Shortcomings in EU data protection in the third and the second pillars. Can the lisbon treaty be expected to help?

Common Market Law Review

Volumn 46, Issue 5, 2009, Pages 1485-1525

  Hijmans, Hielke ^a   Scirocco, Alfonso ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

EID: 77953989814     PISSN: 01650750     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (168)

1. O.J. 1995, L 281/31 (hereinafter: Directive 95/46).
2. Joined cases C-317 & 318/04, European Parliament v. Council and Commission, [2006] ECR I-4721.
3. Case C-301/06, Ireland v. Parliament and Council, judgment of 10 Feb. 2009, nyr.
4. In particular, Joined cases C-402 & 415/05 P, Kadi and Al Barakaat International Foundation v. Council, [2008] ECR I-6351.
5. B. Elton, Blind Faith, (Bantam, 2007), pp. 29 and 331.
6. The background of these passages is the reluctance of the protagonist of the novel to post the video of the birth of his child on his webpage
7. As the former UK Information Commissioner Richard Thomas said on the occasion of the International Data Protection and Privacy Commissioners' Conference in London (November 2006): "Fears that society would 'sleep-walk into a surveillance society' have become a reality" , BBC News, 2 Nov. 2006, news.bbc.co.uk/2/hi/uk_news/6108496.stm.
8. "A report on the surveillance society: for the Information Commissioner by the Surveillance Studies Network" , Sept. 2006, www.ico.gov.uk/upload/documents/library/data_protection/practical_-application/surveillance_society_full_report_2006.pdf.
9. Data Protection in the European Union - Citizens' perceptions - Analytical report, Flash Eurobarometer Series 225, Jan. 2008, ec.europa.eu/public_opinion/flash/fl_225_en.pdf.
10. These are the usual criteria for restrictions of fundamental rights applied by the Court of Justice and the European Court of Human Rights
11. Compliance with these obligations must primarily be ensured by the data controller, as defined in Art. 2 (d) of Directive 95/46.
12. These are the essential elements of data protection; most of them are listed in Art. 8 of the Charter of the Fundamental Rights of the Union.
13. Art. 8 ECHR speaks about the right to private life.
14. Appl. 28341/95, Rotaru v. Romania [GC], judgment of 4 May 2000, ECHR 2000-V.
15. Appl. 27798/95, Amann v. Switzerland [GC], judgment of 16 Feb. 2000, ECHR 2000-II, para 65.
16. See generally in this Review: Oliver, "The protection of privacy in the economic sphere before the European Court of Justice"
17. Also important is Appl. 8691/79, Malone v. United Kingdom, judgment of 2 Aug. 1984, ECHR A82.
18. Case C-275/06, Promusicae, [2008] ECR I-271, para 63
19. Joined cases C-465/00, C-138 & 139/01, Österreichischer Rundfunk and Others, [2003] ECR I-4989
20. ETS No. 108, 28.01.1981 (hereinafter: Convention 108). To this Convention an Additional Protocol was added, regarding supervisory authorities and transborder data flows (ETS No. 181, 8.11.2001). Finally, Recommendation (87)15E of 17 Sept. 1987 regulating the use of personal data in the police sector, by the Council of Ministers of the Council of Europe, contains eight principles of data protection, specific to the police sector.
21. According to its Recital 11, the Directive gives substance to and amplifies the data protection principles of Convention 108, which was considered not specific enough to provide for sufficient protection
22. See infra 3.1.1.
23. COM(2009)262 final, p. 15.
24. See also Opinion of the European Data Protection Supervisor of 10 July 2009 on the Communication from the Commission to the European Parliament and the Council on an Area of freedom, security and justice serving the citizen, available at www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2009/09-07-10_Stockholm_programme_EN.pdf.
25. Europol has a far more restricted competence
26. O.J. 2005, C 53/1.
27. See for instance Council Decision 2008/633/JHA mentioned in 2.3.
28. See J. Rule, Privacy in Peril (Oxford University Press, 2007), amongst others p. 12.
29. Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions - Preparing the next steps in border management in the European Union, 13 Feb. 2008, COM (2008) 69 final, para 1.1.
