11.2.1 Enforcement Stages and Applicable Fundamental Rights

11.2.2 The Evolution of the Concept of Access to Justice in Enforcement Matters: Beyond the Nation-State and beyond the ‘Judge’

Thus far we have looked at the function of fundamental rights within the nation-state and subsequently highlighted the fundamental rights that are at risk of being violated during the three different enforcement stages. In this section, we aim to show that even though an increasing number of EU policy areas are enforced directly at the EU level, this development has largely not been accompanied by a change in which judicial control is offered. In other words, while tasks are shared, controls remain separated.Footnote ²⁵

The traditional method of enforcing EU norms has been that of ‘indirect’ or ‘decentralised’ enforcement: the EU legislator sets out substantive norms and the EU Member States enforce them.Footnote ²⁶ In enforcing EU norms, Member States enjoy enforcement autonomy, a term meant to indicate that where Union law does not lay down enforcement specificities, Member States remain free to lay down national procedural rules for the enforcement of EU rights.Footnote ²⁷ However, indirect enforcement does not always bring about the envisaged results. Relevant literature has attributed problems of non-implementation of and non-compliance with EU policies to such causes as political unwillingness at the Member State level and lack of national resources.Footnote ²⁸

One way of addressing the aforementioned (indirect) enforcement deficit has been the shift towards direct modes of enforcing EU law, notably through the creation of EU law enforcement authorities: supranational actors created by EU law that have at their disposal enforcement powers and monitor compliance, investigate suspected violations, and/or sanction non-compliance with EU law.Footnote ²⁹ In the context of direct enforcement of EU law, various new modes of interaction between the EU and the national level have been instituted. These novel modes of EU administration have been characterised as shared, mixed, multilevel, multijurisdictional, composite, and integrated.Footnote ³⁰ Their common denominator is that, under the umbrella of an EU actor, the different national legal orders of the Member State are brought together.Footnote ³¹ EU actors are in constant liaison with national counterparts and operate in a functional EU territory.Footnote ³² Direct enforcement of EU law by EU law enforcement authorities challenges the traditional understanding of fundamental rights,Footnote ³³ including the right of access to a court and to remedies. We shall illustrate this point by means of three examples.

The first example concerns difficulties pertaining to effectuation of the right of access to a court when an EU binding measure culminates in a national sanction: in the investigative stage of enforcement, an EU authority carries out an on-site inspection at the business premises of a private party and obtains important evidence suggesting that the investigated person violated substantive legal provisions. However, given that the EU authority is not competent to sanction on its own motion, it requests that its national counterpart opens sanctioning proceedings vis-à-vis the aforementioned private party. A sanction is indeed imposed by the EU authority’s national counterpart. The affected party appeals the decision before the competent national court arguing inter alia that the EU authority engaged in a fishing expedition thereby violating their right to privacy. In light of the well-known Foto-Frost doctrine,Footnote ³⁴ national courts are not allowed to invalidate acts of EU organs. The only possibility then left to the reviewing national court is to make use of the preliminary reference procedure (see Chapter 4) and refer a question to the Court of Justice.

A second example concerns national enforcement action leading to EU sanctions and the difficulties surrounding the review – by EU courts – of the national part of such a shared procedure. Think of the following example. A national enforcement authority obtains evidence in the context of an on-site inspection. That evidence is thereafter transferred to the EU authority. Subsequently, based on that evidence, the EU actor imposes on the investigated person a punitive sanction. However, the addressee of the EU sanction argues that, in obtaining the critical piece of evidence, the national authority acted unlawfully. Can the Court of Justice of the European Union (CJEU), which will be called upon to review the final EU decision in accordance with Article 263 TFEU, also review the legality of the acts of the national organs? The CJEU has asserted in that respect that the principle of ‘single judicial review’,Footnote ³⁵ which emanates from the principle of sincere cooperation (Article 4(3) Treaty on European Union (TEU)), demands that the EU courts alone carry out judicial review, that is, they are exclusively competent to review the legality of the acts of national organs. While the reasoning behind the court’s view, namely that single judicial review rules out the possibility of contradictory rulings, is compelling, at the same time, the court has not yet explained on the basis of which standards – EU or national – such national acts shall be reviewed.Footnote ³⁶

A third example concerns the situation in which an EU authority carries out (non- binding) preparatory work that forms the basis for the opening of a national sanctioning procedure. However, according to the CJEU, given that the action of the EU authority was merely preparatory, and therefore did not affect the legal position of the individual, that individual is now unable to question the legality of the act of the EU authority through an action for annulment.Footnote ³⁷

All three examples demonstrate that while we witness a shift in the ways in which Union law in particular policy areas is enforced, this shift has largely not been accompanied by a change in the way in which judicial control is offered to remedy violations of rights suffered by the individual subject to enforcement action. While procedures for the enforcement of EU law are increasingly hybrid/ shared between EU and national actors, judicial review seems to be stuck to dogmas developed within the nation state, according to which a court is only competent to review acts emanating from organs within that court’s own jurisdiction. As a result, effective access to a court might in fact become illusory, seeing as the mechanisms currently foreseen, like the preliminary reference procedure, may be quite lengthy and cumbersome for an individual to seek. After all, as has been rightly noted in that respect – ‘justice delayed is justice denied’.Footnote ³⁸ Furthermore, EU courts reviewing the legality of national measures may not always be well placed to carry out a full review of national questions of law and fact.Footnote ³⁹ In other circumstances, decisive preparatory acts of EU authorities are not subject to any review as they do not change the legal position of the concerned party. This is precisely the reason why the main argument that we wish to bring forward in this contribution is that access to justice is (or must be) more than access to a court. As access to a court may – in the multijurisdictional EU law enforcement setting – know certain limitations, it is essential that judicial mechanisms are complemented or accompanied by sufficient non-judicial control mechanisms.

The other important argument here is that enforcement features certain characteristics that necessitate other forms of control, from a functional perspective. Establishing enforcement priorities as to how to allocate scarce human, financial, and technological resources and equipment in enforcement, which clearly can affect private parties’ access to justice, is an area where political accountability normally plays an essential role. Access to non-judicial control mechanisms may then allow many more possibilities, actors, and procedures to make sure that rights and freedoms are being ensured. At the end of the day, justice means solving the problem at stake and ensuring the effectiveness of policies in a legitimate way, including with the protection of fundamental rights. Achieving ‘justice beyond the judge’ could be done, for instance, through the availability of mechanisms of direct complaint procedures before public authorities (administrative bodies and other dispute resolution tools), contacting members of parliament (political accountability), quasi-legal routes (Ombudsman), mechanisms of external review, or even informal channels. This is especially the case if the enforcement authority lacks independence in its enforcement operations, that is, the ability to withstand pressures from the political sphere and the supervised sector. How could one ensure their fundamental rights if the enforcement authority were dependent on a political will or an industry lobby when making such essential and far-reaching choices as whether to investigate a case or not or to impose a sanction or not? Enforcement action can only ensure fundamental rights and be legitimate if the enforcer (institution, staff, procedures) can be organised in an impartial way. To do this, independence should be guaranteed. In light of rich academic literature on this concept, one can distil the necessity of having relevant de jure obligations (institutional, personnel, financial dimensions to protect functional discretion)Footnote ⁴⁰ brought to life de facto, thanks to having relevant institutional and contextual culture.

In Section 11.3, we will follow the distinction between the judicial and non-judicial remedies for the enforcement actions of the three selected EU law enforcement authorities and touch upon the question of independence of relevant authorities and their staff.

11.3.1 ESMA

ESMA enjoys direct powers in all three stages of enforcement. ESMA contributes to ensuring stability and safety of financial markets by regulating and supervising private actors like credit rating agencies (CRAs) and trade repositories (TRs). At the same time, as ESMA activities interfere with the freedoms of private parties, it has to respect these parties’ fundamental rights and freedoms. How does ESMA do this? First of all, to be able to operate on the EU financial markets, supervised private entities, for example, CRAs, shall receive an authorisation/licence from ESMA. For instance, CRAs assign credit ratings to individual companies and countries. Such ratings may be used by investors to decide whether they wish to invest in debt securities, therefore ESMA supervises these entities together with relevant national counterparts and it ensures that ratings are not based on falsified information. ESMA can delegate some powers to its national counterparts, however, it normally does not do so. The main reason why ESMA carries out supervisory and enforcement tasks by itself is that – by virtue of EU law – it has at its disposal all necessary direct supervisory and enforcement powers. In that sense, unlike other EU enforcement authorities, it does not rely on the powers of national counterparts. For many years, ESMA has had a dedicated supervision department that monitors these entities’ performance and ensures compliance with relevant laws in various ways.

To be specific about its enforcement powers, ESMA can issue a great number of soft law documents clarifying how relevant sectoral laws are to be implemented. For instance, ESMA often issues technical standards that are to be endorsed by the Commission (for instance, Commission Delegated Regulation (EU) No 449/2012 where the terms of application for registration licence for CRAs are clarified, including which information needs to be submitted and through which forms). ESMA can address requests for information to supervised entities and carry out inspections, which are ‘risk-based, proportionate, forward looking and action oriented’.Footnote ⁴³ Finally, financial market participants have the opportunity to pose questions to ESMA through its webpage and ESMA’s answers form additional guidance, the so-called Q&As.

Once the selected private actors are registered/licensed, ESMA monitors them, can investigate possible suspicions of non-compliant behaviour, and can sanction violations via public notices and fines. The law is clear as to the sole responsibility of ESMA over these participants of financial markets. ESMA does not have to share any powers with the relevant authorities at the national level, unless it chooses to delegate some tasks or requires assistance at the national level.

Information gathering is crucial for enforcement in the financial sector. In that respect, ESMA has set a number of requirements as to the information that has to be submitted to its supervisory section on a regular basis. For instance, CRAs have to report rating data to ESMA, which ESMA then analyses. In 2013, ESMA issued Recommendations and Guidelines on the scope of Credit Rating Agency Regulation (CRAR)Footnote ⁴⁴ addressed to, among others, CRAs. In addition, ESMA can perform on-site inspections to get more evidence-based information in addition to its desk-based analysis and it can also receive complaints to check an element concerning CRAs and their reporting. Article 23 (b–e) CRAR sets detailed rules as to how and when ESMA can request information when it supervises and when an Independent Investigator may investigate issues that have given rise to suspicion of violating the law and lead to sanctioning.

11.3.2 DG COMP and the European Competition Network

Enshrined in Articles 101 and 102 TFEU, EU antitrust rules are addressed to economic operators. They prohibit agreements between competitors that harm competition and anticompetitive unilateral conduct by dominant firms. In that sense, the individuals whose rights may be interfered with in the course of antitrust proceedings are first and foremost economic operators, commonly known as ‘undertakings’. However, the fundamental rights of other parties, like those of complainants, may also be at stake.Footnote ⁵⁰ Indeed, third-party complaints play a key role in the public enforcement of antitrust rules, in view of the fact that, through third-party complaints, competition authorities may often become aware of alleged irregularities in the markets.

Regulation 1/2003Footnote ⁵¹ has introduced a system of parallel enforcement, meaning that DG COMP and the national competition authorities (NCAs) enforce Articles 101 and 102 TFEU in tandem. To that effect, they are enabled to exchange with each other information and use in evidence any matter of fact or of law.Footnote ⁵² Given that a system of parallel competences may give rise to parallel proceedings, which is problematic not only from an efficiency perspective but also from a fundamental rights perspective (ne bis in idem), duplication of effort is avoided in at least two ways. First, Article 11(6) of Regulation 1/2003 foresees that the initiation by DG COMP of antitrust proceedings shall relieve the NCAs of their competence to enforce Articles 101 and 102 TFEU. Secondly, the European Competition Network (ECN),Footnote ⁵³ a network that brings together DG COMP and the twenty-seven NCAs, functions as a forum for case allocationFootnote ⁵⁴ and information exchange, which ultimately contributes to avoiding duplication of efforts and proceedings. The ECN does not, however, possess legal personality, therefore its allocation decisions may not be appealed before a court, which raises important questions concerning the (non-judicial) remedies that concerned undertakings are able to seek vis-à-vis ECN case allocation that may be affecting their legal position. This will be further discussed below.

DG COMP has a plethora of investigative and sanctioning powers. More specifically, it may carry out investigations into sectors of the economy (sector inquiries),Footnote ⁵⁵ request information from undertakings by simple request or by decision,Footnote ⁵⁶ interview legal or natural persons who consent to be interviewed,Footnote ⁵⁷ and carry out on-site inspections at business premisesFootnote ⁵⁸ and other premises, land, and means of transport.Footnote ⁵⁹ It is important to note that, with the exception of information requests ordered by simple request, and requests for interviews, all of DG COMP’s powers are of a coercive nature, as refusal to cooperate could result in the imposition of punitive sanctions.Footnote ⁶⁰ As to sanctioning powers,Footnote ⁶¹ where substantive antitrust rules have been violated, DG COMP has the power to impose punitive finesFootnote ⁶² and periodic penalty payments.Footnote ⁶³

The fundamental rights that are primarily at stake during antitrust investigations are the obligation to state reasons, the right to privacy – particularly during on-site inspections and fair trial rights, such as access to a lawyer, the legal professional privilege, and the privilege against self- incrimination. During the inter partes stage, which follows the investigative stage, the right to good administration (Article 41 CFR) and more specifically the right to have access to the file and the right to be heard are of paramount importance. Regarding the sanctioning stage, the principle of legality, the proportionality of the sanction, and the prohibition against double jeopardy (ne bis in idem) come into play.

11.3.3 OLAF

OLAF’s mission is to step up the fight against fraud, corruption, and any other illegal activity affecting the financial interests of the Union.Footnote ¹¹⁰ To that end, OLAF carries out administrative investigations in the Member States (i.e., ‘external investigations’) and in the Union’s institutions, bodies, offices, and agencies (i.e., ‘internal investigations’).Footnote ¹¹¹ For reasons of clarity, we consider only the first – external – type of investigations. OLAF investigates so-called persons concerned: any natural or legal person suspected of having committed any act that falls within OLAF’s mandate. To be sure, this mandate is very broad and covers potentially any act where Union money is involved, irrespective of the policy area affected and irrespective of where – at the EU or Member State level – the alleged infringement has taken place.

OLAF, as should be clear by now, is an investigatory body. It does not monitor nor does it impose sanctions. OLAF’s Director-General opens an investigation when there is a ‘sufficient suspicion’, which is often based on information that derives from third parties, that may or may not have monitoring functions or anonymous information.Footnote ¹¹² At the end of an investigation, when OLAF wishes to see follow-up to its work – in the form of sanctions or otherwise – its Director-General draws up a report (often) accompanied by recommendations that indicate the action to be taken by the Member State concerned: disciplinary, administrative, financial, or judicial (i.e., punitive) action.Footnote ¹¹³ OLAF’s reports are admissible as evidence in national proceedings.Footnote ¹¹⁴

The fundamental rights that may be interfered with or violated, considering OLAF’s restricted investigatory task, are limited to those outlined in Section 11.2.1: the right to privacy and the right to a fair trial. With respect to the first, as indicated earlier, OLAF’s on-the-spot checks and inspections interfere with the natural or legal person’s right to respect for the home and their communications, as protected by Article 7 CFR.Footnote ¹¹⁵ The right to a fair trial is not directly at risk in OLAF’s investigations. After all, the (potential) trial before a Member State court only takes place after OLAF has concluded its work. Nevertheless, the way in which OLAF obtains evidence during its investigations – by means of its on-the-spot checks and its interviews – is of importance for the trial and sanctioning phase and what OLAF does ‘often determines the framework in which the offence charged will be considered at the trial’.Footnote ¹¹⁶ OLAF’s legal framework recognises this and, accordingly, provides the person concerned with the necessary procedural guarantees.Footnote ¹¹⁷ The person concerned has the right to avoid self-incrimination even though OLAF exercises no compulsion. In addition, they have the right to be assisted by a ‘person of choice’; a broad denominator that includes lawyers. Once the investigation has been completed and before conclusions referring to a person concerned by name are drawn up, that person shall be given the opportunity to comment on the facts concerning them.Footnote ¹¹⁸ In other words, while OLAF’s legal framework does not say so explicitly, the person concerned has a right to be heard before the report is transmitted for follow-up proceedings. Beyond that, to make the exercise of procedural safeguards effective, the person concerned also has the right to be informed of the safeguards with which OLAF must comply.Footnote ¹¹⁹

11.4.1 What Are the Lessons That We Can Draw from Our Analysis?

First of all, the three types of EEAs that we have considered in our analysis are useful for analytical purposes to see and assess the sources of potential violations of fundamental rights. The clearer the division of competences among EU and national authorities and the lesser the degree of possible de jure joint enforcement action, the clearer the judicial remedy becomes. For instance, if ESMA carries out all the enforcement actions on its own, the private party has only one authority to address and the private party can do so according to the EU standards of fundamental rights and via other non-judicial remedies at the EU level. At the same time, the more divided the enforcement process between EU and national jurisdictions and the greater the degree of mixing supervisors, the more challenges there can be in seeking judicial redress: Which court? Which standard of fundamental rights? Is there a check on an action or decision of an EEA? etc.

