113.As we have seen, the Government believes that a future security relationship between the UK and EU should be underpinned by a comprehensive security treaty. Elements that might feature in such a treaty are summarised in Box 3.
A UK-EU security treaty that retained the current operational relationship and took account of future developments, but which did not require the UK to apply CJEU jurisdiction, could be based upon the precedent of the EU’s Schengen Association Agreements with Norway, Iceland, Switzerland and Liechtenstein.
An Annex to this treaty could list the EU legislation in this field that the UK was still committed to apply. Certain limited amendments could be agreed to that legislation.
When discussing new EU legislation, the UK could be consulted at ministerial level as well as at the level of senior civil servants and representatives, although as a non-EU country it would not have a vote. If the UK and EU agreed that the UK should participate in a new law, a Joint Committee would have power to amend the Annex, to add that new or revised legislation to it, without the need to conclude a new treaty.
There could be an inter-parliamentary committee consisting of legislators from the UK Parliament, the European Parliament and national EU Parliaments.
If the UK did not accept a new EU law amending an existing EU law, or if case law in the UK and EU courts diverged, then there could be discussion between EU and UK officials with attempts to reach a political agreement to settle the dispute. If no agreement could be reached to settle it, then the two sides could agree to stop cooperating on one issue, but still cooperate on all the others dealt with by the agreement.
It would not be necessary for the CJEU to have a direct role in settling disputes (it has no such role in other EU agreements with third countries in this field). But a reciprocal commitment by both the UK and EU to take account of each other’s case-law could be included.
114.The EU has yet to show any willingness to contemplate a single over-arching security treaty. In his speech at the Fundamental Rights Agency on 19 June, Michel Barnier envisaged a “future internal security partnership” based on “four pillars”:
Mr Barnier also highlighted the cross-cutting issues of fundamental rights, data protection and mechanisms for enforcement and dispute resolution (which are considered later in this chapter).
115.The Government’s enthusiasm for a security treaty remains undimmed. Mr Hurd said that the Government was “being very bold and ambitious with this, but I do not think that we are wrong in that … Our hope and belief is that, particularly at this time, the mutual interests and the need to maintain and to build the integrity and capability of these collective security mechanisms will outweigh other considerations.”
116.The Government considers that while existing precedents for ad hoc EU cooperation with third countries on security “provide context, they are not the right starting point for our future partnership”. The Government argues that current arrangements merely “provide a limited patchwork of cooperation”, and could result in a “serious shortfall in capability affecting not only the UK but also the EU and its Member States … The security of our citizens must be our overriding priority and that will not be achieved by a marked—and avoidable—reduction in our ability to combat serious crime and terrorism.”
117.According to the Government’s analysis, a security treaty would provide more coherence of approach than a series of ad hoc arrangements. In a recent statement on future security cooperation, the Government also said that it was “clear from consultation with law enforcement partners” that a treaty “was operationally necessary”. The Government concluded:
“A future relationship that protects critical operational capabilities and keeps our citizens safe … would be delivered most effectively by a new, comprehensive Internal Security Treaty that draws on legal precedents for strategic relationships between the EU and third countries in other areas of the acquis and enables cooperation to be sustained on the basis of existing EU measures where this delivers mutual operational benefits.”
118.Some witnesses, on the other hand, believed that a treaty was neither practicable nor desirable. Javier Ruiz Dias of the Open Rights Group was concerned that encapsulating the future security relationship in a treaty would both be unworkable and would damage transparency:
“For us, the fundamental question is that we are not sure that a single treaty covering what is currently spread over possibly around a dozen legal instruments, from regulations to directives to opinions, will work, or that it will be feasible to build it in under two years … our experience with [such] agreements is that they generally have a very low level of public accountability.”
119.Tim Devlin challenged the Government’s assertion that “a treaty would be the most efficient way to ensure our relationship can evolve over time as threats and technology change”. Wondering whether a treaty could “adequately replace the existing instruments”, he suggested that “it could but it probably will not, because it is unlikely that European law will stand still. It is highly probable that European law on criminal justice and other Home Office-related matters … will move forward and converge more, and we will need successive treaties to keep up.”
