Provisional text
OPINION OF ADVOCATE GENERAL
RICHARD DE LA TOUR
delivered on 16 May 2024 (1)
Case C‑185/23
protectus s.r.o., formerly BONUL s.r.o.,
v
Výbor Národnej rady Slovenskej republiky na preskúmavanie rozhodnutí Národného bezpečnostného úradu
(Request for a preliminary ruling from the Najvyšší správny súd Slovenskej republiky (Supreme Administrative Court of the Slovak Republic))
(Reference for a preliminary ruling – Decision 2013/488/EU – EU classified information – Facility Security Clearance – Withdrawal of clearance – Charter of Fundamental Rights of the European Union – Article 47 – Access to the file – Article 51 – Implementation of EU law)
I. Introduction
1. This request for a preliminary ruling concerns the interpretation of Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information (2) and of Article 47 and Article 51(1) and (2) of the Charter of Fundamental Rights of the European Union. (3)
2. The request has been made in proceedings between protectus s.r.o., formerly BONUL s.r.o. (‘protectus’ or ‘the appellant in the main proceedings’) and the Výbor Národnej rady Slovenskej republiky na preskúmavanie rozhodnutí Národného bezpečnostného úradu (Committee of the National Parliament of the Slovak Republic for the Review of Decisions of the National Security Authority) (‘the Committee’) concerning the dismissal, by the latter, of the appeal lodged by protectus against the decision of the Národný bezpečnostný úrad (National Security Authority, Slovakia) (‘the NSA’) to revoke its industrial security clearance and, as a result of that revocation, to withdraw its industrial security certificate.
3. Under Slovak law, the purpose of industrial security clearance is to authorise a person to access information classified pursuant to national law. An industrial security certificate allows a person to access EU classified information (‘EUCI’).
4. The decision revoking the industrial security clearance held by protectus was taken because a security risk relating to that undertaking had been established on the basis, in part, of classified information. In that decision, the NSA also found that the revocation of that clearance necessarily entailed the revocation of its industrial security certificate, since those two types of security clearance are linked as a matter of national law.
5. There is, as yet, no horizontal legislation in EU law in the field of EUCI, but there are decisions specific to each EU institution. (4) In addition, the protection of EUCI is governed by EU law only to a partial and limited degree. In such matters, EU law relies on the pre-existing national systems for the protection of classified information on the basis of an equivalent level of protection.
6. The Court has already on several occasions been called upon to rule on the weighing up to be carried out between the right to an effective remedy and the interests cited to justify the non-disclosure of certain information, in particular where those interests relate to national security. This is, however, the first time the Court is called upon to provide clarifications on that weighing-up exercise in relation to EUCI.
7. In answer to the questions submitted by the Najvyšší správny súd Slovenskej republiky (Supreme Administrative Court of the Slovak Republic), and with a view to providing the broad outlines of such an exercise, I will take the following position.
8. First, I will set out the reasons why I take the view that, where a national court is called upon to review the lawfulness of a decision withdrawing from a person a security clearance which allows that person to view EUCI, pursuant to Decision 2013/488, such a situation constitutes an implementation of EU law as provided for in Article 51(1) of the Charter. It follows that the Charter is, in my view, applicable in the context of the present case.
9. Secondly, I will explain why, in my opinion, the arguments put forward by the majority of the participants to these proceedings claiming that Article 47 of the Charter does not apply in the circumstances at issue in the main proceedings must be rejected. Turning to the substance, I will set out the reasons why I am of the view, in the light of the particularities of the field relating to the protection of EUCI, that the Slovak legislation provides for sufficient safeguards to protect the rights of defence of persons whose security clearance is withdrawn.
10. Thirdly, I will clarify that the safeguards stemming from Article 47 of the Charter cannot, in any event, mean that a court, which is to review the lawfulness of a decision withdrawing security clearance based in part on classified information, must have the power to grant the person who is the subject of that decision access to the national security authority’s file containing such information.
II. The facts of the dispute in the main proceedings and the questions referred for a preliminary ruling
11. On 6 September 2018, the NSA issued the appellant in the main proceedings with industrial security clearance allowing it to view information classified as ‘Top Secret’, to transmit information classified as ‘Secret’ in physical and electronic formats and to create information classified as ‘Secret’. In addition, at the request of the appellant in the main proceedings, on 15 November 2018 the NSA also issued it with an industrial security certificate for SECRET EU/EU SECRET information.
12. The NSA subsequently received unclassified information indicating, inter alia, that the appellant in the main proceedings or the members of its board were the subject of a criminal investigation, that it had entered into agreements with companies under such investigation, that it had paid unusual sums to those companies, and that there were suspected associations between its personnel and another company with which it had responded to calls for tenders, with the two companies thus having tendered as parties under common control.
13. The NSA also received other information contained in documents designated as classified documentary evidence.
14. The NSA gave the appellant in the main proceedings the opportunity to comment on some of the information received, but not on the various classified documentary evidence or on the information contained therein.
15. By decision of 25 August 2020, the NSA revoked the industrial security clearance and industrial security certificate held by the appellant in the main proceedings. That clearance was revoked on the basis of the finding that the appellant in the main proceedings posed a security risk based on the existence of a commercial relationship likely to harm the security interests of the Slovak Republic and activities to the detriment of the economic interests of that Member State. In the statement of reasons for that decision, the NSA referred, on the one hand, to unclassified information which it set out in detail and, on the other hand, to classified information, the content of which it did not clarify. In that decision, the NSA also explained that the revocation of the industrial security clearance entailed the revocation of the industrial security certificate, since the validity of that certificate was conditional upon that clearance.
16. The appellant in the main proceedings lodged an appeal against the NSA’s decision with the Committee. In support of that appeal, it claimed primarily that it had not had the opportunity to consult the NSA’s file or to view the content of the classified documentary evidence. The appellant in the main proceedings also challenged the NSA’s findings in so far as they were based on unclassified information.
17. By decision of 4 November 2020, the Committee dismissed that appeal.
18. The appellant in the main proceedings lodged an appeal against that decision before the Najvyšší súd Slovenskej republiky (Supreme Court of the Slovak Republic).
19. By that appeal, the appellant in the main proceedings submits that its procedural rights as regards access to the content of the file could not be subject to an absolute restriction solely on the general ground that classified information was concerned. It also criticises the fact that its lawyer was refused access to such information by the Director of the NSA on very general grounds. The appellant in the main proceedings also calls into question the various factual and legal considerations forming the basis of conclusion reached by the NSA and the Committee that it posed a security risk.
20. After that appeal was lodged, jurisdiction to examine it was transferred to the Najvyšší správny súd Slovenskej republiky (Supreme Administrative Court of the Slovak Republic). On 28 September 2022, the NSA sent to that court the entirety of the file, including the classified documentary evidence. By decision of 4 October 2022, the president of the chamber hearing the appeal did not allow those classified parts of the file to be consulted.
21. On the same day, the lawyer for the appellant in the main proceedings applied to that court to be allowed to consult the classified documentary evidence communicated by the NSA. By letter of 5 October 2022, the president of the chamber hearing the appeal rejected that application, but did ask the NSA to consider allowing that evidence to be disclosed to that lawyer. By letter of 25 November 2022, the NSA gave authorisation for just two pieces of classified documentary evidence to be communicated. It refused to agree to the communication of the other classified documentary evidence at issue, on the ground that its communication could have led to sources of information being disclosed and jeopardised the investigations being conducted into the appellant in the main proceedings. By letter of 16 January 2023, the lawyer for the appellant in the main proceedings again asked to be allowed to consult all the classified documentary evidence, relying, inter alia, on Article 47 of the Charter, as interpreted by the Court of Justice in its judgment of 22 September 2022, Országos Idegenrendészeti Főigazgatóság and Others. (5)
22. In that context, the referring court has doubts as to the applicability of the Charter in the main proceedings.
23. It observes, in that regard, in particular, that the conditions of validity of the industrial security certificate are determined by Slovak law, which links the validity of such a certificate to the validity of industrial security clearance, without regulating in any further detail the handling of EUCI or access to it. The referring court does note, however, that Decision 2013/488 imposes certain specific obligations on the Member States in relation to clearance for contractors, who are defined, in Appendix A to that decision, as all individuals or legal entities possessing the legal capacity to undertake contracts. It is for that reason that the national authorities should take account of the obligations arising from the decision when issuing or withdrawing industrial security certificates. The fact that some of the provisions of Decision 2013/488 refer to the national legislation with which those authorities must comply has no effect on that finding, inasmuch as the Member States must apply that decision using the means and the procedures under their national law.
