83 - The EU Data Centre Regulation

As anyone who spends more than five minutes on LinkedIn will know, data centres are the next big thing. Or the current big thing. Certainly a thing that is big, and getting bigger. As Claude comes for our jobs, Palantir for our healthcare data and Skynet for everything else, the need for data centre capacity is set to do nothing but increase.

It is against that background that, under the auspices of the Energy Efficiency Directive, the EU adopted its snappily titled Commission Delegated Regulation (EU) 2024/1364 of 14 March 2024 on the first phase of the establishment of a common Union rating scheme for data centres (the “Data Centre Regulation”) (Maybe they can ask Alex Shattock to come up with some better titles, Ed).

The purpose of the new Data Centre Regulation? To set out the information and key performance indicators to be communicated to a European database by the operators of data centres with an installed information technology power demand of at least 500kW (Art 1).

Those Key Performance Indicators include lots of information relating to energy demand and consumption, water input and waste heat reuse (see Annex II). It also sets out a number of sustainability indicators relating to Power Usage Effectiveness, Water Usage Effectiveness, Energy Reuse Factors and Renewable Energy Factors (Annex III).

Not all of that information is publicly available, however, and it’s certainly not available on a data centre by data centre basis. Article 5 provides:

“Article 5

European database on data centres

1. The European database shall apply a common user interface as well as a common application programming interface ensuring that all reporting data centres are able to communicate, in the same way, the information and key performance indicators referred to in Annexes I and I

2. The information, and key performance indicators, communicated to the European database, and the data centre sustainability indicators, in accordance with Annex III, shall be made public in an aggregated manner, at Member State and Union level, in accordance with Annex IV.

3. Member States shall have access to all information and key performance indicators communicated to the European database by data centres in their territory pursuant to Article 3.

4. The Commission shall have access to all information and key performance indicators communicated to the European database pursuant to Article 3.

5. The Commission and Member States concerned shall keep confidential all information and key performance indicators for individual data centres that are communicated to the database pursuant to Article 3. Such information shall be considered confidential information affecting the commercial interests of operators and owners of data centres in accordance with Article 4(2) of Regulation (EC) No 1049/2001 of the European Parliament and of the Council (⁴) regarding public access to European Parliament, Council and Commission documents and Article 4(2)(d) of Directive 2003/4/EC of the European Parliament and of the Council (⁵) on public access to environmental information.

6. The aggregated data collected under this Regulation can be reused for European statistics in line with the principles defined in Regulation (EC) No 223/2009 of the European Parliament and of the Council (⁶)” (emphasis added).” (emphasis added)

So, the Commission sees everything, Member States get access to the information broken down by data centre but only in their territory, but members of the public only get the information on an aggregated basis at Member State or EU level, and can’t request it centre by centre pursuant to the Environmental Information provisions.

Earlier this year Investigative Europe revealed that the insertion of Article 5(5), followed feedback by Microsoft and the US tech lobby group Digital Europe which includes Amazon, Google and Meta during the Commission’s consultation on its draft proposal. (It should be noted, in the interests of balance, that both entities suggested other changes in their consultation feedback which were not adopted, and that the consultation went a lot broader than just those two).

The reasons given by Microsoft leading to Article 5(5) are as follows:

“The Delegated Act mandates reporting on each data centre individually, with the expectation that the published data will be aggregated before publication. However, there are serious concerns about the potential release of confidential data stored in the Commission's database in response to access requests from competitors and NGOs including for purposes of responding to requests to access to information under Regulation (EC) 1049/2001 regarding public access to European Parliament, Council and Commission documents and Directive 2003/4/EC on public access to environmental information. For example, making raw data publicly available, like the kWh and data traffic indicators, will show current and emerging competitors where to focus their capital expenditure. Both are by-products of a market so higher numbers will show hotter market.

