally. The Court has re-iterated its general approach, unsurprisingly linking – as the Advocate General also did – between the Privacy International ruling and that in La Quadrature du Net. In its approach, the Court relied generously on its previous rulings, which demonstrates that there is quite a thick rope of cases, all to broadly the same effect. While the Court based its ruling on the ePrivacy directive (which is specific to communications and communications data), it also based its ruling more generally on Articles 7 and 8 of the Charter. It is noteworthy that the Court did not just refer to its case law on communications data but also to the Canada PNR opinion, underlining that there is a similar approach no matter the type of data in issue. The Court also relied on Schrems II, implicitly confirming aspects of its approach there and embedding that decision in its jurisprudence. The underlying concern in Schrems II was the same as here: that is, data collected by private actors are accessed by state actors. In sum, even in the interests of national security, general and indiscriminate surveillance does not satisfy the test of strict necessity and proportionality. While its general approach might be similar to what has gone before, there are still some points of interest and new ground covered.
The IPT seems to have been the only court amongst those making references that still has not accepted that the retention of data falls within the scope of the e-Privacy Directive, relying on the reasoning of the Court on the Data Protection Directive in relation to passenger name records in an early case. In addition to re-establishing the well-trodden principles regarding the impact of requiring electronic service providers to retain data bringing the entire scheme within scope of the e-Privacy Directive, and different functions of Article 1(3) (scope of directive) and Art 15 (derogation from directive), the Court took the opportunity to say something about the scope of the GDPR, the successor legislation to the Data Protection Directive. In effect, the Court has stopped the line of reasoning found in that early PNR judgment – it cannot be used to determine the scope of the GDPR which should be understood in line with Art 1(3) of the e-Privacy Directive.
The Court has emphasised a couple of aspects of the legal regime surrounding surveillance that are worth a second look. Firstly, while the Court says nothing about the form of law on which a surveillance may be based, in its analysis of Article 52(1) Charter it does say that the same law must contain the constraints. The principle then has wider application than just communications data. This raises questions about forms of surveillance rolled out by the police based on broad common law powers, or – as in the recent Bridges decision – in a mix of legislation, common law and code. These sorts of surveillance – although in public – may also give rise to a feeling of being subject to constant surveillance, though the Court’s jurisprudence on video-surveillance under the GDPR has not yet grappled with this issue. It may be, however, that the Court would take a different view on the extent to which ‘private life’ would be engaged in such circumstances. It is also worth noting that the views of the independent body must be binding on the SIAs; this reiterates the point that in principle approval must be sought in advance.
The Court also made clear that the rights in issue are not just privacy and data protection; it specifically referred here to freedom of expression and flagged the distinctive of those under professional duties of confidentiality (doctors, lawyers) and whistleblowers. It did not, however, consider whether any infringement was justified in this context. The list of possible rights affected is not limited to freedom of expression: in Schrems II the Court highlighted the right to a remedy. It is not inconceivable that the right to association could also be affected. Presumably the same points of analysis apply – that general and indiscriminate monitoring cannot be justified even in the interests of national security. The Court also recognised, in La Quadrature du Net, the positive obligations on the State in relation to Article 3 and 8 ECHR and the corresponding article in the Charter – Articles 4 and 7. The balancing of these positive obligations provided the framework for the Court’s analysis of types of surveillance that did not immediately fall foul of its prohibition of of general and indiscriminate data retention. In this context, it might almost be said that the Court is reformulating public interest objectives (such as national security or the fight against sexual abuse of children) as positive obligations and thus bringing them in a rights balancing framework.
The Court’s reasoning in both cases also gave us some insight into the meaning of national security. It is distinct from and covers more serious issues that the objectives listed in Art 15. While this in principle seems to allow more intrusive measures to be justified, it seems that the Court has limited the circumstances of when it can be used. It does not overlap seemingly with those grounds in Article 15 e Privacy Directive. So, even might be argued reading this part of the judgments that serious crime cannot be blurred with national security. The devil will be in the detail here, a tricky one for any independent body to patrol – and in terms of permitted surveillance it is not clear what the consequences in practice would be.