Secondly, the legislative design of enforcement responsibilities, tasks, powers, fundamental rights, and controls is of paramount importance to prevent violations of fundamental rights and redress if the violation has happened. However, at the moment of writing, the legislative design of direct EU law enforcement often results in an allocation of responsibility that may not be matched with accompanying (judicial or non-judicial) remedies at the respective national or EU level. While it is true that we are discussing a relatively new development, such a mismatch must be prevented. Relevant procedural guarantees and procedures need to be developed and be clear for both the EU authorities and the supervised parties. For instance, requests for information need to be based on good reasons, especially if they are issued informally. Supervised parties should be heard, especially if ex post controls, such as judicial review, do not cover specific types of acts, which can limit or affect fundamental rights. Judicial dialogue between EU and national courts should be enhanced in order to overcome the strict dichotomy between the EU and the national level when it comes to judicial review of EU law enforcement authorities’ actions.

Finally, as part and parcel of the previous lesson, the coexistence of judicial and non-judicial remedies can complement each other’s gaps and ultimately ensure a fully-fledged protection of fundamental rights if designed properly and aligned with one another, including EU-national alignment. For instance, if effective enforcement in the field of financial markets requires informal supervisory practices, mediation procedures could be envisaged to ensure a mechanism of redress of possible violations of fundamental rights during such informal supervision. If soft law guidance is crucial to enhance compliance, private actors need to be able to ensure they are being heard when the guidance is developed. If the legislator is setting novel types of cooperation, such as shared enforcement, it should be clear which standard of fundamental rights protection should apply, what key terms on the basis of which enforcement authorities base their decisions mean (e.g., violation with intent or negligently), and which jurisdiction(s) should be responsible for the review of all stages of enforcement. Lastly, it is essential that the EU legislator does not attempt to use (non-judicial) remedies, such as internal mechanisms of review by internal units, to fill the gaps in judicial protection in the domain of direct enforcement by EU authorities, but rather seeks to complement the existence of judicial remedies.

12.2.1 Conceptual Reflections on EU Factual Conduct

Public administration features as the most prominent form of action legally binding acts, be they of a general or individual application. Yet the bulk of daily public administration also entails a lot of human actions, acts, activities, or conduct that do not amount to formal legally binding acts.Footnote ³ Such administrative acts or conduct, though not intended to produce legal effects like a binding legal act, entail nevertheless (sometimes significant) factual and legal consequences; as such, they may also arguably infringe fundamental rights.Footnote ⁴

The range of administrative forms of action outside the category of formal legally binding acts is broad and diverse. It includes various acts and operations that lead to the adoptionFootnote ⁵ or ensure the implementation/enforcementFootnote ⁶ of a formal legally binding act. It also arguably includes more free-standing acts and factual conduct such as legally non-binding or ‘soft law’ actsFootnote ⁷ as well as various concrete actions and operations.Footnote ⁸

From a conceptual point of view, the term ‘factual conduct’ can be understood in two different ways.Footnote ⁹ In one sense, it can be construed as an act of conduct or as a legal fact in the shape of human behaviour that is not intended per se to produce legally binding effects, but which nevertheless may entail certain legal and practical consequences according to law.Footnote ¹⁰ According to this understanding, ‘factual conduct’ would broadly encompass all administrative acts (forms of action) outside the category of formal legally binding acts. In a second sense, ‘factual conduct’ is to be understood as a specific form of administrative action. According to this second, more specific, understanding, it encompasses administrative actions and operations that amount broadly speaking to ‘physical acts’Footnote ¹¹ or measures of a factual nature. Such acts express the conduct of a public authority or its servants in the outside world in a factual manner, their legal relevance (as legally binding acts or mere acts of conduct having some legal relevance) being determined by the applicable legal framework.Footnote ¹² Factual conduct can thus include various physical acts and operations, either free-standing or connected to the adoption and implementation/enforcement of a formal legal act (binding or non-binding). Examples include: publishing/handling information, collecting and processing personal data, feeding a database with information or extracting information therefrom, providing an answer to a request or a petition, preparing a draft legal act, preparing and submitting a report or letter, publishing a legal act in the official journal/communicating the legal act to interested persons, entering business premises, searching for information, collecting and sealing documents and other items during an inspection/investigation, and using police executive powers.Footnote ¹³

Relying mainly on the second sense of the term for the purpose of this chapter, as in our view it analytically depicts more accurately the phenomenon under consideration, we note that factual conduct is very much present in the activity of the EU public administration. All EU bodies handle personal and non-personal data and information, publish and exchange information and various documents, undertake preparatory operations and actions for the purpose of adopting a formal legal act, and carry out various operations and actions for ensuring their implementation. It is less common for EU bodies to carry out physical implementation and enforcement of EU law, as these matters are normally reserved for the Member States’ administrations. Yet there are notable examples of EU bodies doing this (see also Chapter 11). These include the European Commission in competition lawFootnote ¹⁴ and, more recently, the European Central Bank (ECB) in its supervisory role within the Single Supervisory Mechanism (SSM),Footnote ¹⁵ the European Border and Coast Guard Agency (Frontex) with its new direct operational powers in joint operations at the Union’s external borders,Footnote ¹⁶ and the European Public Prosecutor’s Office (EPPO) with its wide-ranging investigation powers.Footnote ¹⁷ This trend is likely to continue in view of the ongoing phenomenon of EU administrative integration and hybridisation, with more EU bodies being granted (gradually increasing) direct enforcement and implementing powers, often exercised within rather intricate composite (EU and national) legal frameworks and in complex relationship with national competent authorities.Footnote ¹⁸

12.2.2 Risks for Fundamental Rights from EU Factual Conduct

EU factual conduct (understood as acts of ‘physical’ conduct by EU institutions, agencies and bodies, and their staff) may directly or indirectly affect fundamental rights of natural and legal persons. Examples are abundant in this respect. For instance, personal data processing operations by EU bodies may breach directly or indirectly the data protection rights (enshrined in Article 8 CFR and further given substance in Regulation 2018/1725)Footnote ¹⁹ as well as the right to respect for private and family life (Article 7 CFR) of the individual. Abusive or inappropriate personal data processing by Europol as regards persons suspected of being involved in serious crime might ultimately result in unlawful arrests and home searches by enforcement authorities in the Member States, in breach of the right to liberty and security of the person (Article 6 CFR) and/or the right to respect for private and family life (Article 7 CFR). Disseminating/publishing abusive defamatory information about individuals and legal persons may affect their reputation and consequently result in a breach of human dignity (Article 1 CFR)Footnote ²⁰ or the freedom to conduct a business (Article 16 CFR).Footnote ²¹ Irregularities committed by Commission officials implementing EU competition law, officials of the European Anti-Fraud Office (OLAF) under Regulation 883/2013,Footnote ²² or ECB officials in the implementation of the SSM Regulation during an inspection at the premises of an undertaking, might result in a breach of Article 7 CFR (protection of ‘home’, including business premises)Footnote ²³ or a breach of the right to property (Article 17 CFR).Footnote ²⁴ Last but not least, the exercise of executive powers by Frontex operational staff during joint operations at sea and/or land bordersFootnote ²⁵ could amount to a breach of the right to life (Article 2 CFR), the right to the integrity of the person (Article 3 CFR), prohibition of torture and inhuman or degrading treatment or punishment (Article 4 CFR), or the right to asylum (Article 18 CFR) and non-refoulement (Article 19 CFR).

The ability of EU factual conduct to directly and indirectly breach fundamental rights raises in turn the issue of ensuring adequate legal protection and remedies against such conduct. Are legal safeguards and remedies necessary and, if so, sufficiently available to address fundamental rights breaches by EU factual conduct?

12.4.1 The Right to an Effective Judicial Remedy for Fundamental Rights Breaches

Article 47 CFR proclaims the right to an effective remedy before a tribunal for ‘everyone whose rights and freedoms guaranteed by the law of the Union are violated’. This provision does not expressly specify or limit the ways in which rights and freedoms could be violated, which would imply that any type of violation, be it through a formal legal act or factual conduct, should be covered by the right to an effective (judicial) remedy. The view that factual conduct comes within the scope of Article 47 CFR and that, as a result, it should be matched by full legal protection in the form of appropriate judicial remedies, finds support in legal scholarship.Footnote ³² As for the Court of Justice, one may wonder whether its rather restrictive ‘dependent approach’Footnote ³³ to Article 47 CFR could entail limitations on judicial review of factual conduct and, implicitly, on the remedies the individual whose fundamental rights have been breached might effectively rely on. More specifically, drawing on the non-binding Explanations relating to the Charter of Fundamental Rights,Footnote ³⁴ the Court affirmed in its landmark Inuit judgment,Footnote ³⁵ that Article 47 CFR ‘is not intended to change the system of judicial review laid down by the Treaties, and particularly the rules relating to the admissibility of direct actions brought before the Courts of the European Union’. As a result, it appears that Article 47 CFR cannot be relied upon to establish new judicial remedies/review avenues or to amend those enshrined in the TFEU.Footnote ³⁶

However, within these confines, it is argued that Article 47 TFEU, giving expression to the principle of effective judicial protection and enshrining it as a fundamental right, could be used creatively by EU courts. It should be relied upon as a canon of interpretation regarding access to the judicial remedies laid down in the Treaties for persons invoking breaches of their fundamental rights by EU acts and measures. Such an approach could arguably offer a quick fix to the potential gaps within the current EU system of judicial remedies regarding violations of fundamental rights, until the more far-reaching solutions suggested by the Court – that is, the use of the formal amendment procedure of the Founding Treaties,Footnote ³⁷ and the Member States’ duties ‘to establish a system of legal remedies and procedures which ensure respect for the fundamental right to effective judicial protection’Footnote ³⁸ – have fully addressed the issue.

Against this background, one needs to consider how far the judicial remedies available for individuals enshrined in the Treaties and carved out through CJEU jurisprudence are effective in addressing the breaches of fundamental rights caused by EU factual conduct. The following judicial remedies are briefly examined for the purpose of this query: action for annulment (Article 263 TFEU), failure to act (Article 265 TFEU), preliminary reference procedure (Article 267 TFEU), action for damages (Article 268 juncto Article 340 TFEU), and plea of illegality (Article 277 TFEU).

12.4.2 The Action for Annulment

The action for annulment appears to raise particular challenges with regard to EU factual conduct in view of its admissibility conditions. Especially the fact that only acts of EU bodies that are ‘intended to produce legal effects vis-à-vis third parties’ are judicially reviewable arguably creates a considerable hurdle for persons willing to challenge before the CJEU EU factual conduct infringing their rights. As recently reconfirmed by the CJEU, ‘it is settled case-law of the Court that actions for annulment, provided for under Article 263 TFEU, are available in the case of all measures adopted by the institutions, bodies, offices and agencies of the European Union, whatever their form, which are intended to have binding legal effects’ (emphasis added).Footnote ³⁹ This means that unless EU factual conduct qualifies as an act or measure intended to have binding legal effects, it cannot be directly challenged under Article 263 TFEU. This observation raises two questions: (1) Could EU factual conduct qualify under certain circumstances as ‘an act or measure intended to have binding legal effects’? and (2) Is there any (indirect) way to review the legality of EU factual conduct that does not qualify as ‘an act or measure intended to have binding legal effects’ under Article 263 TFEU?

The answer to the first question could be positive, especially if Article 263 TFEU is read in light of Article 47 CFR, as suggested earlier. After all, the Court considers reviewable under Article 263 TFEU any EU measures intended to have binding legal effects, whatever their form (emphasis added). In this respect, the Court was quite creative in the past in inferring from a physical act directly affecting the situation of the applicant the existence of a tacit administrative decision that could be reviewed under the annulment procedure.Footnote ⁴⁰ In such a case, one may wonder whether factual conduct is in itself the expression of the challengeable tacit or implicit legal act or whether it is a mere indication of the existence of a previous tacit administrative decision that is being implemented via the physical act. By referring in Akzo and Akcros to ‘the tacit rejection decision expressed through (emphasis added) the physical act of seizing and placing those documents on the file without placing them in a sealed envelope’,Footnote ⁴¹ the CJEU seems to show a slight preference for the first scenario. In this vein, one could consider the factual conduct directly affecting the legal situation of the individual, similarly to a formal legal binding act, as some sort of ‘instant’ implicit decision, whereby the physical act itself amounts to a legally binding act. Such a legal construct, reflecting a more extensive understanding of the concept of ‘act intended to produce legal effects vis-à-vis third parties’ read in light of Article 47 CFR, could capture various situations in which free-standing EU factual conduct directly breaches fundamental rights.Footnote ⁴² While the concept of ‘instant implicit decision’ might still need to gain ground, EU legal scholars highlight, more in line with the second scenario, that the notion of a tacit or implicit decision ‘underpinning [emphasis added] a physical act or factual measure is common in the administrative law of the Member States’, and they argue for its extended application to ensure more effective protection of fundamental rights against EU factual conduct.Footnote ⁴³ In any case, if free-standing factual conduct does not amount somehow to an act intended to have binding legal effects, it cannot be reviewed under Article 263 TFEU.

This brings us to the second question: Is there any (indirect) way to review the legality of EU factual conduct that does not qualify as ‘an act or measure intended to have binding legal effects’? Legal review of factual conduct could in principle be ensured incidentally, in view of the relationship of such conduct with a legal act reviewable under Article 263 TFEU. Most obviously, factual conduct that can be qualified as ‘preparatory acts’ of a legally reviewable act can be reviewed by the Court in the context of the challenge brought to the latter act.Footnote ⁴⁴ This, however, raises the question whether such legal review does not sometimes come too late, as the relevant factual conduct might have produced legal and practical consequences well before the adoption of the legal act.Footnote ⁴⁵ Furthermore, if no legally binding act is finally adopted, then any ‘preparatory’ factual conduct carried out prior to that will not be in principle judicially reviewable,Footnote ⁴⁶ unless such factual conduct represents ‘the culmination of a special procedure … and which produce binding legal effects such as to affect the interests of an applicant, by bringing about a distinct change in his legal position’.Footnote ⁴⁷ As for the factual conduct that implements legally binding acts, legal review is reserved in principle only to the legally binding act, on the ground that ‘the validity of a decision cannot be affected by acts subsequent to its adoption’.Footnote ⁴⁸ The only apparent exception seems to be in the case of factual conduct entailing or underpinning an implicit or tacit legal act, but even in that case it is questionable whether the Court actually reviews the implementing physical act itself or rather exclusively the underlying implicit/tacit legally binding act. In this regard, the concept of ‘instant’ implicit decision could perhaps bring some added explanatory value with respect to the legal review of such ‘factual conduct’ by conceptually equating the physical act with a reviewable act under Article 263 TFEU (not with the mere implementation thereof).Footnote ⁴⁹

12.4.3 Failure to Act

Failure to act is to some extent the mirror image of the action for annulment,Footnote ⁵⁰ and it could also be of relevance as far as breaches of fundamental rights via EU factual conduct are concerned. Article 265 TFEU, third paragraph enables individuals to go to the CJEU for failure of an EU institution, body, office, or agency to address to them ‘any act’, except for recommendations and opinions. Yet it becomes apparent that individuals can rely on this judicial remedy only where the relevant EU body failed to adopt a legally binding act concerning them,Footnote ⁵¹ while being under an obligation to do so.Footnote ⁵² Hence, similarly to the action for annulment, failure to act does not seem a particularly suitable legal remedy against EU factual conduct, except for those instances in which the factual conduct that should have been enacted by the defaulting EU body would amount to an implicit decision impacting on the legal situation of the individual.Footnote ⁵³ Additionally, for a potential action under Article 265 TFEU to be admissible, the relevant EU body must have ‘been called upon to act’ by the individual and, furthermore, not defined its position on the matter after being called to act.Footnote ⁵⁴ As a final point, if successful, the action for failure to act results in a court judgment with a rather limited impact: declaring that the failure to act was illegal but without the possibility to impose on the EU body the type, content, and form of the act that should have been taken.Footnote ⁵⁵