24. In addition, the referring court also considers that the fact that the applicable Slovak legislation was not adopted with a view to ensuring the implementation of a specific act of EU law and that it establishes a link between the validity of the industrial security certificate and national industrial security clearance does not mean that the application of that legislation cannot constitute an implementation of EU law. That court also observes that the review of the contested decision which it is required to carry out may constitute a situation in which a Member State implements EU law, and that neither the legal basis of Decision 2013/488 nor Article 346(1)(a) TFEU can disapply the Charter.
25. If the Charter is applicable to the main proceedings, the referring court asks about the compatibility of the Slovak legislation and practice in relation to classified information with Article 47 of the Charter.
26. That court states that, under that legislation, such information is accessible, without restriction, to the courts called upon to rule on appeals brought against decisions based on that information. The lawyer for an appellant can access that information only after receiving authorisation from the authority which identified the classified information at issue; a refusal to grant such authorisation is not open to review by a court. Furthermore, that lawyer remains bound by a duty of confidentiality and cannot therefore disclose to his or her client the content of any classified information to which he or she has had access.
27. In the light of those elements, the referring court finds that it is conceivable that the issue of whether that legislation is compatible with Article 47 of the Charter can be inferred from the judgment in Országos Idegenrendészeti Főigazgatóság and Others. In that judgment, the Court held that Article 23(1) of Directive 2013/32/EU of the European Parliament and of the Council of 26 June 2013 on common procedures for granting and withdrawing international protection, (6) read in conjunction with Article 45(4) of that directive and in the light of the general principle of EU law relating to the right to sound administration and of Article 47 of the Charter, must be interpreted as precluding national legislation which provides that, where a decision rejecting an application for international protection or withdrawing such protection is based on information the disclosure of which would jeopardise the national security of the Member State in question, the person concerned or his or her legal adviser can access that information only after obtaining authorisation to that end, is not provided even with the substance of the grounds on which such decisions are based and cannot, in any event, use, for the purposes of administrative or judicial proceedings, the information to which they may have had access. (7) In addition, the Court clarified in that judgment that, in order to guarantee the rights of defence of the person concerned, the power of the court having jurisdiction to have access to the file cannot replace access to the information placed on that file by the person concerned or his or her adviser. (8)
28. According to the referring court, it is however necessary to determine whether the solution arising from the judgment in Országos Idegenrendészeti Főigazgatóság and Others, which concerns the field of the common procedures for granting and withdrawing international protection, may be transposed in full to the present case. Unlike in the circumstances of the case which gave rise to that judgment, it is not clear that the rules laid down in Decision 2013/488, in particular in Article 11 thereof and Annex V thereto for the purposes of the granting of an Facility Security Clearance (FSC) by the national security authority, can establish, for the benefit of the contractor concerned, a right guaranteed by EU law, the protection of which he or she could claim on the basis of Article 47 of the Charter. Where appropriate, the referring court would also like to obtain clarifications on the content of the judicial protection arising from that article and on the powers which it must enjoy in order to guarantee the rights flowing from the article in a situation such as that at issue in the main proceedings.
29. In those circumstances, the Najvyšší správny súd Slovenskej republiky (Supreme Administrative Court of the Slovak Republic) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Should Article 51(1) of the [Charter] be interpreted as meaning that a Member State implements EU law in the case where a court of that Member State assesses the legality of a decision of a special [committee] of the parliament of that State by which that [committee], as an appellate body, has upheld an administrative decision of the national security authority revoking/withdrawing:
– first, a legal person’s industrial security clearance giving access to classified information in accordance with national law,
– and, at the same time, and only as a consequence of the revocation of that clearance, a facility security clearance issued to that legal person for access to information classified as “SECRET UE/EU SECRET” within the meaning of Article 11 of, and Annex V to, [Decision 2013/488]?
(2) If [the first question] is answered in the affirmative, should the first and second paragraphs of Article 47 of the Charter be interpreted as precluding national legislation and practice under which
(a) the decision of a national security authority to revoke/withdraw such clearance and the relevant certificate does not divulge the classified information which led to the authority considering the conditions for revocation/withdrawal to have been met, but merely makes reference to the document in the files of that authority containing the classified information,
(b) the legal person concerned does not have access to the national security authority’s file or to the individual documents containing classified information which led that authority to [revoke/withdraw] the clearance and certificate,
(c) access to that file and those documents may be obtained by the lawyer of the legal person concerned, but only with the consent of the head of the national security authority, and possibly with that of the body which provided those documents to the national security authority, whereby, even after having obtained such access, he or she is obliged to keep the content of the file and those documents confidential,
(d) the court which assesses the legality of the decision referred to in [the first question], however, has full access to those files and documents?
(3) If [the second question] is answered in the affirmative, should the first and second paragraphs of Article 47 of the Charter be interpreted as directly permitting (or alternatively obliging) a court assessing the legality of a decision such as that referred to in [the first question] not to apply the rules and practice described in [the second question] and to grant the legal person concerned or its lawyer access to the file of the national security authority and possibly to documents containing classified information, if that court considers this necessary in order to guarantee the right to an effective remedy and an adversarial procedure?
(4) If [the third question] is answered in the affirmative, should Article 51(1) and (2) of the Charter be interpreted as meaning that the right of the court to grant access to the file, and possibly to the documents described in [the third question], extends
– only to those parts of the file or documents that contain information relevant to the industrial clearance assessment within the meaning of Article 11 of, and Annex V to, [Decision 2013/488], or
– also to those parts of the file or documents that contain information that is relevant only for the assessment of industrial security under national law, that is to say, beyond the prerequisites provided for in [Decision 2013/488]?’
30. Written observations were submitted by the Committee, the Slovak and Estonian Governments, the Council of the European Union and the European Commission.
31. A hearing was held on 30 January 2024 at which protectus, the Committee, the Slovak and French Governments, the Council and the Commission were present.
III. Analysis
32. In the present case, the referring court wishes to obtain clarifications from the Court on the weighing up to be carried out between the right to an effective remedy and the protection of national security, in the context of an appeal against a decision, based inter alia on classified information, withdrawing, on the one hand, an industrial security clearance allowing access to information classified by a Member State and, on the other hand, an industrial security certificate allowing access to EUCI.
33. For the purpose of ruling on the appeal lodged against that decision, the referring court asks the Court, in essence, about the compatibility with EU law of the Slovak legislation, in so far as that legislation restricts the access of the person concerned to the classified information forming the basis of the decision taken in relation to him or her, and about the powers which must be available to the court having jurisdiction in order to guarantee that person’s rights.
A. Jurisdiction of the Court
34. The Committee submits that the Court does not have jurisdiction to respond to the request for a preliminary ruling, because the situation at issue falls outside the scope of EU law.
35. In so far as the arguments put forward in that regard seek to establish that the Charter is not applicable in the case in the main proceedings, they can be examined with a view to answering the first question referred for a preliminary ruling, which concerns this point. In support of that finding, it must be stated that the objection alleging the inapplicability of a provision of EU law to the case in the main proceedings concerns the substance of that question. (9)
B. The first question referred for a preliminary ruling
36. By its first question, the referring court asks, in essence, whether Article 51(1) of the Charter must be interpreted as meaning that a Member State implements EU law where a court of that Member State assesses the lawfulness of a decision revoking, on the one hand, industrial security clearance giving access to information classified by a Member State and, on the other hand, an industrial security certificate allowing access to EUCI as provided for in Article 11 of, and Annex V to, Decision 2013/488.
37. Classified information, the conditions governing who may view such information, the conditions for issuing and revoking industrial security clearance and the related procedure are all governed in Slovak law by zákon č. 215/2004 Z. z. o ochrane utajovaných skutočností (Law No 215/2004 on the protection of classified information). (10)
38. It follows from Paragraph 50(1) of Law No 215/2004 that, ‘if the security clearance procedure shows that the contractor meets the conditions laid down in Paragraph 46, [(11)] the NSA shall issue that contractor with industrial security clearance’. Under subparagraph 5 of that paragraph, ‘if the NSA finds that a contractor no longer satisfies one of the conditions of industrial security laid down in Paragraph 46 or has grossly or repeatedly failed to fulfil the obligations related to the protection of classified information, it shall revoke the validity of the clearance’. It is on the basis of the latter provision that the NSA decided to revoke the industrial security clearance which had been granted to protectus.
