Between Security, Secrecy and Scrutiny: Enigmatic External Activities by European Agencies and Bodies in the Fight against Crime


According to the EU Security Union Strategy 2020-2025, ‘Europeans today face a security landscape in flux, impacted by evolving threats’, such as organised crime and human trafficking. Given the cross-border nature of these threats, the Commission states that a comprehensive response at EU level should include cooperation with third countries, as stability outside the EU is crucial for the EU’s own security. In the field of law enforcement and judicial cooperation this entails that the EU must rely on ‘key partner countries to detect and investigate criminals and terrorists’. In turn, this requires specialised agencies and bodies operating in this policy field – the Area of Freedom, Security and Justice (AFSJ) – to maintain international relations as well in order to achieve their goals. Over the years, these bodies have taken up this task and become increasingly visible on the global scene by collaborating with international partners and performing a wide range of external activities. Such activities include exchanges of personal data with third countries and support to international Joint Investigation Teams, as exemplified in the 2020 annual report of the European Union Agency for Criminal Justice Cooperation (Eurojust).

Whereas scholars have shown growing interest in the agencies’ external dimension, there is still a lack of knowledge as to what these bodies actually do at the international level in practice. In this blog post, I illustrate that the agencies’ external activities are characterised by secrecy and opacity, and argue that this hampers full public debate and academic scrutiny. I further illustrate that this is particularly worrying considering the potential impact of the external activities on the fundamental rights of individuals – see for instance the reports by parliamentary working groups and journalists on pushbacks of migrants at the Greek-Turkish border by the European Border and Coast Guard Agency (Frontex). To that end, the next sections first discuss the legal parameters governing the agencies’ external dimension, then illuminate their external activities in the law and in practice, and finally lay out the potentially adverse effects of these activities on fundamental rights and accountability.

The External Dimension of EU Agencies and Bodies

The legal environment in which the external dimension of EU agencies and bodies takes shape is an ambiguous and fragmented one. Authors have referred to it as a ‘legal minefield’ and ‘constitutional twilight zone’, as the agencies’ external relations oscillate between European and international law, with a panoply of actors involved. Regarding the EU dimension, it is notable that primary law is silent on the role of these bodies in the EU external action area. However, according to the Court of Justice of the European Union (CJEU) in ESMA, EU institutions may in principle delegate some of their powers to agencies and bodies. As the Court does not differentiate between internal and external powers, such a delegation possibility exists equally to external relations tasks. When performing such tasks, the agencies are circumscribed by the ‘principle of institutional balance’ and ‘non-delegation doctrine’, as established in Meroni and revamped in ESMA. In short, these require EU agencies not to negatively affect the prerogatives of other institutions in the EU external action area, and to remain within the realm of their legal mandate. An important element is the existence of sufficient control and oversight mechanisms by the main EU institutions. Coman-Kund notes that in line with stated parameters, EU agencies and bodies ‘may be entrusted with international cooperation tasks limited to technical issues within their core mandate’. These powers have been enshrined in the agencies’ distinct regulatory frameworks. Article 23(1) of the 2016 Regulation on the European Union Agency for Law Enforcement Cooperation (Europol) states, for instance, that ‘in so far as necessary for the performance of its tasks, Europol may establish and maintain cooperative relations with (…) the authorities of third countries’.

External Cooperation Instruments

To initiate or amplify their connections with external partners, the agencies’ founding acts provide for a wide variety of international cooperation instruments, which represent the ‘starting point’ for external relations on a more technical level. These collaboration tools may, on the one hand, be light and informal in nature and, on the other, more substantive and formal. The category of informal cooperation instruments comprises, first, the means to exchange best practices with international partners (such as Europol’s organisation of international expert conferences). Second, it includes the tools to enhance mutual communication between EU bodies and third countries. The European Public Prosecutor’s Office (EPPO) may, for example, designate ‘contact points’ in third countries, according to Article 104(2) of its Regulation. With regard to the more structural modes of collaborating, agencies and bodies may choose to formalise their cooperation by concluding agreement-like documents with third countries or third-country authorities. In this vein, the European Anti-Fraud Office (OLAF) has signed a plethora of administrative cooperation arrangements with non-EU investigative services.