12.4.4 Preliminary Reference Procedure

Arguably, some of the gaps resulting from the limited judicial review of factual conduct under Article 263 TFEU could be covered by the preliminary reference procedure under Article 267 TFEU (see also Chapter 4). As is well known from the CJEU’s jurisprudence, the admissibility of a question for preliminary ruling extends to the interpretation and validity of any acts of EU institutions, bodies, offices, or agencies.Footnote ⁵⁶ This clearly covers formal acts, be they legally binding or not, but it is less clear if EU factual conduct in the form of a mere physical act also qualifies as an ‘act’ under Article 267 TFEU.Footnote ⁵⁷ A reading of Article 267 TFEU in light of the fundamental right to an effective legal remedy enshrined in Article 47 CFR offers support for the view that the category of acts of EU bodies ‘without any exception’Footnote ⁵⁸ encompasses also physical acts representing factual conduct.Footnote ⁵⁹

Yet, even if this is the case, there are several difficulties with judicial review of EU factual conduct under Article 267 TFEU. First, for a preliminary question on EU factual conduct to be raised before a national court, there must be a decision or measure adopted by a national authority that the person who claims their fundamental rights are being breached by that EU conduct could challenge.Footnote ⁶⁰ Second, the national measure/act challenged before the national court should be sufficiently linked to the EU factual conduct in such a way that establishing the validity of the latter would enable the national court to decide on the matter.Footnote ⁶¹ If the national court does not find the relevant EU factual conduct ‘necessary’ to judge the case before it, the matter will not in principle reach the CJEU.Footnote ⁶² Third, even if a question for a preliminary ruling regarding the validity of EU factual conduct reaches the CJEU, it has been emphasised that judicial review might often come too late to ensure effective protection of the fundamental rights affected by that conduct.Footnote ⁶³

12.4.5 Action for Damages

In view of the shortcomings highlighted earlier, the action for damages enshrined in Articles 268 juncto 340 TFEU could in principle offer a more reliable remedy against breaches of fundamental rights caused by EU factual conduct.Footnote ⁶⁴ In any case, prima facie the action for damages has a generous scope as it covers ‘any damage (emphasis added) caused by its institutions or by servants in the performance of their duties’. It thus covers both material and non-material damageFootnote ⁶⁵ caused by any acts (both formal legal binding acts as well as factual conduct) of the EU ‘institutions’Footnote ⁶⁶ or EU servants. However, this judicial remedy also displays several shortcomings and difficulties.

First, in spite of the apparently generous, though slightly vague,Footnote ⁶⁷ formulation in the Founding Treaties, the standards for EU liability are in reality quite high,Footnote ⁶⁸ as they are interpreted and applied quite strictly by EU courts.Footnote ⁶⁹ While a breach of fundamental rights via EU factual conduct could relatively easily meet the condition that ‘the rule of law infringed must be intended to confer rights on the individual’, things become more difficult with the requirement that ‘the breach must be sufficiently serious’, as well as with the ‘damage’ and the ‘causal link’. Proving a sufficiently serious breach is in principle easier in the case of an EU measure that does not entail discretionary choices,Footnote ⁷⁰ and it proves particularly difficult where the EU measure entails the exercise of some degree of discretionary power; in this respect, even an illegal EU measure annulled under Article 263 TFEU is not per se sufficient to meet the threshold for a sufficiently serious breach under Article 340 TFEU.Footnote ⁷¹ In our view, Article 47 CFR requires a more lenient reading of the CJEU’s ‘sufficiently serious breach’ condition under Article 340 TFEU, so that EU legally binding acts, including here factual conduct amounting to an instant implicit decision, as well as genuine factual conduct in the form of self-standing physical acts that directly breach fundamental rights, meet the threshold as a matter of principle.Footnote ⁷² As to the damage suffered as a result of EU factual conduct breaching fundamental rights, this might be difficult to establish and quantify,Footnote ⁷³ especially in view of the non-pecuniary consequences that the breach of some fundamental rights entails.Footnote ⁷⁴ Last but not least, the causal link between the EU factual conduct and the damage might be difficult to establish, especially when it is embedded into a broader complex framework entailing concomitant or subsequent actions by EU and Member State actors that might interfere with the causation chain.Footnote ⁷⁵

Second, the monetary compensation that is usually provided within the framework of the action for damages might not fully remedy the situation where redressing a breach of fundamental rights by EU factual conduct would require positive administrative action to end the breach and re-establish the situation before the breach occurred.Footnote ⁷⁶ Yet this point of critique seems to be at least partly addressed by the fact that EU courts acknowledge that Article 340 TFEU does not in principle exclude compensation in kind ‘if necessary in the form of an injunction to do or not to do something’ if this is in line with the general principles of non-contractual liability common to the laws of the Member States.Footnote ⁷⁷ However, one may wonder how far EU courts are willing to have recourse to such types of compensation more extensively and especially in cases of fundamental rights breaches by EU factual conduct.Footnote ⁷⁸ A reading of Article 340 TFEU in light of the right to an effective judicial remedy in Article 47 CFR would, in our view, justify such an approach.

12.4.6 Plea of Illegality

Another judicial remedy provided in the Founding Treaties is the more indirect plea of illegality under Article 277 TFEU. This remedy is limited in three ways: (1) it can be invoked only against an act of general application; (2) only the four grounds for annulment laid down in the second paragraph of Article 263 TFEU may be invoked to establish the illegality of the act; and (3) the illegality of the act only triggers the inapplicability of that act within the direct action before the EU court in which the plea of illegality has been raised.Footnote ⁷⁹ This remedy seems prima facie of limited relevance in the case of EU factual conduct causing breaches of fundamental rights. Only in the rather unlikely scenario in which EU factual conduct would express an (instant) implicit binding legal act of general application, and on the basis of which individual acts or measures are enacted directly affecting the legal situation of the individual, could Article 277 TFEU be invoked within a direct action against such individual acts or measures.Footnote ⁸⁰

12.4.7 Incomplete Judicial Protection for Fundamental Rights Breaches by EU Factual Conduct

One may question whether the paradigm of ‘a complete system of legal remedies and procedures designed to ensure judicial review of the legality of European Union acts’ announced by the CJEU in Les VertsFootnote ⁸¹ and reaffirmed in InuitFootnote ⁸² withstands a reality check, as far as EU factual conduct breaching fundamental rights is concerned. Especially if this paradigm is read in light of Article 47 CFR asserting a judicially effective remedy for ‘everyone whose rights and freedoms guaranteed by the law of the Union are violated’. Based on the previous analysis, one may argue that the judicial remedies available in the Founding Treaties reveal shortcomings as to the completeness and effectiveness of judicial protection in such instances.Footnote ⁸³ Solutions to address this could be: (1) an extensive understanding of the concept of ‘reviewable act’ in line with AKZO jurisprudence whereby factual conduct directly affecting the legal situation and fundamental rights of the individual would amount to implicit reviewable legal actsFootnote ⁸⁴ and (2) a far-reaching interpretation of the action for damages encompassing extensive ways of compensation and a more flexible reading of the conditions for damages that could cover, at least in part, the blind spots of current judicial review of EU factual conduct.Footnote ⁸⁵ It remains to be seen how far EU Courts will be willing to consider such solutions in their future jurisprudence, but even if they do, gaps will arguably remain in the EU system of judicial remedies (especially as regards the lack of preventive judicial protection against potentially harmful EU factual conduct).Footnote ⁸⁶ Therefore, it may be opportune to look further afield and also consider other (non-judicial) remedies available in EU law to assess whether they may or could, alone or in combination with available EU judicial remedies, address some of the gaps and shortcomings highlighted earlier

12.5.1 Non-judicial Remedies and the Right/Principle of Good Administration

While discussions on legal review and legal protection usually focus on the availability and sufficiency of judicial remedies, one should not forget that, in a broad sense, the system of legal remedies is not limited to that. While judicial remedies, in view of their importance, could be placed at the forefront of the Union’s system of legal protection, non-judicial remedies also play a role in ensuring review of and redress against EU administrative action. In fact, under certain conditions, non-judicial remedies (i.e., actions and procedures against administrative actions that do not directly involve courts) could arguably be more accessible and effective in addressing fundamental rights breaches of individuals, be they natural or legal persons. Thus, compared to costly, time-consuming, and restrictive judicial remedies, non-judicial internal and external remedies and review mechanisms in the form of complaints,Footnote ⁸⁷ referrals,Footnote ⁸⁸ and appeals proceduresFootnote ⁸⁹ could provide easier access, comprehensive scrutiny, and relatively timely redress against potentially harmful EU administrative measures, including factual conduct.Footnote ⁹⁰ After all, in light of the commandment of an ‘open, efficient and independent European administration’ in Article 298 (1) TFEU, giving the public administration a chance first to repair its own mistakes and to offer redress via easily accessible non-judicial remedies could largely alleviate the need to have recourse to judicial review.

While access to judicial remedies is enshrined both as a common principle of EU law in CJEU jurisprudence and as a fundamental right under Article 47 CFR, there is no similar explicit constitutional recognition for non-judicial remedies against EU action.Footnote ⁹¹ Arguably, access to non-judicial remedies could be considered as a dimension of the multi-sided good or sound administration laid down as a fundamental right in Article 41 CFR and also established as a general principle of law by EU courts.Footnote ⁹² Following this line of reasoning, the set-up of effective administrative remedies could be seen as an inherent guarantee for the enforcement of the specific rights encompassed within ‘good’ or ‘sound’ administration. It could be arguably incorporated within the scope of ‘the right to have his or her affairs handled impartially, fairly and within a reasonable time’ under Article 41 (1) CFR. To be sure, availability of an administrative remedy against EU measures affecting individuals is not mentioned in the list of specific rights under Article 41 (2) CFR. Yet it has been maintained that Article 41 CFR only provides ‘examples of procedural rights to good administration’, and that it ‘serves to establish a minimum protection of certain elements generally accepted in the existing case law of the European courts as principles of good administration and rights of defence’.Footnote ⁹³ As a result, EU courts could in principle go beyond the rights explicitly listed in Article 41 CFR, though they also warn that ‘the principle of sound administration, does not, in itself, confer rights upon individuals … except where it constitutes the expression of specific rights’ like those enshrined in Article 41 CFR.Footnote ⁹⁴ Alternatively, the availability of effective administrative remedies could be regarded as an element of the general principle of good/sound administration continuously developed by EU courts. As mentioned previously, it could function as a guarantee for the exercise and enforcement of the specific rights included within the scope of good administration and enshrined in Article 41 CFR; additionally, it would also be an enabling element for the right to claim damages provided in Article 41 (3) CFR, especially if this is seen, separately from Article 340 TFEU, as a right to claim damages directly from the EU administration at fault (without necessarily ending up before the EU courts).Footnote ⁹⁵

Since there is a lack of clarity in EU primary law and case law regarding the availability and requirements of non-judicial remedies, the landscape of such remedies is quite diverse and eclectic (see also Chapter 5).Footnote ⁹⁶ In what follows, a few selected non-judicial remedies will be discussed as cases in point as to their applicability to fundamental rights breaches by EU factual conduct. A general observation regarding the mechanisms discussed here is that they are not designed solely to serve as remedies for the individual but to also fulfil other functions pertaining to legal review, scrutiny, and overall accountability of EU public administration (see also Chapter 5).

12.5.2 EU Ombudsman

One obvious horizontal non-judicial remedy available against EU acts and measures consists of the possibility, as well as the fundamental right according to Article 43 CFR, for individuals (natural and legal persons) to lodge complaints with the European Ombudsman.Footnote ⁹⁷ This remedy is very generous in terms of accessibility and scope. It is open to all EU citizens as well as any natural and legal person residing or having its registered office in a Member State, and it covers any instance of ‘maladministration’ in the activities of EU bodies (except for the CJEU).Footnote ⁹⁸ Instances or cases (as enshrined in Article 43 CFR) of maladministration are to be interpreted broadly, including legally binding and non-binding acts, formal acts and measures, as well as factual conduct.Footnote ⁹⁹ This administrative remedy can thus be used by individuals claiming breaches of their fundamental rights by EU factual conduct, such as improper collection or handling of personal data of an individual by an EU body infringing their reputation or privacy and data protection rights, negligent or malevolent physical acts during an investigation resulting in illegal seizure and further disclosure of sensitive documents affecting the legal situation of an individual, or the improper use of physical force by Frontex staff during joint operations at the Union’s external borders endangering the life, physical integrity, or liberty of a person.Footnote ¹⁰⁰

While the Ombudsman has a broad competence and is easily accessible for individuals alleging breaches of fundamental rights by EU factual conduct, its major limitation consists of the fact that its findings are not binding on the EU administration. The finding of an instance of maladministration in the examples mentioned above is followed by proposed solutions, suggestions, and recommendations for addressing the act of maladministration, but the EU body concerned remains entirely free to accept or reject them.Footnote ¹⁰¹ Moreover, the CJEU emphasised in Tillack the nature of the Ombudsman as an ‘alternative non-judicial remedy’ and made clear that the classification as an ‘act of maladministration’ by the Ombudsman does not, in itself, interfere with the judicial determination of whether the conduct of an EU body is ‘a sufficiently serious breach of a rule of law’ for the purpose of Article 340 TFEU.Footnote ¹⁰² However, the prestige of the EU Ombudsman as a moral figure and epistemic authority, supported by sufficient resources and an adequate framework of dialogue and peer pressure in relation to the EU administration, could make it quite an influential and effective actor in successfully addressing instances of maladministration, including breaches of fundamental rights by EU factual conduct (see also Chapter 5).Footnote ¹⁰³

12.5.3 Legal Review of EU Executive Agencies’ Acts

Another interesting non-judicial remedy is provided by Regulation 58/2003 regarding specifically the legal review of the acts of EU executive agencies.Footnote ¹⁰⁴ Article 22 of Regulation 58/2003 enables any person directly and individually concerned by ‘any act of an executive agency which injures a third party’ to refer that act to the Commission for a review of its legality. While the requirement that the person is directly and individually concerned by the act mirrors the strict standing conditions for non-privileged applicants under Article 263 TFEU, the reference to ‘any act’ of the agency arguably encompasses not only formal legally binding acts but also factual conduct in the form of physical acts liable to directly affect the legal situation of the individual.Footnote ¹⁰⁵ Examples of such ‘acts’ in the form of factual conduct could be the provision by the European Research Council Executive Agency (ERCEA) or the European Research Executive Agency (REA) of incorrect information and guidelines regarding calls for proposals under EU research grant programmes that misleads some potential applicants and ultimately precludes them from submitting a grant proposal or the compiling and subsequent dissemination by an EU executive agency of a list of potential applicants for EU grant programmes that are considered ‘undesirable’ because of their perceived ‘problematic’ political views. Pending the review of the act, the Commission ‘may suspend the implementation of the act at issue or prescribe interim measures’.Footnote ¹⁰⁶ Finally, the Commission may either ‘uphold the executive agency’s act or decide that the agency must modify it in whole or in part’,Footnote ¹⁰⁷ the respective executive agency being under a duty to comply with the Commission’s decision.Footnote ¹⁰⁸ Quite importantly in this context, according to Article 22 (5), the explicit or implicit decision of the Commission to reject the administrative appeal filed by the individual against the act of the executive agencyFootnote ¹⁰⁹ is subject to judicial review by the CJEU under Article 263 TFEU. In this way, the agency’s act in the form of factual conduct directly breaching the fundamental rights of the applicant could be reviewed indirectly (in the context of the review of the Commission’s decision to reject the appeal against the act) by the CJEU.