120.Other witnesses believed that a treaty would be the best way to secure an effective future security relationship between the UK and the EU. Dr Helena Farrand-Carrapico, for instance, argued that a comprehensive treaty would “show political commitment to the relationship between the UK and the EU”. She also noted that “the EU has already said that it is not open to the model of the bilateral agreements that Switzerland has”.
121.While the Government hopes that a security treaty will reflect as far as possible the status quo, the inherent difficulties facing third countries that wish to participate in existing EU security frameworks may require the Government to prioritise certain aspects of the current relationship. Indeed, such prioritisation is to some extent a natural extension of the JHA opt-in, which allows the UK to choose to participate in those measures that it believes to be most valuable. It continues to opt into EU measures (such as the proposed Regulation on interoperability), in the knowledge that, as long as the withdrawal agreement is agreed and ratified, the UK’s participation will at least extend into the transition period.
122.When asked which areas they would prioritise, some witnesses understandably pushed for the retention of tools specific to their sector. Tim Devlin of the Bar Council called for UK participation in Eurojust Joint Investigation Teams, and for “equivalent mechanisms for the European Investigation Order”, an instrument that speeds up mutual assistance in criminal investigations. Jim Brisbane of the CPS agreed that the “European Investigation Order [is] extremely important to us”, while his colleague Debbie Price told us that since July 2017 the UK had “issued about 129 EIOs”, and received “in the region of 400 to 500”. Dr Anna Bradshaw highlighted mutual recognition instruments that facilitated “the recognition of confiscation orders made in other Member States. Those are incredibly useful tools.”
123.Dr Marco Stefan thought that the “ideal agreement” would cover “at least three aspects”: first, continued cooperation between UK and EU agencies; secondly, UK access to JHA databases; and thirdly, continued UK participation in mutual recognition instruments, in particular the EAW. Camino Mortera-Martinez agreed, pointing out that these were also the priorities that the Prime Minister laid out in her Munich Speech.
125.Witnesses to this inquiry presented arguments both for and against the Government’s preferred option of negotiating a single, comprehensive treaty to cover all these areas. On balance, however, we consider that the Government’s objective is unlikely to be achievable, given the time that has been taken to negotiate EU agreements with third countries in the past, and the range and complexity of the available models and precedents. We also note that the principle that ‘nothing is agreed until everything is agreed’ increases the risk inherent in seeking to negotiate a single security treaty. In effect, all the eggs would be in one basket.
126.In addition, there would be a strong temptation, within a security treaty, to prioritise a few achievable and significant goals, and some of the synergies between the various instruments in the EU toolkit could be lost.
127.The Government therefore needs to adopt an evidence-based approach. It should analyse on a case-by-case basis the value of maintaining access to each of the tools that it has already opted into, making its findings public wherever possible.
128.The Government also needs to be realistic about what it can achieve, not least because the EU has given little indication that it will be prepared to negotiate a bespoke treaty instead of a series of agreements on security. Whatever the approach adopted, any UK-EU agreement will be judged less on its form than on its success in protecting the security of the UK and EU27.
129.The best should not be the enemy of the good: if a comprehensive treaty cannot be agreed, the safety of the people of the UK and EU27 means that a series of ad hoc security arrangements could help to mitigate reduced operational capacity. Time is short, and both sides urgently need to show pragmatism and flexibility if they are to reach agreement.
130.Although a comprehensive security treaty may be desirable in principle, even the transition phase allows little time in which to draw up such a far-reaching treaty. In particular, while the CJEU has not yet clarified the EU’s external competence in the security field, there is a possibility that a security treaty could be deemed a ‘mixed agreement’, resulting in a complex and potentially time-consuming ratification process. This is outlined in Box 4.
Both the EU and its Member States may adopt legally binding acts in areas of shared competence—though Member States may do so only where the EU has not exercised its competence or has explicitly ceased to do so. An agreement between the EU and a third country in an area of shared competence is therefore known as a “mixed agreement”. It is concluded both by the EU and by the Member States of the EU, which must give their consent according to their own constitutional arrangements.
The EU-Canada Comprehensive Economic and Trade Agreement (CETA) illustrated the difficulties of ratifying mixed agreements. As Camino Mortera-Martinez explained, “If you need every parliament of every country ratifying it, and in some countries you have several parliaments, as we know from the Belgian CETA case, it will take much longer than if you have an exclusive EU agreement.”