30. Data mining is the process of sorting through large amounts of data and picking out relevant information (Wikipedia)
31. Profiling, the extrapolation of information about something, based on known qualities (Wikipedia). One can think about stereotypes, race, religion, cultural background, but also far more innocent qualities.
32. Communication from the Commission to the Council and the European Parliament on improved effectiveness, enhanced interoperability and synergies among European databases in the area of Justice and Home Affairs, 24 Nov. 2005, COM (2005) 597 final.
33. Although technically correct
34. O.J. 2008, L 218/129.
35. Proposal of 10 Sept. 2009 for a Council Decision on requesting comparisons with EURODAC data by Member States' law enforcement authorities and Europol for law enforcement purposes, COM(2009)344 final.
36. O.J. 2006, L 105/54 (hereinafter: Directive 2006/24).
37. The data retention Directive was swiftly approved not only because of the political climate created by the London bombings of July 2005, but also because the European Parliament faced the "threat" of an analogous proposal with a Third Pillar legal basis. The current First Pillar instrument was then adopted by the Council with qualified majority, with the contrary votes of Ireland and Slovakia, while the Third Pillar proposal would have required unanimity. Those two Member States challenged the Directive before the ECJ (see infra 3.3.2).
38. Joined appl. 30562/04 and 30566/04, S. and Marper v. United Kingdom, judgment of 4 Dec. 2008, ECtHR nyr.
39. See Hijmans, "The Third Pillar in practice: Coping with inadequacies. Information sharing between Member States" , available at www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/Publications/Speeches/2007/07-02-07_preadvies_NVER_EN.pdf, original article in Dutch published in (2006) SEW, 375.
40. It is illustrative that, in the organizational field, since 2005 data protection falls no longer within the portfolio of the Commissioner for Internal Market, but within the portfolio of his colleague for Justice, Freedom and Security
41. O.J. 2008, L 350/60 (hereinafter: Framework Decision 2008/977).
42. It has therefore been heavily criticized and sometimes considered as not providing an acceptable level of protection of personal data
43. See e.g. the opinions and comments of the EDPS, available on www.edps.europa.eu.
44. Or the data subject, but under that hypothesis there is no conflict with Recommendation R(87)15
45. Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders, O.J. 2000, L 239/19.
46. Art. 117 of the Convention.
47. O.J. 1995, C 316/1. The Convention will be replaced by Council Decision 2009/371/JHA establishing the European Police Office, O.J. 2009, L 121/37.
48. O.J. 2002, L 63/1, recently amended by Council Decision 2009/426/JHA on the strengthening of Eurojust and amending Decision 2002/187/JHA setting up Eurojust with a view to reinforcing the fight against serious crime, O.J. 2009, L 138/14.
49. Sometimes called Joint Supervisory Body
50. For SIS, the Joint Supervisory Authority will be replaced by a system of "coordinated supervision" whereas for Europol and Eurojust the present system will be continued. For Eurojust the system is different because the Joint Supervisory Body consists of judicial magistrates.
51. O.J. 2009, L 93/23.
52. O.J. 2008, L 210/1. The decision brings into the EU framework the Prüm Treaty, concluded by seven Member States in 2005. It creates a network of national databases where law enforcement authorities can gain automated access to each other's national databases containing DNA analysis files and fingerprints in what is called a hit/no hit system.
53. Not yet adopted by Council; the provisions on data protection were added by Council in the course of the negotiations; the Commission Proposal itself was more limited in this respect. Last available text on the Register of the Council from 29 June 2009, 5618/2/09.
54. See also Opinion of 20 Dec. 2007 of the European Data Protection Supervisor on the Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes, O.J. 2008, C 110/1. One of the main points of criticism in this opinion was that no evaluation was made of the existing legal instruments.
