UK-EU security cooperation after Brexit Contents


34.Europol is an EU law enforcement agency based in The Hague in the Netherlands, providing support and coordination functions to Member States and non-EU partners. It employs more than 1,000 members of staff and around 100 crime analysts, and serves as a hub for over 200 liaison officers from 42 Member States and operational partners, including third countries.25 Europol supports over 40,000 international criminal investigations every year, with a focus on illicit drugs, human trafficking, cybercrime, smuggling, fraud, money laundering, organised criminal groups and terrorism.26 Established in 1999, it formally became an EU agency in 2009. It has been led since then by the British ex-MI5 analyst Rob Wainwright, whose term of office ends in May.27 Europol’s services and support tools include information exchange, such as through SIENA, its secure messaging platform, and intelligence and forensics analysis, including generating and processing cyber-intelligence.28

35.David Armond, then Deputy Director General of the National Crime Agency (NCA), told our predecessors that Rob Wainwright has transformed Europol into a much more effective organisation, which is now “unrecognisable from the one that went before”, and that “most of the systems that make Europol effective are a complete lift and shift from the UK intelligence model.” The Government has frequently emphasised the importance of the UK’s role in Europol. Its future partnership paper said that Europol’s intelligence model and its counter-terrorism internet referral unit are both based on British models; that the UK was a “key instigator” in the creation of the Joint Cybercrime Action Taskforce, which leads and coordinates cybercrime campaigns; and that over 7,400 British intelligence contributions have been made to Europol Analysis Projects.29 As of September 2017, the UK was participating in at least 40 Joint Investigation Teams (JITs) supported by Europol and Eurojust, the EU agency responsible for coordinating cross-border investigations and prosecutions.30 Successful JITs have resulted in many arrests for cross-European criminal operations, including serious offences linked to human trafficking and child sexual exploitation.31 The UK has 49 British Europol officers and staff, as well as 17 liaison officers, which Rob Wainwright said resulted in “greater leverage and influence on a day-to-day basis on the way in which Europol works”.32

36.The Government said recently that Europol’s cross-EU analysis and expertise has enabled it to “pick up links and patterns in order to expose widespread criminality that would not have been within any single country’s capacity to identify”.33 David Armond stated that the presence of British liaison officers in The Hague is one of the most important functions: if an officer hears that an operation needs to be “planned and run today”, they can “quickly get a meeting with four other member states [and] put together an operational plan [ … ] which would have taken months before the bureau existed.”34

Existing third country models

37.Europol has a strong record of operational cooperation with non-EU countries, although its membership is limited to EU Member States. It has two distinct forms of partnership with third countries: ‘strategic agreements’, which provide for the exchange of general intelligence and strategic and technical information, and more extensive ‘operational agreements’.35 Its 20 operational partners, which include the USA, Switzerland and Australia, as well as agencies such as Interpol and Frontex, can access many Europol services, station liaison officers at the Europol headquarters, and access Europol’s messaging facility, SIENA.36 Operational partners do not generally contribute regular members of Europol staff, and do not sit on the Europol Management Board, so they have no formal say in the strategic priorities or direction of the agency. Third countries cannot lead operational projects, but can join them, subject to the unanimous agreement of all Member States.37

38.A significant difference between full membership and operational partnership is the level of access provided to Europol’s main database, the Europol Information System. Rob Wainwright told our predecessors that full members have direct access “even from the field—for example, in terminals around the United Kingdom” and the NCA has since told us that there are 217 British officers trained to access the EIS from the UK.38 In contrast, Mr Wainwright said, third countries can only “channel information and make inquiries of our database”.39 This results in some delays in accessing the information, because the request to search the database comes, for example, “from Washington DC to the representative in our head office. He passes it on to our unit and we find a hit and it comes back down the channel; so there is a time lag.”40

39.The NCA’s evidence also suggested that the UK’s day-to-day relationship with Europol would change drastically if British officers could no longer lead operational projects. David Armond said in December 2016 that the EU policy cycle had determined 13 priority crime areas, and that the UK was leading four of those, with “co-driver status in a number of others”.41 The NCA’s recent evidence stated that the UK currently has ‘project driver’ status in two priorities and co-driver status in a further four, and is leading 25 of the 150 operational actions planned for 2018.42 Existing partnership models would not allow the UK to lead Europol operations after Brexit.