12.5.4 Boards of Appeal

Another rather overarching non-judicial remedy available in EU law is the so-called board of appeal (BoA) featured quite prominently within various EU offices and agencies.Footnote ¹¹⁰ Characterised by some as a ‘quasi-judicial’ remedy,Footnote ¹¹¹ the BoAs are in fact administrative remedies within the structure of the respective EU office or agency that bear certain similarities to courts and court proceedings.Footnote ¹¹² In this respect, they enjoy in principle a high degree of independence within the respective office or agency and the procedures before them are generally of an adversarial nature.Footnote ¹¹³ What is more, it appears that overall the EU legal acts establishing BoAs within various offices and agencies followed the model of EU Courts regarding standing and challengeable acts.Footnote ¹¹⁴ Accordingly, in general only decisions of the office or agency that are of direct and individual concern to the individual may be appealed before a BoA.Footnote ¹¹⁵ As administrative review bodies, BoAs in principle can exercise more intensive scrutiny and have more extensive review powers over the contested decision as compared to judicial review, and their binding decisions may be ultimately challenged before EU courts under Article 263 TFEU.Footnote ¹¹⁶ However, in view of its admissibility standards, this quite far-reaching administrative remedy seems to be of little relevance as regards factual conduct breaching fundamental rights, except, just like in the case of judicial review under Article 263 TFEU, for those instances in which such factual conduct could qualify as an (instant) tacit or implicit administrative act directly affecting the fundamental rights and legitimate interests of the individual. However, in view of its apparent advantages both as a legal review mechanism and as a potential legal remedy, one may consider further extending the scope of BoAs review in the future, similarly to the legal review model of EU executive agencies’ acts, to any acts (including factual conduct) of the EU body affecting the legal situation of the individual and making such a BoA model an entrenched feature of the overall EU institutional framework.

12.5.5 Frontex Fundamental Rights Complaint Mechanism

Staying within the sphere of EU agencies, the European Border and Coast Guard Agency (EBCG Agency, Frontex, or ‘the Agency’) features a specific administrative review mechanism, particularly tailored for breaches of fundamental rights by EU factual conduct. This is the (in)famous complaints mechanismFootnote ¹¹⁷ set up on the basis of Article 111 of the EBCG RegulationFootnote ¹¹⁸ for addressing alleged breaches of fundamental rights caused by staff involved in the Agency’s (operational) activities.Footnote ¹¹⁹ Being available free of charge for any person (no matter the age)Footnote ¹²⁰ directly affected by any actions or failure to act on the part of staff involved in Frontex’s activities,Footnote ¹²¹ the complaints mechanism looks prima facie like a remedy genuinely intended to bridge the gap concerning review of as well as redress for potentially harmful factual conduct of the Agency and its staff during external border management operations.Footnote ¹²²

However, the complaints mechanism also features some alleged shortcomings and limitations that have triggered criticism regarding its legal design and practical operation.Footnote ¹²³

First, while the extensive involvement of the Frontex Fundamental Rights Officer (FRO) in handling individual complaints is to be welcomed, questions pertaining to the genuine independence of the FRO vis-à-vis the management of the Agency as well as to the limited powers of the FRO regarding the outcome of the procedure leave a mixed impression as to its effectiveness in addressing fundamental right breaches.Footnote ¹²⁴ Thus, in the instances in which the FRO finds the existence of concrete fundamental rights violations, for instance in the form of excessive use of force by Frontex staff against individuals attempting to cross the EU external border by land, it draws up a report that includes recommendations for appropriate follow-up by the Frontex Executive Director (ED).Footnote ¹²⁵ Next, although the EBCG Regulation and the Agency’s rules on the complaints mechanism provide that the ED ‘shall ensure the appropriate follow-up’Footnote ¹²⁶ … ‘to FRO’s recommendation through measures provided for by the applicable rules’,Footnote ¹²⁷ the fact remains that the ED has broad discretion in establishing the ‘appropriate follow-up’ and is not formally bound by the FRO’s findings and recommendations.Footnote ¹²⁸ The obligation stipulated for the ED to report back to the FRO as to ‘the findings, the implementation of disciplinary measures, and follow-up by the Agency in response to a complaint’ does not change this;Footnote ¹²⁹ in fact, the Agency’s rules on the complaints mechanism provide clearly that a complaint may be declared unfounded by the ED.Footnote ¹³⁰

Second, it remains unclear what the ‘follow-up’ by the ED may consist of. Both the EBCG RegulationFootnote ¹³¹ and the Agency’s rules on the complaints mechanismFootnote ¹³² merely refer more explicitly to disciplinary measures and referral for initiation of civil and criminal proceedings; for the rest, formulations remain rather vague, such as ‘any follow-up measure’Footnote ¹³³ or ‘undertaking immediate action’ in case of an imminent risk of irreparable harm to the complainant or to the Agency.Footnote ¹³⁴ One may thus wonder whether the follow-up measures decided by the ED should also include redress for the individual whose rights have been breached by the Agency’s factual conduct, such as putting an end to the infringement, where applicable, and/or various compensatory measures for the harm suffered. If this mechanism and its follow-up are not aimed at properly addressing the breaches of the complainant’s fundamental rights caused by the Agency’s operational activities, one may seriously question whether this procedure represents a genuine remedy for the individual.Footnote ¹³⁵

Third, one may wonder whether the affected individual can legally challenge the outcome of the complaint procedure; one may consider in particular a decision by the ED to declare a complaint unfounded or an ED decision by which inappropriate follow-up by the Agency is taken on the complaint. Somewhat paradoxically, the legal review of such ED decisions is not clearly stipulated in the EBCG Regulation, prompting the remark that ‘the complaint mechanism is by design not fit to contest decisions of the agency’.Footnote ¹³⁶ In our view, to the extent that such decisions represent acts of the Agency that directly affect the legal situation of the complainant (and in our view this is the case where they do not properly address complainants’ breaches of fundamental rights), they are covered by Article 98 EBCG Regulation and, as a result, should be challengeable before the CJEU under Article 263 TFEU.Footnote ¹³⁷ In this respect, the revised Agency rules on the complaints mechanism arguably bring more clarity on this matter as they now stipulate that the ‘decisions adopted by the Executive Director … in relation to an admissible complaint shall contain an indication of the appeal possibilities provided under EU … law available for challenging the decision’.Footnote ¹³⁸

Last but not least, the effectiveness in practice of the complaints mechanism has been called into question. With a low number of complaints being registered over the years, and no complaints recorded until June 2021 regarding the activities of Agency staff members,Footnote ¹³⁹ concerns (followed by recommendations for improvement) have been raised inter alia regarding the accessibility, transparency, and proper functioning of this procedure.Footnote ¹⁴⁰

12.5.6 The European Data Protection Supervisor (EDPS)

Finally, a horizontal but rather specific non-judicial remedy available in the area of personal data processing by EU institutions, bodies, offices, and agencies deserves closer attention. Regulation 2018/1725 (the so-called General Data Protection Regulation for EU institutions and bodies) entrusts the European Data Protection Supervisor (EDPS) both with an overarching supervisory function regarding the processing of personal data by EU institutions and bodies and with the function of an administrative remedy for data subjects whose rights have allegedly been breached by unlawful data processing.Footnote ¹⁴¹ For certain, unlawful data processing by EU institutions and bodies may entail formal legal acts but also (perhaps in particular) factual conduct in the form of various physical operations (e.g., inadvertent collecting, recording, retrieving, consulting, altering, or deleting personal data in a database such as EURODAC or Europol Information System (EIS); combining, structuring, or analysing personal data for profiling purposes; prohibited disclosure by transmission of personal data to a third party,Footnote ¹⁴² including, for instance, exchanges of personal data with third countries by Frontex within the EUROSUR framework; unauthorised dissemination of personal data to the public,Footnote ¹⁴³ etc.).Footnote ¹⁴⁴ The right to lodge a complaint with the EDPS is granted broadly to any data subject who considers that the processing of his/her personal data infringes Regulation 2018/1725.Footnote ¹⁴⁵

Further, clear obligations are established for the EDPS in dealing with the complaint. First, the EDPS has a duty of information to the complainant as to the progress and outcome of the complaint, as well as to the availability of a judicial remedy.Footnote ¹⁴⁶ Second, the EDPS is under a duty to handle the complaint or inform the data subject about the progress/outcome of the complaint within three months; failure to do so equates to an implicit negative decision by the EDPS.Footnote ¹⁴⁷

Next, unlike the EU Ombudsman and the Frontex FRO, the EDPS has quite extensive formal powers vis-à-vis EU institutions and bodies at fault. Within the realm of its so-called corrective powers, the EDPS may inter alia order the controller or the processor to: ‘comply with the data subject’s requests to exercise his or her rights’,Footnote ¹⁴⁸ or ‘bring processing operations into compliance [with Regulation 2018/1725] … where appropriate, in a specified manner and within a specified period’,Footnote ¹⁴⁹ or further to ensure ‘the rectification or erasure of personal data or restriction of processing’ pursuant to the data subject’s rights under Regulation 2018/1725.Footnote ¹⁵⁰ Additionally, and quite notably, the EDPS can effectively enforce the measures mentioned previously by imposing administrative fines for non-compliance by the relevant EU institution or body.Footnote ¹⁵¹ The EDPS seems thus to have effective legal means to properly address breaches of fundamental rights by EU personal data processing operations.

Finally, but quite importantly, the decision of the EDPS concerning a data subject’s complaint, including the implicit negative decision where the EDPS fails to handle the complaint or inform the data subject about the progress or outcome of the complaint, can be challenged before the CJEU by the data subject.Footnote ¹⁵² Hence, in the area of personal data processing, the synergy between a strong administrative remedy provided by the EDPS and the judicial review of EDPS ensuing decisions bears the promise, at least on paper, of offering quite effective legal protection as concerns breaches of data subjects’ fundamental rights by EU factual conduct in the form of various physical data processing operations.Footnote ¹⁵³

13.2.1 The Universe of Vertical Composite Procedures: A Proposed Division

The universe of composite procedures (and, within it, the galaxy of vertical procedures entailing the cooperation of EU and Member State authorities) is extremely varied and in continuous evolution and, as a consequence, multiple categorisations are possible.Footnote ⁷ For the purposes of this chapter and in light of the focus of this volume on remedies for fundamental rights violations, in the following, it is submitted that the more or less ‘formalised’ and decisional nature of an administrative action represents a suitable criterion to distinguish different types of composite procedures. From this perspective, one can draw a distinction between procedures that entail various types of factual acts and procedures that instead comprise measures that are not factual in nature (whether binding or not). This distinction is relevant for the purposes of this chapter for two reasons. First, because of the different types of fundamental rights that may be at stake in the course of the decision-making process. In particular, factual conduct is capable of infringing specific fundamental rights regarding domicile and correspondence. Second, because, as will be shown below, the more or less formal nature of the administrative action at stake has implications for the identification of the appropriate judicial forum.

In Section 13.2.2, possible factual conduct scenarios identifiable in the framework of vertical composite procedures will be considered, with a discussion of the fundamental rights that might come into play in those situations. In Section 13.2.3, within the very diverse universe of composite procedures that do not entail factual conduct on the part of the authorities, examples will be provided of different fundamental rights that might be relevant in these procedures. They are not specifically linked to the ‘type’ of procedure (e.g., whether they culminate in limiting the legal sphere of an individual, such as the ban on the import of a product or an order of repatriation, or entail the expansion of the individual’s legal sphere, such as the granting of an authorisation to carry out a certain activity) but on the subject matter of the procedure. Furthermore, fundamental rights that might be relevant in all types of composite procedure (whether decisional or not in nature, or entailing more or less ‘formalised’ administrative measures) are ‘procedural’ in nature (e.g., the right to be heard). These will be examined in Section 13.2.4. As will be shown, these rights display peculiar features in the context of composite procedures and have been subject to fairly extensive scrutiny by the CJEU.

13.2.2 Factual Action, Composite Procedures, and the Infringement of Fundamental Rights

The notion of ‘factual action’ is not a dogmatic category known at the EU level, unlike several national systems.Footnote ⁸ Yet it is beyond doubt that both national and EU authorities carry out factual actions in the framework of composite procedures for the implementation of EU law and that these actions can have a severe impact on individuals’ fundamental rights (see also Chapter 12).Footnote ⁹

This can happen, for example, in the framework of inspection procedures: in increasingly more policy fields, composite procedures entail enforcement actions, including inspections.Footnote ¹⁰ For example, in the fields of competition law, fisheries, and aviation safety, EU authorities (be it the Commission or the competent European agencies) can carry out inspection activities, including, for example, seizure of documents, confiscation of computer systems, and interrogation of witnesses.Footnote ¹¹ These inspection activities may be part of composite procedures when a subsequent act of the enforcement process, such as the imposition of a sanction, is adopted at the national level. Cooperation in enforcement tasks may also take place at the inspection step itself, when national and EU authorities cooperate in various ways in carrying out an inspection.Footnote ¹² Inspections and the actions they entail may be in conflict with Article 7 of the Charter, protecting the right to private life, home, and communications, which corresponds to the first paragraph of Article 8 of the ECHR. That these fundamental rights might be at stake in such cases has also been confirmed by the case law of the CJEU.Footnote ¹³

Factual action can also go beyond inspection activities and includes the performance of other types of acts. For example, Frontex has been carrying out factual activities (such as the detention or transfer of individuals from one location to another) in support of search and rescue activities performed by national authorities at the EU borders, which may conflict (and indeed have been considered as conflicting) with, amongst others, the fundamental right to asylum and the prohibition of refoulement contained in Articles 18 and 19 of the Charter.Footnote ¹⁴ Other fundamental rights contained in the Charter, such as the prohibition of torture contained in Article 4 or the right to liberty enshrined in Article 6, can also be of relevance in this context. The same fundamental rights can be violated in the framework of the cooperation between the national competent authorities and the European Union Agency for Asylum, in the context of which the Agency is tasked with, amongst others, conducting admissibility interviews with migrants.Footnote ¹⁵

13.2.3 Other Composite Procedures and ‘Substantive’ Fundamental Rights

Composite procedures of a decisional nature, and which do not involve factual conduct, are present in very diverse policy fields, ranging from competition law to the Common Agricultural Policy, asylum, risk regulation, environmental policy, and data protection. It is therefore fairly straightforward to conclude that a large range of possible fundamental rights can come into play in these very diverse situations. Without any attempt at completeness, in this section, examples of types of composite procedure will be provided to show how and why EU fundamental rights might be violated.

An increasingly common type of composite procedure entails the sharing of data between EU and national authorities.Footnote ¹⁶ At the outset, it should be mentioned, with respect to these procedures and the proposed categorisation based on the presence of factual conduct in a vertical composite procedure, that these acts of information, as has been appropriately argued, ‘sit uneasily within [the] legal/factual dichotomy’.Footnote ¹⁷

These data sharing procedures often take place through various databases, in which national authorities enter information that, in turn, may be used by other national authorities. In some cases, the role of the EU level of administration can materialise in the facilitation of the sharing of information between authorities of different legal systems. This is the case for the Rapid Exchange of Information System (RAPEX). This is an alert system for unsafe consumer products, established by the General Product Safety Directive.Footnote ¹⁸ In this system, Member States share information concerning dangerous products with the Commission. After validation by the Commission, the information is made available to the competent authorities throughout the EU, which can take measures to prevent the circulation of the product, such as a ban on sales or withdrawal from the market. Potentially, in such cases, the composite procedure thereby generated might come into conflict with the freedom to conduct a business protected by Article 16 of the Charter.

In other cases, the EU presence can relate to the creation and management of a database, such as the Schengen Information System (SIS), through which competent national authorities, such as the police and border guards, are able to enter alerts on people and objects in the database, which can be consulted by the competent authorities of all Member States, and which can form the basis of restrictive measures such as removal from the national territory. The involvement of the EU legal system is, however, ‘silent’ in that it is limited, through the EU Agency for large-scale IT systems (eu-LISA), to the operational management of the central IT system and the network on which the system operates. This has implications for the accountability of the EU administrative authorities, and hence for access to justice, since their participation in the decision-making process is unclear.Footnote ¹⁹ Regardless of the more or less ‘explicit’ role of the Agency in the procedure, like in the cases of Frontex and the European Union Agency for Asylum examined above, the fundamental right to asylum and the prohibition of refoulement contained in Articles 18 and 19 of the Charter might be violated as a consequence of the actions of public authorities taken on the basis of alerts entered in the SIS system, as well as the right to respect for family life and the rights of the child, as enshrined in Articles 7 and 24 of the Charter.Footnote ²⁰

At the same time, in the examples of both the RAPEX- and the SIS-generated procedures, it is clear that, as certain personal data are shared, the right to data protection contained in Article 8 of the Charter might also come into play.Footnote ²¹

Other sets of composite procedures entail the authorisation or denial thereof to place on the market a product or a substance. Various types of composite procedures are indeed foreseen for the authorisation to place on the market genetically modified organisms, medicines, pesticides, and so on, entailing the cooperation in various forms and at various stages between national and EU authorities.Footnote ²² In such cases, one could imagine that the freedom to conduct a business protected by Article 16 of the Charter as well as the prohibition of discrimination contained in Article 21 might come into play.