55. The second sentence of Recital (7) is remarkable: "No conclusions should be inferred from this limitation regarding the competence of the Union to adopt acts relating to the collection and processing of personal data at national level or the expediency for the Union to do so in the future." In short, the limitation has a political background, not a legal one.
56. Referred to as UN Sanctions Committee
57. These kinds of sanctions replace traditional commercial or political measures targeting a country and are also referred to as "smart sanctions" . The concept of "smart sanctions" refers to the idea that, being more selective and targeted, they reduce the suffering of the whole population of one country, while focusing on specific organizations or individuals.
58. In both situations, the EU implements the blacklists through Common Positions adopted in the framework of the Common Foreign and Security Policy, integrated in Community instruments adopted under Arts. 60 and 301 EC.
59. See infra para 4.2.1.
60. See Nettesheim, "U.N. sanctions against individuals: A challenge to the architecture of European Union governance" , 44 CML Rev. (2007), 567-600.
61. Indeed, at the heart of the Treaty lies the core principle of upholding the rule of law
62. See Lenaerts, "The rule of law and the coherence of the judicial system of the European Union" , 44 CML Rev. (2007), 1625.
63. See, more recently, Kunoy and Dawes, "Plate Tectonics in Luxembourg: The ménage à trois between EC law, International law and The European Convention on Human Rights following the UN sanctions cases" , 46 CML Rev. (2009), 73-104.
64. Gattini, annotation on joined cases C-402/05 P & 415/05, 46 CML Rev. (2009), 213-239.
65. Literature cited therein, as well as the annotation on these cases by Jacqué, 45 RTDE (2009)
66. About the lack of sufficient guarantees at UN level
67. Possibly also because it was not invoked by the plaintiffs. In Case T-49/04, Hassan v. Council, [2006] ECR II-52, the argument of a possible violation of the right to privacy, as guaranteed by Art. 8 ECHR, is explicitly invoked by the applicant. The Court recognizes the right to privacy as part of jus cogens, but then dismisses this argument in the specific case.
68. See also infra section 4.2 where the terrorists' lists will be discussed in the light of the difficulties arising from the division between pillars.
69. Arts. 25 and 26 of the Directive also contain other mechanisms for the transfer of personal data to third countries; they are not discussed here.
70. See more extensively on the PNR Agreements: Papakonstantinou and De Hert "the PNR Agreement and transatlantic anti-terrorism cooperation: No firm human rights framework on either side of the Atlantic" , 46 CML Rev. (2009), 885-919.
71. Agreement between the European Community and the United States of America on the processing and transfer of PNR data by air carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection, O.J. 2004, L 183/84.
72. Council Decision 2007/551/CFSP/JHA on the signing, on behalf of the European Union, of an Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (2007 PNR Agreement), O.J. 2007, L 204/16.
73. Also other countries require passenger data from European airlines. This has led to agreements with Canada (Agreement between the European Community and the Government of Canada on the processing of Advance Passenger Information and Passenger Name Record data, O.J. 2006, L 82/14) in 2005 and with Australia (Agreement between the European Union and Australia on the processing and transfer of European Union-sourced passenger name record (PNR) data by air carriers to the Australian customs service, O.J. 2008, L 213/49). Discussions are also taking place with further third countries.
74. See Working Party 29 Opinion 10/2006 on the processing of personal data by the Society for Worldwide Interbank Financial Telecommunication (SWIFT), available at www.ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2006/wp128_en.pdf.
75. As a result of this case, SWIFT decided to change its technical architecture and it no longer stores the data within US territory. On the institutional level, the result was, inter alia, an exchange of letters between the EU and the US, O.J. 2007, C 166/17, and the appointment of an eminent EU person reviewing the use of the data within the US.
76. US Homeland Security, Press release of 11 March 2008, www.dhs.gov/xnews/releases/pr_1205330012342.shtm.
77. These agreements are published on the websites of Europol and Eurojust
78. Document of 28 May 2008, Council Register, Doc. 9831/08.
79. Discussion continues on one of these principles. The need for (judicial) "redress" is not understood in the same way by the EU and by the US.
