1. On 12 April, the Secretary to the Cybercrime Convention Committee (T-CY), Mr Alexander Seger requested a legal opinion on the following:

• What would be the legal and policy implications of and what would be the arguments for or against an EU-specific disconnection clause (e.g. along the lines of article 40 of the Convention on Trafficking in Human Beings of 2005) as opposed to article 39 of the Budapest Convention?

Background

2. In June 2017 the T-CY decided to undertake the preparation of a second additional protocol to the Budapest Convention on Cybercrime. This decision was based on the recommendations of the T-CY Cloud Evidence working group from 2015 to mid-2017 and the earlier work of the T-CY Transborder working group from 2012 to 2014.
3. The protocol is to contain provisions for:

• more effective mutual legal assistance;

• direct cooperation with service providers, including production orders for subscriber information to be issued directly to a service provider in another Party;

• extending searches transborder;

• conditions and safeguards, including data protection requirements.

4. The protocol is being drafted by a T-CY Protocol Drafting Group - with subgroups for specific provisions - consisting of experts appointed by the parties to the Budapest Convention. The proposals prepared by this Group are submitted to the T-CY Protocol Drafting Plenary.
5. In April 2018, the European Commission published its e-evidence proposals for:

• An EU Regulation on a European Production and Preservation Order;

• A complementary Directive on the establishment of legal representatives of service providers within the EU which could be served with the orders.

6. These proposals have been inspired by the work of the T-CY.
7. As a result, both the EU e-evidence proposals and the protocol cover direct production and preservation orders. The EU proposals go further in that they cover also the production of content and traffic data, while the protocol is likely to be limited to the production of subscriber information (although its exact scope is not yet determined).
8. The European Commission and other EU institutions are observers in the Protocol Drafting Plenary. The European Commission is participating with “ad-hoc experts” in the meetings of the Protocol Drafting Group. Both the Protocol Drafting Plenary and Group have underlined the need to ensure consistency between the e-evidence proposals and the protocol.
9. On 5 February 2019, the European Commission published a Recommendation for a Council Decision authorising the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185). These draft “negotiation directives” are likely to be finalised and approved by the JHA Council by June 2019.
10. The Annex to the Recommendation provides under the heading “Relation with EU law and other (possible) agreements”:

“(d) It should be ensured that the Second Additional Protocol contains a disconnection clause providing that the Member States shall, in their mutual relations, continue to apply the rules of the European Union rather than the Second Additional Protocol.

(e) The Second Additional Protocol may apply in the absence of other more specific international agreements binding the European Union or its Member States and other Parties to the Convention, or, where such international agreements exist, only to the extent that certain issues are not regulated by those agreements. Such more specific international agreements should thus take precedence over the Second Additional Protocol provided that they are consistent with the Convention’s objectives and principles.”

11. The Budapest Convention contains the following general clause in article 39 (2):

“Article 39 – Effects of the Convention

…

2 If two or more Parties have already concluded an agreement or treaty on the matters dealt with in this Convention or have otherwise established their relations on such matters, or should they in future do so, they shall also be entitled to apply that agreement or treaty or to regulate those relations accordingly. However, where Parties establish their relations in respect of the matters dealt with in the present Convention other than as regulated therein, they shall do so in a manner that is not inconsistent with the Convention’s objectives and principles.

3 Nothing in this Convention shall affect other rights, restrictions, obligations and responsibilities of a Party.”

12. After having recalled the use of so-called ‘disconnection clauses’ in the Council of Europe and the study by the Committee of Legal Advisers on Public International Law (CAHDI), the legal opinion will examine the pros and cons for the use of such a clause in the second additional protocol. The final part will deal with wider legal and policy considerations.

