As part of her ongoing fight over the EU's agreement with the US over the exchange SWIFT data, MEP Sophie in 't Veld is trying to get her hands on the full version of this Europol inspection report. The problem is that it is classified UE SECRET, which predictably led to Ms. In 't Veld's Access to Documents request being denied. (Cf. art. 9 of Regulation 1049/2001.) One way to solve this problem, the solution she is currently considering, is to appeal the denial of access in the usual way. As far as I know, no one has ever tried to do this for a document classified at level UE SECRET, and even for the next lowest level, UE RESTREINT, such a case has never been won. (Cf. Case C-266/05, Sison v. Council.) So I started thinking about a way to get around this, for example by having Europol produce it under art. 24 Statute.
It is undisputed that the EU authorities are probably a little too generous with their security levels. (Cf. this EUObserver article, for example.) Let us assume that this Europol document does not really merit an UE SECRET rating. How do we get rid of it? Can this security rating itself be challenged in court?
To start at the beginning, for an action for annulment under the Treaties you need the following:
Art. 263 TFEU:
The Court of Justice of the European Union shall review the legality of (...) acts of bodies, offices or agencies of the Union intended to produce legal effects vis-à-vis third parties.
I think we can all agree that the first two requirements are met in the case of a decision to classify a document at the level UE SECRET. The question is whether the third condition is. While the level of classification obviously has consequences for the staff of the European institutions and agencies, they do not count as "third parties". So which other possible legal effects are there?
Firstly, there is access to documents law. Unfortunately, there is art. 9(2) of Europol's Access to Documents Decision:
Europol classified documents shall not automatically be subject to refusal of access. Every classified document shall be examined whether any of the exceptions provided for by Article 4 apply. Classified documents can not be disclosed, unless they have been declassified in accordance with Article 10 of the Rules on confidentiality. Access to classified Member State, third party and EU body documents shall be subject to the consultation mechanism referred to in Article 4(4).
Obviously this provision has the effect of making sure that the decision to classify a document does not produce legal effects through access to documents law. (Regulation 1049/2001 does not have this rule, but it does clearly foresee the possibility that classified documents might nonetheless be released, so likewise no dice.)
Given that the EU only rarely does substantive criminal law - cf. art. 83 TFEU - it is unsurprising that the EU has no Official Secrets Act. The Member States do, but those acts don't usually refer to the EU's classification scheme, and even if they did it would probably be insufficient to satsify art. 263 TFEU.
That leaves the overall obligation generated by the classification decision for all "holders" of such information - regardless of whether the are EU staff - to make sure it doesn't get lost. (Cf. art. 4(2) of the Council's Decision on the security rules for protecting EU classified information.) To be sure, that's a little thin, but then again "the Treaty established a complete system of legal remedies" (Les Verts, par. 23), and it is difficult to explain how the EU authorities can have an obligation to declassify information whenever possible without a corresponding means for anyone to sue them if they don't. So I say go for it. If you end up with the right panel, you may well win.
In the case of Ms. In 't Veld, specifically, it should of course be noted that such an action needs to be brought by the Parliament, since an individual MEP probably doesn't have standing under Plaumann. But that is not necessarily a bad thing. Especially when the case is a bit dubious and political, it helps if it is brought by the entire Parliament instead of by an individual MEP.