80. Council Regulation (EC) No. 2725/2000 of 11 Dec. 2000 concerning the establishment of "Eurodac" for the comparison of fingerprints for the effective application of the Dublin Convention, O.J. 2000, L 316/1.
81. Convention implementing the Schengen Agreement of 14 June 1985
82. See also Regulation (EC) No. 1987/2006 of the European Parliament and of the Council of 20 Dec. 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II), O.J. 2006, L 381/4. This instrument does not stand by itself, but is connected to several other legal instruments, relating to SIS II.
83. Regulation (EC) No. 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation), O.J. 2008, L 218/60.
84. Part Three, Title IV of the EC Treaty
85. For example, the Communication from the Commission of 13 Feb. 2008, (cited supra note 26), envisages the creation of an integral entry/exit system to be also used for the identification of overstayers (third country nationals staying in the EU after the expiry of their visa).
86. Case C-101/01, Bodil Lindqvist, [2003] ECR I-12971
87. Österreichischer Rundfunk, para 42
88. Lindqvist, paras. 43-44.
89. See more extensively on this judgment
90. To include an international agreement with the United States
91. On the adequate level of data protection guaranteed by the US authorities
92. PNR judgment, para 58
93. See also case note by Herlin-Karnell in this Review
94. Furthermore, it amends Art. 15 of Directive 2002/58/EC, which allows Member States to restrict some data protection obligations for certain public interest purposes laid down by the directive itself.
95. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), O.J. 2002 L 201/37.
96. This is made clear by Recital 25 of the Directive, stating that these issues fall outside the scope of Community law and thus "may be subject to national law or action pursuant to Title VI of the Treaty on European Union"
97. Case C-301/06, EDPS pleading of 1 July 2008, www.edps.europa.eu (" consultation" -" court interventions").
98. A.G. Bot suggested that "[m]easures which harmonize the conditions under which providers of communications services must retain traffic and location data which are generated or processed in the course of their commercial activities belong to the Community pillar" (para 106) while "[...] measures harmonizing the conditions under which the competent national law-enforcement authorities may access, use and exchange retained data in the discharge of their duties belong to the Third Pillar" (para 107), Opinion in Case C-301/06, paras. 106-114.
99. Case C-91/05, Commission v. Council, [2008] ECR I-3651.
100. See on this case and on the meaning of Art. 47 TEU, Hillion and Wessel, "Competence distribution in EU external relations after Ecowas: Clarification or continued fuzziness?" , 46 CML Rev. (2009), 551-586.
101. Case C-176/03, Commission v. Council, [2005] ECR I-7879.
102. In this case, A.G. Ruiz-Jarabo Colomer highlighted that "[j]ust as the Community lacks any general power in criminal matters, it likewise does not have any 'natural capacity' under the Third Pillar either, which would act as a magnet attracting all issues of that type which arose in the European Union. The solution must be reached via a different path, along the lines intimated by the case-law when it develops the power to impose penalties as a means of protecting the Community legal order" , Opinion, para 82.
103. Directive 1991/308/EEC, repealed by Directive 2005/60/EC on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing, O.J. 2005, L 309/15.
104. See, for example, Art. 21 of the Directive.
105. Case C-290/98, Commission v. Austria, [2000] ECR I-7835, where A.G. Saggio states: "I am persuaded that the money laundering directive is fully consonant with the basic substance of the provisions of the EEC Treaty - Articles 57 and 100a - on the basis of which the Council adopted the directive" . The Court did not adopt any judgment, since the infringement procedure was closed further to the compliance by Austria with the obligations stemming from the Directive.
106. Case T-228/02, Organisation des Modjahedines du peuple d'Iran (OMPI) v. Council, [2006] ECR II-4665.
107. Regulation (EC) No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaida network and the Taliban, O.J. L 2002, 139/9, and Common Position 2002/402/CFSP of 27 May 2002 concerning restrictive measures against Usama bin Laden, members of the Al-Qaida organization and the Taliban and other individuals, groups, undertakings and entities associated with them, O.J. 2002, L 139/4.