13.2.4 Composite Procedures and Fundamental ‘Procedural’ Rights

All composite procedures, whether entailing enforcement measures or leading to an authorisation or the drafting of a plan or the ban of a product or person from the European administrative space, whether taken in economic or non-economic fields, whether comprising only two or multiple cooperative steps, need to respect several procedural fundamental rights. The starting point here is Article 41 of the Charter, referring to the right to good administration, including the right to be heard and the duty to give reasons. Article 41 is closely linked to the right to an effective remedy under Article 47 of the Charter, because judicial protection cannot be considered effective if the person concerned is unable to ascertain the reasons upon which the decision relating to them is taken.Footnote ²³ The obligation to give reasons aims to enable the person concerned to ‘defend his rights in the best possible conditions and to decide, with full knowledge of the relevant facts, whether there is any point in his applying to the court with jurisdiction’.Footnote ²⁴

Early in the case law, it was established that the right to be heard applies to individual decisions, which is a typical outcome of composite procedures (e.g., in the case of authorisation to place a product on the market or the imposition of a sanction).Footnote ²⁵ However, the exercise of this right can be particularly arduous in the case of composite procedures: Quid iuris indeed if the right to be heard was not exercised in one step of the procedure? Can this omission be ‘compensated’ down the line of the decision-making chain, although the following decisional steps might be taken by authorities pertaining to a different legal system from that of the authority that violated the right to be heard in the first place? Can the omission of the authority of one legal system ‘contaminate’ the actions of the authorities belonging to a different legal system? What is the relevant level of administration before which the right to be heard can or must be exercised?Footnote ²⁶

These issues came to the attention of the CJEU in the context of the structural funds in the Lisrestal case, in which the Court considered a cooperative mechanism between the national authorities and the Commission leading to the reduction of the financial assistance received by the applicant.Footnote ²⁷ The right to be heard was considered violated by the Court, and this circumstance led to the invalidity of the final Commission decision. However, interestingly, in the absence of a clear indication in the underlying legislation, the Court did not specify whether the right to be heard had to be afforded by the national or EU authorities, although the national authorities had no discretion to decide on the recovery of the funds. In a later case, Mediocurso, the applicants had been heard by the national authorities but there were indications that the right to be heard could have been infringed as the applicants had been given too little time to submit their observations. The Court of Justice on appeal, reversing the decision of the (then) Court of First Instance, invalidated the final Commission decision.Footnote ²⁸

Also the later case lawFootnote ²⁹ confirms that, while the right to be heard needs to be respected regardless of whether it is specifically mentioned in the applicable rules, it is not required that it be granted before the authority making the ‘real’ determination in the composite procedure.Footnote ³⁰ This line of case law, however, seems to stand in contradiction with another strand of decisions that the CJEU handed down in the field of the repayment of import duties. After confirming the earlier position in France-Aviation,Footnote ³¹ in a long line of subsequent case law, it held that a person vis-à-vis whom an unfavourable decision is to be adopted must be heard by the authority who has the discretion to take the decision (in the cases at stake, the Commission).Footnote ³²

This contradiction in case law of the CJEU did not go unnoticed, with Alonso de León stating that the European courts ‘fail to see the connection between some of the cases’, possibly because they do not recognise composite procedures as a category of their own.Footnote ³³ While he proposes that the right to be heard in composite procedures must be afforded before the authority ‘in the driving seat’ of the procedure (i.e., holding the discretionary power with respect to the final decision), he acknowledges that this very solution might present additional complexities in procedures with more complex collaborative structures, such as in the case of authorisation of pesticides or genetically modified organisms, where national and EU authorities intervene at several points of the procedure.Footnote ³⁴ What is however clear from this case law is that, whenever a composite procedure is concluded with an EU measure on which the ‘main’ decision-making power is held by an EU administrative authority, the violation of the right to be heard at the national level is able to ‘contaminate’ the validity of the final EU law. This finding is in line with the division of jurisdictions between the national and EU courts, which will be discussed in Section 13.3.

The duty to give reasons, which undoubtedly also applies to acts of individual scope, resembles to some extent the broader problématique discussed with respect to the challenges of the right to be heard in composite procedures: Which governance level must discharge the duty to give reasons in composite procedures? Can the shortcomings of one authority be compensated by an authority belonging to a different legal system?

While the duty to give reasons, like the right to be heard, is sometimes enshrined in the legislation creating a composite procedure,Footnote ³⁵ the case law has revolved around situations in which this duty is not precisely stated. In particular, as highlighted by Brito Bastos, two situations have been brought to the attention of the Court, both relating to composite procedures where a national preparatory measure is followed by a final EU measure: first, whether EU authorities must include the reasons contained in the relevant national preparatory acts in their statements of reasons; second, whether EU authorities may discharge their duty to give reasons simply by per relationem (i.e., merely by referring back to the national preparatory measures).Footnote ³⁶

With respect to the first point, the ruling in Sweden v Commission (which was confirmed in later case law)Footnote ³⁷ allows the conclusion that if the statement of reasons contained in the preparatory measure contains facts and circumstances that are decisive for the final decision then the EU authority issuing the final measure should include them in its own statement of reasons.Footnote ³⁸

Regarding the possibility for EU authorities to refer to the statement of reasons of the national preparatory measure, the CJEU has been consistent since the Branco ruling that this is possible, provided that the EU measure confirms the preparatory measure adopted by national authorities, which should themselves have issued a sufficiently clear statement of reasons, and that the addressee has been able to take cognisance of the measure.Footnote ³⁹

While this case law solves some of the issues connected to the extent of the duty to give reasons in composite procedures, as with respect for the right to be heard, several doubts still remain: What is the extent of the duty to give reasons if the procedure is reversed and it is the EU authority taking the preparatory measure? To what extent should national preparatory measures be subject to a duty to give reasons? What about composite procedures involving more than two steps or two legal systems?

These questions are not only relevant with respect to the decision-making process itself but also for the question of the competent judicial instance when any of those (procedural or substantive) fundamental rights are violated. It is to this question that the chapter now turns.

13.3.1 The Separation of Jurisdiction as the Cornerstone of the European Judicial Architecture

As the examples presented above have shown, the variegated universe of composite procedures, as the regulatory manifestation of the increasingly intense cooperation between national and European authorities for the implementation of EU law, are present in virtually all EU policy fields. Despite their capacity to violate fundamental rights protected by the EU legal order, the current judicial framework seems ill-suited to cater for their comprehensive judicial control.

This is because of the traditional approach to the judicial review of administrative action, which is based on the principle of territoriality. On this basis, the jurisdiction of courts is limited to the review of the administrative action stemming from the authorities belonging to the domestic legal system. This approach would make judicial review of a national court on an EU measure, or vice versa of the CJEU on a measure adopted by a national authority, in principle, impossible.

This strict separation of judicial control of administrative action (with the only avenue of procedural integration represented by the preliminary question of validity under Article 267 TFEU,Footnote ⁴¹ see Chapter 4) creates difficulties in access to justice. These are likely to arise for two main reasons. First, because the actions of the several national and EU authorities participating in a composite procedure might be so intertwined that it could be difficult to trace the contribution of each authority in the process and, consequently, the attributability of a conduct to a specific level of administrative governance. Second, because, even if an action could be ‘isolated’ and attributed to a specific administrative authority, the several preliminary steps leading to a final decision within a composite procedure might not be reviewable in any legal system. They might not constitute a reviewable act in the legal system to which these steps, acts, or actions belong (in light of their preparatory nature), and, at the same time, they might not be subject to judicial control in the court of the legal system adopting the final decision because of the limitations generated by the principle of territoriality. In Section 13.3.2, the access to justice issues arising from composite procedures entailing factual conduct will be examined. As Section 13.3.2 will show, these issues mostly revolve around the question of attributability of a conduct to a specific level of governance. Section 13.3.3 will then consider the case law of the Court of Justice concerning procedures of a decisional nature. This division mirrors the distinction made in Section 13.2 and is warranted by the different problems arising from these two types of vertical composite procedure. Section 13.3.3 will show that the CJEU has been asked on a number of occasions to determine the extent of its own jurisdiction as well of that of the national courts in composite procedures. However, many questions are still left unanswered and possible gaps in judicial protection might persist.

13.3.2 Factual Action in Composite Procedures and the Problem of Attributability

As introduced in Section 13.2, composite procedures can entail a variety of actions of a factual nature, such as the removal of individuals from the EU territory, the carrying out of interviews, the seizing of documents, and the like. When these acts are carried out in the context of composite procedures, and in particular when the factual action is itself cooperative in nature, it is very difficult to attribute a specific conduct to one or other administrative authority. If, for example, a national inspector and an inspector of the European Central Bank, working together in the so-called Joint Inspection Teams, perform a number of actions on the premises of a financial institution, the actions will be so intertwined as to render attributability of conduct to the national or European level of governance next to impossible.Footnote ⁴²

If this problem is solved and disentangling the EU action from the national action is somehow possible, access to justice will nevertheless not be fully ensured per se in cases of fundamental rights violations.

Where the procedure is concluded with a national measure, the national competent court will be able to send a question concerning the validity of the EU conduct to the CJEU. The latter is, according to its Foto-Frost ruling,Footnote ⁴³ the sole judicial authority in the case of doubt on the validity of acts or actions stemming from an EU authority, able to control it. Furthermore, according to the Grimaldi ruling, preliminary questions of validity are admitted with respect to all measures of EU law.Footnote ⁴⁴ Hence, for a factual action of an EU authority, the preliminary question of validity seems to be available.Footnote ⁴⁵

However, even in this – seemingly easy – case, the fact that the use of the preliminary question of validity presupposes the capacity of the national court to ‘discern’ the EU contribution to the national measure might place the national court in a conundrum: Should it – in doubt concerning the attributability of conduct to the EU authority – send a preliminary question of validity, even though the contribution of the EU administrative authority might not be discernible (incurring a risk of the preliminary question being declared inadmissible), or should it accept the indiscernibility of EU and national action and review the measure, possibly in breach of its Foto-Frost obligation?

Furthermore, if the procedure concludes with an EU measure, the competent EU court will be faced with the lack of a ‘reverse’ preliminary ruling, whereby the CJEU could ask a national court to review the validity of the factual conduct of a national authority.Footnote ⁴⁶ In this situation, the applicant might need to access a national court to have the conduct of the national authorities reviewed. However, whether this claim will be admissible remains to be seen, and it is equally not clear whether the case law concerning composite procedures concluded with an EU measure and entailing ‘formalised’ preliminary national measures (i.e., the Borelli/Berlusconi line of case law examined in Section 13.3.3) can also be applied when factual conduct is at stake.

13.3.3 Composite Procedures, Discretion, and the Quest for the Competent Court

For the myriads of composite procedures where no factual conduct is involved, and the preliminary measures adopted by the competent national and EU authorities materialise in more ‘formalised’ measures (such as an opinion, a plan, an objection, etc.), it is again helpful to differentiate the situations in which the final measure of the decision-making process is adopted by the national or the EU level of administration.

As in the scenarios discussed above with respect to factual conduct, in the case of a composite procedure concluded by a national measure, the preliminary measures of the EU authorities can be challenged through a preliminary question of validity under Article 267 TFEU. For the opposite situation, when a composite procedure ends with an EU measure, the hurdle to access to justice arises from the combined absence of a ‘reverse’ preliminary ruling and the preliminary nature of national measures, which would, in most legal systems, lead to the inadmissibility of a claim against these measures.

In order to ensure access to justice in these situations, the Court has intervened with two landmark rulings that require national preliminary measures to be either autonomously reviewed before the national courts or to be reviewed by the CJEU in the context of a claim against the final EU measure. The first solution was proposed in the Borelli ruling, in which the Court held first that it was not entitled to review acts of national authorities but also, second, that national courts had to admit claims against national preparatory measures, regardless of the limitation posed to that review by the applicable national procedural rules.Footnote ⁴⁷ After Borelli, the same approach was repeated in a number of cases relating to the field of protected denomination of origins and geographical indications under the applicable EU legislation. In these cases, the Court confirmed, on the basis of Borelli, that national preparatory measures should be reviewed by national courts but only when such a measure ‘constitutes a necessary step in the procedure for the adoption of a[n] [EU] measure, [and in regard to which] the [EU] institutions have only a limited or non-existent discretion’.Footnote ⁴⁸

The solution envisaged in Borelli therefore only applies if the EU authorities adopting the final measure retain little or no margin of discretion vis-à-vis the preparatory national measure. If, instead, the EU authority retains a margin of discretion in respect of the final measure to be issued vis-à-vis the preparatory measure of the national authorities, the system of judicial protection afforded in such cases is the one proposed by the Berlusconi ruling. In this case, the Court ruled that, for composite procedures where the final decision-making power lies with the EU authorities, the CJEU has jurisdiction to review the entirety of the decision-making chain, including its national component.Footnote ⁴⁹ Advocating a form of ‘integrated’ judicial review, the CJEU has, at the same time, and in an established line of case law (though limited to date to the banking sector), stripped national courts of their jurisdiction to review certain national preparatory measures that are part of composite procedures.Footnote ⁵⁰

The combined reading of Borelli and Berlusconi entails that the determining criterion to vest national courts with the jurisdiction (and the duty) to review national preparatory measures is that of the margin of discretion afforded to the final EU decision-maker.Footnote ⁵¹

However, the criterion established by the CJEU, based on the margin of discretion afforded to the final EU decision-maker is not without difficulties for those who need to apply it. In Berlusconi, the CJEU uses the notion of ‘discretion’ to refer to the margin of manoeuvre of the EU authorities to decide on the content of a decision (as opposed to a situation in which this content is pre-determined by the content of the national preparatory measure). However, the notion of discretion can also relate, for example, to the question of whether to exercise a power or to which form a decision can take. Furthermore, discretion can relate to policy choices but also the assessment of facts.Footnote ⁵² This somewhat oversimplified view of discretion is not realistic in light of the variety of legislative scenarios through which composite procedures can be generated. It is also liable to generate further preliminary references and legal uncertainty: Who is to assess whether the legal framework is such to grant ‘exclusive jurisdiction’ to the CJEU or conversely whether a national court must be seized of the review of a preliminary measure? Quid iuris of time limits if the CJEU eventually decides that the preliminary measure needs to be reviewed by the national courts?

The Borelli and Berlusconi rulings also leave a number of further questions unanswered. In particular, the solution proposed by the Borelli ruling still remains unclear from a practical point of view and has only been partially clarified by the Jeanningros ruling.Footnote ⁵³ Indeed, while the obligation for national courts to review national preparatory measures binding on the EU authority taking the final decision was clear after Borelli, the question remained open as to what would happen if a final decision is taken by the Union administration before the national court has had the opportunity to review the binding national preparatory act upon which it is based.

In Jeanningros, the Court clarified that, on the one hand, any pending proceedings against the national preparatory act should continue and, on the other, a national ruling holding that act invalid should lead the EU authority to revoke a decision taken on that basis (upon the assumption that the time limits under Article 263 would be long expired). While this confirms for potential applicants that the national route must remain open even when the EU authority has taken a final decision, it still does not clarify the remedies at their disposal if the Commission were to refuse to or simply does not revoke its final measure after the national proceedings are concluded. Is an action for failure to act under Article 265 TFEU then open to applicants? Given the lack of formalised communication channels between national courts and the Commission, what if the Commission is simply unaware of the fact that the relevant national proceedings are concluded?Footnote ⁵⁴

If one considers specifically the Berlusconi scenario, the review of the national measure permitted by the CJEU seems to be limited to errors of EU law, to the exclusion, therefore, of flaws in the national preparatory act based on domestic procedural law.Footnote ⁵⁵ A different solution would entail the CJEU applying national law and would make the determination of the validity of an EU measure indirectly dependent on varying national procedural arrangements. However, the exclusion from the scope of judicial control of these national preparatory measures of errors stemming from national law inevitably creates what has been referred to as an ‘administrative crack in the EU’s rule of law’.Footnote ⁵⁶

Furthermore, it is unclear how the combined reading of Borelli and Berlusconi can be applied in composite procedures that entail more than two steps. This difficulty is exemplified in the Association Greenpeace France ruling, which concerned the authorisation scheme in the field of GMOs.Footnote ⁵⁷ In this case, the applicant complained that the actions of the national authority where the procedure had started were irregular and therefore rendered the final Commission decision irregular. The Court could thus still implicitly rely on the Borelli ruling and find that national courts are competent for the review of that preliminary national measure.Footnote ⁵⁸ However, it is not clear which would be the competent court to review the input of another national authority in the process (e.g., in the form of an objection to the assessment made by the first authority).