In the UK, the Constitutional Reform and Governance Act 2010 requires that the Government place a copy of any treaty subject to ratification before both Houses of Parliament for a period of at least 21 sitting days, after which the treaty may be ratified unless there is a resolution against it. Treaties do not have direct effect in UK domestic law, but where necessary the Government can introduce further legislation to implement a treaty.
131.Many EU justice and home affairs tools involve the transfer of data. At present this is enabled by the UK’s membership of the EU and its compliance with its data protection legislation, including the General Data Protection Regulation (GDPR). The data protection provisions of JHA frameworks such as the PNR are shaped by this broader EU data protection law. Under the new Europol Regulation, the Commission, rather than Europol, is the body that carries out adequacy assessments for sharing Europol data.
132.Article 7 of the draft Withdrawal Agreement states that at the end of the transition period, the UK shall no longer be entitled to “access any network, any information system, and any database established on the basis of Union law”. According to Marco Stefan, this provision would include EU justice and home affairs databases: “This means that in order to ensure continuity of access to these databases the UK will need, first, to obtain an adequacy decision within the transitional period and, secondly, to conclude an operational agreement with the agencies, in a very short amount of time.”
133.As we noted in our report, Brexit: the EU data protection package, the need for an ‘adequacy decision’—a determination that the UK’s data protection laws were essentially equivalent to the EU’s—means that the UK would need to comply with standards that it had not had a role in setting. This principle was reasserted by Michel Barnier on 28 May 2018: “We cannot, and will not, share … decision-making autonomy [on data protection] with a third country.”
134.Securing an adequacy decision, in accordance with Article 45 of the GDPR, might also be difficult and potentially time-consuming. The process could only begin after the UK becomes a third country in March 2019, and assessments typically take two years. Failure to secure an adequacy decision could thus jeopardise conclusion of a security treaty by the end of the transition period.
135.Moreover, in order to achieve an adequacy decision, the UK’s legal framework for data processing for national security purposes would be assessed. For as long as the UK is an EU Member State, its data processing for national security purposes is outside the scope of EU law. This will change once the UK is a third country, and in the case of the USA the CJEU “invalidated the European Commission’s adequacy decision on the ground that there was an insufficient examination of the powers of the US National Security Agency to access the personal data of EU citizens once they reach US shores”.
136.The Government has proposed a separate agreement on data protection, as a “cross-cutting issue”.. It has not stated directly that it will seek an adequacy decision, but has instead said that “the UK wants to explore a UK-EU model for exchanging and protecting personal data, which could build on the existing adequacy model”. The Minister, Mr Hurd, also told us that the Government wished to “build on” this model.
137.The Government has also stressed the alignment of the UK’s existing data protection legislation with EU standards. It has emphasised that “as a former Member State, the UK will be a third country whose operational processes and data-sharing systems are uniquely aligned with approaches adopted at an EU level”, arguing that more extensive cooperation than currently exists with third countries should be possible. Mr Hurd told us:
“What we are trying to do, not least through our domestic legislation programme, is make sure that, at the time we exit the EU, our data standards are 100% aligned with those of our European partners, because that will facilitate the bespoke UK-EU model for exchanging protected personal data that we have undertaken to negotiate with them.”
138.EU negotiators do not appear to share the Government’s optimism. Michel Barnier has expressed scepticism about the UK’s ability to keep its data protection regime in line with EU Regulations, while the UK has been accused of having “illegally copied” personal information from the Schengen Information System. A slide published by the European Commission on 15 May suggests that the EU might accept a “security of information agreement” for police and judicial cooperation matters, which would appear to fall short of a treaty on data protection. In our report, Brexit: the EU data protection package, we warned that in the absence of an agreement between the UK and EU, “The lack of tried and tested fall-back options for data-sharing in the area of law enforcement would raise concerns about the UK’s ability to maintain deep police and security cooperation with the EU and its Member States in the immediate aftermath of Brexit”.
139.We also noted that the EU-US Privacy Shield and the EU-US Umbrella Agreement—both of which cover data protection—would cease to apply to the UK post-Brexit. Because of EU rules for onward transfers, securing unhindered flows of data with the EU might require the UK also to demonstrate that it had put arrangements in place with the US affording the same level of protection as the Privacy Shield and the Umbrella Agreement.