39. The conditions for issuing the industrial security certificate are laid down in Paragraph 5(6) of vyhláška č. 134/2016 Z. z. o personálnej bezpečnosti (Decree No 134/2016 on personnel security), (12) which refers to the conditions for issuing a security clearance certificate to a natural person as set out in subparagraphs 1 to 5 of that paragraph. It follows inter alia from those provisions combined, first, that the industrial security certificate specifies the highest level of classification of EUCI to which a person may have access and the corresponding provisions of EU law under which that person may access classified information. (13) Secondly, the validity of that certificate is linked to the validity of the industrial security clearance. (14)
40. In order to determine whether the situation in which a national court reviews the lawfulness of a decision revoking those security clearances within the national legal context thus described constitutes an implementation of EU law, it is necessary to recall the scope of the Charter in so far as the actions of the Member States are concerned. That scope is defined in Article 51(1) of the Charter, according to which the provisions thereof are addressed to the Member States only when they are implementing EU law. That article of the Charter confirms the Court’s settled case-law, under which the fundamental rights guaranteed in the legal order of the European Union are applicable in all situations governed by EU law, but not outside such situations. (15) Thus, if national legislation falls within the scope of EU law, the Court, when requested to give a preliminary ruling, must provide all the guidance as to interpretation needed in order for the national court to determine whether that legislation is compatible with the fundamental rights the observance of which the Court ensures. (16) Where, however, a legal situation does not come within the scope of EU law, the Court does not have jurisdiction to rule on it and any provisions of the Charter relied upon cannot, of themselves, form the basis for such jurisdiction. (17)
41. According to settled case-law, the concept of ‘implementation of Union law’ within the meaning of Article 51(1) of the Charter presupposes a degree of connection between an act of EU law and the national measure at issue which goes beyond the matters referred to or the indirect effects of one of the matters on the other, having regard to the assessment criteria laid down by the Court. (18)
42. Accordingly, in order to determine whether a national measure involves ‘implementing Union law’ for the purposes of Article 51(1) of the Charter, it is necessary to determine, inter alia, whether the national legislation at issue in the main proceedings is intended to implement a provision of EU law; the nature of that legislation and whether it pursues objectives other than those covered by EU law, even if it is capable of indirectly affecting EU law; and also whether there are specific rules of EU law on the matter or rules which are capable of affecting it. (19)
43. As I have already stated, the protection of EUCI is not yet the subject, as a matter of EU law, of horizontal legislation covering all the institutions and bodies of the European Union. The rules governing such protection are thus set out in a number of separate acts which are specific to each EU institution or body.
44. Here, the referring court refers to Decision 2013/488 as the applicable instrument of EU law in the context of the dispute in the main proceedings. Given the lack of clarifications from that court vis-à-vis its choice to request the interpretation of that decision rather than another one, it is necessary, in my view, to start from the premiss upon which the international cooperation established by the procedure provided for in Article 267 TFEU is based, namely that the national court is responsible for defining the factual and legislative context of the reference for a preliminary ruling, the accuracy of which is not a matter for the Court to determine, and that questions on the interpretation of EU law referred by a national court in that context enjoy a presumption of relevance. (20) It is therefore my view that the question of whether there is an implementation of EU law in the case at issue in the main proceedings must be assessed having regard to that decision.
45. In order to determine whether the situation at issue in the main proceedings constitutes an implementation of EU law, it is necessary to state the various obligations which Decision 2013/488, which was adopted by the Council on the basis of its power of internal organisation, imposes on the Member States.
46. As recital 1 of that decision sets out, the purpose of the decision is to ‘develop Council activities in all areas which require handling classified information[, by establishing] a comprehensive security system for protecting classified information covering the Council, its General Secretariat and the Member States’. With that in mind, it follows from recital 3 of Decision 2013/488 that, ‘in accordance with national laws and regulations and to the extent required for the functioning of the Council, the Member States should respect this Decision where their competent authorities, personnel or contractors handle EUCI, in order that each may be assured that an equivalent level of protection is afforded to EUCI’.
47. Thus, as provided for in Article 1(1) of Decision 2013/488, that decision ‘lays down the basic principles and minimum standards of security for protecting EUCI’. According to paragraph 2 of that article, ‘these basic principles and minimum standards shall apply to the Council and the [General Secretariat of the Council (‘the GSC’)] and be respected by the Member States in accordance with their respective national laws and regulations, in order that each may be assured that an equivalent level of protection is afforded to EUCI’.
48. Under Article 2(1) of the decision, ‘“[EUCI]” means any information or material designated by an EU security classification, the unauthorised disclosure of which could cause varying degrees of prejudice to the interests of the European Union or of one or more of the Member States’.
49. In order for EUCI to be protected, the Member States must adopt measures where economic actors are required to have access to such information.
50. From that perspective, Article 11(1) of Decision 2013/488 defines ‘industrial security’ as ‘the application of measures to ensure the protection of EUCI by contractors or subcontractors in pre-contract negotiations and throughout the lifecycle of classified contracts. Such contracts shall not involve access to information classified as TRÈS SECRET UE/EU TOP SECRET’.
51. The application of such measures is required since, in accordance with Article 11(2) of Decision 2013/488, ‘the GSC may entrust by contract tasks involving or entailing access to or the handling or storage of EUCI by industrial or other entities registered in a Member State …’.
52. In that context, the protection of EUCI means inter alia that:
– the GSC, as contracting authority, is to ensure that the minimum standards on industrial security set out in Decision 2013/488, and referred to in the contract, are complied with when awarding classified contracts to industrial or other entities (Article 11(3));
– the National Security Authority, the Designated Security Authority or any other competent authority of each Member State is to ensure, to the extent possible under national laws and regulations, that contractors and subcontractors registered in their territory take all appropriate measures to protect EUCI in pre-contract negotiations and when performing a classified contract (Article 11(4)); and
– the National Security Authority, the Designated Security Authority or any other competent security authority of each Member State is to ensure, in accordance with national laws and regulations, that contractors or subcontractors registered in the respective Member State participating in classified contracts or sub-contracts which require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET within their facilities, either in the performance of such contracts or during the pre-contractual stage, hold an FSC at the relevant classification level (Article 11(5)).
53. In Appendix A to Decision 2013/488, a classified contract is defined as ‘a contract entered into by the GSC with a contractor for the supply of goods, execution of works or provision of services, the performance of which requires or involves access to or the creation of EUCI’. In turn, FSC is defined as ‘an administrative determination by a [national security authority] or [designated security authority] that, from the security viewpoint, a facility can afford an adequate level of protection to EUCI of a specified security classification level’.
54. As Article 15(3) of Decision 2013/488 provides, responsibility for implementing the basic principles and minimum security standards for protecting EUCI rests inter alia with the Member States.
55. Accordingly, Member States are to take ‘all appropriate measures, in accordance with their respective national laws and regulations, to ensure that when EUCI is handled or stored, [Decision 2013/488] is respected’ by a series of people, including those who are ‘duly authorised by virtue of their functions to have access to EUCI’ (Article 15(3)(c)) and ‘Member States’ contractors, whether on the territory of the Member States or abroad’ (Article 15(3)(d)).
56. Furthermore, for the purposes of implementing Article 15(3) of Decision 2013/488, Article 16(3)(a) of that decision provides that Member States are to designate a national security authority responsible for security arrangements for protecting EUCI, in order that inter alia:
– ‘EUCI held by any national department, body or agency, public or private, at home or abroad, is protected in accordance with this Decision’ (Article 16(3)(a)(i));
– ‘security arrangements for protecting EUCI are periodically inspected or assessed’ (Article 16(3)(a)(ii)); and
– ‘all individuals employed within a national administration or by a contractor who may be granted access to information classified as CONFIDENTIEL UE/EU CONFIDENTIAL or above are appropriately security cleared or are otherwise duly authorised by virtue of their functions in accordance with national laws and regulations’ (Article 16(3)(a)(iii)).
57. It follows from those provisions that Decision 2013/488 imposes a series of specific obligations on the Member States in relation to the protection of EUCI. Those obligations include the obligation that Member States must ensure that persons who are required, in the context of their activities, to have access to EUCI obtain security clearance from a national security authority.