108. Proposal for a Council Regulation amending Regulation (EC) No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaida network and the Taliban, COM (2009) 187 final
109. Art. 3 of Regulation (EC) No. 45/2001 is in this context illustrative. The regulation applies to all "processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law" .
110. Which has led some authors to define the protection of personal data as a "fundamental fundamental right"
111. See Rouvroy, Poullet, "Self-determination as 'the' key concept" , presentation delivered at the Conference "Reinventing Data Protection" , held in Brussels on 12-13 Oct. 2007.
112. Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents, O.J. 2001, L 145/43.
113. Case T-47/03, Sison v. Council, [2007] ECR II-73, and Case C-266/05 P, Sison v. Council, [2007] ECR I-1233. Sison, member of National Democratic Front of Philippines, was black-listed by Council Decision 2002/848/CE of 28 Oct. 2002.
114. See also Opinion A.G. Geelhoed, which notes that "in the context of the application of Article 4(1)(a) of Regulation No 1049/2001 there is no place for the balancing of the public interest in respecting the confidential character of certain documents against the personal interests a citizen or entity may have in the disclosure of that document" , para 82.
115. Opinion AG, para 35
116. Case T-284/08, Organisation des Modjahedines du peuple d'Iran (OMPI) v. Council, judgment of 4 Dec. 2008, nyr, para. 36.
117. Data protection laws specify this general legal principle. See Art. 10 of Convention 108, Art. 23 of Directive 95/46/EC and Art. 32 of Regulation 45/2001.
118. As put forward by the plaintiffs in different cases: Case T-49/04, Hassan v. Council, [2006] ECR II-52, para 70); Case C-229/05 P, Ocalan v. Council, [2007] ECR I-439, para 110; Case T-315/01, Kadi v. Council and Commission, [2005] ECR II-3649, para 136.
119. See also EDPS opinion, cited infra note 132, point 44
120. See GAO, "Report on Terrorist Watch List Screening" , October 2007, www.gao.gov/new.items/d08110.pdf, p. 43: "TSC [" Terrorist Screening Center" ] has ongoing quality-assurance initiatives to identify and correct incomplete or inaccurate records that could contribute to either false negatives or false positives. The [...] quality of data is a high priority and also is a continuing challenge, particularly given that the database is dynamic, changing frequently with additions, deletions, and modifications" .
121. See Art. 22 of Directive 95/46 and Art. 32 of Regulation 45/2001.
122. Since concerned persons cannot address themselves directly to the UN Sanctions Committee, Member States should ensure that the case is brought before the Committee and that at national level an appeal is possible against a denial
123. The Court rejects the arguments that blacklisting is a political question in which it has no jurisdiction and that in any case its review should be limited to "flagrant and glaring" violations of human rights
124. See also Opinion A.G. Poiares Maduro, paras. 33-34.
125. See Art. 28 of Directive 95/46/EC and Art. 47 of Regulation No. 45/2001.
126. See Hijmans, "The European Data Protection Supervisor: The institutions of the EC controlled by an independent authority" , 43 CML Rev. (2006), 1313-1342.
127. Notably Recitals 10 and 2 and Art. 7d.
128. On 29 July 2009 the Commission adopted similar proposals for Council Regulations imposing certain specific restrictive measures directed against certain natural and legal persons, entities and bodies in view of the situation in Somalia (COM(2009)393 final) and Zimbabwe (COM(2009)395 final)
129. See Opinion of the European Data Protection Supervisor of 28 July 2009 on the proposal for a Council Regulation amending Regulation (EC) No 881/2002, available at www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2009/09-07-28_Restrictive%20measueres_AlQaida_Taliban_EN.pdf.