140.Of most urgent concern is the possibility that failure to reach agreement on data protection could lead to a “cliff-edge”, an operational gap in security cooperation. As Dr Stefan explained:
“That cliff-edge scenario would happen, especially when it comes to access to EU databases, if there was no adequacy decision before the end of the transitional period and no agreement in place between the UK and the agencies allowing for this exchange of information … We need to discuss whether it is possible to prolong the transition period, if that is an option.”
Helena Farrand-Carrapico made a similar point:
“There is clearly a risk of operational disruption. It is very clear from the [Withdrawal] Agreement. More worryingly, the Agreement does not foresee a mechanism for extending the transition, so if there is no Agreement within those 21 months we could fall off a cliff edge. I was much more optimistic before I saw the draft Agreement. Now, I am seriously more pessimistic.”
141.Some witnesses told us that they had begun to make contingency plans to ensure operational continuity, should the negotiations fail. Richard Martin reported that the Metropolitan Police’s planning involved mapping how they might fall back on the I-24/7 database (see above paragraph 36). Steve Smart told us that the NCA was “identifying the highest priority tools … and then looking at, where there are fallbacks, what those fallbacks are”. He admitted that such a scenario would “make us less dynamic and less effective. We will not be able to work at the speed we work now, assuming all things remain the same … in order to do what we need to do, we would have to look at doing things in a different way.” Jim Brisbane confirmed that the CPS had also undertaken internal contingency planning, in particular to ensure “that we have the depth of expertise to deal with extradition in a different setting”.
142.The campaigning organisation Liberty, in a position paper published in March 2018, argued that “the potential content of [the proposed security treaty] raises serious concerns for fundamental rights. Taking justice and security as an example, the UK opted out of a raft of rights protections relating to cross-border extraditions and investigations.” Liberty suggested that such “gaps in protection were tolerated while the UK remained a member of the EU—arguably because laws like the Charter of Fundamental Rights provided a backstop—but with the Charter’s future in the UK uncertain, it’s vital that any future treaty explicitly protects rights we’ve opted out of in the past”.
143.George Wilson, EU Law and Policy Specialist at Liberty, expanded on these concerns in evidence, telling us that any reversion to older security cooperation frameworks—which might occur in the event of there being no deal on security—could have human rights ramifications:
“The current arrangements benefit from strong fundamental rights protections. Although we did not opt into … rights protections in a similar way to other states … we benefit from the application of the Charter, which has provided strong and robust protections for human rights in this area in comparison with other external measures, such as the Council of Europe’s European Convention on Extradition. Although the convention is strong, it is not as strong in rights protection terms as the current arrangements that we have through our justice and home affairs opt ins.”
144.The Government has, however, made it clear that the European Charter of Fundamental Rights (‘the Charter’) will not apply in the UK post-Brexit, and has sought to exclude it from the body of retained EU law that will be created under the terms of the European Union (Withdrawal) Act 2018.
145.This decision will have operational consequences. Liberty has argued that “if we want to keep cooperating with our neighbours on security, human rights must form the bedrock of any future agreement”. The rights afforded by the Charter apply to any exercise of EU law provisions, including, for instance, the European Arrest Warrant. Without the Charter, it will be more difficult for the UK to make human rights guarantees to EU27 countries. Another example is the European Investigation Order (see above, paragraph 122), which includes a provision allowing a national court to refuse to grant an order if the court believes that the order has been issued in breach of the Charter. We also noted in our December 2016 report that “high levels of data protection” are among the rights enshrined in the Charter.
146.Finally we note, but have not had the opportunity to consider in detail, the European Commission’s slides on police and judicial cooperation in criminal matters, published on 18 June 2018. In analysing the UK’s position on fundamental rights, the slides refer to the Government’s position of “no Charter”, and identify a “potential risk of lowering the standards of protection for individuals”. They identify the UK remaining “a party to the European Convention of [sic] Human Rights” as a key safeguard, and propose that any agreement should include a “‘Guillotine clause’, if the UK leaves the Convention or is condemned by the European Court of Human Rights (ECHR) for non-execution of an ECHR judgment in the area concerned”.