58. In summary, Decision 2013/488 provides for a general responsibility on part of the Member States to ensure compliance with that decision by certain individuals (Article 15(3)), to guarantee the application of the provisions intended to ensure the protection of EUCI (Article 16(3)) or to ensure that contractors or sub-contractors participating in classified contracts hold an FSC (Article 11(5)).
59. I note that Decision 2013/488 does not simply impose a general obligation on persons who are required in the context of their activities to have access to EUCI to obtain security clearance from a national security authority. That decision also lays down certain rules intended to govern the clearance procedure and the conditions of that procedure.
60. Thus, Annex V to that decision contains, in Title III thereof, the following paragraphs (paragraphs 8 to 13):
‘8. An FSC shall be granted by the [National Security Authority] or [Designated Security Authority] or any other competent security authority of a Member State to indicate, in accordance with national laws and regulations, that an industrial or other entity can protect EUCI at the appropriate classification level (CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET) within its facilities. It shall be presented to the GSC, as the contracting authority, before a contractor or subcontractor or potential contractor or subcontractor may be provided with or granted access to EUCI.
9. When issuing an FSC, the relevant [National Security Authority] or [Designated Security Authority] shall, as a minimum:
(a) evaluate the integrity of the industrial or other entity;
(b) evaluate ownership, control, or the potential for undue influence that may be considered a security risk;
(c) verify that the industrial or any other entity has established a security system at the facility which covers all appropriate security measures necessary for the protection of information or material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in accordance with the requirements laid down in this Decision;
(d) verify that the personnel security status of management, owners and employees who are required to have access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has been established in accordance with the requirements laid down in this Decision; and
(e) verify that the industrial or any other entity has appointed a Facility Security Officer who is responsible to its management for enforcing the security obligations within such an entity.
10. Where relevant, the GSC, as the contracting authority, shall notify the appropriate [National Security Authority]/[Designated Security Authority] or any other competent security authority that an FSC is required in the pre-contractual stage or for performing the contract. An FSC or [Personnel Security Clearance (PSC)] shall be required in the pre-contractual stage where EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has to be provided in the course of the bidding process.
11. The contracting authority shall not award a classified contract with a preferred bidder before having received confirmation from the [National Security Authority]/[Designated Security Authority] or any other competent security authority of the Member State in which the contractor or subcontractor concerned is registered that, where required, an appropriate FSC has been issued.
12. The [National Security Authority]/[Designated Security Authority] or any other competent security authority which has issued an FSC shall notify the GSC as contracting authority about changes affecting the FSC. In the case of a sub-contract, the [National Security Authority]/[Designated Security Authority] or any other competent security authority shall be informed accordingly.
13. Withdrawal of an FSC by the relevant [National Security Authority]/[Designated Security Authority] or any other competent security authority shall constitute sufficient grounds for the GSC, as the contracting authority, to terminate a classified contract or exclude a bidder from the competition.’
61. In order to determine whether, in the light of the rules of EU law thus described, the situation at issue in the main proceedings constitutes an implementation of EU law, a distinction must be drawn, in my view, between the clearance that was held by protectus to access information classified pursuant to national law and the clearance which allowed it to view EUCI.
62. Thus, the situation which led the NSA, first, to issue protectus with industrial security clearance allowing it to view information classified pursuant to national law and, secondly, to revoke that clearance does not constitute, in my view, an implementation of EU law. Decision 2013/488 does not contain any provisions intended to govern the decisions taken by national authorities concerning access, for the purposes laid down in national law, to information classified pursuant to that law. In addition, it is not apparent from the documents before the Court that other acts of EU law harmonise in any way the national rules governing the status of such information. Furthermore, the Court has recently found in its judgment in NW and PQ (Classified information) that the rules on the categorisation of information as classified or non-classified under national legislation are not the subject of rules harmonised by an act of the European Union. (21)
63. It follows that the Slovak legislation on the industrial security clearance, just like the measures relating to that clearance taken by the Slovak authorities, are to be regarded as being covered solely by national law and thus falling outside the scope of EU law. The assessment of the lawfulness of a decision revoking industrial security clearance does not therefore appear to constitute directly a form of ‘implementing Union law’ within the meaning of Article 51(1) of the Charter.
64. However, the situation which led the NSA, first, to issue protectus with an industrial security certificate allowing it to have access to EUCI at the SECRET UE/EU SECRET level and, secondly, to revoke that certificate appears to me to constitute an implementation of EU law.
65. An industrial security certificate, which, I repeat, specifies, in accordance with the Slovak legislation, the highest level of classification of EUCI to which a person may have access and the corresponding provisions of EU law under which that person may access classified information, can be regarded as having an object and effects which match those of the FSC provided for in Decision 2013/488. In addition, in accordance with the provisions of that decision, a national security authority (here, the NSA) is responsible for conducting the clearance procedure. It also follows from the Slovak legislation that the purpose of the security clearance procedure is to allow a person who holds such clearance to view classified information in connection with the performance of duties arising from an international treaty that is binding on the Slovak Republic, (22) from which it may be inferred that that legislation is not pursuing a purely national objective, which would therefore be distinct from the objective pursued by Decision 2013/488.
66. I would add that the grounds on which the NSA revoked the industrial security certificate of the appellant in the main proceedings, which essentially relate to the fact that the latter posed a security risk on account of a commercial relationship likely to harm the security interests of the Slovak Republic and activities to the detriment of the economic interests of that Member State, may be viewed as meaning that the minimum conditions for granting the FSC contained in Annex V to Decision 2013/488 (23) are no longer met by the appellant in the main proceedings.
67. The fact that, under the Slovak legislation, the validity of the industrial security certificate is linked to that of the industrial security clearance (24) cannot mean, in my view, that the situation at issue in the main proceedings is excluded from the scope of EU law. After all, it is indeed on account of an identified security risk that the two security clearances have been revoked.
68. In addition, the link between the validity of the industrial security certificate and that of the industrial security clearance seems logical to me because, as the Committee acknowledges in its written observations, if a security risk has been identified so far as concerns the entity in question under national law, that risk cannot be limited solely to the territory of the Slovak Republic, but must necessarily be extended to all the areas of that Member State’s external relations. In such matters, the interests of the Member States and the European Union’s interests are closely linked, and it is therefore quite normal for a security risk identified nationally, on the basis inter alia of information classified pursuant to national law, to have a direct impact on clearance to access EUCI. That link between the Member States’ interests and those of the European Union is, moreover, expressed in the very definition of the concept of ‘EUCI’ contained in Article 2(1) of Decision 2013/488, which emphasises the fact that such information is information ‘the unauthorised disclosure of which could cause varying degrees of prejudice to the interests of the European Union or of one or more of the Member States’. (25)
69. In addition, the vulnerability of the undertaking at issue may stem from information classified pursuant to national law, without that precluding an implementation of EU law as regards the revocation of the measure authorising a person to access EUCI. It must also be made clear that the fact that, as the referring court states in paragraphs 35 and 37 of its order for reference, the withdrawal of the national industrial security clearance was based exclusively on the criterion of trustworthiness in terms of security, as defined in national legislation, does not preclude the situation at issue in the main proceedings from constituting an implementation of EU law. I note, in that regard, that, according to the Court’s settled case-law, although it is for the Member States alone to define their essential security interests and to adopt appropriate measure to ensure their internal and external security, the mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable and exempt the Member States from their obligation to comply with that law. (26)
70. As for the fact that the Slovak legislation was not adopted specifically to apply Decision 2013/488, it should be recalled that the fact that national legislation was not adopted to transpose an EU act is irrelevant, as long as the application of that legislation actually implements EU law. (27)
71. It is immaterial, in my view, that Decision 2013/488 gives the Member States broad discretion to establish the existence of and the criteria for a security risk in the context of the procedure for issuing, amending or withdrawing an FSC. That situation is one in which an EU act gives the Member States the freedom to choose between various methods of implementation or grants them a margin of discretion which is an integral part of the regime established by that act. (28)
72. Furthermore, the fact that national authorities and procedures are mobilised to discharge the obligations laid down in Decision 2013/488 does not preclude a finding of an implementation of EU law, for the purposes of Article 51(1) of the Charter. This is simply a classic expression of the rule that Member States are required, in the context of their national structures and procedures, to ensure the application of the rules of EU law which impose obligations upon them.