The headline news, however, must be the ruling of the Court relating to measures that do not fall within the prohibition as general and indiscriminate measures. This on one level is not totally novel; it is implied, for example, in Tele2/Watson, para 106. The questions relate to what level of generality of surveillance would be permissible, and in relation to what sort of objective? Para 137 seems to limit targeted retention of communications data to matters of national security (including terrorism), but the Court then wheels out the same reasoning in relation to serious crime and public safety, and seems to envisage similar safeguards in both cases. This then means that the test of ‘strict necessity’ is doing a lot of work in distinguishing between the legitimate and illegitimate use of surveillance measures. The Court has historically not been particularly strong on what it requires of a necessity test – let alone one requiring strict necessity – in other cases involving the interference with Charter rights.
The final point relates to the procedural questions. The Court was clear that striking down incompatible law cannot have suspended effect. Yet, that is precisely what the English court did in Watson when allowing the UK government several months to get its house in order. The Court of Justice also held here that illegally obtained evidence cannot be used in court, relying on the need to ensure that the rights granted by EU law are effective. While the status of EU law in the British courts may currently be uncertain on the face of it this might mean that convictions based on data between the handing down of Tele2/Watson, or at latest its application by the English courts, until the revision of the regime might be open to challenge whatever the domestic rules on evidence might say. Of course, even if we did not have to deal with the jurisprudential consequences of Brexit, the Court of Appeal, in its approach to Tele2/Watson ignored the aspects of the judgment directed at Tele2 referring court despite the fact that element of the judgment was an interpretation of EU law having general application, so it is to be assumed that still more would it ignore a ruling in a different case altogether.
This post first appeared on the EU Law Analysis blog and is reproduced here with permission and thanks.
Digitisation has enabled access to and availability of cultural heritage to an extent previously unknown and, in addition, it has enhanced preservation and modern research opportunities, e.g. through text mining and data analytics. The availability of and access to cultural materials in digital form can provide significant support to conservation, renovation, research, study and promotion of cultural assets and, in this regard, digital cultural heritage can serve as a resource for education, enjoyment or re-use, including use towards the development of new knowledge. The need for digital transformation has been revealed and become as relevant as ever as a result of the COVID-19 pandemic. Despite its benefits, the digitisation of cultural heritage challenges traditional legal norms, such as copyright law.
In their position paper, they recommend that digitisation should enable preservation of cultural artefacts, including world heritage properties, access to the public, and accessibility by people with special needs and educational institutions.
They also recommend that law and policy should offer further support to cultural institutions towards developing digitisation initiatives (e.g. the legislative framework on orphan works should be revisited in terms of its breadth and parameters of application).
They warn against the creation of digital monopolies (e.g. public domain material should remain in the public domain after digitisation) and urge for the development of legal provisions ensuring the security of computer infrastructure both to safeguard digital culture and avoid the spread of misinformation.
Click below to download a copy of the position paper:
Join us for this online workshop, which aims to bring together scholars to support the development of research.
The purpose of this workshop is to bring together scholars at an early stage in their careers to support the development of research on critical perspectives on global law and the environment. The workshop will be hosted by the School of Law and Human Rights Centre, University of Essex and held entirely online.
The workshop calls for papers that use innovative or (broadly) alternative approaches to the study of the relationship between global law and the environment.
This includes, but is not limited to, perspectives that examine:
North-South dimension of environmental issues, including from a TWAIL, and/or a critical race or post-colonial perspective;
critical perspectives on human rights and the environment;
uses of interdisciplinary methodologies to explore the role of law and the environment;
critical readings of the law in the Anthropocene/Capitlocene/Cthulecene;
relationship between law, environment and capitalism;
indigenous perspectives on the law and the environment;
critical international, transnational and domestic environmental law scholarship;
posthuman and new/neo materialist analyses of law and the environment;
queer theory, gender theory, intersectional theory and the relationship between law and the environment;
eco-centric and earth jurisprudence, including its limitations and critiques.
We warmly welcome papers that explore such questions from an interdisciplinary, theoretical, empirical, and practical perspective.
Applicants and papers from all disciplines are encouraged to apply.
Workshop Format
The workshop will be held via video conference over 2 days, with 8 to 10 papers selected. The workshop will bring together early career academics (up to 5 years post-PhD) and (late-stage) PhD researchers.
Each paper will receive comments and feedback from senior academic(s) as discussant(s), as well as other workshop participants who are expected to have read each other’s papers.
Invited participants will be expected to:
send a full paper (8,000 words) unpublished and not currently under consideration for publication, by 1 April 2021;
to read the papers of the other participants before the workshop and to engage actively in the discussion of the others’ papers.