A separate and final reflection should be dedicated to the emerging case law concerning a special type of composite procedure that is based on information sharing between the EU and national authorities, such as in the above-mentioned cases of the SIS and RAPEX databases.Footnote ⁵⁹ The Borelli and Berlusconi cases do not seem to fit the schemes of composite procedures in these scenarios as the final decision-making process does not lie with the EU level, and the existence of the preliminary question of validity does not solve the problem of access to justice. This is because these procedures involve the EU authorities and more than one national authority: they are thus ‘triangular’ in nature in that they are started at one national level, with an intermediate participation of the EU authorities, and concluded at another national level.

The case law in this framework is rather limited and leaves many questions unanswered. Two cases, MalaguttiFootnote ⁶⁰ and Bowland,Footnote ⁶¹ dismissing an action for damages against the EU for sharing allegedly incorrect information (on the basis of which national measures had been adopted), seem to indicate that, according to the CJEU, the EU action within these systems is limited to ‘passing on’ the information, which remains within the full responsibility of the Member State that shared the information in the first place. The ‘triangularity’ in these procedures seems therefore, according to this case law, merely formal.

If these procedures are then to be considered horizontal in substance, where can or should national preparatory measures in these cases be reviewed? The recent Funke ruling seems to indicate that preparatory measures in which the information is shared (in this case, within the RAPEX system) must at least be open to judicial control in the legal system where the measure was taken.Footnote ⁶² However, in this case, there had not yet been any national measure taken after the alert was shared by the Commission to the Member States. If a subsequent national measure (e.g., determining that a product be banned from the market) is taken by the authority of another Member State, should an applicant initiate two separate proceedings in the course of both legal systems involved in the procedure?Footnote ⁶³

14.2.1 What Is Soft Law and What Makes It Soft?

The study of soft law in the EU legal order is already well established. A seminal work, and one that has advanced an often relied on definition of the notion, was that of Senden. She qualifies soft law as ‘rules of conduct which are laid down in instruments which have not been attributed legally binding force as such, but nevertheless may have certain (indirect) legal effects, and that are aimed at and may produce practical effects’.Footnote ² This definition remains rather vague, however, and a lot of intellectual effort has since gone into attempts to better understand what kind of practical and/or indirect legal effects are sufficiently relevant in order for non-binding acts to be considered legally significant enough to constitute soft law.Footnote ³ Further research has therefore looked into the question of which precise features makes soft law soft and the types of soft law that exist.

On what makes soft law soft and trying to better capture the notion of soft law, Terpan proposed to understand the phenomenon as a function of two criteria, those being obligation and enforcement. A norm can then be qualified as hard law when it cumulatively prescribes a sufficiently clear obligation that can also be enforced. Conversely, norms that do not prescribe sufficiently clear obligations would constitute soft law as would norms that do prescribe obligations but that are not enforceable. To determine whether a sufficiently clear obligation is being prescribed, Terpan considers the source and the content of the norm in question and, in terms of enforcement, he distinguishes between norms that are subject to judicial (or at least very constraining) control, those subject to non-coercive control (such as mere monitoring), and those subject to no control.Footnote ⁴

14.2.2 Soft Law’s Different Functions

To better appreciate the dynamics (and interference with fundamental rights) that may flow from soft law, it is useful to distinguish the different functions that soft law acts may fulfil. Here, different authors have elaborated different typologies. Senden and Van den Brink, for instance, distinguish between soft regulatory rule-making and soft administrative rule making. The first has a para-law policy-steering function while the purpose of the other is to give post-legislative guidance.Footnote ⁵ The classification of soft law adopted specifically for EU agencies as proposed by Rocca and Eliantonio also categorises soft law in light of its position in the policy cycle and can also be integrated in that of Senden and Van den Brink. Rocca and Eliantonio distinguish four types: where soft law is adopted in the form of acceptable means of compliance or technical guidance (categories one and two of Rocca and Eliantonio), it will typically fulfil the function of post-legislative guidance; conversely, technical documents and high quality information (categories four and three of Rocca and Eliantonio) typically fulfil a para-law function.Footnote ⁶ Just like the origin of a norm’s soft nature above, the conceptual distinction between these two main categories is important because it feeds into the constitutional assessment of the informalisation of EU governance through soft law.

On the one hand, post-legislative soft law may be beneficial to clarify the meaning and scope of legislative provisions. On the other hand, there also exists a risk that in the post-legislative phase, through the soft law guidance, a binding norm is given (slightly) different meaning, thereby also possibly altering fundamental rights interferences flowing from that binding norm. In that case, however, a binding norm still exists that might meet the requirements of Article 52(1) of the Charter. In contrast, soft law fulfilling a para-legislative function does not have such a binding norm to fall back on, raising the question of whether any fundamental rights interferences by such soft law would be ‘prescribed by law’ or whether they would be ipso facto violations.

A final consideration to present at this point is the dual question of the author and the addressee of the soft law. In EU law, perhaps the archetypical form of soft law are the Commission’s guidelines in the field of competition law where the Commission set out its view on how EU competition law is to be applied. This soft law has no specific addressees but helps private parties anticipate the Commission’s practice, since the soft law has self-binding effect on the Commission as the (main) actor responsible for the enforcement of EU competition law.Footnote ⁷ More recently, a different trend can be seen, as will be further illustrated below, whereby a proliferation in the authors of soft law can be witnessed. In this fairly new constellation,Footnote ⁸ the rather straightforward link between the author adopting the soft law and the enforcement actor has also been severed, meaning there is no self-binding effect anymore either. Often EU agencies or bodies are called on to adopt soft law, fleshing out legislative provisions that are to be applied by national authorities. While such soft law may still fulfil the clarification function of post-legislative soft law noted above, the fact remains that the fiction of an authority limiting its own (enforcement) discretion can no longer be upheld in these cases. That would mean that the position of private parties is weakened, and the possible interferences with their fundamental rights may become more acute. This since the soft law will still carry in it an expectation of compliance but without being balanced by the legitimate expectation that the enforcement actor has limited its own discretion.

This feature is exacerbated by a further feature of the typical composition of EU agencies or bodies adopting soft law. Unlike the main EU executive (the Commission), the main decision-making entities of EU agencies and bodies are the national authorities responsible for the implementation of EU law. The further risk this poses is illustrated nicely by the recent ThyssenKrupp cases. At issue here was a composite procedure whereby the EU customs expert group (composed of national authorities) could not agree on whether certain conditions to grant an exceptional authorisation to one of ThyssenKrupp’s competitors were met. Still, a majority in the expert group was in favour of granting the authorisation and the Commission concluded that the conditions to do so were indeed met. The Dutch customs authority subsequently formally granted the authorisation and claimed that it was obliged to do so in light of the Commission’s conclusion.Footnote ⁹ This because a further soft law act adopted by the expert group, ‘the new administrative practice’, provided that such Commission conclusions are binding on the national authorities.Footnote ¹⁰ The General Court (GC) ruled that the Commission’s conclusion was not challengeable pursuant to Article 263 TFEUFootnote ¹¹ since the relevant legislation merely prescribed that national authorities ‘shall take it’ into account.Footnote ¹² The GC’s findings were upheld by the Court of Justice, which furthermore remarked that the ‘fact that … the competent customs authority took its decision in the belief that it was bound by the contested conclusion does not … have the effect of making that conclusion an act which is legally binding’.Footnote ¹³ For readers versed in the admissibility requirements of Article 263 TFEU procedures, the Courts’ findings will appear logical and sound. However, a troubling dynamic at play here is that national authorities come together at EU level and de facto limit their own discretion through soft law, obfuscating the available remedies available to private parties. As Eliantonio explains in Chapter 13, where the EU adopts preliminary measures and national authorities adopt the final act, a disentangling of who does what becomes paramount.

14.2.3 Soft Law Interferences with Fundamental Rights in Theory

Having further clarified what makes soft law soft and how soft law may occupy different positions in the policy cycle, it is now possible to look into the implications of soft law from a fundamental rights perspective. Two questions are especially relevant here: First, if soft law is soft because it does not prescribe a hard obligation and/or because any possible obligation prescribed will not be enforced through a ‘constraining’ enforcement mechanism, can it become sufficiently relevant for its fundamental rights implications? Secondly, if a limitation or restriction may result from soft law, under which conditions may those limitations or restrictions be said to be ‘prescribed by law’? Under the Convention, this requirement first refers back to the domestic law of a party but that domestic law must itself also be in conformity with the Convention. While the domestic law need not formally be law, and can be enactments of lower rank than statutes and even unwritten law, it must meet qualitative requirements, including those of accessibility and foreseeability.Footnote ¹⁴ While this seems to provide sufficient flexibility to encompass soft law, the flexibility is arguably aimed at accommodating the different legal systems of parties to the Convention.Footnote ¹⁵ Given the risks that soft law poses for executive overreach in the EU,Footnote ¹⁶ limitations flowing exclusively from soft law might have to be ruled out as being ‘prescribed by law’ regardless of whether the soft law was accessible and its application foreseeable. Most of the time, however, a limitation will not flow exclusively from soft law, the latter instead fulfilling a mediating function. Where soft law is tolerated in such scenarios it becomes crucial to ensure proper remedies, as discussed in Section 14.3.

Returning to the first question, the relevance arguably lies in the practical and indirect effects that soft law may produce. After all, from a fundamental rights perspective, the question is not so much whether the norm prescribing (in)action on the part of the government is valid and/or binding but if and how such (in)action impacts the fundamental rights position of the individual.

The constitutional relevance of soft law is still obscured, however, since the notion of a limitation or restriction (of a fundamental right) has arguably not been properly clarified by either the European Court of Human Rights (ECtHR) or the Court of Justice of the EU (CJEU). For the ECtHR, this might not come as a surprise since the cornerstone of the Convention is the right of individual petition.Footnote ¹⁷ The ECtHR thus addresses specific (individual) complaints of concrete (alleged) violations of fundamental rights and not abstract questions relating to possible dubious legislative acts or government policy.Footnote ¹⁸ Such a constellation provides less opportunity for theory-crafting compared to the system in which the CJEU operates of which the purpose is not to protect fundamental rights but to oversee the construction of an internal market. In its system of remedies, the cornerstone is the preliminary reference procedureFootnote ¹⁹ and an independent Commission can bring infringement actions against Member States. Returning to the ECtHR, Letsas notes that its diagnostic test has five main stages, those being: (i) whether the facts come within the ECHR’s scope, (ii) whether there is an interference with a right, (iii) whether the interference is prescribed by law, (iv) whether a legitimate is aim pursued, and (v) whether the interference is necessary in a democratic society.Footnote ²⁰ While the second stage is conceptually distinct from the others,Footnote ²¹ in practice it is often subsumed under the fifth stage, which has also meant that the ECtHR has not developed a horizontal approach to the question of which types of governmental action or inaction may amount to an interference.Footnote ²² Since such an approach is lacking, the ECtHR has not articulated a general approach to the potential fundamental rights implications of soft law either.

When the interference question is explicitly addressed by the ECtHR, it is necessarily done in a case-by-case manner. In those cases, it is not exceptional for the ECtHR to simply postulate that there has been no restriction, without elaborating any reasoning in this regard. It thus, for instance, held that ‘in themselves, the security checks to which passengers are subject in airports prior to departure do not constitute a restriction on freedom of movement’.Footnote ²³ On other occasions, the finding of a lack of a restriction is more reasoned. In Cha’are Shalom Ve Tsedek v France, the ECtHR held that while ritual slaughter was protected under Article 9 of the Convention, ‘there would be interference with the freedom to manifest one’s religion only if the illegality of performing ritual slaughter made it impossible for ultra-orthodox Jews to eat meat from animals slaughtered in accordance with the religious prescriptions they considered applicable’.Footnote ²⁴ Similarly, in A, B and C v Ireland, the Grand Chamber of the ECtHR ruled that there was no interference with a woman’s right to life by a party’s anti-abortion legislation when the woman in question could go abroad to receive treatment.Footnote ²⁵ As Gerards notes, if the Court were to follow this approach consistently, not many interferences would be found,Footnote ²⁶ since an interference could only be qualified as such when it resulted in the impossibility to enjoy the protection of the right concerned. Linking back to soft law, that threshold might never be met since its soft nature means that non-compliant behaviour remains entirely possible.

On the other hand, in a greater number of cases, the Court links the degree of interference with the intensity of the proportionality review.Footnote ²⁷ As a result, ‘although in some cases the Court pays express attention to the phase of interference, in other cases it implicitly accepts or assumes the existence of an interference, or it merges the test of interference with the test of applicability or that of jurisdiction [or that of the justification of an interference]’.Footnote ²⁸ Linking back again to soft law, this would mean that the existence of an interference will be accepted but that the proportionality review might be lenient. The lack of a clear position on the possible interfering effects flowing from soft law contrasts with the approach of the CJEU, at least in the area of the internal market.Footnote ²⁹ As noted, this can arguably be explained by the different purposes of both Courts and the different procedural avenues to reach them.

In its internal market jurisprudence, it is firmly established case law that where national measures ‘are capable of hindering or rendering less attractive the exercise of the fundamental freedoms guaranteed by the Treaty’ they will constitute interferences.Footnote ³⁰ That non-binding measures may also constitute restrictions on free movement is explicitly established in case law of the CJEU, since the restrictive effect of non-binding measures may be comparable to that of binding measures.Footnote ³¹ The degree of interference will then only be relevant in the possible assessment of the proportionality of the (national) measure. Of course, this ‘internal market’ logic might not be transposable to the fundamental rights protection offered by the Charter. While the CJEU itself has created a bridge between the two, that bridge does not connect the internal market freedoms with the full scope of material rights in the Charter. Instead, the Court held that where there are interferences with the fundamental freedoms of the internal market, these automatically cover interferences with only a limited subset of Charter rights (notably those laid down in Articles 15 to 17),Footnote ³² amalgamating the assessment of both. Going back to soft law’s effects and as AG Bobek explained, soft law as an imperfect norm may not be coercively enforced but still have the ‘normative ambition of inducing compliance’.Footnote ³³ In the law of the internal market, such an ambition is sufficient for the measures to be caught by the free movement rules. Applying the same logic, the possibility of soft law constituting an interference with fundamental rights should be accepted.

The more concrete question of whether this means that the Charter applies to EU soft law further falls apart in two sub-questions, in light of the Charter’s field of application. As Kenner and Peake note, the first is whether EU institutions are bound by the Charter when adopting soft law. For those authors, ‘ideally, when it adopts non-binding policies, it should also be regarded as constrained and empowered by fundamental rights. However, in those contexts, as its output is not legally binding, it would be difficult to enforce this commitment in the courts’.Footnote ³⁴ The second question is whether EU Member States are to be considered as implementing EU law when they adopt binding measures in the wake of EU soft law. As the law currently stands, Kenner and Peake answer this question in the negative but again call for a de facto respect for the Charter in order not to erode the protection offered by the latter.Footnote ³⁵ At this point, it is useful to make a distinction between the different ways in which EU soft law may be followed upon or implemented. Thus, once an EU institution or body adopts soft law, generally four scenarios are possible: (i) the soft law is addressed to private parties (or has no addressee) and is acted upon by them; (ii) a governmental body (EU or national) adopts a binding act further to the EU soft law; (iii) a national body adopts soft law further to the EU soft law; (iv) the EU soft law is acted upon through factual conduct of a governmental body (EU or national). Evidently, the possibility for parties to bring a potential fundamental rights interference before a court will be influenced by which of the four scenarios is at issue.

While the Court has not addressed the first scenario explicitly yet, the dynamics that would be in play have popped up in cases before it. In Bevándorlási és Állgmpolgársági Hivatal, the Court noted that asylum seekers cannot be required to undergo a personality test, since their consent to do so would be required. However, it explicitly accepted that ‘that consent is not necessarily given freely, being de facto imposed under the pressure of the circumstances in which applicants for international protection find themselves’.Footnote ³⁶ The Court thus recognised that an applicant might be indirectly or practically forced, in which case there is an interference with the right to respect for a private life that needs to be justified. In the separate context of EU-induced national austerity programmes, which come under the second of the four scenarios noted above, AG Saugmandsgaard Øe in Associação Sindical dos Juízes Portugueses held that the Council recommendation based on Article 126(7) TFEU at issue ‘did not fix sufficiently specific and precise objectives to support the view that the Portuguese State implemented on the basis of that recommendation requirements of EU law within the meaning of Article 51 of the Charter’.Footnote ³⁷ This suggests, however, that, on the more fundamental preliminary point, the AG did not per se rule out that a Member State could be said to be implementing EU law in the sense of Article 51 of the Charter when acting on EU soft law.