147.The Government has acknowledged that the proposed security treaty would need to be supported by a dispute resolution mechanism; it has also indicated that one of its ‘red lines’ is that the UK should no longer be subject to the jurisdiction of the CJEU.
148.This could create problems for future security cooperation. Nick Vamos, formerly of the CPS, told us that the Government’s aims were threefold. The first was to achieve cooperation “that looks like what we have now, not just for the European arrest warrant but across the piece, including the European investigation order, Europol, Eurojust, transfer of prisoners”. The second was “something that allows us the level of divergence that we have and is specially bespoke for the UK”, and the third was being “outside the jurisdiction of the CJEU”. He concluded that while the three objectives were “not impossible in principle,” in practice they were “very, very difficult”.
149.In our report Brexit: judicial oversight of the European Arrest Warrant, we noted that the Government’s insistence that the UK not be subject to the jurisdiction of the CJEU post-Brexit might prove to be one of the thornier aspects to the negotiations on security. More recently the Prime Minister has indicated a willingness to move to a more flexible position on the CJEU, and accept its remit, when, for example, the UK participates in EU agencies under the proposed treaty. In her 17 February Munich Speech, she laid out how the proposed security treaty “must preserve our operational capabilities. But it must also … be respectful of the sovereignty of both the UK and the EU’s legal orders. So, for example, when participating in EU agencies the UK will respect the remit of the European Court of Justice”.
150.Finally, we note that, alongside dispute resolution mechanisms, new institutions might be needed to support the operation of any security treaty or agreements. While witnesses made few concrete proposals, they were clear that relationships between ministers, civil servants, parliaments, law enforcement professionals, and judges would be vital. Nick Vamos, for example, called for “a framework that allows for those relationships to grow, flourish and really become effective”. Richard Martin told us that relationships were “absolutely fundamental”, and Camino Mortera-Martinez advocated having resources in place to “nurture” such relationships: “The more you keep those relationships in place, the more you keep people in the room, the easier it will be for you to get a good deal.”
151.We note that a comprehensive security treaty could be deemed to be a ‘mixed agreement’. While this would not have important consequences domestically, it would result in a more complex, time-consuming and risky process of ratification by the EU and its Member States. We call on the Government to explain what consideration it has given to this issue in bringing forward its proposals for a comprehensive security treaty.
152.Continued data-sharing is critical for future UK-EU security cooperation. Were the UK to lose access to the EU’s security databases, information that today can be retrieved almost instantaneously could take days or weeks to access, creating not only a significant hurdle to effective policing but a threat to public safety.
153.We support in principle the Government’s objective of securing a cross-cutting agreement on data protection. But this means that the sequencing of the negotiations will be vital: if future security cooperation is to be effective, the Government must reach an agreement on data before agreeing a security treaty.
154.We note also that negotiations on data-sharing are notoriously complex. So while we acknowledge the advantages of a cross-cutting agreement on data protection, we stress that this should not come at the expense of an agreement on security.
155.Given the hurdles ahead, we are concerned that there is no mechanism in the draft Withdrawal Agreement for extending it, either in whole or in part, beyond the end date of 31 December 2020. We call on the Government and the EU to consider options for allowing such an extension, at least in respect of key security measures, where any interruption to ongoing operational cooperation could cost lives.
156.In the meantime, internal security practitioners should prepare for the possibility of an operational cliff-edge. We commend the contingency planning undertaken by the Crown Prosecution Service, the Metropolitan Police and the National Crime Agency, in case the UK loses access to databases and other frameworks for security cooperation at the end of the transition period.
157.Setting aside the arguments for and against retaining the European Charter of Fundamental Rights in UK law, any perceived reduction in the rights enjoyed by criminal suspects in the UK could have a significant operational impact on those working to protect the country’s security. This is underlined by the European Commission’s latest slides on police and judicial cooperation, which identify continuing UK adherence to the European Convention on Human Rights (and compliance with relevant judgments of the European Court of Human Rights) as key safeguards for any UK-EU agreements in this area.
158.The Government needs urgently to explain how fundamental rights will be protected after Brexit, and how these protections will cohere with the proposed security treaty. Otherwise it risks delaying an agreement on internal security, leading to an operational cliff-edge.