As it stands now, the Commission proposal also exposes security-critical datacentres to cyberattacks. Revealing the total bandwidth capacity of a data centre can inform attackers about traffic volume needed to overwhelm and disable the facility. Similarly, providing server data on sent/received streams at a granularity finer than monthly could enable attackers to assess the impact of their attempted attacks on our platform, allowing them to optimize their strategies for greater damage. In the same way, releasing data like kWh and data traffic indicators can lead to security risks as bad actors can extrapolate where to focus attacks on strategically important locations. This can be a significant problem also for discrete sites with highly confidential locations that process and hold government data, for example. Although Article 12(1) of the EED refers to confidential business information and 12(2) to data centres used for defence and civil protection aims, it remains unclear who determines if a certain site will fall under this exemption and if this is self-determined by the reporting entity.” (emphasis in the original)

While the reports focus on the consultation responses from Microsoft and Digital Europe, the consultation of course went much broader than that. The EU’s explanatory memorandum (downloadable here) indicates:

“To prepare this delegated regulation, a technical study[1] (November 2022 to December 2023) was launched, and extensive dedicated stakeholder consultations were held. Three stakeholder workshops (with more than 150 participants in average for each one) took place from December 2022 to June 2023. Moreover, stakeholders were systematically consulted in the different stages of the preparatory work. More than one hundred items (position papers, white papers, feedback, etc.) were received by the Commission. Many meetings with private and public stakeholders were held in the frame of this consultation. The three reports of the technical study that propose which information and key performance indicators the reporting scheme should cover; analyse existing labelling and minimum performance standards schemes for data centres; and proposes a structure for the European database for the reporting obligation of data centres have all been published[2]^,[3],[4].

During this time, Member States were consulted, both in the frame of the EED recast negotiations and in bilateral meetings.

An inter-service consultation[5] took place between 26 October 2023 and 20 November 2023 and the text was amended to take into consideration certain comments made by the consulted DGs.

Two meetings of the Expert Group on the EED recast with Member States took place on 15 December 2023 and 17 January 2024. In parallel, a public consultation took place between 11 December 2023 and 15 January 2024. In both cases, the text was amended to take into consideration certain comments made by the Member States and stakeholders.”

What we have not been able to find is any more detailed explanation for Article 5(5).

The real question on everyone’s lips though: is this Aarhus compliant?

EIRs and Article 4

The information set out above almost certainly falls within the definition of Environmental Information in the Convention (Art 2(3)(b))).

Art 4 of the Convention therefore places an obligation on Member States to disclose that information unless (per Art 4(4)(d)) the disclosure would adversely effect

“(d) The confidentiality of commercial and industrial information, where such confidentiality is protected by law in order to protect a legitimate economic interest. Within this framework, information on emissions which is relevant for the protection of the environment shall be disclosed;”

Article 4(4)(b), which concerns International relations, national defence or public security, has not been relied upon by the Commission.

The remainder of Art 4 provides:

“The aforementioned grounds for refusal shall be interpreted in a restrictive way, taking into account the public interest served by disclosure and taking into account whether the information requested relates to emissions into the environment.”

Art 4(4)(d) does not prohibit disclosure unless there is no harm. It is a balancing exercise: if for example there is a relatively small amount of harm and a significant public interest in disclosure, disclosure is what the Convention requires: ACCC/C/2007/21 (European Community) at §30.

The question whether public authorities can exempt categories of information generally or must consider them on a case by case basis has already been considered by both the Committee and the CJEU.

In C-266/09 Commission v Netherlands ECLI:EU:C:2010:779 the CJEU noted:

“55.      By its third question the referring court asks essentially whether Article 4 of Directive 2003/4 must be interpreted as meaning that the balancing exercise it prescribes between the public interest served by the disclosure of environmental information and the specific interest served by a refusal to disclose must be carried out in each individual case submitted to the competent authorities, or that it can be defined in a general measure adopted by the national legislature.

56.      It is apparent from the very wording of Article 4 of Directive 2003/4 that the European Union legislature prescribed that the balancing of the interests involved was to be carried out in every particular case.

57.      Neither Article 14 of Directive 91/414 nor any other provision of Directive 2003/4 suggests that the balancing of the interests involved, as prescribed in Article 4 of Directive 2003/4, could be substituted by a measure other than an examination of those interests in each individual case.

58.      That does not, however, prevent the national legislature from determining, by a general provision, criteria to facilitate that comparative assessment of the interests involved, provided only that that provision does not dispense the competent authorities from actually carrying out a specific examination of each situation submitted to them in connection with a request for access to environmental information made on the basis of Directive 2003/4.