130. See Arts. 7a and 7c of the proposal.
131. See, in particular, Art. 7d of the proposal. See also the criticism expressed in the EDPS opinion.
132. See, in particular, Recitals 10 and 12 and Art. 7e of the proposal.
133. The relevance of this part depends on the outcome of the second referendum in Ireland
134. Art. 286 EC has a much more limited objective, as follows from its text.
135. The processing in this area by the Member States is subject to the specific rules under Art. 39 TEU.
136. See Scirocco, "The Lisbon Treaty and the protection of personal data in the European Union" , Dataprotectionreview.eu, Feb. 2008, nr.
137. Declaration on the protection of personal data in the field of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference that adopted the Treaty of Lisbon, O.J. 2008, C 115/345.
138. Protocol No. 21, O.J. 2008, C 115/295.
139. E.g., if the UK (or Ireland) decided not to participate in EU instruments on the exchange of information on criminal records, it would not be bound by EU data protection rules as far as these Member States process data from their criminal records (NB: This example is fictitious).
140. Protocol No. 22, O.J. 2008 C 115/299.
141. NB: The agreement with Canada was adopted under the First Pillar, so is not covered by Protocol No. 36.
142. Case C-413/99, Baumbast and R, [2002] ECR I-7091, para 84
143. See e.g. Case C-540/03, European Parliament v. Council, [2006] ECR I-5769 (on the right to family reunification).
144. See the very interesting overview by Dougan, "The constitutional dimension to the case law on Union citizenship" , 31 EL Rev. (2006), 613-641.
145. Case C-184/99, [2001] ECR I-6193, paras. 31-33.
146. See Kranenborg, "Access to documents and data protection in the European Union: On the public nature of personal data" , 45 CML Rev. (2008), 1086.
147. See Recital (11) of Directive 95/46/EC
148. The Directive is based on Art. 95 EC, the Regulation on Art. 286 EC (the Article that will be replaced by Art. 16).
149. See e.g. Case C-380/03, Germany v. European Parliament and Council (Tobacco Advertising II), [2006] ECR I-11573, para 39.
150. Prejudice to the institutional balance is a main reason for invalidity of EU instruments because of the choice of the legal basis
151. See Prechal, "Institutional balance: A fragile Principle with uncertain contents" , in Heukels et al. (Eds.), The European Union after Amsterdam. A legal analysis (Den Haag, 1998), p. 273.
152. Under Art. 39 TEU: Council.
153. Case 13/83, European Parliament v. Council, [1985] ECR 1513.
154. Or, exceptionally, an individual that would fulfil the criteria of Art. 265 TFEU.
155. See para 5.3.
156. See on Lisbon and the area of freedom, security and justice, more in detail, Dougan, "The Treaty of Lisbon 2007, Winning minds, not hearts" , 45 CML Rev. (2008), 617-703, para 9.
157. The Commission already thinks in this direction. See COM(2008)69 final.
158. This is already a subject of EU intervention. See Council Regulation (EC) No. 2252/2004 of 13 Dec. 2004 on standards for security features and biometrics in passports and travel documents issued by Member States, O.J. 2004, L 385/1, and several subsequent documents.
159. Art. 218(11) TFEU replacing Art. 300(6) EC.
160. Art. 76 TFEU.
161. In particular, Regulation (EC) No. 45/2001.
162. As confirmed by the Court in Case C-160/03, Spain v. Eurojust, [2005] ECR I-2077.
163. See europa.eu/agencies/index_en.htm.
164. This is best illustrated in the legal framework establishing Europol. In Art. 5 of the Council Decision establishing the European Police Office (cited supra footnote 45), the principal tasks of Europol are listed, to begin with: "(a) to collect, store, process, analyse and exchange information and intelligence; (Europol)" .
165. By an independent joint supervisory body
166. The limitation of the application of the Charter in those two Member States has been extensively commented
167. Appl. 45036/98, Bosphorus v. Ireland, judgment of 30 June 2005, ECHR 2005-VI, para 165.
168. Taking into account the transitional period of 5 years included in Protocol No. 36 and its interaction with the activity of the EU legislator.