External Activities

As mentioned, the collaboration instruments constitute the basis for more profound external cooperation, in other words for pursuing concrete external activities. Whereas the use of certain instruments may in itself raise concerns related to transparency, fundamental rights, and the rule of law, it is essentially the performance of external activities that can directly or indirectly violate individuals’ human rights (see below). According to academics, these external activities have – alongside the agencies’ general powers and competences – expanded tremendously in recent years, both in depth as well as in number. Current negotiations on the European Commission’s proposal aimed at strengthening Europol’s mandate, notably by bolstering the agency’s cooperation with third countries, show that this ‘mission creep’ of external agency action is not bound to stop yet. Paradoxically, however, their exact external activities remain elusive to us, with negative consequences for human rights and accountability. The following sections will serve to illustrate this point by discussing the external activities in the law and in practice.

A. Obscure External Activities in the Law

After analysing the legal frameworks of the five above-mentioned agencies and bodies operating in or closely to the AFSJ – Europol, Eurojust, Frontex, OLAF and the EPPO – the following picture emerges with regard to their activities in the international arena. These bodies are, first of all, legally enabled to perform a great variety of external activities, ranging from international transfers of information to the facilitation and coordination of judicial cooperation between Member States (MS) and third countries. Second, these activities are – in line with the EU constitutional principles – ancillary to the distinct internal characteristics, mandates and tasks of the particular EU body. Hence, while there are similarities in actions envisaged – all bodies may exchange information and personal data with third countries (for example, Art. 80(1) of the 2017 EPPO Regulation) – also agency-specific activities pertain. OLAF can, for instance, carry out ‘on-the-spot inspections’ on the territory of third countries (Art. 3(1) of the 2013 OLAF Regulation), contributing to its objective of stepping up the fight against illegal activities affecting the Union’s financial interests. Alternatively, Eurojust – described as ‘facilitator of judicial cooperation’ – may ‘assist in investigations and prosecutions’ between MS and non-EU countries (Art. 3(5) of the 2018 Eurojust Regulation).

While these provisions all mention the external activities that the agencies may undertake, they do not define what these activities entail, nor do they stipulate their reach and limits, or the precise role envisaged for the agencies. One may wonder, for instance, what acts ‘assistance’ in investigations and prosecutions entails in practice, and what role a ‘facilitator’ of cooperation may assume. The agencies’ regulations remain omissive in this regard. To obtain a comprehensive overview of the agencies’ external activities, it is therefore imperative to look beyond the agencies’ legal provisions, and assess their on-the-ground international cooperation practice.

B. Secretive External Activities in Practice

Examination of the agencies’ and bodies’ cooperation arrangements, annual reports and press-releases lays bare a vast array of external activities, many of which are not expressly included in the agencies’ statutory regulations.

Whereas Europol’s legal framework, for instance, only comprises ‘information-related’ external activities, its cooperation agreements also encompass the agency’s support in individual criminal cases (for example, Art. 4 of its agreement with Bosnia). The press-releases on the agency’s website, furthermore, illustrate what this ‘support’ may entail. On 27 September 2021, Europol for example published a press release showcasing its support to an international law enforcement operation by eight MS and third-country authorities, investigating a ‘Balkan drug cartel’. According to the news item, Europol brought together the countries involved, led coordination efforts in the framework of an operational taskforce, and provided continuous intelligence development and analytical support – leading to the arrest and indictment of dozens of people, and the seizure of illegal drugs and vehicles. Other press-releases, moreover, show a collection of different activities, such as Europol’s organisation of action days with the active on-the-spot participation of its officers in an international anti-human smuggling action.

The same holds true for Frontex, whose 2019 Regulation lists its potential to carry out ‘border management actions’ outside the EU. It does not, however, include the exercise of ‘executive powers’ such as the use of force, ammunition and equipment on non-EU territory, which the agency is allowed to do under international cooperation documents (for example, the EU-Albania status agreement). Nor does it contain the ‘performance of border checks’ at crossing points or the ‘prevention of unauthorised entries’ by Frontex team members, activities which the agency has carried out in recent times, according to its press-releases. While these documents shed light on the agency’s international activities, many of Frontex’s external actions remain unknown due to the agency’s ‘obstructive and secretive practices’. Article 2(1) and 2(2) of Regulation 1049/2001 give EU citizens and residents the right to public access to documents, and agencies the option to grant this access to individuals outside the Union as well. Nevertheless, Frontex is increasingly resistant to share information, with its especially unsettling ‘blanket refusal’ to provide access to individuals residing outside the EU.