The best papers presented at the workshop will be considered for a Symposium in the Asian Journal of International Law, subject to the journal’s review process and criteria of having a significant transnational or international component, in line with the journal’s focus.
Keynote Address
Professor Carmen G. Gonzalez, Morris I. Leibman, Professor of Law at Loyola University of Chicago, will deliver a keynote address on the topic of racial capitalism and global environmental law.
Carmen Gonzalez (BA, Yale University and JD, Harvard Law School) is a world-renowned expert in international environmental law, human rights and the environment, environmental justice, and food security.
Recent publications include International Environmental Law and the Global South (Cambridge University Press 2015) and Energy Justice: US and International Perspectives (Edward Elgar Publishing, 2018). She previously taught at Seattle University School of Law.
Submission of Abstracts
Abstracts of no longer than 500 words must be sent for consideration by 1 December 2020.
To submit an abstract, please write to Dr Birsha Ohdedar at b.ohdedar@essex.ac.uk with the subject heading ‘Early Careers Workshop 2021’. Along with your abstract, please include name, affiliation /institution, stage of career (number of years post-PhD, or PhD stage).
Successful applicants will be notified in early January 2021.
By Geoff Gilbert, Professor of International Human Rights and Humanitarian Law, University of Essex, Chair of the Global Academic Interdisciplinary Network
The United Nations Global Compact on Refugees (GCR) of 2018 is a document that tries to embrace all aspects of forcible displacement across international borders in the 21st century. This review of the new EU Pact will focus principally on how it might facilitate solutions for displacement in relation to the GCR, but necessarily there first has to be some more general analysis.
CONSIDERING that the grant of asylum may place unduly heavy burdens on certain countries, and that a satisfactory solution of a problem of which the United Nations has recognized the international scope and nature cannot therefore be achieved without international co-operation.
Nevertheless, it took until the GCR in 2018 to put “flesh” on those bare bones. As figures from UNHCR [accessed 14 September 2020] show, there are 79.5 million displaced persons of concern to UNHCR, of whom 20.4m are refugees and 4.2m are asylum seekers; 73% live in neighbouring countries to those that they have fled, often alongside the 45.7m internally displaced persons (IDPs) who are also of concern to the organisation.[1] Of the top five hosting states, only Germany is in the global north: 80% of displaced persons of concern to UNHCR live in states where there is acute food insecurity and malnutrition.
In these circumstances, where the modal average length of a situation of displacement is around eighteen years, it is little wonder that the development actors play such an important role in the GCR, while UNHCR maintains its unique protection mandate for all refugees, including asylum seekers and returnees without a durable and sustainable solution.
Some aspects of the new EU Pact have a direct impact on how the GCR’s guiding principles and objectives (paragraphs 5 and 7) are to be achieved – as the new Communication on the new Pact (COM(2020) 609 FINAL) states, the EU is the “the world’s major development donor” (p. 18).
As regards durable and sustainable solutions, the traditional three are voluntary repatriation, resettlement or local integration. The GCR recognised a fourth means for responding to displacement, complementary pathways for admission to third countries (paragraphs 94-96). There is, however, language in those paragraphs that indicates that complementary pathways are not durable and sustainable, with references to student scholarships and labour mobility. If the objective is to provide the refugee with the sustainable international protection of a state rather than that upheld by UNHCR under its mandate, then studentships and labour mobility schemes do not offer that guarantee, at least in the first instance, although they may facilitate one of the traditional durable solutions and provide the refugee with the capacity to resolve their own situation.
The new EU Pact and the GCR
It is always worth mentioning that the EU’s approach of joining asylum with migration is fundamentally flawed, regardless of how long they have persisted with it. Asylum is about protection and immigration is about controlling borders.[2]
The idea that the new Pact’s focus should be “a common framework for asylum and migration management at EU level as a key contribution to the comprehensive approach and seeks to promote mutual trust between the Member States” does undermine the primacy of refugee protection (COM(2020) 610 final, 2020/0279 (COD), Proposal for a Regulation of the European Parliament and of the Council on asylum and migration management and amending Council Directive (EC) 2003/109 and the proposed Regulation (EU) [Asylum and Migration Fund] (23 September 2020), p.2).