Use of disconnection clauses in the Council of Europe treaties

13. The so-called ‘disconnection clauses’ declared purpose is to safeguard the application of EU law between EU member states against potentially diverging provisions of an international treaty. They constitute conflict clauses added to treaties with the view to regulate potential conflicts between EU law and the treaties in question.
14. Disconnection clauses have been used in a number of Council of Europe treaties since the late 1980s (see ‘Examples of Conventions containing a disconnection clause’, Appendix 2 to the Committee of Legal Advisers on Public International Law (CAHDI) Report on the consequences of the so-called "disconnection clause" in international law in general and for Council of Europe conventions, containing such a clause, in particular). The most recent version of the clause has been introduced in the three 2005 Conventions – Council of Europe Convention on the Prevention of Terrorism (CETS No. 196), Council of Europe Convention on Action against Trafficking in Human Beings (CETS No. 197) and Council of Europe Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime and on the Financing of Terrorism (CETS No. 198), see for example article 40 (3) of the Convention CETS No. 197:

“Parties which are members of the European Union shall, in their mutual relations, apply Community and European Union rules in so far as there are Community or European Union rules governing the particular subject concerned and applicable to the specific case, without prejudice to the object and purpose of the present Convention and without prejudice to its full application with other Parties.”

15. In relation to article 40 (3), upon the adoption of the Convention, the European Community and the member states of the European Union, made the following declaration:

“The European Community/European Union and its Member States reaffirm that their objective in requesting the inclusion of a “disconnection clause” is to take account of the institutional structure of the Union when acceding to international conventions, in particular in case of transfer of sovereign powers from the Member States to the Community.

This clause is not aimed at reducing the rights or increasing the obligations of a non-European Union party vis-à-vis the European Community/European Union and its Member States, inasmuch as the latter are also parties to this Convention.

The disconnection clause is necessary for those parts of the convention which fall within the competence of the Community / Union, in order to indicate that European Union Member States cannot invoke and apply the rights and obligations deriving from the Convention directly among themselves (or between themselves and the European Community / Union). This does not detract from the fact that the Convention applies fully between the European Community/European Union and its Member States on the one hand, and the other Parties to the Convention, on the other; the Community and the European Union Members States will be bound by the Convention and will apply it like any party to the Convention, if necessary, through Community / Union legislation. They will thus guarantee the full respect of the Convention's provisions vis-à-vis non-European Union parties.”

16. In 2008, ‘disconnection clauses’ were the subject of a detailed report by the CAHDI, Report on the consequences of the so-called "disconnection clause" in international law in general and for Council of Europe conventions, containing such a clause, in particular) which concluded that:

• i. “The existing ‘disconnection clauses’ are legally valid.

2. They do not cover the relations between EU Member States and other parties to conventions. Therefore, they may not be interpreted or applied in a way that would change the contents of rights and obligations of EU Member States vis-à-vis other parties.
3. Recent versions of the clauses stipulate that any EU regime that is different from the one established by the convention in question shall be without prejudice to the object and purpose of the convention. In order to assess whether this is the case, it is advisable to ensure that all parties to a convention are able to identify the applicable EU/EC rules. Given the practice within the Council of Europe of producing detailed explanatory reports to accompany its conventions, the nature, scope and function of any ‘disconnection clause’ should be set out in the explanatory report.
4. The need for, and precise scope of, any ‘disconnection clause’ should be assessed on a case-by-case basis, taking into account the nature and content of the convention in question.
5. The experience of EC participation in UN conventions may be helpful. Where the Community participates in a convention alongside its Member States, the need for a disconnection clause may fall away. Community participation may help to ensure the coherence of the relevant treaty regime; the fact that both the Community and its Member States are parties would ensure that the convention would be fully implemented. Community participation should therefore be encouraged when appropriate in a case.”

17. In practice, the most recent Council of Europe treaty which contains such a clause is the Council of Europe Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse (CETS 201, opened for signature on 1 July 2007). Since 2007 the clause has not been used any more, although several conventions covering aspects of EU law have been concluded.^[1] The Amending Protocol to Data Protection Convention 108 (CETS 223), which was opened for signature in October 2018, uses a special clause, but only in the context of transborder data flows. It enables parties to refuse the transfer of personal data if they are “bound by harmonised rules of protection shared by States belonging to a regional international organisation.”[2]
18. Apart from the case C-222/94^[3] relating to transfrontier television, where the CJEU confirmed that EU member states are not entitled to invoke treaty obligations in order to justify non-compliance with conflicting standards contained in an EU directive, the Council of Europe Secretariat is not aware of any instance where this clause has actually been applied, invoked or relied upon by the EU or its member states.^[4] Actual practice is however difficult to ascertain because the clauses work automatically; there is no need for any further act, declaration or notification to the other parties or the Council of Europe to activate them.