73. In my view, the fact that there is no formal right to obtain or retain a FSC is likewise not a condition to which the applicability of the Charter could be made subject.
74. Thus, the protection of EUCI is ensured by the Member States and their national security authorities in accordance with national laws and regulations. (29) That reference to national law cannot be understood as giving the Member States the power to determine independently the context in which EUCI is protected. The Member States are therefore required to guarantee such protection whilst observing the rules laid down in EU law.
75. More generally speaking, it cannot be argued, in my view, that EU law has no bearing on the definition and implementation of the rules on the protection of EUCI, even though it is the purpose of those rules to ensure that the European Union functions properly. This would amount to taking the view that granting or withdrawing clearance to access such information can be regarded as the Member States exercising a retained competence which falls outside the scope of EU law and, therefore, that of the Charter. On the contrary, national laws and regulations relating to classified information must, in my opinion, be applied in relation to the protection of EUCI in accordance with EU law.
76. I infer from the foregoing that, in the light of the rules on the protection of EUCI set out in Decision 2013/488, a national authority which issues an industrial security certificate that is equivalent to an FSC grants an authorisation provided for in EU law. The effects of that authorisation, just like those of its withdrawal, are laid down in EU law and are meant to be produced essentially in the relationships between the person concerned and the EU institutions. In addition, the competent national authority which decides to revoke an FSC acts in performance of a role delegated to it by the EU institutions with a view to ensuring that EUCI is protected. That authority must, therefore, comply with the minimum requirements laid down in EU law.
77. In the case of the appellant in the main proceedings, attention must also be drawn to the particularly wide scope ratione personae of Decision 2013/488. I would point out, in that regard, that paragraph 8 of Annex V to that decision is worded in general terms, in that it does not restrict the persons to whom an FSC must be issued. (30)
78. In addition, that paragraph states that ‘[the FSC] shall be presented to the GSC … before a contractor or subcontractor or potential contractor or subcontractor may be provided with or granted access to EUCI’. It follows from that provision that the security clearance provided for in Decision 2013/488 may be granted to a potential contractor; this is a very general notion and can cover an undertaking such as the appellant in the main proceedings. In the same vein, it must be pointed out that the concept of a ‘contractor’ is defined in Appendix A to that decision as referring to ‘an individual or legal entity possessing the legal capacity to undertake contracts’ and not as a person who currently has a contractual relationship with the Council or has already taken steps with a view to entering into such a relationship.
79. Turning to the situation of protectus and its potential access to EUCI, what matters is that, even if no such access has ever in fact occurred, that undertaking applied for an industrial security certificate, the object of which is, inter alia, to allow its holder to view EUCI. Furthermore, protectus stated at the hearing that it had current contracts with the Ministerstvo hospodárstva (Ministry of the Economy, Slovakia). It cannot be ruled out that EUCI may be present in this type of contractual relationship, on account of the overlap between the protection of classified information at the national level and in respect of EUCI.
80. In the light of all the foregoing, the application to the situation at issue in the main proceedings of the criteria established in the settled case-law of the Court means, in my view, that it must be found, contrary to what is argued by all the participants to these proceedings, with the exception of protectus, that a Member State implements EU law, as provided for in Article 51(1) of the Charter, where a court of that Member State reviews the lawfulness of a decision revoking an industrial security certificate allowing access to EUCI, which is equivalent to an FSC, within the meaning of Article 11 of, and Annex V to, Decision 2013/488. It is, in that regard, immaterial that the national legislation establishes a link between the validity of that industrial security certificate and that of a national industrial security clearance, in so far as the withdrawal of that certificate is based on the finding that its holder poses a security risk. It follows that the Charter is applicable to the main proceedings.
C. The second question referred for a preliminary ruling
81. By its second question, the referring court asks the Court, in essence, about the procedural safeguards that must be guaranteed, pursuant to Article 47 of the Charter, for an undertaking whose FSC has been revoked by a national security authority on the basis, in part, of classified information which that undertaking was unable to access. More specifically, that court wishes to ascertain whether that article precludes national legislation which does not guarantee that the person concerned and that person’s lawyer have access to the classified information on the basis of which an FSC is revoked and which does not allow the court to ensure such access, even though it itself has access to that classified information.
82. The referring court states, in that regard, that it follows from Paragraph 26(3) of Law No 215/2004, read in conjunction with Paragraph 50(6) of that law, that, where it decides that a person cannot view classified information, the NSA must set out in its decision the factors forming the basis of that decision, the considerations which guided its assessment of the evidence and information relating to the possibility of challenging the decision.
83. In accordance with the practice of the NSA and of the Committee, the various items of classified information upon which their decisions are based are not included in the statement of reasons for those decisions. The decisions merely refer to the title of the documentary evidence containing that information.
84. Where it contains classified information, documentary evidence is not accessible to the person subject to an industrial security clearance procedure.
85. If that person lodges an appeal against the decision revoking an industrial security clearance or certificate, the courts which examine that appeal are, pursuant to Paragraph 34(1)(f) of Law No 215/2004, authorised without restriction to view all the classified information placed on the file.
86. Under Paragraph 35(3) of Law No 215/2004, the lawyer of the person concerned may also view that classified information, but only with the consent of the authority which identified the classified information at issue and reported it to the NSA. That lawyer is then bound by a duty of confidentiality in respect of that information, which means, in practice, that he or she cannot disclose the information to his or her client.
87. Before examining the compatibility of the procedural safeguards thus described with Article 47 of the Charter, it is necessary to consider, as the referring court asks the Court to do, the applicability of that article in the situation at issue in the main proceedings.
1. The applicability of Article 47 of the Charter
88. When implementing EU law, the Member States must, in accordance with Article 51(1) of the Charter, ensure that the requirements arising inter alia from the right to an effective remedy and the right to a fair hearing laid down in the first and second paragraphs of Article 47 of the Charter are respected. (31)
89. Prima facie, it might appear that an implementation of EU law for the purposes of Article 51(1) of the Charter means that Article 47 of the Charter is applicable. (32) There would thus be a degree of automaticity between the condition that EU law is being implemented and the need to respect the latter article.
90. That said, the case-law of the Court appears to indicate that no such automaticity in fact exists.
91. Indeed, it follows from that case-law that the application of Article 47 of the Charter in a particular case presupposes that the person invoking that article is relying on rights or freedoms guaranteed by EU law or that that person is the subject of proceedings constituting an implementation of EU law. (33) That condition comes on top of the general condition relating to the implementation of EU law set out in Article 51(1) of the Charter, (34) which is the subject of the first question.
92. In the present case, the referring court expresses its doubts as to whether the appellant in the main proceedings can rely on a right guaranteed by EU law and asks the Court to determine whether the rules laid down in Decision 2013/488 can establish, for the benefit of the appellant in the main proceedings, a right guaranteed by EU law, the protection of which it can claim on the basis of Article 47 of the Charter.
93. I take the view that that condition is satisfied here.
94. It is true that, as I have already stated, Decision 2013/488 gives the Member States broad discretion to determine in which cases an FSC must be granted or withdrawn. Thus, Annex V to that decision requires Member States to conduct minimum checks before issuing an FSC, without however affording the persons concerned a right to obtain an FSC where certain conditions are met. Nor do such persons have a right to retain their clearance, even if they were to continue to satisfy the minimum conditions laid down in that decision.
95. I do, however, consider that, while Decision 2013/488 does not grant an undertaking the right to obtain or to retain an FSC, it does nevertheless afford an undertaking which has obtained such clearance a specific right to participate in classified contracts of the Council.
96. In the same vein, for the purpose of determining whether Article 47 of the Charter is applicable, it is necessary, in my view, to take into account the effects that a decision withdrawing an FSC is likely to have on an undertaking. I would point out, in that regard, that paragraph 13 of Annex V to Decision 2013/488 provides that ‘withdrawal [of such clearance] shall constitute sufficient grounds for the GSC, as the contracting authority, to terminate a classified contract or exclude a bidder from the competition’. In view of the adverse consequences that a decision withdrawing an FSC is likely to have for an undertaking, I consider that that undertaking may legitimately insist that the requirements relating to effective judicial protection are respected if it contests the lawfulness of such a decision.