Nevertheless, in the context of solutions, some aspects of the new Pact may be facilitative (see, C(2020) 6467 final Commission Recommendation of 23.9.2020 on legal pathways to protection in the EU: promoting resettlement, humanitarian admission and other complementary pathways (23 September 2020), Preambular paragraphs 3 and 6). Equally, those elements relating to prevention, development aid and migration as a way to end refugee status and protect the dignity of refugees could be helpful (see COM(2020) 609 final, §§6.2, 6.3, 6.5)
2.1. Prevention
The cynical view within the 1990s was that there was no such thing as post-conflict, just a pause before it was pre-conflict again. Nevertheless, the link between development assistance and prevention is well established and is even built into the responsibility to protect (UNGA Res. 60/1 (2005), paragraph 139).[3]
139 … We stress the need for the General Assembly to continue consideration of the responsibility to protect populations from genocide, war crimes, ethnic cleansing and crimes against humanity and its implications, bearing in mind the principles of the Charter and international law. We also intend to commit ourselves, as necessary and appropriate, to helping States build capacity to protect their populations from genocide, war crimes, ethnic cleansing and crimes against humanity and to assisting those which are under stress before crises and conflicts break out.
The new Pact takes this further and should be read with paragraphs 8 and 9 of the GCR:
8 … In the first instance, addressing root causes is the responsibility of countries at the origin of refugee movements. However, averting and resolving large refugee situations are also matters of serious concern to the international community as a whole, requiring early efforts to address their drivers and triggers, as well as improved cooperation among political, humanitarian, development and peace actors.
In line with the Sustainable Development Goals, the international community, including the EU, should provide development assistance. The new Pact takes a similar line in COM(2020) 609 final §6.3 when it asserts that,
Conflict prevention and resolution, as well as peace, security and governance, are often the cornerstone of these efforts. Trade and investment policies already contribute to addressing root causes by creating jobs and perspectives for millions of workers and farmers worldwide. Boosting investment through vehicles such as the External Investment Plan can make a significant contribution to economic development, growth and employment.
On the other hand, while the new Pact has some useful language regarding long-term prevention through addressing root causes, there are other references that indicate an EU-centric attitude that will not effect global fairness and reduced displacement. In COM(2020) 609 final, §2.4 of the document talks about how “[the] new Asylum and Migration Management Regulation will … improve planning, preparedness and monitoring at both national and EU level”, rather than solidarity with the states in low- or middle-income countries who host 83% of the world’s refugees (UNHCR Global Trends 2019, p.25); as such, the focus once again seems to be on averting another 2015 European asylum crisis that never was a crisis given the wealth of European Union member states and the very limited numbers they were dealing with by comparison with many other low- or middle-income countries.[4]
2.2. Burden- and responsibility-sharing/ Local Integration
Predictable and equitable burden- and responsibility-sharing is fundamental to all of the GCR (paragraph 3). In this particular context, given the protracted nature of most displacement crises and that most displaced persons only cross one border according to the World Bank (Forcibly Displaced, 2017, p.23), supporting the low- or middle-income countries who host most refugees is part of the solution to the crisis. Solutions start from the moment of protection, as human rights and the rule of law protect refugees in the country of asylum.
The traditional durable and sustainable solutions are the endpoint of an international protection framework that is based on resolving the issues to which displacement gives rise: denial of access to education, employment and healthcare, interference with the guarantees the rule of law should offer, and the upholding of human rights. Some of the new Pact targets these problems refugees face during their situations of displacement. COM(2020) 609 final §6.2 states that
… [The] EU is determined to maintain its strong commitment to providing life-saving support to millions of refugees and displaced people, as well as fostering sustainable development-oriented solutions.
Nevertheless, this is a perfect example of why the new Pact might be evidence of hope triumphing over expectation. Niger has provided incredible support to forcibly displaced persons for years,[5] but according to the UNDP Human Development Index for 2020, Niger came 189th out of 189 countries. The EU should not be ‘solving’ forced displacement and providing protection through transfer to one of the poorest countries on the planet.
What is also true, however, is that whether formally or not, lots of forcibly displaced persons remain for protracted periods in the country of asylum and settle there. As will be seen, where voluntary repatriation is not possible, refugees have few options other than to make a new life in the country giving protection. The generosity of many countries of asylum in this regard, though, cannot be abused by the international community and, thus, EU initiatives with respect to development, also indicated in the new Pact, will inevitably play a large part in solutions. According to COM(2020) 609 final §6.3:
The EU is the world’s largest provider of development assistance. This will continue to be a key feature in EU engagement with countries, including on migration issues. Work to build stable and cohesive societies, to reduce poverty and inequality and promote human development, jobs and economic opportunity, to promote democracy, good governance, peace and security, and to address the challenges of climate change can all help people feel that their future lies at home.