14.2.4 Soft Law Interferences with Fundamental Rights in Practice

To make things more concrete, the present section will look into three distinct areas to illustrate how soft law may result in fundamental rights interferences. The first is the area of economic coordination and the Euro crisis response. To assist Eurozone Member States that are cut off from the international financial markets, the Eurozone Member States established the European Stability Mechanism (ESM) as an international organisation distinct from the EU. The ESM TreatyFootnote ³⁸ confers a number of important tasks on the European Commission and the European Central Bank, which the CJEU accepted in the Pringle case.Footnote ³⁹ The ESM funds made available to the Eurozone Member States are conditional on the negotiation and conclusion of a Memorandum of Understanding (MoU) between the ESM and the Member State concerned. These MoUs, while negotiated and signed by the Commission, follow from the ESM Treaty and therefore do not constitute challengeable acts under Article 263 TFEU.Footnote ⁴⁰ At the same time, the EU can still be held liable for the Commission’s wrongful acts or omissions, specifically under the Charter (and the right to property, notably of those people affected by the austerity or restructuring measures taken in execution of the MoU), as confirmed by the Court in Ledra Advertising.Footnote ⁴¹

The legal nature of the MoUs, negotiated by the Commission under the ESM, is highly disputed. The analogous MoUs agreed between the Commission and non-Eurozone Member States, under EU law, were considered to be ‘mandatory’ by the CJEU,Footnote ⁴² against the findings of the AG,Footnote ⁴³ but it is unclear whether this can be transposed to the ESM MoUs. AG Wathelet in Mallis suggested they are non-binding,Footnote ⁴⁴ as does Repasi,Footnote ⁴⁵ while Poulou suggests they are binding.Footnote ⁴⁶ The Court in Ledra Advertising did not address this question and focuses on the Commission’s conduct in negotiating the MoU. Distinguishing the negotiation by the Commission from the MoU itself is in part built on a legal fiction however, and it seems difficult to see how the Commission’s conduct as such would constitute an interference in the absence of the MoU itself constituting such an interference. The Court of Justice indeed seems to assume that the MoU (as negotiated by the Commission) interfered with the right to property of the deposit holders at the banks that were put under resolution. Ledra would thus imply either that the CJEU accepts that a non-binding act may have such constraining practical or indirect legal effects that a fundamental rights interference may result from it or, alternatively, that it believed the MoU was binding. While Ledra concerned the right to property of deposit holders (of Cypriot banks), it is useful to flag that the MoU also prescribed an austerity programme with significant fundamental rights implications. For instance, the Cyprus MoU foresaw that Cyprus would reform its pension system, increasing the minimum age for pension entitlements and reducing pensions.Footnote ⁴⁷

A second set of examples can be seen in the soft law adopted in the Area of Freedom, Security and Justice (AFSJ), for instance, by the EU Agency for Asylum (EUAA). Article 13 of its establishing Regulation provides that its Management Board can adopt operational standards, indicators, guidelines, and best practices to ensure a correct and effective implementation of Union law on asylum.Footnote ⁴⁸ The agency thus adopts post-legislative guidance fleshing out different provisions of the EU asylum acquis, such as the Asylum Procedures Directive. In its Articles 14 and 15, the latter sets out the rule that applicants are entitled to a personal interview before a decision on their application is made as well as setting out the requirements that such a personal interview must meet.Footnote ⁴⁹ Under Article 15(3)(c) of the Directive, the ‘communication shall take place in the language preferred by the applicant unless there is another language which he or she understands and in which he or she is able to communicate clearly’. In the EUAA’s Guidance on asylum procedure: operational standards and indicators of September 2019, however, Standard 30 prescribes that ‘the personal interview takes place in a language the applicant understands’.Footnote ⁵⁰ The ‘good practice’ listed under that standard provides that if no interpreter is available in the language that the applicant understands, another language ‘that the applicant is reasonably expected to understand’ can be used. The guidance that is provided to national authorities to comply with the Directive thus effectively sets a lower (or at least less detailed) standard than the Directive itself. Since the latter is explicitly intended to promote inter alia the right to human dignity and the right to asylum,Footnote ⁵¹ it cannot be excluded that the guidance might set the actual standard for the administrative practice of Member States and thereby interfere with these fundamental rights. This despite the Court in Addis ruling that the personal interview is of fundamental importance in the asylum procedure.Footnote ⁵²

A further example in the AFSJ can be found in the EU’s response to Russia’s invasion of Ukraine. Quite quickly this led to calls within the EU of banning Russian tourists from acquiring Schengen visas, although the Schengen Visa CodeFootnote ⁵³ does not explicitly provide for such a ban. Following the EU Council’s suspension of the EU-Russia visa facilitation agreement,Footnote ⁵⁴ Russian citizens are to be given the default treatment under the Visa Code regulation when applying for visas. When it comes to refusing Russian citizens’ applications, the main relevant provision in the Visa Code on which Member States would rely is Article 21(3)(d), which requires Member States to verify that ‘the applicant is not considered to be a threat to public policy, internal security or public … or to the international relations of any of the Member States’. While the regulation has not been amended, in September 2022 the European Commission did adopt guidance specifically for the issuance of visas to Russian citizens.Footnote ⁵⁵ These guidelines seem to lower the bar for Member States to refuse applications from Russians: ‘As far as Russian nationals travelling for tourism are concerned, having a very strict approach is justified as it is more difficult to assess the justification for the journey.’Footnote ⁵⁶ The Commission in its guidance also seems to lower the bar by introducing the notion of a ‘potential threat’, a concept that does not as such appear in the Visa Code or the (general) Visa Handbook.Footnote ⁵⁷ While there is evidently no fundamental right of Russians to visit the EU, one may well argue that there is a fundamental right for Russian citizens, pursuant to Articles 20 and 21 of the Charter, not to be treated differently from, for example, Kazakh citizens (i.e., citizens of states other than Russia that are also listed in Annex I of Regulation 2018/1806Footnote ⁵⁸ with which the EU has not concluded a facilitation agreement).Footnote ⁵⁹ Arguably, the result of the guidance is that Member States are given a basis to routinely reject applications from Russians requesting a visa for touristic purposes.

A third illustration may be found in the digital sphere where the EU has adopted ambitious legislative packages in recent years. Although the General Data Protection RegulationFootnote ⁶⁰ is not limited in scope to the processing of data through digital means, its importance for the digital information society is self-evident. In 2022, the EU legislator also adopted the Digital Services Act (DSA) and a Data Governance Act (DGA).Footnote ⁶¹ Aside from their special relevance for the digital provision of services and the digital processing of data, two further features of these three different legislative instruments are noteworthy for the purposes of this chapter: they contain important enabling clauses foreseeing the adoption of soft law to ensure the proper application of the legislative acts and they rely on a new type of governance mechanism by setting up so-called Boards (the European Data Protection Board [EDPB], the European Board for Digital Services [EBDS], and the European Data Innovation Board [EDIB]) that are to adopt such soft law. While these Boards are heterogeneous in their nature, structure, and functioning,Footnote ⁶² they have in common that they bring together representatives of the national authorities and that they are given the power to adopt soft law (guidance) on any issue coming under the scope of their respective legislative acts. This is very similar to the constellation at issue in the ThyssenKrupp cases discussed above. When it comes to the actual application of these legislative packages, different fundamental rights are evidently in play. The DSA is especially clear on this as it provides in its Article 34 that providers must make an assessment of how their services and the way they are offered may negatively affect rights, in particular the fundamental rights to human dignity enshrined in Article 1 of the Charter; to respect for private and family life enshrined in Article 7 of the Charter; to the protection of personal data enshrined in Article 8 of the Charter; to freedom of expression and information, including the freedom and pluralism of the media, enshrined in Article 11 of the Charter; to non-discrimination enshrined in Article 21 of the Charter; to respect for the rights of the child enshrined in Article 24 of the Charter; and to a high-level of consumer protection enshrined in Article 38 of the Charter.Footnote ⁶³

How providers are concretely meant to mitigate risks is initially left to self-regulation, but Article 35(3) provides that the Commission ‘may issue guidelines … in relation to specific risks, in particular to present best practices and recommend possible measures, having due regard to the possible consequences of the measures on fundamental rights enshrined in the Charter of all parties involved’. In short, it may be expected that soft law will de facto determine the limits within which fundamental rights may be impacted by providers of very large online platforms and very large online search engines.Footnote ⁶⁴ Generally, for these three acts, their actual implementation will be significantly steered by acts of soft law, adopted by either the Commission, the Boards, or the regulated entities themselves.

What the examples in these three very diverse policy fields show is, first, a seemingly insatiable appetite for soft law, not just on the part of the executive branch and, second, the very real possibilities for soft law to affect the legal position of natural and legal persons.

14.3.1 Unavailability of the Action for Annulment

The Court of Justice shut this door firmly in 2018 in Belgium v Commission,Footnote ⁶⁵ despite suggestions by AG Bobek to take a more flexible approach. The Court of Justice thereby endorsed the findings of the General Court, which, at first instance, observed that the recommendation does not have and is not intended to have binding legal effects with the result that it cannot be classified as a challengeable act for the purposes of Article 263 TFEU.Footnote ⁶⁶ The problematic repercussions of Belgium v Commission for effective judicial protection were decried by Arnull in strong terms: ‘[I]n direct actions the Court of Justice and the General Court now sometimes seem content to collude with other institutions to evade the requirements laid down by the Treaty.’Footnote ⁶⁷ What therefore remains is the action for damages and the preliminary reference procedure, before the Courts, and the different forms of review by administrative bodies as a non-judicial remedy.

14.3.2 The Action for Damages

As the Ledra case discussed above suggests (assuming the CJEU found the MoU to constitute soft law), it is in principle possible to challenge the fundamental rights interferences of soft law through an action for damages. It is established case law of the EU Courts to require three cumulative conditions for the EU to incur non-contractual liability, those being the unlawfulness of the EU’s conduct, the fact of damage, and the existence of a causal link between the conduct and the damage.Footnote ⁶⁸ In Ledra, the Court dismissed the claim for damages on the first of these conditions by finding that the Commission had not committed a sufficiently serious violation of the fundamental right involved because the restriction of the fundamental right could be justified pursuant to Article 52(1) of the Charter.Footnote ⁶⁹ Specifically for soft law, the third cumulative condition appears to be the most problematic, however. Under the Court’s established case law, a sufficiently direct causal link means that the conduct must be the determining cause of the damage.Footnote ⁷⁰ Yet, given its non-binding nature, the indirect legal and practical effects of soft law seem incapable of ever constituting such a determining cause.Footnote ⁷¹ This is clear where EU soft law is subsequently implemented by further decisions (binding or non-binding) but also when it results in the first and fourth scenarios noted above in Section 14.2.3. The threshold to show that soft law itself determined a private party’s behaviour or the factual conduct of a government body lies exceptionally high. Where the action for annulment against soft law will be inadmissible, an action for damages might be admissible but would then always fail on the merits.

14.3.3 The Preliminary Reference Procedure

The only judicial remedy practically available will then be the preliminary reference procedure, as evidenced by the FBF case.Footnote ⁷² In that case, the Court followed up on Belgium v Commission mentioned earlier where it refused to review soft law in an action for annulment but where it noted that ‘Article 267 TFEU confers on the Court jurisdiction to deliver a preliminary ruling on the validity and interpretation of all acts of the EU institutions without exception’.Footnote ⁷³ From a more institutional perspective, the Court’s decision, as also predicted by AG Bobek in his Opinion in FBF,Footnote ⁷⁴ goes against the current evolution of the judicial system at EU level. In terms of workload, it would have made more sense to allow for a direct review of soft law measures, given the recent expansion of the General Court. That the Court confirmed that there would be a possibility to seize it in order to challenge the validity of soft law was still welcomed by Gündel,Footnote ⁷⁵ but there are at least three important constraints, inherent to the preliminary reference procedure, that require pointing out. First, the preliminary reference procedure requires a reference point in the national legal order that can be relied on to seize a national judge; second, a procedure must also be available at national level (which may not be self-evident in the realm of soft law); and third, the preliminary reference procedure is not a self-standing remedy but instead depends on the national judge referring questions.

The first two of these constraints are intertwined: concretely, a natural or legal person taking issue with an EU soft law measure will only be able to indirectly challenge this measure before a national judge if there is a national measure or conduct that is challengeable pursuant to a procedure available in national law. In the first scenario noted above in Section 14.2.3, such a reference point may not be available. This puts an acute challenge to the right of natural and legal persons to effective legal protection. The avenue to which the Court directs applicants revives the same problems that resulted from Plaumann and the Court’s response in cases like UPA and Jégo Quéré,Footnote ⁷⁶ as well as revealing a further challenge to the principle of procedural autonomy.

In the scenario where EU soft law will be followed up on or implemented at national level through further (national) soft law, this may prove problematic. While different national legal systems seem increasingly open to allow such challenges,Footnote ⁷⁷ this option still does not seem to exist in the majority of national legal systems. In addition, the requirements to be fulfilled by applicants may vary greatly between Member States. Should these differences simply be accepted in light of national procedural autonomy? That is doubtful. While national procedural autonomy should be considered a legal principle, rather than a temporary state of affairs in EU law, it is still to be balanced with other principles such as that to effective legal protection.Footnote ⁷⁸ In this regard, Arnull has noted that in the post-Lisbon era ‘the venerable principles of national procedural autonomy, equivalence and effectiveness seem to have been absorbed into a more complex matrix of rules and principles which represent a considerable intrusion into fields formerly considered the prerogative of the Member States’.Footnote ⁷⁹ In line with UPA, Unibet,Footnote ⁸⁰ and Article 19(1) TEU,Footnote ⁸¹ it would instead be up to the Member States to provide adequate remedies. Assuming that the Court will refuse to revisit its Belgium v Commission ruling, it will be up to the Member States courts to fix any resulting lacunae. This is already a significant requirement imposed on those legal systems that have not (yet) accepted the reviewability of national soft law endogenously. However, it will be most acute in those cases under a second scenario, in the vein of Jégo-Quéré, where there is no national measure (not even a soft law measure) to be contested to begin with.

The third constraint of the Court’s solution in FBF is that, under the established case law of the Court of Justice,Footnote ⁸² the preliminary reference procedure is not a self-standing remedy offered to (private) parties. It is rather an instrument through which national courts may enter into dialogue with the Court of Justice and whether preliminary references are sent to the Court ultimately depends on those national judges, not on the parties appearing before them. FBF therefore means that a genuine remedy against soft law will depend on national judges referring questions on validity to the Court of Justice.

14.3.4 Subjecting Soft Law to Administrative Review

In light of the constraints that come with the preliminary reference procedure identified in Section 14.3.3, it is important to draw attention to other possible remedies. As Jääskinen observed, there are indeed ‘alternative ways of constitutionally legitimised control structures of the use of public powers’ and ‘judicial protection is a societally and economically scarce resource which cannot be light-heartedly allocated to cases that are better dealt with [by] other types of remedies or that do not deserve the attention of courts’.Footnote ⁸³ While the possibility to seize an independent judicial tribunal would appear to be a requirement under Article 47 of the Charter, there may indeed be other (administrative) remedies available that may be more effective. Apart from the general possibility to seize the Ombudsman (when a soft law act is alleged to be vitiated by an instance of maladministration), such administrative remedies arguably ought to bear the brunt of ensuring adequate legal protection, with the judicial remedy acting as a safety valve.