An EU-specific disconnection clause in the context of the second additional protocol to the Budapest Convention

19. As a premise, it should be noted that EU policies and legislation on cybercrime are relying on the Budapest Convention which is part of the EU acquis.[5] EU member states have transposed its substantive and procedural provisions into their domestic law.
20. The second additional protocol may affect common EU rules. The above-mentioned Recommendation recalls in its preamble that the European Union has adopted common rules that overlap to a large extent with the envisaged elements being considered for inclusion in the second additional protocol. These include in particular legal instruments to facilitate judicial co-operation in criminal matters, to ensure minimum standards of procedural rights, as well as data protection and privacy safeguards. While the EU may thus have a legitimate interest to clarify that treaty obligations among EU member states will be implemented through EU law rather than by each EU member state individually, the wording used in disconnection clauses appears to be somewhat broader.
21. EU-specific disconnection clauses provide a guarantee that only EU law, whether existing or future, will be applied as between EU member states. It must however be taken into account that the Budapest Convention already contains a provision which should meet the concerns of the European Union not to compromise its normative acquis or the autonomy of its legislative process. Article 39 (2) of the Budapest Convention was specifically adopted with the intention that the Convention should supplement and not supplant multilateral and bilateral agreements and arrangements between parties. It foresees that the parties may supplement its provisions by more detailed bilateral agreements or otherwise establish their relations “in a manner that is not inconsistent with the Convention’s objectives and principles” (article 39 (2) in fine). Article 39 has worked well for many years, permitting the European Union and its member states to make full use of the Budapest Convention and EU law.
22. Article 39 of the Budapest Convention will apply to the new additional protocol. It is unnecessary to repeat its provisions in the new protocol. It is established Council of Europe treaty practice to have just one general clause in additional protocols declaring the general provisions of the mother convention applicable. This is the case of the (first) Additional Protocol to the Cybercrime Convention (CETS 189). Article 8 of the (first) Additional Protocol (CETS 189) does not mention article 39 of the Budapest Convention because, unlike the second additional protocol, it only dealt with substantive criminal law and not with cooperation procedures or mechanisms. Since the obligation to criminalise acts of a racist or xenophobic nature is of absolute nature, there was no need to mention article 39. To give another example, the Council of Europe Convention on the Prevention of Terrorism (CETS No. 196) contains a clause on relations with other treaties and EU law in article 26 (3). The Additional Protocol to this Convention (CETS No. 217) does not contain such a clause, but only a general provision on the relations between this Protocol and the Convention (article 9). If necessary, the protocol’s explanatory report can be used to explain the application of article 39 (2) of the Budapest Convention in respect of EU law.
23. As long as the objective and purposes of the protocol are respected, the EU will have full discretion to develop its own internal law and will not be prevented from adopting for example legislation providing for ‘European Production Orders,’ the scope of which will presumably be wider than the legal instruments/orders foreseen in the protocol.
24. Finally, it should be taken into account that Council of Europe standards are as a rule consistent with EU standards as both organisations share the same values and goals. In addition, another general principle of treaty law allows parties to apply higher standards than those contained in the treaty

Wider legal and policy implications

25. The use of a disconnection clause in the second additional protocol may have wider legal and policy implications. As highlighted by the International Court of Justice, the fact “that a question has political aspects does not suffice to deprive it of its character as a legal question.”[6] This opinion is not concerned with the political nature or the motives which may have inspired the request for a disconnection clause. It will address wider legal and policy implications exclusively from the angle of public international law and Council of Europe treaty practice, as well as, more specifically, of the second additional protocol’s subject-matter and its relation to the proposed e-evidence legislation.
26. In this context, it should be noted that it is not possible to definitively assess the legal and policy implications of a disconnection clause without knowing the exact wording of the clause that the EU will propose. This difficulty is compounded by the fact that the actual scope of the second additional protocol has not been agreed yet, and that EU rules on matters falling within the scope of the protocol, or related to it, are currently under development.

