protectus (Classified information - Facility Security Clearance - Judgment) [2024] EUECJ C-185/23 (29 July 2024)

Judgment This request for a preliminary ruling concerns the interpretation of Article 47 and Article 51(1) and (2) of the Charter of Fundamental Rights of the European Union (‘the Charter’). The request has been made in proceedings between protectus s. r. o., formerly BONUL s. r. o., and the Výbor Národnej rady Slovenskej republiky na preskúmavanie rozhodnutí Národného bezpečnostného úradu (Committee of the National Parliament of the Slovak Republic for the Review of Decisions of the National Security Authority; ‘the Committee’) concerning the dismissal, by the latter, of the appeal lodged by protectus against the decision of the Národný bezpečnostný úrad (National Security Authority, Slovakia; ‘the NBÚ’) to revoke the industrial security clearance and to withdraw the industrial security certificate formerly held by protectus. Legal context European Union law Recital 3 of Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information (OJ 2013 L 274, p. 1) states: ‘In accordance with national laws and regulations and to the extent required for the functioning of the Council [of the European Union], the Member States should respect this Decision where their competent authorities, personnel or contractors handle [EU classified information (“EUCI”)], in order that each may be assured that an equivalent level of protection is afforded to EUCI.’ Article 1(1) and (2) of that decision provides: ‘1. This Decision lays down the basic principles and minimum standards of security for protecting EUCI. 2. These basic principles and minimum standards shall apply to the Council and the [General Secretariat of the Council (“GSC”)] and be respected by the Member States in accordance with their respective national laws and regulations, in order that each may be assured that an equivalent level of protection is afforded to EUCI.’ Article 11(2), (5) and (7) of that decision provides: ‘2. The GSC may entrust by contract tasks involving or entailing access to or the handling or storage of EUCI by industrial or other entities registered in a Member State … … 5. [The National Security Authority (NSA), the Designated Security Authority (DSA)] or any other competent security authority of each Member State shall ensure, in accordance with national laws and regulations, that contractors or subcontractors registered in the respective Member State participating in classified contracts or sub-contracts which require access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET within their facilities, either in the performance of such contracts or during the pre-contractual stage, hold a Facility Security Clearance (FSC) at the relevant classification level. … 7. Provisions for implementing this Article are set out in Annex V.’ Article 15(3)(a) to (c) of that decision states: ‘Member States shall take all appropriate measures, in accordance with their respective national laws and regulations, to ensure that when EUCI is handled or stored, this Decision is respected by: (a) personnel of Member States’ Permanent Representations to the European Union, and national delegates attending meetings of the Council or of its preparatory bodies, or participating in other Council activities; (b) other personnel in Member States’ national administrations, including personnel seconded to those administrations, whether they serve on the territory of the Member States or abroad; (c) other persons in the Member States duly authorised by virtue of their functions to have access to EUCI …’ Article 16(3)(a)(i) of Decision 2013/488 is worded as follows: ‘For the purposes of implementing Article 15(3), Member States should: (a) designate an NSA … responsible for security arrangements for protecting EUCI in order that: (i) EUCI held by any national department, body or agency, public or private, at home or abroad, is protected in accordance with this Decision’. Annex V to that decision, entitled ‘Industrial security’, provides, in points 8 to 13 thereof: ‘8. An FSC shall be granted by the NSA or DSA or any other competent security authority of a Member State to indicate, in accordance with national laws and regulations, that an industrial or other entity can protect EUCI at the appropriate classification level (CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET) within its facilities. It shall be presented to the GSC, as the contracting authority, before a contractor or subcontractor or potential contractor or subcontractor may be provided with or granted access to EUCI. 9. When issuing an FSC, the relevant NSA or DSA shall, as a minimum: (a) evaluate the integrity of the industrial or other entity; (b) evaluate ownership, control, or the potential for undue influence that may be considered a security risk; (c) verify that the industrial or any other entity has established a security system at the facility which covers all appropriate security measures necessary for the protection of information or material classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET in accordance with the requirements laid down in this Decision; (d) verify that the personnel security status of management, owners and employees who are required to have access to information classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has been established in accordance with the requirements laid down in this Decision; and (e) verify that the industrial or any other entity has appointed a Facility Security Officer who is responsible to its management for enforcing the security obligations within such an entity. 10. Where relevant, the GSC, as the contracting authority, shall notify the appropriate NSA/DSA or any other competent security authority that an FSC is required in the pre-contractual stage or for performing the contract. An FSC … shall be required in the pre-contractual stage where EUCI classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET has to be provided in the course of the bidding process. 11. The contracting authority shall not award a classified contract with a preferred bidder before having received confirmation from the NSA/DSA or any other competent security authority of the Member State in which the contractor or subcontractor concerned is registered that, where required, an appropriate FSC has been issued. 12. The NSA/DSA or any other competent security authority which has issued an FSC shall notify the GSC as contracting authority about changes affecting the FSC. In the case of a sub-contract, the NSA/DSA or any other competent security authority shall be informed accordingly. 13. Withdrawal of an FSC by the relevant NSA/DSA or any other competent security authority shall constitute sufficient grounds for the GSC, as the contracting authority, to terminate a classified contract or exclude a bidder from the competition.’ Slovak law Paragraph 46 of Zákon č. 215/2004 Z. z. o ochrane utajovaných skutočností a o zmene a doplnení niektorých zákonov (Law No 215/2004 on the protection of classified information and amending certain laws) of 11 March 2004, in the version applicable to the dispute in the main proceedings (‘Law No 215/2004’), provides: ‘A contractor’s industrial security clearance can be issued solely to a contractor who is … (c) reliable in terms of security …’ Paragraph 49(1) and (2)(a) and (b) of that law states: ‘(1) A contractor in respect of whom a security risk has been identified shall not be considered reliable in terms of security. (2) The following shall be considered a security risk: (a) any conduct contrary to the interests of the Slovak Republic in the field of State defence, State security, international relations, economic interests of the State, the functioning of a State authority, or contrary to the interests which the Slovak Republic has committed to protect, (b) any foreign, commercial or proprietorial relationship which could cause damage to the interests of the Slovak Republic in the field of foreign policy or security policy …’ Paragraph 50(5) of that law is worded as follows: ‘If the NBÚ finds that a contractor no longer satisfies one of the conditions of industrial security laid down in Paragraph 46 or has grossly or repeatedly failed to fulfil the obligations related to the protection of classified information, it shall revoke the validity of the clearance.’ Paragraph 60(7) of that law provides: ‘The NBÚ shall carry out the security clearance procedure for any natural person who is required to view classified information in connection with the fulfilment of tasks under an international treaty binding the Slovak Republic, and it shall deliver a security clearance certificate to that person; the provisions of Paragraphs 10 to 33 shall apply to the grant of a person’s security clearance certificate …’ Paragraph 5 of vyhláška č. 134/2016 Z. z. o personálnej bezpečnosti (Decree No 134/2016 on personnel security) of 23 March 2016, in the version applicable to the dispute in the main proceedings, provides: ‘(1) The security clearance certificate of a natural person as referred to in Paragraph 60(7) of [Law No 215/2004] shall state: … (d) the highest level of EU classified information … to which the holder may have access and the corresponding provisions of EU legislation … under which the access of the natural person to the classified information is authorised, … (4) In the absence of contrary provision in an international treaty binding the Slovak Republic, (a) the certificate shall be granted at the most for the period of validity of the clearance, (b) before the natural person views the classified information, the responsible authority shall ensure that he or she is informed of the obligations in terms of protection of classified information laid down under Law [No 215/2004] and in EU legislation … … (6) The provisions of subparagraphs 1 to 5 shall apply mutatis mutandis also to the grant of a contractor’s industrial security certificate.’ The dispute in the main proceedings and the questions referred for a preliminary ruling On 6 September 2018, the NBÚ issued the appellant in the main proceedings with an industrial security clearance allowing it to view information classified as ‘Top Secret’ and to transmit or create information classified as ‘Secret’. On 15 November 2018, the NBÚ also issued it with an industrial security certificate for ‘SECRET UE/EU SECRET’ information. The NBÚ subsequently received non-classified information relating to the appellant in the main proceedings indicating, inter alia, that it or the members of its board were the subject of a criminal investigation, that it had entered into agreements with companies under such investigation to which it had paid ‘unusual sums’ and that there were suspicions that the appellant in the main proceedings and another company, with which it was under common control, had responded to the same calls for tenders. The NBÚ also received other information on its own initiative or from other authorities, which information was designated as ‘classified documentary evidence’. The NBÚ offered the appellant in the main proceedings the possibility to comment on the non-classified information at the NBÚ’s disposal. By decision of 25 August 2020, the NBÚ revoked the industrial security clearance and industrial security certificate held by the appellant in the main proceedings. In support of the revocation of that clearance, the NBÚ stated that, in the light of the classified and non-classified information available to it, the appellant in the main proceedings posed a security risk based on the existence of a commercial relationship likely to harm the security interests of the Slovak Republic and conduct to the detriment of the economic interests of that Member State. In that decision, the NBÚ also specified that the revocation of that clearance entailed the revocation of the industrial security certificate, since the validity of that certificate was conditional upon the validity of that clearance. The appeal brought by the appellant in the main proceedings against that decision was dismissed by a decision of the Committee of 4 November 2020. The latter decision was justified, inter alia, by a reference to classified information the content of which was not set out in that decision and to which neither protectus nor its lawyer had had access, since that lawyer’s request to be able to consult that information had been rejected by the Director of the NBÚ. The appellant in the main proceedings lodged an appeal against that decision of the Committee before the Najvyšší súd Slovenskej republiky (Supreme Court of the Slovak Republic). After that appeal was brought, jurisdiction to examine it was transferred to the Najvyšší správny súd Slovenskej republiky (Supreme Administrative Court of the Slovak Republic), which is the referring court. On 28 September 2022, the NBÚ sent that court the entirety of the file, including the classified documentary evidence mentioned in the statement of reasons for the decisions of the NBÚ and of the Committee. By decision of 4 October 2022, the president of the chamber hearing the appeal of the appellant in the main proceedings did not allow the classified parts of the file to be consulted. On the same day, the lawyer for the appellant in the main proceedings applied to the referring court to be allowed to consult the classified documentary evidence communicated by the NBÚ. By letter of 5 October 2022, the president of the chamber hearing the appeal lodged by the appellant in the main proceedings rejected that application, but did ask the NBÚ to examine the possibility of granting consent for that evidence to be disclosed to that lawyer. By letter of 25 November 2022, the NBÚ informed that court that it granted consent for the disclosure of two pieces of classified documentary evidence, but refused to give its agreement for the disclosure of the other classified documentary evidence at issue in the main proceedings, on the ground that to do so would have led to the disclosure of sources of information. By letter of 16 January 2023, the lawyer for the appellant in the main proceedings again asked to be allowed to consult all the documentary evidence, relying, inter alia, on Article 47 of the Charter, as interpreted by the Court of Justice in its judgment of 22 September 2022, Országos Idegenrendészeti Főigazgatóság and Others (C‑159/21, EU:C:2022:708 ). In that context, the referring court raises the issue of the applicability of the Charter in the main proceedings. It observes in that regard, in particular, that the conditions of validity of the industrial security certificate are determined by Slovak law, which renders the validity of such a certificate conditional on the validity of industrial security clearance, without regulating in any further detail the handling of EUCI or access to it. The referring court also observes that Decision 2013/488 imposes on Member States certain specific obligations on the matter of clearance of individuals or legal entities possessing the legal capacity to undertake contracts. It also considers that the fact that the applicable Slovak legislation was not adopted with a view to the implementation of a specific act of EU law and that it establishes a link between the validity of the industrial security certificate and a national security clearance does not mean that the application of that legislation cannot constitute an implementation of