59.      It follows from the above considerations that the answer to Question 3 is that Article 4 of Directive 2003/4 must be interpreted as meaning that the balancing exercise it prescribes between the public interest served by the disclosure of environmental information and the specific interest served by a refusal to disclose must be carried out in each individual case submitted to the competent authorities, even if the national legislature were by a general provision to determine criteria to facilitate that comparative assessment of the interests involved.”

The CJEU’s approach is in line with Committee decisions. In ACCC/C/2013/89 Slovakia, Slovakia’s nuclear authority adopted a directive deeming categories of information sensitive and thus requiring them be withheld (§21). The Committee held this was a breach of both Article 4(4) and Article 6 read with Article 4:

“83. The Committee notes that section 3.2 of the Directive on Sensitive Information contains a list of data which are to be kept confidential and for which no discretion remains with the authorities on whether to release the information to the public. The Committee finds that a number of the types of “sensitive information” listed in section 3.2 of the Directive are “environmental information” within the scope of article 2, paragraph 3, of the Convention. For example, information about facilities for the supply of raw water for a power plant, nuclear materials, radioactive waste and chemicals. Moreover, at least one item of environmental information on the list, i.e., radioactive waste, could relate to emissions into the environment. The Committee stresses that an approach where whole categories of environmental information are unconditionally declared as confidential and for which no release is possible is incompatible with article 6, paragraph 6, in conjunction with article 4, paragraph 4, of the Convention. Rather, when dealing with a request for the information to which the Directive on Sensitive Information applies, the final clause of article 4, paragraph 4, of the Convention requires that the public interest served by disclosure shall be taken into account and the grounds for refusal shall be interpreted in a restrictive way and taking into account whether the information requested relates to emissions into the environment. The Committee notes that the Directive contains no requirement for officials to interpret the grounds for refusal in a restrictive way, taking into account the public interest served by disclosure and whether the information relates to emissions into the environment.

84. For the above-mentioned reasons, the Committee finds that, in the context of a decision-making procedure subject to article 6 of the Convention and with respect to requests for information under article 4 generally, by adopting an approach in the Directive on Sensitive Information whereby whole categories of nuclear-related environmental information are unconditionally declared as confidential and for which (contrary to the general legal regulation in the Freedom of Information Act) no release is possible, and for failing to require that any grounds for refusal are interpreted in a restrictive way, taking into 84. account the public interest served by disclosure and whether the information relates to emissions into the environment, the Party concerned has failed to comply with article 4, paragraph 4, as well as article 6, paragraph 6, in conjunction with article 4, paragraph 4, of the Convention.”

In that case the Committee also noted that the directive did not include wording allowing the exemptions to be construed restrictively (§82). See too ACCC/C/2008/30 (Moldova).

Taking all this together: I think the Committee is going to have fun with this if/when a complaint is made. A legislative statement that information is not only confidential but should not be disclosed, rather than reviewing the matter on a case by case basis, appears out of line with the approach taken to interpreting the convention by both the Committee and the CJEU. There isn’t a great deal of information in the public domain about exactly how the Commission struck its balance and weighed the competing public interests, so it will be interesting to see what contemporaneous documents it adduces to justify its decision and whether it, for example, looked at each item of information individually or treated it all as one block. It is notable that the Commission hasn’t relied on the security exception, while the submission by (for example) Microsoft deal with some bits of information, but not others.

That deals with article 4.

Article 1

There is another, potentially interesting, argument. Article 1 provides

OBJECTIVE

In order to contribute to the protection of the right of every person of present and future generations to live in an environment adequate to his or her health and well-being, each Party shall guarantee the rights of access to information, public participation in decision-making, and access to justice in environmental matters in accordance with the provisions of this Convention.

One might read that – entirely conventionally – as indicating the purpose of the Convention and that it intends to guarantee the specific rights set out in later articles.

However, in at least one decision the ACCC has rather indicated it goes further to that, and seems itself to be a source of substantive rights. In ACCC/C/2014/102 (Belarus) it said:

“66. The Committee considers that the rights referred to in article 3, paragraph 8, encompass the broad range of rights granted to members of the public by article 1 of the Convention, namely the rights of access to information, public participation in decision making and access to justice, which contribute to the right of every person of present and future generations to live in an environment adequate to their health and well-being. The exercise of these rights would include situations in which the provisions of the Convention concerning access to information, public participation in decision-making and access to justice set out in articles 4 to 9 of the Convention are applicable and also situations covered by the general provisions of article 3 of the Convention, but is not limited to them. Accordingly, the Committee finds that article 3, paragraph 8, applies to all situations in which members of the public seek access to information, public participation or access to justice in order to protect their right to live in an environment adequate to their health or well-being.” (emphasis added).