97. In any case, I note that, in accordance with the Court’s case-law, protection against arbitrary or disproportionate intervention by public authorities in the sphere of the private activities of both natural and legal persons constitutes a general principle of EU law. (35) According to the Court, that protection may be invoked by a legal person as a right guaranteed by EU law, for the purposes of the first paragraph of Article 47 of the Charter, in order to challenge before a court an act adversely affecting that person. (36)
98. Since the applicability of Article 47 of the Charter appears to me to be established, it is necessary to clarify which procedural safeguards an undertaking such as protectus can derive from that article in a situation such as that at issue in the main proceedings.
2. The safeguards arising from Article 47 of the Charter in relation to access to EUCI
99. The referring court’s questions regarding the compatibility with Article 47 of the Charter of the procedural rules laid down in the Slovak legislation have their origin in the presumed difference between the case-law of the European Court of Human Rights (‘the ECtHR’) and that of the Court in relation to the limitation of the adversarial principle where classified information is at issue.
100. Thus, according to the referring court, the ECtHR regarded as decisive, in its judgment of 19 September 2017, Regner v. the Czech Republic, (37) in finding there to be no violation of Article 6(1) ECHR, that the court having jurisdiction to review the lawfulness of a decision withdrawing security clearance has access to all the classified information on the basis of which such a decision was adopted. (38)
101. Pursuant to Article 52(3) of the Charter, it could therefore appear sufficient, in the light of Article 47 of the Charter and of that case-law of the ECtHR on Article 6(1) ECHR, that only the court responsible for providing judicial protection to the person concerned is able to view the classified information.
102. That said, the referring court observes that it follows from the case-law of the Court that such a solution is not necessarily sufficient in the light of Article 47 of the Charter. The national court refers in particular, in that regard, to the judgment in Országos Idegenrendészeti Főigazgatóság and Others.
103. The Court is therefore asked to determine whether, in the field of the protection of EUCI, Article 47 of the Charter must be interpreted as precluding national legislation under which a decision withdrawing an FSC does not state the classified information which served as the basis for that decision, the legal person concerned does not have access to the national security authority’s file containing such information, that legal person’s lawyer may access that file provided that he or she obtains the consent of that authority and guarantees the confidentiality of the information disclosed, and the national court responsible for reviewing the lawfulness of that decision has access to all the classified information contained in that file.
104. With a view to answering that question, I note that it follows from the case-law of the Court that, in the absence of applicable provisions of EU law on how Member States are to guarantee respect for the rights of defence of the person concerned where his or her right of access to the file is restricted pursuant to national legislation, the practical arrangements of the procedures established to that end are a matter for the domestic legal order of each Member State, in accordance with the principle of procedural autonomy of the Member States, provided however that these are not less favourable than those governing similar domestic situations (principle of equivalence) and that they do not make it impossible in practice or excessively difficult to exercise the rights of defence conferred by the European Union legal order (principle of effectiveness). (39)
105. With regard to the principle of equivalence, I note that, as the referring court states, it follows from Paragraph 26(3) of Law No 215/2004, read in conjunction with Paragraph 50(6) of that law, that, where it decides that a person cannot view information classified pursuant to national law, in particular where it is established that that person poses a security risk, the NSA must set out in its decision the factors upon which that decision is based, the considerations which guided its assessment of the evidence and information relating to the possibility of challenging the decision.
106. Those procedural safeguards, which consist in the provision of a reasoned decision, should likewise apply in respect of a decision withdrawing an FSC, as otherwise the principle of equivalence is infringed. Accordingly, it appears to me to be established that an undertaking such as protectus, which is subject of such a decision, must be able to ascertain the reasons, at the very least the main reasons, forming the basis of that decision, subject to the conditions laid down in those provisions of Law No 215/2004, as interpreted by the national courts. This seems to be the case because of the link established by the Slovak legislation between the withdrawal of an industrial security clearance and that of an industrial security certificate.
107. It must, however, be observed that an obligation to disclose to the person subject to a decision withdrawing his or her FSC the classified information serving as the basis of that decision cannot be inferred from the principle of equivalence. As I have already stated, according to the practice of the NSA and of the Committee, the various classified information upon which their decisions are based does not appear in the statement of reasons for those decisions. This point must thus be examined from the perspective of the principle of effectiveness.
108. With regard to that principle, it is important to note that it is satisfied only if the procedural rule at issue is consistent with the right to effective judicial protection guaranteed by Article 47 of the Charter. (40) Thus, the obligation on the Member States to ensure the effectiveness of the rights that individuals derive from EU law implies a requirement of judicial protection, enshrined in Article 47 of the Charter, which is binding on the national court. That protection must be assured both as regards the designation of courts having jurisdiction to hear and determine actions based on EU law and as regards the definition of detailed procedural rules relating to such actions. (41)
109. It must also be borne in mind that the Member States are required, when they implement EU law, to ensure compliance with the requirements of the right to an effective remedy enshrined in the first paragraph of Article 47 of the Charter, which requires respect for the rights of defence of the person concerned during judicial proceedings. (42)
110. Thus, it follows from settled case-law that, for the judicial review guaranteed by Article 47 of the Charter to be effective, it being rightly recalled that that provision is sufficient in itself, (43) the person concerned must be able to ascertain the reasons upon which the decision taken in relation to him or her is based, either by reading the decision itself or by requesting and obtaining notification of those reasons, without prejudice to the power of the court with jurisdiction to require the authority concerned to provide that information, so as to make it possible for him or her to defend his or her rights in the best possible conditions and to decide, with full knowledge of the relevant facts, whether there is any point in applying to the court with jurisdiction, and in order to put the latter fully in a position in which it may carry out the review of the lawfulness of the national decision in question. (44) Respect for the rights of the defence means that the person concerned must be able not only to ascertain the reasons upon which the decision taken in relation to him or her is based, but also to have access to all of the elements on file on which the authority has based that decision, in order to be able effectively to comment on those elements. (45)
111. Furthermore, the adversarial principle, which forms part of the rights of the defence, which are covered by Article 47 of the Charter, means that the parties to a case must have the right to examine all the documents or observations submitted to the court for the purpose of influencing its decision, and to comment on them, which presupposes that the person concerned must be able to acquaint himself or herself with the elements of his or her file which are made available to the court or tribunal called upon to rule on the appeal against that decision. (46)
112. That said, in accordance with the provisions of Article 52(1) of the Charter, the right of access to the file is not absolute in the light of Article 47 of the Charter. It is thus important to recall that the rights of the defence are not absolute rights, and that the right of access to the file, which is the corollary thereto, may therefore be limited, on the basis of a weighing up, on the one hand, of the right to an effective remedy of the person concerned and, on the other hand, of the interests relied on in order to justify the non-disclosure of an element of the file to that person, in particular where those interests relate to national security. (47) Indeed, it may prove necessary, both in an administrative procedure and judicial proceedings, not to disclose certain information to the person concerned, in particular in the light of considerations connected with national security. (48)
113. However, the Court consistently rejects the rights of the defence being rendered worthless, regardless of the sensitivity attached to the area in question. In each case, it asks the national court to strike a balance between the right to an effective remedy and the protection of security requirements.