EU law for the purposes of Article 51(1) of the Charter, implying that the latter is applicable to the dispute in the main proceedings. If the Charter is applicable to the case in the main proceedings, the referring court raises the issue of the compatibility with Article 47 of the Charter of the Slovak legislation and practice in relation to access to classified information in proceedings seeking to challenge the revocation of industrial security clearances or industrial security certificates. Under that legislation and practice, such information is accessible, without restriction, to the courts called upon to rule on appeals brought against decisions based on that information, but it is not part of the file accessible to the appellant. The lawyer for the appellant can access that information only after receiving consent from the authority which identified the classified information at issue; the validity of a refusal to grant such authorisation is not open to review by a court. Furthermore, that lawyer remains bound by a duty of confidentiality and cannot therefore disclose to his or her client the content of any classified information to which he or she has had access. In the light of that information, the referring court finds it conceivable that that legislation, as it is implemented by the national authorities and courts, may be inferred to be incompatible with Article 47 of the Charter on the basis of the judgment of 22 September 2022, Országos Idegenrendészeti Főigazgatóság and Others (C‑159/21, EU:C:2022:708 ). However, it considers that it is necessary to determine whether that solution may be transposed in full to the present case. If that is the case, the referring court would also like to obtain clarifications as regards the powers which it must enjoy in order to guarantee the rights flowing from Article 47 of the Charter in a situation such as that at issue in the main proceedings. In those circumstances, the Najvyšší správny súd Slovenskej republiky (Supreme Administrative Court of the Slovak Republic) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: ‘(1) Should Article 51(1) of the [Charter] be interpreted as meaning that a Member State implements EU law in the case where a court of that Member State assesses the legality of a decision of a special [committee] of the parliament of that State by which that [committee], as an appellate body, has upheld an administrative decision of the [NSA] revoking/withdrawing: – first, a legal person’s industrial security clearance giving access to classified information in accordance with national law, – and, at the same time, and only as a consequence of the revocation of that clearance, [the industrial security certificate] issued to that legal person for access to information classified as “SECRET UE/EU SECRET” within the meaning of Article 11 of, and Annex V to, [Decision 2013/488]? (2) If [the first question] is answered in the affirmative, should the first and second paragraphs of Article 47 of the Charter be interpreted as precluding national legislation and practice under which (a) the decision of [the NSA] to revoke/withdraw such clearance and the relevant certificate does not divulge the classified information which led to the authority considering the conditions for revocation/withdrawal to have been met, but merely makes reference to the document in the files of that authority containing the classified information, (b) the legal person concerned does not have access to the [NSA’s] file or to the individual documents containing classified information which led that authority to [revoke/withdraw] the clearance and certificate, (c) access to that file and those documents may be obtained by the lawyer of the legal person concerned, but only with the consent of the head of the [NSA], and possibly with that of the body which provided those documents to the [NSA], whereby, even after having obtained such access, he or she is obliged to keep the content of the file and those documents confidential, (d) the court which assesses the legality of the decision referred to in [the first question], however, has full access to those files and documents? (3) If [the second question] is answered in the affirmative, should the first and second paragraphs of Article 47 of the Charter be interpreted as directly permitting (or alternatively obliging) a court assessing the legality of a decision such as that referred to in [the first question] not to apply the rules and practice described in [the second question] and to grant the legal person concerned or its lawyer access to the file of the [NSA] and possibly to documents containing classified information, if that court considers this necessary in order to guarantee the right to an effective remedy and an adversarial procedure? (4) If [the third question] is answered in the affirmative, should Article 51(1) and (2) of the Charter be interpreted as meaning that the right of the court to grant access to the file, and possibly to the documents described in [the third question], extends – only to those parts of the file or documents that contain information relevant to the industrial clearance assessment within the meaning of Article 11 of, and Annex V to, [Decision 2013/488], or – also to those parts of the file or documents that contain information that is relevant only for the assessment of industrial security under national law, that is to say, beyond the prerequisites provided for in [Decision 2013/488]?’ The jurisdiction of the Court The Committee disputes the Court’s jurisdiction to answer the request for a preliminary ruling. First, it argues that the case at issue in the main proceedings has no link with EU law inasmuch as the Slovak authorities applied, in that case, national legislation which sought exclusively to protect the interests of the Slovak Republic and which was adopted before the accession of that Member State to the European Union, in a field which fell in any event within the scope of the Member States’ exclusive competence. Secondly, the third question directly requests the Court to interpret national legislation and to assess that legislation’s compatibility with EU law. It must be observed in that regard, first, that the first question seeks to determine whether a situation such as that at issue in the main proceedings falls within the scope of the Charter and that the other questions, which all relate to the interpretation of provisions of the Charter, are asked only on the assumption that the Court answers the first question in the affirmative. It follows that the arguments presented by the Committee as regards the Court’s lack of jurisdiction to rule on the request for a preliminary ruling in its entirety, as set out in paragraph 32 above, should be examined in the consideration of the first question and that they cannot lead to a finding that the Court has no jurisdiction to rule on that request for a preliminary ruling. Secondly, so far as the third question specifically is concerned, it must admittedly be recalled that, in proceedings under Article 267 TFEU, which are based on a clear separation of functions between the national courts and the Court of Justice, the national court alone has jurisdiction to find and assess the facts in the case before it and to interpret and apply national law (judgment of 24 July 2023, Lin , C‑107/23 PPU, EU:C:2023:606 , paragraph 76 and the case-law cited). However, it is apparent from the very wording of that question that it relates to the interpretation not of a provision of national law, but of the Charter. As a result, it must be held that the Court has jurisdiction to rule on the request for a preliminary ruling. Consideration of the questions referred The