159.We welcome the Prime Minister’s statement that the UK will “respect the remit” of the Court of Justice with regard to EU agencies, including those in the field of internal security. Time is now short, and the security of the UK and EU demands flexibility. A security treaty that required the UK courts to take account of decisions of the CJEU (and vice versa) might be more acceptable to the EU—and might therefore be negotiated more quickly—than an entirely bespoke solution.
160.We note also that continuing dialogue, at all levels, will be needed to support the future UK-EU security relationship. This will require an increased emphasis on cultivating relationships, both formal and informal, to compensate for the UK’s absence from decision-making bodies. We call on the Government to explain the means by which it intends to support such dialogue and embed it in the UK-EU security relationship.
147 Michel Barnier, ‘Speech at the European Union Agency for Fundamental Rights’, 19 June 2018: [accessed 22 June 2018]
149 HM Government, ‘Technical Note: Security, Law Enforcement, and Criminal Justice’, p 5: [accessed 18 June]
150 Ibid., p 6
151 HM Government, Framework for the UK-EU Security Partnership (May 2018), p 15: [accessed 18 June 2018]
152 HM Government, ‘Technical Note: Security, Law Enforcement, and Criminal Justice’, p 8: [accessed 18 June]
154 HM Government, ‘Technical Note: Security, Law Enforcement, and Criminal Justice’, p 1: [accessed 18 June]
156 ; ; ; written evidence from Fair Trials international (); written evidence from the Law Society of Scotland ()
158 ; cf.
162 ; cf. Rt Hon Theresa May MP, Speech at Munich Security Conference, 17 February 2018: [accessed 3 July 2018]
164 Regulation (EU) 2016/794 of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (, 24 May 2016)
165 European Commission, Draft Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community, 19 March 2018: [accessed 18 June 2018]
166 ; cf. ; written evidence from Law Society of Scotland ()
167 European Union Committee, (3rd Report, Session 2017–19, HL Paper 7), para 163
168 Michel Barnier, Speech at the 28th Congress of the International Federation for European Law, 26 May 2018: [accessed 22 June 2018]
170 European Parliament, Study for the LIBE Committee, The Implications of the United Kingdom’s Withdrawal from the European Union for the Area of Freedom, Security and Justice, December 2017, p 63: [accessed 3 July 2018]
171 HM Government, Framework for the UK-EU Security Partnership (May 2018), p 4: [accessed 18 June 2018]
172 HM Government, The Exchange and Protection of Personal Data: A Future Partnership Paper (August 2017), p 2: [accessed 25 June 2018]
174 HM Government, Security, Law Enforcement and Criminal Justice: A Future Partnership Paper (September 2017), pp 6–7: [accessed 25 June 2018]
176 Michel Barnier, Speech at the 28th Congress of the International Federation for European Law, 26 May 2018:
177 Nikolaj Nielsen, EU Observer, ‘UK unlawfully copying data from EU police system’, 28 May 2018: [accessed 26 June 2018]
178 European Commission, ‘Slide on the EU/UK Possible Framework for the Future Partnership Discussions’, 15 May 2018: [accessed 25 June 2018]
179 European Union Committee, (3rd Report, Session 2017–19, HL Paper 7), para 114
180 Ibid., para 116
185 Liberty, ‘Brexit: the final countdown’, 29 March 2018: [accessed 25 June 2018]
187 Liberty, ‘Theresa May can’t have EU security cooperation unless she brings home our rights protections too’, 15 February 2018: [accessed 25 June 2018]
188 Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters, recital 12, (, 1 May 2014)
189 European Union Committee, (7th Report, Session 2016–17, HL Paper 77), para 63
190 European Commission, ‘Police and judicial cooperation in criminal matters’, 18 June 2018: [accessed 22 June 2018]
191 HM Government, Security, law enforcement and criminal justice—a future partnership paper (September 2017), p 2: [accessed 18 June 2018]
193 European Union Committee, (6th Report, Session 2017–19, HL Paper 16)
194 Rt Hon Theresa May MP, ‘Speech at Munich Security Conference’, 17 February 2018: [accessed 23 June 2018]
196 ; cf.