40.Europol’s existing operational agreements were concluded before its current legal framework—the Europol Regulation—came into effect. Mr Wainwright pointed out that the UK might be the first country to seek operational cooperation with Europol under the new arrangements; as a result, “it will no longer be a tried and tested route: effectively, the UK will have to test a new procedure”.43 He explained that the new Regulation provides for “two possibilities”: either for the EU to conclude an international agreement with a third country, including a justice and home affairs chapter; or, alternatively, for the Commission to make a data adequacy decision. He said that either of these scenarios would enable Europol to conclude an “operational arrangement” with a third party.44 Since then, the Commission has put forward recommendations for eight Council Decisions, which would authorise it to negotiate agreements enabling Europol to exchange personal data with the law enforcement authorities of eight countries, including Turkey, Israel and Lebanon.45

41.Existing operational agreements between Europol and third countries allow for extensive cooperation across a number of areas, including considerable access to Europol products and a physical presence at Europol headquarters. However, such arrangements fall significantly short of the full membership currently enjoyed by the UK. It is clear that an operational agreement between the UK and the EU after Brexit, based on existing third country models, would represent a significant diminution in the UK’s security capacity.

Existing ‘bespoke’ relationships

42.The UK Government has set out its intention to seek a “bespoke relationship” with Europol, above and beyond any current relationship between the agency and a third country. The only precedent for a deal beyond an operational agreement, but falling short of full membership, is the relationship between Denmark and the agency. Crucially, however, Denmark has negotiated a bespoke arrangement while remaining an EU Member State: it was forced to renegotiate its relationship with Europol last year, after Danish voters rejected a proposal that would have allowed its continued membership.

43.In a referendum held in December 2015, Danish voters decided to maintain their opt-out of EU criminal justice and police cooperation measures, including the proposed new Europol Regulation, so the Danish Government sought an operational agreement with Europol. This was concluded quite rapidly—Rob Wainwright said that it was “a matter of months”, although he noted that it was “a very different case to that of the United Kingdom, not least because Denmark is not leaving the EU”.46 Danish officers can access Europol data through a 24-hour “contact point”, with information exchange taking place “without delay”. They do not have direct access from the field. Neither does Denmark have a full place on the Management Board—it “may be invited” to attend meetings, but without the right to vote.47

44.When the Danish agreement was concluded, the European Commission said that it was a “tailor-made” solution, “allowing for a sufficient level of cooperation, including the exchange of operational data and the deployment of liaison officers”. It added: “Being fully in line with European data protection rules, Denmark will have a unique status which will allow for much closer ties with Europol without amounting to full membership”.48 Rob Wainwright noted that the Danish deal is a “hybrid arrangement [ … ] , somewhat between a full member and a third party”, which recognises that Denmark is not leaving the European Union.49 The deal requires Denmark to recognise the jurisdiction of the CJEU, although its EU membership brings it under the Court’s jurisdiction anyway. In 2016, Reuters reported that Denmark had sought a “parallel deal” to allow it to retain the same relationship with Europol as full members, but the Vice-President of the European Commission, Frans Timmerman, had told a Danish broadcaster:

I‘m afraid not. You can’t be slightly pregnant, you’re either pregnant or you’re not. If you vote to be out of Europol, you’re out of Europol. I don’t see on the basis of the legal situation any alternative for that, [ … ] The vote of the Danish people was very clear, and the consequence of that vote is that Denmark will not be in Europol.50

45.There are no direct comparators for the relationship with Europol that the UK is seeking. Denmark’s operational agreement with Europol is the best precedent, short of full membership, which is reserved for EU Member States. It allows the country better access to databases and data sharing than other operational partners, and the ability to attend meetings of the Management Board as a non-voting observer. Under this arrangement, Denmark fully respects the direct jurisdiction of the CJEU. It nevertheless falls short of full membership, and does not give it direct access to the agency’s main database, even though it remains a full EU Member State.