first question By its first question, the referring court asks, in essence, whether Article 51(1) of the Charter must be interpreted as meaning that the review, by a national court, of the lawfulness of a decision, first, withdrawing an industrial security clearance allowing access to information classified by a Member State and, secondly, as a result of that withdrawal, withdrawing an industrial security certificate authorising access to EUCI, in accordance with Article 11 of Decision 2013/488 and Annex V thereto, concerns acts constituting an implementation of EU law, within the meaning of Article 51(1) of the Charter. The scope of the Charter is defined in Article 51(1) thereof, according to which, so far as action by the Member States is concerned, the provisions of the Charter are addressed to those States only when they are implementing EU law. The fundamental rights guaranteed in the legal order of the European Union are applicable in all situations governed by EU law, but not outside such situations (judgments of 26 February 2013, Åkerberg Fransson , C‑617/10, EU:C:2013:105 , paragraph 19, and of 6 October 2015, Delvigne , C‑650/13, EU:C:2015:648 , paragraph 26). The concept of ‘implementation of Union law’, within the meaning of Article 51(1) of the Charter, presupposes a degree of connection between an act of EU law and the national measure at issue above and beyond the matters covered being closely related or one of those matters having an indirect impact on the other (see, to that effect, judgments of 6 October 2016, Paoletti and Others , C‑218/15, EU:C:2016:748 , paragraph 14, and of 24 February 2022, Glavna direktsia ‘Pozharna bezopasnost i zashtita na naselenieto’ , C‑262/20, EU:C:2022:117 , paragraph 60). Accordingly, in order to determine whether a national measure involves ‘implementing Union law’ within the meaning of Article 51(1) of the Charter, it is necessary to determine, inter alia, whether that national legislation is intended to implement a provision of EU law; the nature of the legislation at issue and whether it pursues objectives other than those covered by EU law, even if it is capable of indirectly affecting EU law; and also whether there are specific rules of EU law on the matter or rules which are capable of affecting it (judgment of 5 May 2022, BPC Lux 2 and Others , C‑83/20, EU:C:2022:346 , paragraph 27 and the case-law cited). In this respect, as regards, in the first place, the applicability of the Charter to the withdrawal of an industrial security clearance allowing access to information classified by a Member State, it must be observed that EU law does not contain, at the present stage of its development, any act establishing general rules on decisions taken by the Member States in order to authorise access to information classified under national legislation (see, to that effect, judgment of 25 April 2024, NW and PQ ( Classified information) , C‑420/22 and C‑528/22, EU:C:2024:344 , paragraph 103). In particular, Decision 2013/488, to which the referring court refers as regards the industrial security certificate granting access to EUCI, states, in Article 1(1) thereof, that it lays down the basic principles and minimum standards of security for protecting EUCI. That decision does not, however, include provisions governing access to information classified under national legislation. In that context, it is not apparent from the request for a preliminary ruling that the national legislation governing the withdrawal of the industrial security clearance at issue in the main proceedings has the object or effect of giving effect to a provision of EU law or that the application of that national legislation affects the application of a provision of EU law. Therefore, it does not appear that the withdrawal of a security clearance such as that at issue in the main proceedings would entail the implementation of EU law, within the meaning of Article 51(1) of the Charter. As regards, in the second place, the applicability of the Charter to the withdrawal of an industrial security certificate authorising access to EUCI, it should be noted that some EU institutions have adopted specific acts intended to govern the protection of EUCI in the context of their operation. In particular, the Council adopted, to that end, Decision 2013/488, to which the referring court refers. It follows from recital 3 and Article 1(2) of that decision that the basic principles and minimum standards which it lays down must be respected by the Member States, in accordance with their respective national laws and regulations, in order that each may be assured that an equivalent level of protection is afforded to EUCI. As regards, specifically, industrial security, Article 11(2) of that decision provides that the GSC may entrust by contract tasks involving or entailing access to or the handling or storage of EUCI by industrial or other entities. In order to ensure the protection of EUCI by contractors and subcontractors, Article 11(5) of that decision requires the NSA, DSA or any other competent security authority of each Member State to ensure, in accordance with national laws and regulations, that contractors or subcontractors registered in the respective Member State participating in classified contracts or sub-contracts which require access to EUCI within their facilities, either in the performance of such contracts or during the pre-contractual stage, hold an FSC at the relevant classification level. Article 11(7) of Decision 2013/488 stipulates that the provisions for implementing Article 11 of that decision are set out in Annex V thereto. Annex V to that decision sets out, in points 8 to 13 thereof, rules on the FSC. It follows, in particular, that an FSC is granted by the competent national authority, in accordance with national laws and regulations, to indicate that an industrial entity can protect EUCI, that that authority must ensure, as a minimum, observance of a series of requirements laid down in Annex V to that decision and that any changes to an FSC must be notified to the GSC. Point 13 of Annex V states, in addition, that the withdrawal of an FSC by the competent national authority is to constitute, for the GSC, sufficient grounds to terminate a classified contract or exclude a bidder from the competition. In order to ensure the implementation of Decision 2013/488, Article 15(3)(c) thereof provides that Member States are to take all appropriate measures, in accordance with their respective national laws and regulations, to ensure that when EUCI is handled or stored, that decision is respected by, in particular, other persons duly authorised by virtue of their functions to have access to EUCI. In order to fulfil that obligation, Member States must, inter alia, in accordance with Article 16(3)(a)(i) of that decision, designate an NSA responsible for security arrangements for protecting EUCI in order that EUCI held by any department, body or agency is protected in accordance with that decision. In the light of the rules thus established by Decision 2013/488, which imposes obligations on the Member States, the measures adopted by those states, with the aim of ensuring industrial security, by regulating access to EUCI linked to contracts concluded by the Council through the granting and monitoring of FSC, must be regarded as implementing EU law. In particular, the withdrawal by a national authority of an FSC, within the meaning of point 13 of Annex V to that decision, entails such implementation. Such a withdrawal calls into question an authorisation, the granting of which is specifically provided for by EU law, namely Article 11(5) of that decision, read in conjunction with point 8 of Annex V thereto. Moreover, the