On 9 June 2021, the Commission informed about the opening or progress of several infringement procedures in the area of justice and home affairs / security law and PIF:

• In the area of justice and general EU law, the Commission initiated an infringement procedure against Germany due to the ruling of the Federal Constitutional Court of 5 May 2020 on the public sector purchase programme (“PSPP”) of the European Central Bank (ECB). In the ruling, the judges in Karlsruhe stated, for the first time, that the ECB’s bond-buying programme and the CJEU’s ruling on it in the preliminary ruling proceedings were clearly not covered by the powers conferred on them (“ultra vires”). The Commission considers the ruling to be a violation of fundamental principles of EU law, in particular the principles of autonomy, primacy, effectiveness and uniform application of Union law, as well as the respect of the jurisdiction of the CJEU under Art. 267 TFEU. The Commission believes that the ruling sets a serious precedent and could pave the way for a Europe “à la carte”. Germany now has two months to respond to the accusation.
• The Commission opened infringement procedures against Bulgaria, Germany, Poland and Portugal for failing to correctly transpose certain elements of the EU Directive on combating terrorism (Directive (EU) 2017/541). The Directive includes provisions that criminalise and sanction terrorism-related offences and foresees measures for the protection, support and assistance for victims of terrorism. It is considered a main element of the EU’s Counter-Terrorism Agenda. Member States had to transpose the Directive into national law by 8 September 2018. The Commission sent letters of formal notice to Bulgaria, Germany, Poland and Portugal. The States now have two months to respond to the arguments put forward by the Commission.
• The Commission opened infringement procedures by sending letters of formal notice to Austria, Belgium, Czechia, Estonia, Luxembourg, Poland and Sweden for having incorrectly transposed measures set out in Directive 2013/40/EU on attacks against information systems. The Directive is considered a major building block in the EU’s fight against cybercrime. It harmonises crimes and penalties for several cybercrime-related offences and foresees better cooperation between authorities. The Commission believes that the Member States at issue have not sufficiently implemented the required penalty levels, illegal interception, and the criminalisation of the production and use of certain tools to commit the offences referred to in the Directive.
• The Commission believes that the national laws of Greece, the Netherlands and Lithuania do not fully transpose Council Framework Decision (FD) 2008/913/JHA on combating certain forms and expressions of racism and xenophobia by means of criminal law. Therefore, the Commission initiated the first step of the infringement procedure by sending letters of formal notice to the countries. The FD harmonises the penalization of certain serious manifestations of racism and xenophobia, e.g., public incitement to violence or hatred directed against a group of persons or a member of such a group. The Commission is already conducting other infringement procedures on this instrument.
• The Commission referred Luxembourg to the CJEU for having failed to notify all national measures necessary to transpose EU rules on the freezing and confiscation of proceeds of crime (Directive 2014/42/EU). The Commission also requests to impose a daily penalty payment to Luxembourg in accordance with Art. 260(3) TFEU. According to the Commission, Luxembourg has not transposed the Directive into its national law yet. Directive 2014/42 sets out minimum rules for freezing and subsequently confiscating the proceeds and instrumentalities of crime. EU countries had to incorporate the rules into national law by 4 October 2016.
• The Commission opened infringement procedures against Belgium, Greece, Hungary, the Netherlands, and Spain because their legislation is not in line with Framework Decision 2002/584/JHA on the European Arrest Warrant. The Commission mainly criticises the incorrect implementation of grounds for refusal and sent letters of formal notice to the countries. The infringement procedures follow up an in-depth analysis of the correct implementation of the EU’s cross-border surrender scheme in force since 2004. Other infringement procedures against 10 EU Member States have been opened in October/December 2020 and February 2021.
• The Commission sent a letter of formal notice to Belgium because the country does not ensure full independence of its Data Protection Authority (DPA). The Commission believes that the DPA is not fully independent from any external influence which would constitute a violation of Art. 52 of the General Data Protection Regulation (GDPR).
• The Commission took further steps in the infringement procedures against Cyprus and Malta for their “golden passport” schemes. By “selling” EU citizenship to wealthy nationals from third countries, the Commission believes that the two countries have not made “due regard to EU law”, as requested by the CJEU. The “golden passport schemes” are criticised, inter alia, for carrying "inherent" security issues, as well as risks of money laundering, tax evasion and corruption.
• The Commission took the second step in the infringement procedure against Germany for failure to communicate the implementation of EU tax rules, including rules on tax evasion. The underlying EU legal framework refers to Directive 2016/1164 laying down rules against tax avoidance practices that directly affect the functioning of the internal market (ATAD1) and Directive 2017/952 as regards hybrid mismatches with third countries (ATAD2). The Commission sent a reasoned opinion to Germany because no national implementing measures have been communicated yet. The deadline ended on 31 December 2019.
• The Commission initiated the second step of the infringement procedure by sending reasoned opinions to Hungary, the Netherlands and Poland for having incompletely transposed the 5th Anti-Money Laundering Directive. The Commission found different points in each of the countries that do not guarantee the full implementation of the provisions in the Directive. The Directive, inter alia, further develops the obligations on due diligence as laid down in previous AML Directives and improves the status of and cooperation between FIUs. The Directive is considered a major step forward towards better transparency of the financial system. It had to be transposed into national law by 10 January 2020. If the three Member States fail to adequately react to the reasoned opinion, the Commission may refer the cases to the CJEU.