1. International law and Council of Europe treaty practice

27. Taking a broader approach, it must be recalled that disconnection clauses have been used almost exclusively in Council of Europe conventions and only very exceptionally at a more global level.[7] Generally, on an international level, such clauses have been met with resistance. In particular, the European Union was unable to introduce a disconnection clause in the WTO Agreements, as it was felt that the full participation of member states would be undermined.[8] Thus, the reintroduction of the disconnection clause after many years (the last use in a Council of Europe treaty dates back to 2007, see paragraph 17 above) would create a negative precedent, especially so since it is unnecessary from a legal point of view.
28. In 2006, the International Law Commission Study Group Report on Fragmentation of International Law noted the ambiguity of disconnection clauses. It suggested that this practice raises doubts about the equal application of treaty norms between parties,^[9] possibly enabling the EU and its member states to derogate from the provisions of the treaty.
29. For the ILC concerns regarding so-called ‘disconnection clauses’ arise from the exclusiveness given only to some parties of the treaty, possible uncertainties of other parties on the precise content of relevant EU law and that this law might be subject to changes that could lead to a negative derogation of the convention in the relations between states parties.^[10] Moreover, the clause does not indicate as to whether and how it should be applied when a convention has been ratified by all or some EU member states but not by the EU as such (which is precisely the case of the Budapest Convention which is not open for signature of the EU). These questions do not affect the validity of the clause provided that all parties consent to its inclusion when adopting the treaty. However, the parties might not have agreed to later modifications of EU rules that would substantially deviate from the treaty in question.
30. The use of disconnection clauses has been criticised by the Parliamentary Assembly of the Council of Europe,[11] non-governmental organisations[12] and legal doctrine.[13] As Jan Klabbers observed in 2009, “[a]s a political choice among political choices, the EC is, of course, fully entitled to do so. Still, on occasion the choice for having Community law prevailed is a rather parochial one, which would not be tolerated if coming from a state. Surely, not even the United States would insist on fencing off its domestic law from international law without being subjected to severe critiques. It is ironic then that Europe, so often depicted as supportive of international law, fares little better when the chips are down.”[14]
31. Another argument pleading against the use of an EU-specific disconnection clause can be deduced from general rules of treaty law. In the same way as a state must not invoke the provisions of its internal law for not implementing a treaty (article 27 of the 1969 Vienna Convention on the Law of Treaties), the European Union should not invoke EU Law to justify the non-application of the rules of a treaty.
32. Disconnection clauses need to be drafted in clear and specific terms. In any case, the preferred and established practice would be to refer to the final clauses of the Budapest Convention, which apply also to additional protocols (including article 39 (2) and the relevant parts of the explanatory report) rather than including a separate ‘disconnection clause’ in the second additional protocol when it does not exist in the Convention.

1. The second additional protocol and EU law

33. As regards the material scope of the second additional protocol, it must be taken into account that the precise scope of direct production orders under the protocol is not yet definitively defined. Whilst the EU’s proposed e-evidence regulation will apply, under article 3, to all service providers that offer services in the Union, including those service providers that are not established in the EU, the second protocol’s application may have a wider scope. It may for example not be required that the service provider offers services in the party whose law enforcement authorities seek the subscriber information. In such a case, the Budapest Convention could act as a basis for facilitating the exchange of information that could not otherwise be obtained through the EU’s e-evidence proposals as proposed by the European Commission.

Conclusion

34. Forming a value-based partnership, the European Union and the Council of Europe have a shared responsibility for upholding the coherence and efficiency of their respective legal frameworks. Against this background and taking into account the object, purpose and content of the Budapest Convention, the inclusion of an EU-specific disconnection clause in the second additional protocol appears to be both legally unnecessary and counterproductive from a policy point of view.
35. Disconnection clauses have the potential to create unnecessary divisions between the parties and legal uncertainty about applicable standards. Their use in the second additional protocol is moreover unnecessary because article 39 of the Budapest Convention adequately meets the European Union’s concerns to preserve its legal order. Instead of disconnecting, the European Union and its member states should fully take advantage of the existence of a well-functioning multilateral instrument encompassing 63 state parties worldwide, including most important strategic partners.
36. A more detailed analysis of the possible impacts of an EU-specific ‘disconnection clause’ can only be made once the actual wording is submitted. In the meantime, given the risks inherent in the use of such clauses and the lack of proven benefits and indeed need for such clauses in the framework of Council of Europe treaties, the drafting committee should be discouraged from introducing an EU-specific disconnection clause in the text of the second additional protocol to the Budapest Convention. The onus is on the EU (European Commission) to explain to the parties to the Budapest Convention why a reference in the second additional protocol to article 39 (2) of the Convention, in line with international law, would not be sufficient.