effects of such an authorisation are defined, at least in part, by that law, Article 11(5) of that decision requiring that a contractor or sub-contractor participating in classified contracts or sub-contracts which require access to EUCI within its facilities, either in the performance of such contracts or during the pre-contractual stage, hold an FSC at the relevant classification level. The fact that the conditions under which a national authority may withdraw an FSC, within the meaning of Decision 2013/488, are not directly determined by that decision or by another EU act and thus fall within the discretion of the Member States, albeit in compliance with the framework laid down by that decision, is not such as to justify a different conclusion. It is apparent from the Court’s case-law that a Member State which makes use of a freedom to choose between various methods of implementation of an EU act or of a margin of discretion which is an integral part of the regime established by that act, must be regarded as implementing that law, within the meaning of Article 51(1) of the Charter (see, to that effect, judgment of 19 November 2019, TSN and AKT , C‑609/17 and C‑610/17, EU:C:2019:981 , paragraph 50 and the case-law cited). That solution may be applied in the present case, given that the broad discretion of the Member States, within the framework defined by Decision 2013/488, to withdraw an FSC, within the meaning of that decision, is part of the scheme set out by that decision. The existence of such a discretion indeed in no way means that such an FSC has its basis in national law or that its effects are exclusively defined by national law. In those circumstances, and in the light of the fact that the EUCI protection scheme established by Decision 2013/488 is intended to ensure the proper functioning of the Council, the argument put forward by the Slovak, Estonian and French Governments that the exercise of that discretion falls within a competence retained by the Member States cannot succeed. In so far as the Slovak Government relies, in that regard, on Article 4(2) TEU, it must be borne in mind that, although it is for the Member States, in accordance with that provision, to define their essential security interests and to take appropriate measures to ensure their internal and external security, the mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable and exempt the Member States from the need to comply with EU law (judgment of 16 January 2024, Österreichische Datenschutzbehörde , C‑33/22, EU:C:2024:46 , paragraph 50 and the case-law cited). In the present case, it follows from the information in the request for a preliminary ruling that an industrial security certificate such as that at issue in the main proceedings must be regarded as constituting an FSC within the meaning of Decision 2013/488. Thus, first of all, it is apparent from the request for a preliminary ruling that, in accordance with the applicable Slovak legislation, such a certificate is granted for the sole purpose of enabling the undertaking to whom it is issued to access EUCI, that its granting entails informing that undertaking of the obligations under EU law with which it must comply and that Slovak law does not provide for any other authorisation allowing an undertaking to have access to EUCI within the framework defined by Decision 2013/488. Next, although the referring court states that the applicable Slovak legislation was not adopted specifically to transpose that decision, it is apparent from the case-law of the Court that such a finding is not capable of precluding an act based on that legislation from constituting an implementation of the law of that decision, within the meaning of Article 51(1) of the Charter, in so far as that act follows on from the rules laid down in that decision (see, by analogy, judgment of 26 February 2013, Åkerberg Fransson , C‑617/10, EU:C:2013:105 , paragraph 28). Finally, although the request for a preliminary ruling does not establish that the appellant in the main proceedings was a party to a contract with the Council or that it participated in the negotiation or performance of such a contract, that fact cannot suffice to preclude the application of Decision 2013/488. The consequence of Article 11 of that decision and Annex V thereto is that an undertaking may apply to be granted an FSC in order to be able to participate, as the case may be, in a call for tenders issued by the Council which would involve access to EUCI. Furthermore, the referring court asks the Court about the relevance to be attached to the fact that Slovak law authorises the withdrawal of an undertaking’s industrial security certificate solely because that undertaking’s industrial security clearance has been withdrawn. In that regard, it must be held that the establishment of such a link between the withdrawal of a national security clearance, as provided for in the Slovak legislation, and that of an FSC, within the meaning of Decision 2013/488, constitutes a choice made by the Slovak Republic in the exercise of the discretion referred to in paragraph 60 above and that such a choice is therefore not such as to preclude the withdrawal of such an FSC from constituting an implementation of EU law. In the light of all the foregoing, the answer to the first question is that Article 51(1) of the Charter must be interpreted as meaning that: – the review by a national court of the lawfulness of a decision withdrawing an industrial security clearance allowing access to information classified by a Member State does not concern an act constituting an implementation of EU law, within the meaning of that provision; – the review, by such a court, of the lawfulness of a decision withdrawing, as a result of the withdrawal of that industrial security clearance, an industrial security certificate authorising access to EUCI, in accordance with Article 11 of Decision 2013/488 and Annex V thereto, concerns an act implementing EU law, within the meaning of Article 51(1) of the Charter. The second and third questions By its second and third questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 47 of the Charter must be interpreted, first, as precluding national legislation and national practice under which a decision withdrawing an FSC, within the meaning of Decision 2013/488, does not divulge the classified information justifying that withdrawal, while providing that the court with jurisdiction to assess the lawfulness of that withdrawal has access to that information and that the lawyer of the former holder of that FSC may not have access to that information apart from with the consent of the national authorities concerned and on condition that he or she guarantees the information’s confidentiality and, secondly, as meaning that, in the event that that article precludes such legislation and practice, it authorises that national court of its own motion to disclose certain classified information to the former holder of that FSC, as the case may be through the former holder’s lawyer, where the failure to disclose that information to that former holder or its lawyer does not appear to be justified. It is necessary, in the first place, to examine whether a situation such as that at issue in the main proceedings falls within the scope of Article 47 of the Charter. In accordance with the Court’s settled case-law, the recognition, in a given case, of the right to an effective remedy provided for in Article 47 of the Charter presupposes that the person invoking that right is relying on rights or freedoms guaranteed by EU law or that that person is the subject of proceedings constituting an implementation of EU law, within the meaning of Article 51(1) of the Charter (judgment of 22 February 2022, RS (Effect of the decisions of a constitutional court) , C‑430/21, EU:C:2022:99 , paragraph 34 and the case-law cited). In the present case, it is true that Decision 2013/488 does not establish a right for an economic operator to be granted an FSC where certain conditions are satisfied. However, it follows from point 8 of Annex V to that decision that access to EUCI by an economic operator for the conclusion or performance of a classified Council contract is subject to the holding of an FSC. In those circumstances, it must, first of all, be recalled that, as is apparent from paragraph 52 above, it follows from Article 11(5) of Decision 2013/488 that contractors and subcontractors who participate in classified contracts or subcontracts requiring access to EUCI within their facilities, either in the performance of those contracts or during the pre-contractual phase, must hold an FSC at the relevant classification level. Next, point 10 of Annex V to that decision states that an FSC is required in the pre-contractual phase where EUCI has to be provided in the course of the bidding process. Lastly, in accordance with point 11 of Annex V to that decision, the contracting authority is not to award a classified contract to a preferred bidder before having received confirmation from the competent national authority of the Member State in which the contractor or subcontractor concerned is registered that, where required, an appropriate FSC has been issued. Furthermore, point 13 of that annex provides that the withdrawal of an FSC is to constitute sufficient grounds for terminating a classified contract. It follows that the withdrawal of an FSC, within the meaning of Decision 2013/488, has the consequence that the economic operator concerned loses the authorisation to access EUCI for the purposes of the conclusion and performance of a classified contract. Therefore, such a withdrawal means, inter alia, that that operator will be deprived of the option, which it had before that withdrawal, to participate in the pre-contractual stage of a classified contract of the Council and to be awarded such a contract by that institution if its tender is selected. The loss of that option occurs even if, like the appellant in the main proceedings, that economic operator was not, on the date of the withdrawal of its FSC, a contractor or subcontractor of the Council. Such an economic operator must, consequently, have, in accordance with Article 47 of the Charter, an effective remedy before a court in order to challenge the withdrawal of its FSC, within the meaning of Decision 2013/488. In the second place, as regards the minimum guarantees which such a remedy must satisfy, it should be recalled that, according to the settled case-law of the Court, if the judicial review guaranteed by Article 47 of the Charter is to be effective, the person concerned must be able to ascertain the reasons upon which the decision taken in relation to him or her is based, either by reading the decision itself or by requesting and obtaining notification of those reasons, without prejudice to the power of the court with jurisdiction to require the authority concerned to provide that information, so as to make it possible for him or her to defend his or her rights in the best possible conditions and to decide, with full knowledge of the relevant facts, whether there is any point in his or her applying to the court with jurisdiction, and in order to put the latter fully in a position in which it may carry out the review of the lawfulness of the national decision in question (judgment of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 53 and the case-law cited). In a situation, such as that at issue in the main proceedings, where the withdrawal of an FSC, within the meaning of Decision 2013/488, is based exclusively on the withdrawal of another security clearance, the judicial review of the withdrawal of that FSC can be effective only in so far as the former holder of that FSC may have access to the grounds on which the withdrawal of that other security clearance is based, since only that access will enable it to understand the nature of the reasons which led, ultimately, to the withdrawal of that FSC and therefore, where appropriate, to challenge those reasons. Admittedly, overriding considerations concerning, inter alia, the protection of State security or international relations may preclude the disclosure to the former holder of an FSC, within the meaning of Decision 2013/488, of all or part of the information on which the withdrawal of that FSC is based. In such circumstances, it is nonetheless the task of the national court with jurisdiction, before whom the secrecy or confidentiality of that information is no valid objection, to apply, in the course of the judicial review to be carried out, techniques which accommodate, on the one hand, those overriding considerations and, on the other, the need sufficiently to guarantee to an individual respect for his or her procedural rights, such as the right to be heard and the requirement for an adversarial process (see, by analogy, judgment of 18 July 2013, Commission and Others v Kadi , C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518 , paragraph 125 and the case-law cited). To that end, the Member States are required to provide for effective judicial review both of the existence and validity of the reasons invoked by the competent national authority with regard to State security to justify its refusal to disclose all or part of the information on which the withdrawal of the FSC, for the purposes of Decision 2013/488, was based, and of the lawfulness of that withdrawal (see, by analogy, judgment of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 58). In the context of the judicial review of the lawfulness of the withdrawal of the FSC, within the meaning of Decision 2013/488, it is incumbent upon the Member States to lay down rules enabling the court entrusted with review of that withdrawal’s lawfulness to examine both all the grounds and the related evidence on the basis of which that withdrawal was made (see, by analogy, judgment of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 59). As for the requirements to be met by judicial review of the existence and validity of the reasons invoked by the competent national authority with regard to State security of the Member State concerned, it is necessary for a court to be entrusted with carrying out an independent examination of all the matters of fact or law relied on by the competent national authority in order to assess, in accordance with the national rules of procedure, whether overriding considerations concerning, for example, the protection of State security or international relations actually preclude the disclosure of all or part of the grounds on which the withdrawal at issue is based and of the related evidence (see, by analogy, judgments of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraphs 60 and 62, and of 18 July 2013, Commission and Others v Kadi , C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518 , paragraph 126). If that court concludes that State security does not preclude the disclosure, at least in part, of the grounds or evidence which constitute the basis for the withdrawal of the FSC, within the meaning of Decision 2013/488, and which were not initially disclosed, it is to give the competent national authority the opportunity to disclose the missing grounds and evidence to the person concerned. If that authority does not authorise their disclosure, that court is to proceed to examine the lawfulness of that withdrawal on the basis of solely the grounds and evidence which have been disclosed (see, by analogy, judgments of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 63, and of 18 July 2013, Commission and Others v Kadi , C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518 , paragraph 127). On the other hand, if it turns out that overriding considerations concerning, for example, the protection of State security or international relations do indeed preclude the disclosure to the person concerned of all or part of the grounds or evidence which form the basis for the withdrawal of the FSC, within the meaning of Decision 2013/488, the judicial review of the lawfulness of that withdrawal must be carried out in the context of a procedure which strikes an appropriate balance between the requirements arising from those overriding considerations and those of the right to effective judicial protection, in particular the right to respect for the principle of an adversarial process, while limiting any interference with that right to what is strictly necessary (see, by analogy, judgments of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 64, and of 18 July 2013, Commission and Others v Kadi , C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518 , paragraph 128). In this connection, first, in the light of the need to comply with Article 47 of the Charter, that procedure must ensure, to the greatest possible extent, that the adversarial principle is complied with, in order to enable the person concerned to contest the grounds on which the withdrawal of the FSC, within the meaning of Decision 2013/488, is based, and to make submissions on the evidence relating to that withdrawal and, therefore, to put forward an effective defence. To that end, it is legitimate to consider possibilities such as the disclosure of a summary outlining the information’s content or that of the evidence in question (see, by analogy, judgments of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 65, and of 18 July 2013, Commission and Others v Kadi , C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518 , paragraph 129). In any event, the person concerned must be informed of the essence of the grounds on which that withdrawal is based, as the necessary protection, inter alia, of State security or of international relations cannot have the effect of denying the person concerned his or her right to be heard and, therefore, of rendering his or her right of redress against that withdrawal ineffective (see, by analogy, judgment of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 65). Where appropriate, if the national authority which has withdrawn the FSC, within the meaning of Decision 2013/488, intends to rely, before the national court with jurisdiction, solely on some of the grounds underlying the withdrawal of that FSC, which it considers sufficient to justify that withdrawal, it is entitled to disclose only the essence of those grounds exclusively (see, by analogy, judgment of 18 July 2013, Commission and Others v Kadi , C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518 , paragraphs 119, 127 and 130). In that case, in accordance with the case-law referred to in paragraph 85 above, that court is to proceed to examine the lawfulness of that withdrawal on the basis of solely the grounds the essence of which has been disclosed. Secondly, the weighing up of the right to effective judicial protection against the necessity to protect, in particular, State security or international relations - upon which the conclusion set out in paragraphs 87 and 88 above is founded - is not applicable in the same way to the evidence underlying the grounds that is adduced before the national court with jurisdiction. In certain cases, disclosure of that evidence is liable to compromise, inter alia, State security in a direct and specific manner, in that it may, in particular, endanger the life, health or freedom of persons or reveal the methods of investigation specifically used by the national security authorities and thus seriously impede, or even prevent, future performance of the tasks of those authorities (see, by analogy, judgment of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 66). In that context, it is for the national court with jurisdiction to assess whether and to what the extent the failure to disclose confidential information or evidence to the person concerned and his or her consequential inability to submit his or her observations on them are such as to affect the probative value of the confidential evidence (see, by analogy, judgment of 18 July 2013, Commission and Others v Kadi , C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518 , paragraph 129 and the case-law cited). Accordingly, it is incumbent upon the national court with jurisdiction to ensure that the person concerned is informed of the essence of the grounds which constitute the basis of the withdrawal of the FSC, within the meaning of Decision 2013/488, in a manner which takes due account of the necessary confidentiality of the evidence and, if necessary, to draw, pursuant to national law, the appropriate conclusions from any failure to comply with that obligation to inform him or her (see, by analogy, judgment of 4 June 2013, ZZ , C‑300/11, EU:C:2013:363 , paragraph 68). In the light of those requirements stemming from Article 47 of the Charter, it appears, in the present case, that the power of the national court with jurisdiction to have access to all classified information which forms the basis of the withdrawal of the FSC, within the meaning of Decision 2013/488, as noted by the referring court, is a necessary, albeit insufficient, condition to ensure an effective remedy in a situation such as that at issue in the main proceedings. Respect for the rights of the defence means not only that the court with jurisdiction has available to it all relevant information in order to make its decision, but also that the person concerned, where appropriate through an adviser, may defend his or her own interests by expressing his or her point of view on that information (see, to that effect, judgment of 22 September 2022, Országos Idegenrendészeti Főigazgatóság and Others , C‑159/21, EU:C:2022:708 , paragraph 58). Furthermore, the option given to the lawyer of the former holder of the FSC to have access, with the consent of the national authorities concerned, to the classified information on which the withdrawal of the FSC, within the meaning of Decision 2013/488, is based is not sufficient to ensure compliance with Article 47 of the Charter in a situation where those authorities may refuse such access without the competent national court being able to draw the appropriate conclusions from the potentially unjustified nature of such a refusal for the purposes of reviewing the lawfulness of that withdrawal, and where that lawyer must guarantee the confidentiality of that information, which means that he or she cannot disclose its content to his or her client. As to the remainder, it cannot be determined from the information in the request for a preliminary ruling whether the national court with jurisdiction has, under the Slovak legislation, the power to ascertain whether the reasons relied on by the national authorities actually preclude the disclosure of all or part of the classified information on which the withdrawal of the FSC, within the meaning of Decision 2013/488, is based, and to draw, as the case may be, the appropriate conclusions from a refusal to disclose part of that information which is not duly justified. Similarly, although it is apparent from the request for a preliminary ruling that the appellant in the main proceedings or its lawyer were able to access the non-classified information and some of the classified information on which