Prospects of a ‘bespoke’ deal for the UK

46.Evidence from the NCA demonstrates the extent of the UK’s contribution to Europol intelligence and operations. During 2017, the UK sent and received almost 47,000 messages through Europol channels. In 2016, it was the highest contributor to Europol serious organised crime analysis projects and the second highest contributor overall (after Germany). British intelligence is the highest contributor of information related to firearms, child sexual abuse and exploitation, money laundering, cybercrime and modern slavery, and the UK is the second-highest contributor to the Organised Immigration Crime Analysis Project.51

47.Nevertheless, neither Mr Wainwright nor Mr Armond were optimistic about the chances of the UK obtaining the ‘bespoke’ deal on Europol desired by UK Government. David Armond told our predecessors that his “early informal soundings with officials” had indicated that “there are no bespoke deals to be done”: the UK could either have an operational agreement like the USA and Australia, or a strategic arrangement like Russia, China and Turkey—and that the latter would bring “almost no operational tactical intelligence sharing”.52 Despite the UK’s dominant role within the agency, Mr Wainwright said:

[ … ] I would not expect the full membership rights that are currently given to member states of Europol to be granted to any current or future non-member of Europol. I would expect the qualitative difference that exists today to continue to exist, in one way or another, in any future arrangements with non-EU member states.53

48.Academic witnesses were similarly sceptical about the prospects for a closer relationship than other operational partners have achieved. Michael Levi, Professor of Criminology at Cardiff University, told our predecessors that he would be “astonished if we had a deal in which we had direct access to Europol databases”;54 Steve Peers, Professor of EU Law at the University of Essex, said that “I do not know of any EU agency which has non-EU countries with places on the management board”;55 and Valsamis Mitsilegas, Professor of European Criminal Law at Queen Mary University of London, said that he found it “hard to see how the UK will retain its unlimited access to the Europol intelligence products, as a third country”.56 Sir Alan Dashwood QC, Emeritus Professor of European Law at the University of Cambridge, was more optimistic, but he agreed with his fellow witnesses that a relationship akin to full membership would require the UK to accept the full jurisdiction of the CJEU.57

49.In particular, the new legal framework for Europol, the Europol Regulation (effective May 2017) gives the CJEU jurisdiction over any arbitration relating to a Europol contract. It also allows the European Data Protection Supervisor (EDPS) to oversee the processing of personal data by Europol, and allows the EDPS to refer a matter to the CJEU, or intervene in actions brought before the CJEU.58 The Prime Minister’s Munich speech suggested that the Government would be willing to “respect the remit of the European Court of Justice” when participating in EU agencies.59

50.The Commission’s emphasis on “European data protection rules” within its statement on the Danish agreement also highlights the potential importance of data adequacy to the UK’s future relationship with Europol (a process elaborated upon in Chapter 5 of this report). Professor Peers said that “Europol is quite closely connected to other EU legislation on data sharing”, so “it might be difficult to think about a deal on Europol access in isolation”.60 The fact that the Commission is seeking to negotiate agreements to allow Europol to exchange personal data with a further eight non-EU countries, including Egypt, Morocco and Tunisia, suggests that some level of post-Brexit data exchange is likely to be achievable. What is less clear is whether it will allow the UK direct access to Europol databases.

