Case C-544/15, Fahimian – aspiring to research a technology of control

If a person lives in a non-EU country that is ruled by a repressive regime but wants to come to the EU in order to pursue doctorate research that will be financed by a university in the EU, then can the host Member State turn down the person’s visa application on the ground that the knowledge acquired in the EU might subsequently be misused by the regime either to gain access to confidential information in the EU, or to develop technology that could be used as a further means to repress people living under that regime?

Background
In 2012, an Iranian graduate applied for a visa to come to Germany in order to pursue doctorate research which would form part of a broader project that was being run by a German technical university. The research post was funded by the German university and it would pay a stipend to the researcher.

In 2013, the Germany embassy in Teheran turned down the application. It was explained that the reasons for the refusal included those relating to national security. More specifically, the authorities were concerned that the knowledge which could potentially be acquired through the doctorate research might subsequently be used by the regime in Iran. The regime runs a cyber-programme which attempts to access confidential information in the West. As has been reported in the media, companies and research institutes around the world have been subject to cyber attacks by hackers seeking to access sensitive industrial data, for example, about aviation and space. German security experts could also not exclude the possibility that such attacks might in future help to advance Iran’s nuclear programme, and its suspected uses for military purposes.

Other reasons for refusing the request included the concerns that had been expressed by members of the international community. In response to the involvement of Iranian institutions in violations of human rights, the EU had imposed restrictions on trading specific types of technology with Iran, including that used in telecoms, the internet, encryption and cryptography. In October 2013, the EU Council had also issued statements about its concerns about nuclear proliferation; the need to protect technical know-how about sensitive technology; and the importance of its uses for peaceful purposes. Furthermore, the US had made Iran subject to sanctions.

In 2015, three judges in the Berlin Administrative Law Court [Verwaltungsgericht Berlin] did not know whether the German embassy’s refusal to issue a visa was legally right – it all depended on the correct interpretation being given to EU law. Therefore, the judges composed three intricate, self-explanatory and fact-rich questions for the CJEU.

Questions Referred
According to the Curia website, the questions asked by the Verwaltungsgericht in Berlin read:

1a. Is Article 6(1)(d) of Council Directive 2004/114/EC of 13 December 2004 on the conditions of admission of third-country nationals for the purposes of studies, pupil exchange, unremunerated training or voluntary service […] to be interpreted as meaning that the competent authorities of the Member States are able to exercise a degree of discretion in examining whether a third-country national who applies to be admitted for the purposes set out in Articles 7 to 11 of that directive is regarded as a threat to public policy, public security or public health, as a result of which discretion the assessment by the authorities may be subject to only limited judicial review?

1b. If Question 1a is answered in the affirmative:
What are the legal limits placed on the competent authorities of the Member States when making the assessment that a third-country national who applies to be admitted for the purposes set out in Articles 7 to 11 of Council Directive 2004/114/EC of 13 December 2004 on the conditions of admission of third-country nationals for the purposes of studies, pupil exchange, unremunerated training or voluntary service is to be regarded as a threat to public policy, public security or public health, particularly in view of the facts underlying that assessment and their evaluation?

2. Independently of the answers to Questions 1a and 1b:
Is Article 6(1)(d) of Council Directive 2004/114/EC of 13 December 2004 on the conditions of admission of third-country nationals for the purposes of studies, pupil exchange, unremunerated training or voluntary service to be interpreted as meaning that the Member States are thereby empowered, in a case such as the present, in which a third-country national from Iran, who obtained her university degree from the Sharif University of Technology (Tehran) in Iran, which specialises in technology, engineering and physics, seeks entry for the purpose of taking up doctoral studies in the area of IT-security research within the framework of the ‘Trusted Embedded and Mobile Systems’ project, in particular the development of effective security mechanisms for smartphones, to deny entry to their territory, stating as grounds for this refusal that it could not be ruled out that the skills acquired in connection with the research project might be misused in Iran, for instance for the acquisition of sensitive information in Western countries, for the purpose of internal repression or more generally in connection with human rights violations?

Comment
The order of reference produced by the German court carefully redacted and anonymised the German university and the name of Iranian graduate but the CJEU has now made that information public.

Today, the EU and the US have announced changes to the sanctions regimes that are applicable to Iran.

Nevertheless, this preliminary reference remains of potential importance to universities and the Member States in the EU.

Curiously, the use of technology that can assist states to control their populations has led to allegations that EU Member States might violate international human rights laws too; see further, Case C-203/15, Tele2 Sverige – Swedish data retention despite Digital Rights Ireland and Case C-698/15, Davis – did the CJEU in Digital Rights Ireland intend to lay down mandatory requirements of EU law? ; and Case C-582/14, Breyer – seeing the logs from the trees in privacy law.

Update – 19 August 2016
The Grand Chamber is due to hear the Fahimian case on 20 September 2016.

Update – 30 October 2016
Advocate General Szpunar is due to hand down his Opinion on 29 November.