114. Thus, according to the Court, the weighing up to be carried out by the national court cannot lead, in the light of the necessary observance of Article 47 of the Charter, to depriving the rights of defence of the person concerned of all effectiveness and to rendering meaningless the right to a remedy enjoyed by that person under that article, in particular by not informing that person, or, as the case may be, his or her representative, at the very least of the substance of the grounds on which the decision taken against him or her is based. (49)
115. That weighing up may, however, result in certain information in the file not being disclosed to the person concerned, where disclosure of that information is likely to jeopardise the national security of the Member State concerned in a direct and specific manner, in that it may, in particular, endanger the life, health or freedom of persons or reveal the methods of investigation specifically used by bodies entrusted with specialist functions relating to national security and thus seriously impede, or even prevent, future performance of the tasks of those authorities. (50)
116. It follows from the foregoing that, although EU law allows the Member States, particularly where national security so requires, not to grant the person concerned direct access to the entirety of his or her file, that law cannot be interpreted, without infringing the principle of effectiveness, the right to sound administration and the right to an effective remedy, as allowing the competent authorities to place that person in a situation where neither he or she nor his or her representative would be able to gain effective knowledge, where applicable in the context of a specific procedure designed to protect national security, of the substance of the decisive elements contained in that file. (51)
117. In that context, the Court has already held, first, that, where the disclosure of information placed on the file has been restricted on grounds of national security, respect for the rights of defence of the person concerned is not sufficiently guaranteed by the possibility for that person of obtaining, under certain conditions, authorisation to access that information, together with a complete prohibition on using the information thus obtained for the purposes of the administrative procedure or judicial proceedings. (52)
118. Secondly, with regard to whether the rights of defence of the person concerned are sufficiently guaranteed by the power of the court having jurisdiction to have access to the file, it must be pointed out that such an option cannot replace access to the information placed on that file by the person concerned or his or her representative. (53) Thus, respect for the rights of the defence in judicial proceedings does not mean that the court having jurisdiction has available to it all the relevant information in order to make its decision, but rather that the person concerned, where appropriate through an adviser, may defend his or her own interests by expressing his or her point of view on that information. (54) Indeed, access to the information placed on the file by the courts having jurisdiction and the establishment of procedures ensuring that the right of defence of the person concerned are respected are two separate and cumulative requirements. (55)
119. The foregoing considerations have led the Court to rule in its most recent case-law, in line with its earlier judgments, that the general principle of sound administration and Article 47 of the Charter, read in conjunction with Article 20 TFEU, must be interpreted as precluding national legislation which provides that, where a decision to withdraw or to refuse a residence permit, adopted in respect of a third-country national who may enjoy a derived right of residence under Article 20 TFEU, is based on information the disclosure of which would compromise the national security of the Member State in question, that third-country national or his or her representative can access that information only after obtaining an authorisation to that effect, is not even informed of the substance of the grounds on which such decisions are based and cannot, in any case, use, for the purposes of an administrative procedure or judicial proceedings, the information to which they might have had access. (56)
120. The referring court wishes to ascertain whether those elements taken from the case-law of the Court and the conclusions reached by the Court to date can be transposed to the area relating to the protection of EUCI, which could lead to a finding that Article 47 of the Charter precludes the national legislation at issue in the main proceedings.
121. That question seems reasonable to me, given the specific nature of the area relating to the protection of EUCI, which marks it out from those areas in which the Court has, thus far, provided guidance on the weighing up to be carried out between the right to an effective remedy and the interests cited to justify the non-disclosure of certain information, in particular where those interests relate to national security.
122. It follows from settled case-law of the Court that the existence of an infringement of the rights of the defence, including the right of access to the file, must be examined in relation to the specific circumstances of each case, including the nature of the act at issue, the context of its adoption and the legal rules governing the matter in question. (57)
123. In that regard, it must be pointed out that the present case differs from those which gave rise to the judgments in ZZ, in Országos Idegenrendészeti Főigazgatóság and Others and in NW and PQ (Classified information). In the case of a decision restricting the free movement of a citizen of the Union on public security grounds, a decision rejecting an application for international protection or withdrawing such protection on account of a threat to public security, or a decision withdrawing or refusing to issue a residence permit, on national security grounds, to a third-country national who may be entitled to a derived right of residence pursuant to Article 20 TFEU, the grounds and the information on which such decisions are based are, in principle, disclosed in full. The limitation of that principle thus appears to constitute an exception which must be interpreted strictly. (58)
124. In the area relating to the protection of classified information, it appears to me that the approach should be the reverse, and therefore the disclosure of such information to unauthorised persons is, in principle, prohibited. The disclosure of classified information is thus the exception to that rule, and such information may be disclosed only to persons who satisfy the conditions necessary to be granted security clearance. As an exception, such disclosure may quite rightly be subject to strict limits.
125. It follows that a person whose FSC is called into question by a national security authority cannot, in the context of judicial proceedings to challenge a decision withdrawing that clearance, demand access to the classified information upon which that decision is based, regardless of whether that classification follows from national or EU law. It would be paradoxical if, even though his or her clearance to be able to access classified information is cast into doubt by a national security authority, a person could, in the context of such proceedings, be afforded the opportunity to consult information of that kind concerning him or her. This would effectively mean revealing to him or her classified information which formed the basis of the decision to prevent him or her from consulting EUCI, thus enabling him or her to view classified information so as to demonstrate that, contrary to the position taken by the competent national authority, it is appropriate for him or her to access such information. Accordingly, given the very subject matter of the decision withdrawing security clearance, if the person who is the subject of that decision were to have access to classified information, including in the context of judicial proceedings, this would ultimately mean, in my view, calling into question the rule that only persons with such clearance can view such information.
126. Respect for the principle that classified information is not to be disclosed to persons who contest the withdrawal of their security clearance in the context of judicial proceedings is justified by the requirements of prudence and prevention which are inherent in the area relating to the protection of EUCI and by the broad discretion which must be afforded to Member States in connection with granting or withdrawing an FSC.
127. In addition, as I have previously set out, the Court has already stressed the need for certain information in the file not to be disclosed to the person concerned, where disclosure of that information is likely to jeopardise the national security of the Member State concerned in a direct and specific manner, in that it may, in particular, endanger the life, health or freedom of persons or reveal the methods of investigation specifically used by bodies entrusted with specialist functions relating to national security and thus seriously impede, or even prevent, future performance of the tasks of those authorities. (59) Such requirements, to which the Court originally drew attention in its judgment in ZZ, (60) together with the need not to hinder ongoing criminal investigations to which the person at issue or his or her associates (61) might be subject, appear to me to be particularly relevant in connection with the protection of EUCI.
128. It must be stated, in that regard, that persons applying for security clearance, just like those who have already obtained such clearance, are investigated in order to discover anything which may mean that they risk being blackmailed or coming under pressure with a view to forcing them to cooperate with nefarious organisations or individuals wishing to access the classified information in those persons’ possession. Those investigations are based on objective criteria and methods of investigation which make it possible to determine whether a person who has requested or who holds security clearance is, by virtue of his or her conduct or environment, vulnerable to being used by a third party to obtain protected data. It is, ultimately, for the competent national authority to establish whether or not a person can be considered trustworthy from the perspective of security and the necessary confidentiality of classified information, by ensuring that that person is loyal and reliable. I consider it essential not only to preserve the confidentiality of the classified information on the basis of which a national security authority finds that a person poses a security risk, but also to protect the secrecy which must surround the evidence and investigative methods by which such a risk is established.
129. Thus, the investigations intended to assess whether an industrial security risk exists are meant, by their nature, to be strictly confidential, especially since it is necessary to ensure that the implementation of EU law does not adversely affect the exercise of the exclusively national competence of protecting information classified pursuant to national law.
130. It follows from the foregoing that, in the area relating to the protection of EUCI, the role of the national court called upon to review whether or not a decision withdrawing an FSC is lawful must be guided by the principle that classified information is not to be disclosed to the applicant challenging such a decision.
131. However, as I have already clarified, the case-law of the Court seems to me to be based on the fundamental idea that, regardless of the sensitivity of the area in question, the rights of the defence cannot be rendered worthless and the review carried out by the national court on the basis of all the relevant information cannot replace the genuine exercise of those rights by the person concerned or by his or her representative. The rights of the defence, which are essential in order to allow, on the one hand, the person who is the subject of a decision withdrawing an FSC to express his or her point of view and, on the other hand, the court to review the lawfulness of that decision in full knowledge of the relevant facts, presuppose, in my view, that that person is not wholly unaware of the allegations against him or her. Moreover, the grounds upon which a decision withdrawing an FSC is based do not all necessarily stem from classified information, as the situation at issue in the main proceedings makes clear. It must be added that, for the rights of the defence to be exercised effectively, rights on the basis of which the person denied a right arising from an FSC must be able to challenge the allegations made against him or her, their exercise must not be affected by the fact that that person cannot claim a right to obtain or to retain such clearance.
132. It is therefore my view that, while, in the area relating to the protection of EUCI, the principle of minimising the information to be disclosed to the person who is the subject of a decision withdrawing an FSC must take precedence, that person or, as the case may be, his or her representative, must be aware, at the very least, of the substance of the grounds upon which that decision is based. The case-law of the Court consistently refers to such a minimum guarantee. (62) I will, however, apply the following limits in the specific context of the area at issue in this case.