The EU legislator has in the past already experimented with administrative review procedures that potentially allow soft law to be challenged. The typical constellation in which such review procedures have been established is one where an EU agency has been granted certain powers and where the Commission has been identified as the body competent to review its acts at the request of a private party. Pre-Lisbon, such clauses were included to ensure the possibility of at least some review of agency decisions, given the agencies’ unclear passive legal standing in the action for annulment.Footnote ⁸⁴ Post-Lisbon, such clauses are not strictly needed anymore, which explains why they were deleted in the 2019 revisions of the Eurofound, Cedefop, and EU-OSHA Regulations and in the 2017 European Union Intellectual Property Office Regulation.Footnote ⁸⁵ Remarkably, the revision in 2022 of the establishing regulation of the European Centre for Disease Prevention and Control (ECDC) revamped this procedure, rather than deleting it from the regulation all together.Footnote ⁸⁶ Article 28 of the ECDC Regulation now provides:

Similar mechanisms are still in place for the Community Plant Variety Office (CPVO)Footnote ⁸⁷ and for the European Food Safety Authority (EFSA).Footnote ⁸⁸ While part of the administrative appeal is modelled on Article 263 TFEU, notably the requirement that private parties need to be directly and individually concerned, the scope of the appeal seems to be broader, since any act of the agency may be referred to the Commission.Footnote ⁸⁹

In 2019, the EU legislator further experimented with this type of review mechanism by introducing Article 60a in the three Regulations establishing the European Supervisory Authorities (ESAs) in the financial sector.Footnote ⁹⁰ The new provision was introduced specifically to allow for a review of some of the soft law that the ESAs adopt.Footnote ⁹¹ Article 60a provides: ‘Any natural or legal person may send reasoned advice to the Commission if that person is of the opinion that the Authority has exceeded its competence, including by failing to respect the principle of proportionality referred to in Article 1(5), when acting under Articles 16 and 16b, and that is of direct and individual concern to that person.’Footnote ⁹² Although it has already been in force for a couple of years, this administrative review procedure has not actually been relied on yet.

For a number of reasons, it is also doubtful whether that procedure offers any genuine remedy against the ESAs exceeding their competences through the adoption of soft law. First, only individually and directly concerned persons may communicate reasoned advice to the Commission per Article 60a. This arguably makes the remedy dependent on similar standing requirements as those under Article 263 TFEU and the earlier administrative review procedures, but it is unclear how these would apply in the given context, as soft law acts cannot in principle be of direct concern to a person. After all, in the Courts’ established case law, direct concern means that a measure ‘must directly affect the legal situation of the individual and, second, it must leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from the EU rules alone without the application of other intermediate rules’.Footnote ⁹³ Since the effects of soft law are merely of a practical nature or, at the most, indirect legal effects, it seems a priori impossible for soft law to ever be of ‘direct concern’. In addition, if the Plaumann criteria would also apply mutatis mutandis, it would be almost impossible for a party to demonstrate that they are individually concerned by the ESAs’ guidelines and Q&As since these will be general in scope.Footnote ⁹⁴ This may be different for the ESAs’ recommendations, as Article 16 of the ESA Regulations provides that they may be addressed ‘to one or more [national] competent authorities or to one or more financial institutions’. Still, since direct and individual concern are cumulative conditions, the standing requirement will never be met for soft law. Unless, of course, ‘direct and individual concern’ is not to be understood in the same way as the analogous notions in Article 263 TFEU.

Second, Article 60a does not provide an actual remedy. Even if an admissible complaint were to be lodged, the Commission cannot, under Article 60a or any other provision of the ESAs Regulations, provide an actual remedy where it finds that an ESA has exceeded its competences. Only ESAs can issue and, in turn, repeal guidelines, recommendations, and Q&As and the Commission cannot give instructions to the ESAs or override the soft law, except where it has been specifically empowered to adopt delegated or implementing acts. Article 60a therefore at best represents an alert mechanism. While the attempt of the legislator to afford private parties protection against the effects of the ESAs’ soft law should be lauded, the effectiveness of Article 60a of the ESAs Regulations will be undermined by the legislator’s failure to recognise that the challenges posed by soft law represent a paradigm shift for the system of remedies. Transplanting admissibility requirements from procedures that aim at the review of hard law ignores the fundamental features characterising soft law. While administrative review of soft law seems an appropriate way forward (see below), it would have to be devised mindful of the specific features of soft law.

14.3.5 A Possible Way Forward

Building on the legislator’s recognition, in the 2019 ESAs Regulations, of the importance of a possibility to review soft law, complementing the existing EU system of remedies with a dedicated administrative review mechanism appears to be the way forward. Special attention should thereby be devoted to three issues: access to the mechanism, the nature of the adjudicating body, and the remedy provided.

As noted in the discussion of Article 60a of the ESAs Regulations, the mechanism’s admissibility requirements should take proper account of soft law’s non-binding nature and therefore not replicate those applicable under Article 263 TFEU. Instead, the mechanism could be open to parties showing an interest.

As regards the body made responsible to review soft law, the 2019 revision of the ESAs Regulations also provides interesting clues. During the legislative negotiations, the European Parliament had proposed to extend the mandate of the ESAs’ Joint Board of Appeal, making it competent to hear challenges to the ESAs’ soft law.Footnote ⁹⁵ The Parliament’s suggestion did not make it in the end, but it is interesting, nonetheless. Within decision-making EU agencies, there are already specialised and independent boards of appeal that are competent to review (individual) binding decisions.Footnote ⁹⁶ The 2019 revision thus constituted a missed opportunity to tap this potential and it would be worthwhile to revisit this possibility. For those EU agencies adopting soft law and who are already equipped with a Board of Appeal, the latter’s mandate could be broadened.Footnote ⁹⁷ Where soft law is adopted by other agencies or bodies of the EU or by the Commission itself, a variant of Article 60a of the ESAs Regulations could be envisaged where the review is entrusted to a functionally independent entity within the Commission. Just like the independent Regulatory Scrutiny Board (unilaterally established by the Commission) double-checks the soundness of the Commission’s proposals and impact assessment, so could an independent review board be entrusted with scrutinising soft law.Footnote ⁹⁸

Lastly, any mechanism should provide for a clear remedy. Given soft law’s non-binding nature, that remedy need not mimic the remedy under Article 263 TFEU, just like the admissibility requirements need not be mimicked. Instead, a requirement for the original author to reconsider the soft law in light of the reviewing authority’s remarks could also be sufficient.

15.2.1 Frontex at the Forefront of Border Surveillance

Frontex is rapidly expanding its AI capabilities. Among those currently explored are AI tools for automated border control (e.g., e-gate hardware), document scanning tools, facial recognition and other biometric verification tools, maritime domain awareness capabilities, unmanned surveillance tools (i.e., ‘towers’ planted in border regions to detect illegal border crossings), and other forms of unmanned autonomous aerial surveillance systems.Footnote ¹⁰ Two examples deserve closer inspection to illustrate how the AI uses by EU actors give rise to fundamental rights violations: automated risk assessments and AI-powered aerial surveillance.

15.2.2 The Diverse Nature of the Risks to Fundamental Rights

EU law requires that any use of AI, including by EU actors, must comply with fundamental rights enshrined in the EU Charter of Fundamental Rights and protected as general principles of EU law, irrespective of the area of AI use concerned.Footnote ⁴⁴ This emerges from the requirements of the Union as a legal order based on the rule of law, which, under Article 2 TEU, declares, among others, respect for human dignity and human rights, including the rights of persons belonging to minorities.Footnote ⁴⁵ With rapid technological progress, the use of AI as a system technologyFootnote ⁴⁶ brings about an ever greater potential for misuse, which broadly impacts human dignity and various fundamental rights deeply connected to the inviolability of a human being.Footnote ⁴⁷ This concern is broadly acknowledged within the international community and the EU,Footnote ⁴⁸ asserting that protection of human values, including fundamental freedoms, equality, fairness, the rule of law, social justice, data protection, and privacy, shall remain at the centre of placing AI into use in modern democratic societies.

Preserving human dignity in the age of AI requires that individuals retain control over their lives, including when and how they are being subjected, without knowledge or informed consent, to the use of AI. Putting humans and human dignity at the centre of the use of AI is necessary to ensure full respect for fundamental rights. It should thus be the starting point in every discussion on the development, deployment, and reliance on AI where human lives are at stake. However, as the Court of Justice repeats, fundamental rights ‘do not constitute unfettered prerogatives’.Footnote ⁴⁹ They must be viewed in light of their function within society, and, if necessary, they may be limited as long as any interferences with the rights are duly justified.Footnote ⁵⁰ Accordingly, the deployment of and reliance on AI shall be reviewed with the same set of considerations in mind: it must be legally authorised, respect the essence of specific rights, and be proportionate and necessary under the objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others (Article 52(1) CFR).

The examples of AI use by Frontex examined above exhibit the breadth of cross-cutting fundamental rights concerns occurring in AI-powered border surveillance. Three key concerns can be highlighted: the risks to privacy and data protection (Articles 7 and 8 CFR), discrimination (Article 21 CFR), and risks to other substantive rights, such as the right to asylum (Article 18 CFR).

15.3.1 The Impact of AI Use on Individuals’ Access to Remedies

Article 41 CFR guarantees to everyone the right to good administration in decisions or other legal acts adopted by EU actors. Historically, the CJEU interpreted this right as a general principle of EU law,Footnote ⁸⁴ which expanded its application wherever EU law applies. Under its umbrella,Footnote ⁸⁵ the right to good administration enshrines rights and obligations, which hold at their core the enabling role for legal accountability in public conduct. On the one hand, the right demands that the authorities act fairly, impartially, and within a reasonable time. On the other hand, it obliges the authorities to present sufficient reasons substantiating their acts vis-à-vis the affected persons. In TUM, the Court formulated the interplay of good administration requirements as ‘the duty of the competent institution to examine carefully and impartially all the relevant aspects of the individual case’ prior to decision-making.Footnote ⁸⁶ In Nölle, the Court further recognised this duty of care as an individual right arising from the clear, precise, and unconditional obligation in Article 41 CFR.Footnote ⁸⁷ The authorities’ compliance with their duty of care obligations ensures that the affected person understands the evidentiary basis of the decision in order to decide whether or not to seek remedies against it. As an essential procedural requirement,Footnote ⁸⁸ failure to comply with the duty of care obligations may lead to the annulment of the decision.Footnote ⁸⁹

It is in its defence-enabling function that the right to good administration also becomes central to remedial possibilities against the AI-driven EU conduct. In this context, compliance with the good administration requirements faces significant obstacles. The opacity of algorithmic risk assessments, exemplified in the ETIAS authorisation process, poses substantial challenges to the authorities’ ability to reason their decisions and ensure that these are based on factually correct, relevant, and complete information. As explained above, any of the 1.4 billion visa-exempt citizens that apply through the ETIAS website will be automatically screened for any suspicion of posing serious threat to public security. This suspicion will be found to exist whenever an automated processing of the traveller’s application results in a hit against pre-determined risk criteria in conjunction with an automatic comparison with millions of alerts stored in other EU information systems. If the process results in a hit, the competent authorities will have to manually review the data, ensuring the possibility to contradict the automated result, in view of their duty of care obligations. This requirement of human intervention ensures that each rejection of travel authorisation is not a decision based solely on automated processing of personal data (Article 22(3) GDPR).

However, to what extent will the manual review verify the correctness, relevance, and completeness of the information so as to uncover whether or not the hit was, for instance, due to discriminatory profiling by the pre-screening algorithm? This question does not permit an easy answer,Footnote ⁹⁰ especially considering the context in which the manual reviews will take place: namely, time-pressured (the ETIAS rules estimate a response within a few days where manual verification is required), without sufficient AI expertise of the officials, and facing other constraints, such as well-documented automation and confirmation biases in manual reviews,Footnote ⁹¹ coupled with a limited access to the training data underpinning the risk assessment algorithm.

The diminished potential to meet the requirements of good administration in the AI-powered decision-making will have direct implications for the individuals’ access to effective remedies. In fact, in its jurisprudence, the CJEU often equates the requirements of reasoning under the right to good administration to the requirements of an effective remedy under Article 47 CFR.Footnote ⁹² Their interplay, according to the Court, lies in enabling the person to ascertain the reasons upon which the decision is based, ‘so as to make it possible for him or her to defend his or her rights in the best possible conditions’.Footnote ⁹³ Individuals will only be able to defend themselves when it is indeed possible to understand the relevant decision and the process under which it was taken. Additionally, the Court recognises the significance of reasoning for ability of judges and other supervisory authorities to exercise effective review. Indeed, these concerns are reflected in the regulation of AI – the AI Act, which brings about specific transparency requirements intended to facilitate the AI users’ ability to act with a meaningful human control over AI-generated outputs.

Before turning to the AI Act, it remains to be stressed that judicial remedies are rather limited in the context of AI-powered conduct based on composite administrative procedures involving actors at EU and Member State levels.Footnote ⁹⁴ The courts’ jurisdiction to review AI-driven decision-making is territorially limited and constrained by the narrow notion of what constitutes a reviewable act.Footnote ⁹⁵ On the one hand, the former prevents individuals from challenging the conduct of the EU actors directly before the Court of Justice when the responsibility lies with the national authorities, such as in case of refusals to ETIAS applications or illegal pushbacks of migrants.Footnote ⁹⁶ The staff of the competent ETIAS National Unit will need to manually review the automated refusals, hence exercise final discretion.Footnote ⁹⁷ Also, where an ETIAS ARA results in a hit with the information entered by Europol, the ETIAS Regulation only establishes a consultation procedure between the Europol and the responsible Member State.Footnote ⁹⁸ Under this procedure, Europol must provide the responsible Member State with a ‘reasoned opinion on the application’.Footnote ⁹⁹ Nonetheless, the final decision – hence final discretion – lies with the Member State concerned. Accordingly, complaints against potential discriminatory effects of the ETIAS algorithm in these circumstances might thus only be raised before the courts of that State, without the possibility of uncovering the factual basis of the information supplied by Europol and relied on in the refusal decision.

On the other hand, these potential discriminatory effects of the underlying risk criteria might not be deemed to produce legal effects to trigger justiciability of the ARA. Indeed, pursuant to the requirement of ‘direct and individual concern,’ the impact of the discriminatory effect might not occur for each person whose application had been refused by the ETIAS ARA.Footnote ¹⁰⁰ Accordingly, as argued elsewhere,Footnote ¹⁰¹ construing reviewability in a similar context needs to reflect the underlying automation and output biases if we expect EU law to guarantee sufficient legal protection to the affected individuals. Yet, for now, EU law does not recognise the impact of the screening algorithm on the final decisions taken by the Member States.Footnote ¹⁰² As such, for now, there seems to be no possibility of direct judicial remedy against the Frontex-based ETIAS Central Unit for its role in the development and deployment of the ETIAS risk criteria algorithm.

15.3.2 Unwrapping the Remedial Possibilities under the Upcoming AI Act

In 2018, EU legislators embarked on the process of designing specific rules governing develoment and use of artificial intelligence systems in the EU, that would ensure, inter alia, full respect for fundamental rights.Footnote ¹⁰³ The efforts culminated in the proposal for a horizontal regulation of AI – the AI Act.Footnote ¹⁰⁴ Central to this is the EU’s self-proclaimed ‘human-centric approach to AI’, which shall ‘strive to ensure that human values are central to the way in which AI systems are developed, deployed, used and monitored, by ensuring respect for fundamental rights’.Footnote ¹⁰⁵

That the human-centric Act will mitigate the above-identified risks to fundamental rights should, however, not be taken for granted. With the legal basis set in Article 114 TFEU,Footnote ¹⁰⁶ the AI Act will first and foremost ensure safe operation of AI systems on the EU’s internal market (Article 1). The Act’s pledge to guarantee respect for fundamental rights is arguably manifested in its ‘risk-based approach’. On the most basic level, the Act differentiates between ‘prohibitions of certain [AI] practices’ and ‘specific requirements for high-risk AI systems’ (Article 1(2)). The former include systems using subliminal techniques beyond a person’s consciousness (manipulation), uses of AI that may exploit vulnerable individuals (Article 5 (a) and (b)), or the real-time biometric identification systems in publicly accessible spaces for law enforcement purposes, except where duly authorised (Article 5(c)).Footnote ¹⁰⁷ According to the latest text, the list of high-risk systems in Annex III should be amended to consider the impact of the AI use on the relevant action or a decision to be taken.Footnote ¹⁰⁸ Ultimately, the concept of risk to fundamental rights underpinning the AI Act’s approach is defined as ‘the combination of the probability of an occurrence of harm and the severity of that harm’.Footnote ¹⁰⁹

Although far from settled, the final elaboration of the prohibited and high-risk AI uses will determine the extent to which the AI Act can provide some form of fundamental rights protection also in the context of AI uses by the EU actors. Yet, as we await clarity on the AI Act’s final shape, one aspect is clear: the AI Act will need to be applied in conjunction with the existing EU law, including the rules on remedies and existing data protection rules, wherever the system relies on, among others, processing of personal data. Accordingly, the following discussion highlights two key aspects, which will be determinative for the protection of fundamental rights from the risks posed by the EU’s AI uses: first, the scope of application of the AI Act to the EU actors’ use of AI and, second, the interplay and main discrepancies between the AI Act’s substantive rules and the data protection rules.