It may not be what low- or middle-income countries hoped for during the Formal Consultations on the GCR, but without robust engagement with the source states, which have predominantly remained the same since the 1990s (World Bank, Forcibly Displaced, 2017, p. 23), voluntary repatriation will not resolve displacement crises.
2.3. Resettlement and Complementary Pathways
Resettlement is one of the classic durable and sustainable solutions, but it is less and less available, such that only for the most vulnerable will it provide a means of ending refugeehood. The Commission Recommendation on legal pathways to protection in the EU: promoting resettlement, humanitarian admission and other complementary pathways (C(2020) 6467 final) supports the expansion of resettlement programmes within the EU. But even so its impact on low- or middle-income countries that host so many refugees would still be minimal because the base figure is so low – 107,800 in a mere 26 countries worldwide in 2019 according to UNHCR.
The proposed Recommendation is a positive move by the EU, although the role of the European Asylum Support Office (EASO) alongside UNHCR needs to be further developed. Complementary Pathways are an additional solution listed in the GCR (paragraphs 94-96), but whether they will always be durable and sustainable like the traditional ones is open to question. The Pact deals with one very specific aspect of this in §6.6, the migration control effected through visa requirements for short-term mobility.
The remaining aspects of the proposed Recommendation apply equally to resettlement and complementary pathways. The aim of trying to ensure that forcibly displaced persons do not have to resort to irregular migration or even people smugglers is to be commended (§6.6, new Pact), but unless that reflects effective access rather than simply top slicing particular refugees based on limited skill sets that only suit EU member states (see paragraphs 19 and 21 of the Recommendation), then no noticeable change will take place. It will also reduce the skill-base in the country of nationality for when transition towards peace and stability can commence.
To start, resettlement is a humanitarian response that benefits refugees and the countries of first asylum, usually low- or middle-income countries, it is not a means by which to “match people, skills and labour market needs through legal migration” (§6.6, new Pact). That might be applicable to complementary pathways, but not resettlement as is clear from the Pact’s own description of the Union Resettlement and Humanitarian Admission Framework Regulation. The Pact also encourages broader community engagement with resettlement programmes that again reflects positive aspects of the GCR. (see paragraph 91 read in the light of paragraphs 33-44).
2.4. Voluntary repatriation
Often spoken of as the most desired solution by refugees and countries of asylum, voluntary repatriation relies on restoration of human rights and rule of law in the country of nationality, along with substantial development initiatives. UNHCR can ensure that voluntary repatriation does lead to durable and sustainable solutions for returning refugees through monitoring, but the international community as a whole will provide the framework.
The EU has a major role to play in peace building and conflict resolution, not only as regards addressing the root causes, not just vis-à-vis prevention, but also to encourage voluntary repatriation (§6.3). While there is much in the new Pact on the economic initiatives and on return programmes where people do not require protection, more on restoring human rights, rule of law and good governance would have been welcome.
Conclusion
The Pact on Migration and Asylum has once again missed the opportunity to put the EU at the forefront of resolving the global displacement crisis. It focuses on internal EU concerns and aims at pushing the problem away, often with a cynical reference to how that will protect so many from the dangers they might face in trying to reach Europe. When only 17% of persons of concern to UNHCR were in high-income countries in 2019, the need to support low- or middle-income countries and to offer enhanced protection and assistance to refugees should have been the outward-looking drivers for this review. International protection standards have been sacrificed in the (vain?) hope of achieving a compromise within the EU.
[1] This year’s figures include 3.6 million Venezuelans displaced abroad, alongside the 93,300 refugees and 794,500 asylum seekers – 4.5 million Venezuelans in total.
[2] For further discussion, see Gilbert, ‘Is Europe Living Up to Its Obligations to Refugees?’ 15 EJIL 963 at 968 (2004); Refer to S. Carrera, ‘Whose Pact? The Cognitive Dimensions of the New EU Pact on Migration and Asylum’, Policy Insight Kick-off Contribution to the ASILE Forum.
[3] For further discussion, see Gilbert, ‘Rights, Legitimate Expectations, Needs and Responsibilities: UNHCR and the New World Order’, 10 International Journal of Refugee Law 349 (1998), fn.1.
Essex Law Research Blog 