These examples illustrate how broadly and opaquely-formulated provisions on external activities in the agencies’ legal instruments – allowing for ‘cooperation’, ‘assistance’, ‘coordination’, ‘support’, etc. – lead to these bodies performing far-reaching activities potentially going beyond what was originally envisaged by their founding regulations. According to Pollak and Slominski this case of ‘experimentalist governance’ may allow for the necessary flexibility and dynamism in the agencies’ work. However, it also justifies a degree of secrecy, and is evidently problematic from the perspective of legality, transparency, and accountability, as affirmed by Carrera et al in the area of migration control.

 Concerns for Fundamental Rights and Accountability

The difficulties arising from the agencies’ undisclosed ways of working on the international scene are particularly worrying considering the potential impact that the external activities may have on individuals. It is, first, noteworthy that the activities of AFSJ agencies and bodies may generally raise fundamental rights concerns, given that these bodies are generally characterised by the more operational nature of their activities and the human rights-sensitive spheres in which they act. Following, such concerns are exacerbated when these bodies cooperate externally, as there is a notable difficulty in ensuring that legal safeguards are complied with by partner third countries. These countries are, namely, not bound by the Union’s Charter of Fundamental Rights (CFR) and may not even be party to international human rights treaties like the European Convention on Human Rights. Last year’s Schrems II judgment by the CJEU illustrates this. In that case, the CJEU invalidated the legal basis for international data exchanges between the EU and the United States, as US law did not ensure a level of protection to citizens that was ‘essentially equivalent’ to that of the CFR. The complexities of safeguarding human rights in external cooperation are, finally, most acute when agencies act on the territory of third countries – see for instance the above-mentioned extraterritorial actions by Frontex. These activities raise intricate legal issues both on the applicable legal regime and the delimitation of responsibilities among the actors involved in an operation.

In practice, it is imaginable that the agencies’ external activities adversely affect individuals’ fundamental rights in various ways. On the one hand, they are capable of directly violating specific provisions, with the example of Europol’s international data exchanges breaching privacy and data protection rights. On the other hand, agencies may indirectly violate human rights when cooperating in, or aiding and abetting, violations by external partners. The data Europol transfers to third countries will, for instance, likely be used to provide evidence for criminal prosecutions and ultimately to impose criminal penalties, significantly impacting the lives of persons concerned. International data transfers by Europol may, thus, not only infringe data protection rights, but also other fundamental rights, such as the right to a fair trial or the ne bis in idem principle, as the European Data Protection Supervisor has underscored. In terms of indirect violations, one can also think of Eurojust-coordinated investigations leading to unlawful arrests and detention or acts of torture and ill-treatment by third-country authorities.

In order to prevent and remedy potential fundamental rights violations – and to make sure the agencies comply with the above-mentioned constitutional standards – it is essential that there are effective mechanisms to hold the agencies accountable for their external activities. In line with Santos Vara and Coman-Kund, this should comprise multiple actors, fora and channels, not only evaluating the agencies’ past conduct but also providing ex ante and ongoing control over their activities. A prerequisite to exercising such scrutiny is having sufficient knowledge and information of the agencies’ activities. Furthermore, access to information is especially important to third-country nationals – the group of individuals most affected by the agencies’ external activities – as it allows them to exercise the right to an effective remedy and obtain judicial redress for harm suffered. Without disclosure of the agencies’ activities, collecting evidence and proving the alleged violation before a court of law will be very difficult, as two migration lawyers have stated regarding their recently-initiated case against Frontex before the CJEU. The lack of clarity and transparency of the agencies’ external activities in the law and in practice is, thus, a serious impediment to holding these bodies accountable for potential violations of fundamental rights.


As the foregoing shows, EU AFSJ agencies and bodies have asserted themselves on the international scene, and are increasingly developing their role as global actors. While this is to be welcomed from the standpoint of security, it is the secrecy of their external activities that obstructs full scrutiny over their actions. To hold these bodies accountable for their fundamental rights-sensitive actions, it is imperative that they do not hide behind enigmatic legal provisions and experimentalist actions. Key to this will be enhancing transparency and access to agency documents, as well as illuminating and analysing the agencies’ external activities in practice. Whereas the European Ombudman has recently called for the former, my doctoral research will serve as a contribution to the latter.