the withdrawal of the FSC, within the meaning of Decision 2013/488, was based, the referring court did not specify whether the information thus disclosed enabled the appellant in the main proceedings to have at its disposal the essence of the grounds for that withdrawal or, at the very least, the essence of the ground or grounds on which the competent national authority sought to rely. It is therefore for the referring court to assess to what extent the national legislation and practice at issue in the main proceedings ensure compliance with the requirements stemming from Article 47 of the Charter, as they follow from paragraphs 79 to 92 above. In the third place, as regards the consequences of a finding that that legislation and practice are incompatible with Article 47 of the Charter, it remains open to the Member States to reserve to the competent national authority the power to disclose or refuse to disclose those classified grounds or that classified evidence, provided that the national court seised of the action against the withdrawal of the FSC, within the meaning of Decision 2013/488, has the power to draw the appropriate conclusions from the decision ultimately taken in that regard by that authority (see, by analogy, judgment of 25 April 2024, NW and PQ ( Classified information) , C‑420/22 and C‑528/22, EU:C:2024:344 , paragraph 113). Where the competent national authority unjustifiably impedes the disclosure of all or part of the evidence on which such a withdrawal is based, that solution is such as to ensure full compliance with Article 47 of the Charter, in that it guarantees that the authority’s failure to comply with its procedural obligations will not result in the judicial decision being based on facts and documents which the applicant has not had the opportunity to examine and on which he or she has therefore been unable to comment (see, by analogy, judgment of 25 April 2024, NW and PQ ( Classified information) , C‑420/22 and C‑528/22, EU:C:2024:344 , paragraph 114). Therefore, it cannot be considered essential, in order to ensure effective judicial protection when assessing the lawfulness of the withdrawal of an FSC, within the meaning of Decision 2013/488, that the national court seised of the action against that withdrawal have the power to disclose of its own motion certain classified information where the failure to disclose that information to the former holder of that FSC, as the case may be, through his or her lawyer, does not appear to be justified (see, to that effect, judgment of 25 April 2024, NW and PQ ( Classified information) , C‑420/22 and C‑528/22, EU:C:2024:344 , paragraph 115). In the light of all the foregoing, the answer to the second and third questions is that Article 47 of the Charter must be interpreted as: – first, not precluding national legislation and national practice under which a decision withdrawing an FSC, within the meaning of Decision 2013/488, does not divulge the classified information justifying that withdrawal, on account of overriding considerations relating, for example, to the protection of State security or international relations, while providing that the court with jurisdiction to assess the lawfulness of that withdrawal has access to that information and that the lawyer of the former holder of that FSC may not have access to that information apart from with the consent of the national authorities concerned and on condition that he or she guarantees the information’s confidentiality, in so far as that court ensures that the non-disclosure of information is limited to what is strictly necessary and that the former holder of that FSC is informed, in any event, of the essence of the grounds for that withdrawal in a manner which takes due account of the necessary confidentiality of the evidence; – secondly, as meaning that, in the event that Article 47 of the Charter does preclude such legislation and practice, it does not require the national court with jurisdiction to disclose of its own motion certain classified information to the former holder of the FSC, as the case may be through the former holder’s lawyer, where the failure to disclose that information to that former holder or its lawyer does not appear to be justified. It is for the competent national authority to do so, if necessary. If that authority does not authorise that disclosure, that court is to proceed to examine the lawfulness of the withdrawal of that FSC solely on the basis of the grounds and evidence which have been disclosed. The fourth question In view of the answer to the second and third questions, there is no need to answer the fourth question. Costs Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable. On those grounds, the Court (Grand Chamber) hereby rules: 1. Article 51(1) of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that: – the review by a national court of the lawfulness of a decision withdrawing an industrial security clearance allowing access to information classified by a Member State does not concern an act constituting an implementation of EU law, within the meaning of that provision; – the review, by such a court, of the lawfulness of a decision withdrawing, as a result of the withdrawal of that industrial security clearance, an industrial security certificate authorising access to EU classified information, in accordance with Article 11 of Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information and Annex V thereto, concerns an act implementing EU law, within the meaning of Article 51(1) of the Charter. 2. Article 47 of the Charter of Fundamental Rights must be interpreted as: – first, not precluding national legislation and national practice under which a decision withdrawing a Facility Security Clearance, within the meaning of Decision 2013/488, does not divulge the classified information justifying that withdrawal, on account of overriding considerations relating, for example, to the protection of State security or international relations, while providing that the court with jurisdiction to assess the lawfulness of that withdrawal is to have access to that information and that the lawyer of the former holder of that FSC may not have access to that information apart from with the consent of the national authorities concerned and on condition that he or she guarantees that information’s confidentiality, in so far as that court ensures that the non-disclosure of information is limited to what is strictly necessary and that the former holder of that FSC is informed, in any event, of the essence of the grounds for that withdrawal in a manner which takes due account of the necessary confidentiality of the evidence; – secondly, as meaning that, in the event that Article 47 of the Charter of Fundamental Rights precludes such legislation and practice, it does not require the national court with jurisdiction to disclose of its own motion certain classified information to the former holder of the Facility Security Clearance, as the case may be through the former holder’s lawyer, where the failure to disclose that information to that former holder or its lawyer does not appear to be justified. It is for the competent national authority to do so, if necessary. If that authority does not authorise that disclosure, that court is to proceed to examine the lawfulness of the withdrawal of that Facility Security Clearance solely on the basis of the grounds and evidence which have been disclosed. [Signatures] * Language of the case: Slovak. © European Union The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice . This electronic version is not authentic and is subject to amendment. BAILII: Copyright Policy | Disclaimers | Privacy Policy | Feedback | Donate to BAILII