51.Rob Wainwright pointed to a concern within Europol at the prospect of a relationship with the UK that did not incorporate direct access to data. He said that the UK is “one of the most active users of our platforms”, so channelling its requests “on a daily basis” would “create an enormous burden on the organisation”. As a result, he said, some “business imperative” might influence the position taken by the Commission in the Brexit negotiations.61

52.Europol is the jewel in the crown of EU law enforcement cooperation. Under the able and effective leadership of its current Director, Rob Wainwright, it has become an invaluable tool in the fight against international terrorism, serious organised crime and cybercrime. In an increasingly interconnected world, with many serious crimes crossing borders or taking place online, it has never been more vital for UK law enforcement agencies to work in partnership with their counterparts across Europe. From the evidence received, it is clear to us that there can be no substitute for UK access to Europol’s capabilities and services, and that maintaining this should be a key priority in the Brexit negotiations.

53.The UK Government should do all it can to achieve the negotiating objective of a future relationship with Europol that maintains the operational status quo in full. It is therefore welcome that the Prime Minister has indicated willingness to accept the remit of the CJEU in this area. The commitments she has given suggest that if the UK and Europol are in dispute in future, the CJEU would be the ultimate arbiter. We welcome this flexibility in the Prime Minister’s approach, as a way of ensuring continued security cooperation, which is in the interests of both the UK and the EU. For the operational status quo to be maintained, the future relationship must provide for more than Europol’s operational partnership with Denmark, including:

54.Although it would be premature to second-guess the outcome of negotiations, the evidence we have received leaves us concerned that it will be difficult for the UK to achieve a relationship with Europol which is closer than Denmark was able to obtain. We hope that the volume of data exchanged between the UK and Europol might enable a bespoke mechanism to be negotiated, to avoid delays in the UK and EU’s ability to share vital crime-fighting data. We urge the Government to make the security relationship a priority in the negotiations, and to work proactively to develop bespoke arrangements, in order to minimise the risks generated by the UK’s possible relegation from a leading member of Europol to an operational partner of the agency.

25 Europol website, About Europol, accessed February 2018

26 Europol website, About Europol, accessed February 2018

27 Council of the EU press release, Coreper puts forward Catherine De Bolle as new executive director of Europol, 6 December 2017

28 Europol website, Services & Support, accessed February 2018

31 Europol website, Joint Investigation Teams - JITS, accessed February 2018; and HM Government, Security, law enforcement and criminal justice: a future partnership paper, 18 September 2017

32 Oral evidence taken on 7 March 2017, Q141

34 Oral evidence taken on 6 December 2016, Q36

35 Europol website, Partners & Agreements, accessed February 2018

36 Oral evidence taken on 7 March 2017, Q141

37 Oral evidence taken on 7 March 2017, Q141

38 National Crime Agency written evidence (PSC009), 20 February 2018

39 Oral evidence taken on 7 March 2017, Q141

40 Oral evidence taken on 7 March 2017, Q144

41 Oral evidence taken on 6 December 2016, Q41

42 National Crime Agency written evidence (PSC009), 20 February 2018

43 Oral evidence taken on 7 March 2017, Q141

44 Oral evidence taken on 7 March 2017, Q141

45 European Scrutiny Committee, Documents considered by the Committee on 7 February 2018, Europol: exchanging personal data with third countries

46 Oral evidence taken on 7 March 2017, Q176

49 Oral evidence taken on 7 March 2017, Q141

51 National Crime Agency written evidence (PSC009), 20 February 2018

52 Oral evidence taken on 6 December 2016, Q46

53 Oral evidence taken on 7 March 2017, Q151

54 Oral evidence taken on 6 December 2016, Q6

55 Oral evidence taken on 6 December 2016, Q18

56 Oral evidence taken on 5 December 2017, Q10

57 Oral evidence taken on 5 December 2017, Qs 11 and 58

60 Oral evidence taken on 6 December 2016, Q11

61 Oral evidence taken on 7 March 2017, Q145

Published: 21 March 2018