Whether the Committee was right or not is not a question for this particular post. It’s certainly a matter in dispute between the Committee and various state Parties. If the Committee is correct, however, and Article 1 is a source of additional rights beyond those specifically enumerated in the Convention, it’s anybody’s guess where those stop, and whether the Data Centre Regulation is on the right side of it.

[1] “Reporting requirements on the energy performance and sustainability of data centres for the Energy Efficiency Directive”

[2] https://op.europa.eu/s/y5vh

[3] https://op.europa.eu/s/za50

[4] https://op.europa.eu/s/za51

[5] Consultation ISC/2023/09850

----------------

Authors of the Aarhus blogs

– James Maurici KC – James has been in many of the leading cases on Aarhus costs including: R (RSPB) v SSJ [2017] 5 Costs L.O. 691; Case C 530/11 Commission v United Kingdom; Case C-260/11 Edwards v EA; R (Edwards) v EA (No.2) [2011] 1 Costs L.R. 70 and [2013] UKSC 78; and R (Edwards) v EA [2011] 1 W.L.R. 79. He has also appeared a number of times before the UNECE Aarhus Compliance Committee in Geneva, cases include: ACCC/C/2010/45; ACCC/C/2010/53; ACCC/C/2011/60; ACCC/C/2011/61; ACCC/C/2012/77; ACCC/C/2014/100 and 101; ACCC/C/2017/150. He is currently acting on the Free Trade Agreement Communication ACCC/C/2022/194. He was one of the contributors to the Aarhus Convention: A Guide for UK Lawyers (2015) and he has written and lectured extensively on the Aarhus Convention.

– Nick Grant – Nick joined Chambers in 2019 and has regularly advised on Aarhus related matters. He has represented the UK twice before the Aarhus Convention Compliance Committee, appearing with James Maurici KC in ACCC/C/2017/150 (the Withdrawal Act case) and unled in the admissibility hearing for ACCC/C/2022/194 (the free trade agreements case).

– Margherita Cornaglia – Margherita’s public law practice often involves acting in claims raising environmental and climate change related issues. For instance, she acted as junior counsel in the judicial review of the Government’s Third National Adaptation Programme (NAP3), pursued with an Aarhus costs cap, advancing novel arguments under Part 4 of the Climate Change Act. She also acted as junior counsel for community claimants in the Launders Lane litigation, challenging Havering Council’s refusal to designate Arnold’s Field as contaminated land; that claim likewise proceeded with Aarhus costs protection to secure effective participation and accountability. Beyond litigation, she has advised solicitors on the Government’s recent consultation concerning access to justice in relation to the Aarhus Convention, drawing on her broader practice representing NGOs and affected communities in environmental and climate cases.

– Alex Shattock – Alex has been involved in a number of environmental claims including Friends of the Earth v SSLUHC (the Cumbria coal mine case: acting for Friends of the Earth in the Planning Inquiry and High Court, with Paul Brown KC and Toby Fisher); Cox and Ors v Oil and Gas Authority [2022] EWHC 75 (Admin) (representing Extinction Rebellion activists in a challenge to the Oil and Gas Authority’s Strategy, with David Wolfe KC and Merrow Golden); R (Hough) v SSHD [2022] EWHC 1635 (acting for the claimant in an environmental and equalities challenge to the controversial use of Napier Barracks as asylum seeker accommodation, with Alex Goodman KC and Charles Bishop). He regularly advises individual and NGO clients on Aarhus costs protection. Alex also has a keen interest in treaty law generally. He has a masters and PhD in public international law and has been involved in various treaty negotiations and treaty ratification processes.

– Rebecca Sage – Rebecca is a junior tenant at Landmark Chambers with a growing practice in planning and environmental law. She is regularly instructed on matters engaging the Aarhus Convention, usually through the lens of judicial review. Rebecca has a developing interest in this complex and important area of the law and its implications for access to information, public participation in decision-making and access to justice.