133. In the first place, the guarantee that the person concerned or, as the case may be, his or her representative, is to be informed of, at the very least, the substance of the grounds upon which a decision withdrawing an FSC is based cannot lead to classified information, or any part thereof, being disclosed. The substance of those grounds must therefore be communicated in a manner ensuring the strict confidentiality of that type of information. Furthermore, the grounds must be notified in a manner respectful of other public interests to which I have referred above, such as the need not to reveal methods of investigation or to hinder ongoing criminal investigations.
134. In the second place, it is my view that, in order for the rights of defence of the person subject to a decision withdrawing his or her FSC to be safeguarded sufficiently, there is no need for that person to be notified of the substance of all the grounds upon which that decision is based. It is enough, in my opinion, that the person is informed of the substance of the ground or grounds which constitute, in the view of the national court, a sufficient basis to support that decision, having regard to the requirements of prudence and prevention and to the broad discretion which must be afforded to the competent national authority in connection with the protection of EUCI. (63)
135. In the light of those considerations, I consider that the Slovak legislation contains sufficient guarantees which, taken as a whole, mean that respect for the rights of defence of a person subject to a decision withdrawing an FSC can be ensured.
136. I would recall in that connection that, according to the information provided by the referring court, the court reviewing the lawfulness of that decision has access to the national security authority’s file in its entirety. Moreover, while the legal person concerned does not have access to that file containing the classified information which served, alongside other information, as the basis of the decision, that legal person’s lawyer may access that file, provided that that authority’s consent is obtained and the confidentiality of the information disclosed is guaranteed. I note, indeed, that, in the course of the judicial proceedings, at the request of the lawyer for the appellant in the main proceedings, the NSA communicated to that lawyer two pieces of classified documentary evidence.
137. In addition to that classified information, it is apparent from the order for reference that the NSA took note of unclassified information indicating, inter alia, that the appellant in the main proceedings or members of its board were the subject of a criminal investigation, that it had entered into agreements with companies under such investigation, that it had paid unusual sums to those companies, and that there were suspected associations between its personnel and another company with which it had responded to calls for tenders, with the two companies thus having tendered as parties under common control. It is established that the appellant in the main proceedings was able to comment on the information thus obtained by the NSA.
138. Moreover, the revocation of the industrial security clearance by the NSA, which automatically meant that the industrial security certificate was revoked, was based on the finding that the appellant in the main proceedings posed a security risk on account of the existence of a commercial relationship likely to harm the security interests of the Slovak Republic and activities to the detriment of the economic interests of that Member State. In the statement of reasons for that decision, the NSA referred, on the one hand, to unclassified information which it set out in detail and, on the other hand, to classified information, the content of which it did not clarify.
139. As the referring court states, in its appeal, the appellant in the main proceedings calls into question the various factual and legal considerations forming the basis of conclusion reached by the NSA and the Committee that it posed a security risk. That suggests that the appellant in the main proceedings was informed of those considerations and was, therefore, given an opportunity to challenge them.
140. I infer from the foregoing that, in accordance with the guarantees provided by the Slovak legislation, the appellant in the main proceedings is not in a position in which it is unaware of the allegations made against it, even though it was not provided, quite rightly in my opinion, with all the classified information which it wanted to view. The information provided by the referring court leads me, on the contrary, to take the view that the appellant in the main proceedings was notified of the substance of the grounds capable of constituting a sufficient basis to support the decision withdrawing its FSC; this is, of course, a matter to be determined by the referring court. Accordingly, if that court considers that the grounds set out in that decision are sufficient to justify that decision, taking into account the broad discretion which must be afforded to the competent national authority in the field of the protection of EUCI, and that the appellant in the main proceedings was able to debate those grounds, which appears to have been the case, the rights of the defence cannot be held to have been infringed.
141. Therefore, Article 47 of the Charter must, in my view, be interpreted as not precluding national legislation under which a decision revoking an FSC does not state the classified information which served as the basis for that decision and the legal person concerned does not have access to the national security authority’s file containing that information, where, first, the lawyer representing that legal person can access that file, provided that that authority’s consent is obtained and the confidentiality of the information disclosed is guaranteed; secondly, the national court responsible for reviewing the lawfulness of that decision has access to all the classified information contained in the file; and, thirdly, the legal person has been informed of the substance of the grounds capable of constituting a sufficient basis to support that decision, which is a matter for the referring court to determine.
D. The third and fourth questions referred for a preliminary ruling
142. By its third and fourth questions, the referring court asks, in essence, whether Article 47 of the Charter must be interpreted as requiring that a court which is to review the lawfulness of a decision revoking an FSC based in part on classified information has the power to allow the legal person who is the subject of that decision to access the national security authority’s file containing such information. If so, the referring court also wishes to obtain clarifications as to the scope of such a power.
143. It must be pointed out that the third question is submitted by the referring court in the event that the Court were to answer its second question to the effect that Article 47 of the Charter precludes the Slovak legislation. As I have already stated, subject to the determinations to be made by that court, the guarantees provided by that legislation appear to me, taken as a whole, sufficient to ensure the protection of the rights of defence of a person who is the subject of a decision withdrawing his or her FSC.
144. I do, however, consider it appropriate that an answer is provided to the referring court as regards whether Article 47 of the Charter requires that a court responsible for reviewing the lawfulness of such a decision has, in addition to the guarantees provided by the Slovak legislation, the power to allow the person concerned to access the entire file containing classified information.
145. On this point, the solution recently adopted by the Court in its judgment in NW and PQ (Classified information) must, in my view, apply a fortiori in connection with the protection of EUCI. (64)
146. Accordingly, in that judgment, the Court relied on the guidance provided in its judgment in ZZ (65) to find that the Member States may reserve for the national authorities competent in matters of security the power to disclose or not to disclose grounds or evidence, provided that the court having jurisdiction has the power to draw the appropriate conclusions from the decision ultimately adopted in that regard by those authorities. (66)
147. According to the Court, such a solution is capable, where a national authority unjustifiably blocks the disclosure of all or part of the information upon which the decision at issue is based, of ensuring that Article 47 of the Charter is fully respected, in that it guarantees that that authority’s failure to comply with its procedural obligations will not result in the judicial decision being based on facts or documents which the applicant has not had the opportunity to examine and on which he or she has therefore been unable to comment. (67)
148. The Court infers from those considerations that Article 47 of the Charter cannot be regarded as requiring that, in order to review a decision based on classified information, the court having jurisdiction must necessarily have the power to categorise certain information as non-classified and to disclose, of its own motion, that information to the applicant, since such declassification and disclosure are not essential in order to ensure effective judicial protection when assessing the legality of the contested decision. (68)
149. In the light of the foregoing, I take the view that the third question should be answered to the effect that Article 47 of the Charter must be interpreted as not requiring that a court which has to review the lawfulness of a decision revoking an FSC based in part on classified information has the power to allow the legal person who is the subject of that decision access to the national security authority’s file containing such information.
150. In view of the answer which I propose the Court give to the third question, there is no need, in my opinion, to examine the fourth question.
IV. Conclusion
151. In the light of all the foregoing considerations, I propose that the Court answer the questions referred by the Najvyšší správny súd Slovenskej republiky (Supreme Administrative Court of the Slovak Republic) as follows:
(1) Article 51(1) of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that a Member State implements EU law where a court of that Member State reviews the lawfulness of a decision revoking an industrial security certificate allowing access to EU classified information, which is equivalent to a Facility Security Clearance (FSC), within the meaning of Article 11 of, and Annex V to, Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information. It is, in that regard, immaterial that the relevant national legislation establishes a link between the validity of that industrial security certificate and that of a national industrial security clearance, in so far as the withdrawal of that certificate is based on the finding that its holder poses a security risk.
(2) Article 47 of the Charter of Fundamental Rights must be interpreted as not precluding national legislation under which a decision revoking an FSC does not state the classified information which served as the basis for that decision and the legal person concerned does not have access to the national security authority’s file containing that information, where, first, the lawyer representing that legal person can access that file, provided that that authority’s consent is obtained and the confidentiality of the information disclosed is guaranteed; secondly, the national court responsible for reviewing the lawfulness of that decision has access to all the classified information contained in the file; and, thirdly, the legal person has been informed of the substance of the grounds capable of constituting a sufficient basis to support that decision.
(3) Article 47 of the Charter of Fundamental Rights must be interpreted as not requiring that a court which has to review the lawfulness of a decision revoking an FSC based in part on classified information has the power to allow the legal person who is the subject of that decision access to the national security authority’s file containing such information.