Back to Criminal Law publications
Back to Business Crime publications

William Julie
William Julié Avocats, Paris
wj@wjavocats.com

Sophie Menegon
William Julié Avocats, Paris
sm@wjavocats.com

Alice Murgier
William Julié Avocats, Paris
am@wjavocats.com

 

In international law, the sovereignty of all states, which implies the exclusive right to exercise certain powers, is a fundamental principle. This principle is mostly found in customary law (such as the 1648 Westphalia Treaties), but is also referenced in international instruments, including the 1945 United Nations Charter (Article 2) and the 2007 Treaty of the European Union (Article 4).

Applying domestic law abroad, called extraterritorial enforcement jurisdiction, is theoretically prohibited as it is contrary to state sovereignty. Generally, the exercise of extraterritorial jurisdiction is only lawful when the acting state can claim to have a connection with the persons or situations it intends to govern.

This article focuses on the current tensions between extraterritoriality and state sovereignty. The United States has adopted the most extensive extraterritorial laws to which the European Union tries to respond with its own legislation with a mitigated effect.

US extraterritoriality

The US is unique in the realm of extraterritoriality laws.

They are only one of the two countries, along with Eritrea, that impose domestic taxes on its citizens on the basis of their worldwide income: fiscal liability is linked to citizenship. US citizens living abroad are required to file their taxes annually. Failure to do so could invoke high financial penalties and could be flagged by the US State Department, which in turn could revoke or deny a citizen’s passport request.^[1]

In addition, any company or individual can be investigated, charged and sentenced because of a remote link with US jurisdiction, such as a transaction in US dollars, the existence of a subsidiary onto US territory, or an exchange with a US citizen.

This article deals with the main US extraterritorial legal instruments, relating to the fight against corruption and money laundering, national emergencies and the fight against terrorism, the consequential economic sanctions, and the collection of personal data.

US extraterritorial laws prohibiting corruption and money laundering

The US Foreign Corrupt Practices Act (FCPA) became law in 1977, enabling US authorities to prosecute people suspected of bribery of foreign public funds, even if the offences were committed outside of the US.

Three categories of people are expressly targeted by the FCPA, including:

• companies issuing securities on a US market and their employees, directors, administrators, shareholders or any other person acting on their behalf (US Code (UCS) Title 15: Commerce and trade, section 78dd-1: ‘issuer’);

• US citizens, nationals and residents, and companies under US law (‘which has its principal place of business in the US, or which is organised under the laws of a state of the US or a territory, possession, or commonwealth of the US’, USC 15, section 78dd-2 (h)(1)(b)) or having their main establishment in the US, their employees, officers, directors, shareholders or any other person acting on their behalf (USC 15, section 78dd-2: ‘domestic concern’); and

• any natural or legal person, regardless of their nationality, who has committed an act in connection with the pact of corruption from US territory or by using the US postal services or any other means or instrument of interstate commerce (USC 15, section 78dd- 3).

It should be stressed that the US Department of Justice (DoJ) can launch prosecution on the basis of an extensive interpretation of the concepts of federal law of ‘complicity’, ‘conspiracy and aiding and abetting a violation of a federal statute’. Therefore,‘individuals and companies, including foreign nationals and companies, may also be liable for conspiring to violate the FCPA – ie, for agreeing to commit an FCPA violation – even if they are not, or could not be, independently charged with a substantive FCPA violation. For instance, a foreign, non-issuer company could be convicted of conspiring with a domestic concern to violate the FCPA... A foreign company or individual may be held liable for aiding and abetting an FCPA violation or for conspiring to violate the FCPA, even if the foreign company or individual did not take any act in furtherance of the corrupt payment while in the territory of the United States.’^[2]

Non-US entities can be charged under the FCPA. For instance, in 2008, the German company Siemens settled for US$350m with the Securities Exchange Commission (SEC) (US federal agency primarily responsible for enforcing the federal securities laws, proposing securities rules, and regulating the securities sector) and US$450m with the US DoJ, because it was charged with bribery of foreign officials in Argentina, Bangladesh, China, Iraq, Israel, Mexico, Venezuela and Vietnam, in violation of the FCPA and the SEC Act of 1934 (section 30a, codified with the FCPA and 15 USC section 78dd-1).

During that same year, the French company Sanofi was charged with corruption in connection with the activities of its subsidiaries in Kazakhstan and sanctioned by the SEC.

US extraterritorial laws justified by national emergencies and the fight against terrorism

Since it came into force in 1977, the International Emergency Economic Powers Act (IEEPA) authorises the US President to declare a national emergency in response to any ‘unusual and extraordinary threat’ to the US, coming from outside the US fully or in part, and to regulate international commerce on that basis.

The IEEPA was voted to broaden the Trading with the Enemy Act (TWEA), which was passed in 1917, and gives similar powers to the US President in times of war.

Following the 9/11 terrorist attacks, President George W Bush issued an Executive Order 13224 under TWEA on 23 September 2001, aimed at blocking the assets of terrorist organisations.

The USA Patriot Act was also passed in response to the 9/11 attacks, and codified in US Code, Title 18, section 2339(B). This Act lists under which conditions it is prohibited to provide material support or resources to designated foreign terrorist organisations. The Patriot Act enhanced the IEEPA asset blocking provisions under section 1702(a)(1)(B), to permit the blocking of assets even during the ‘pendency of an investigation’.

The difficulty is that each country qualifies an organisation as terrorist at its own discretion. The UN and the EU regularly update their own lists of terrorist organisations but any state may complete these lists with further entities. Therefore, the US will qualify a terrorist group according to its own criteria, meaning that a European entity might be sanctioned by the US even though its actions are not reprehensible according to UN or EU standards. For example, Hezbollah is on the list of terrorist organisations in the US.^[3] In 2013, however, the EU only classified the military branch of Hezbollah as terrorist and not its political branch.^[4]

In 2014, the French bank BNP Paribas was fined US$8.9bn by the US government for processing transactions in dollars through the US financial system on behalf of Sudanese, Iranian and Cuban entities subject to US economic sanctions, in breach of the IEEPA and the TWEA,^[5] while its actions were not necessarily prohibited by French or EU law.^[6]

US extraterritorial laws adopting sanctions and embargos

The Countering America’s Adversaries Through Sanctions Act (CAASTA), which came into effect on 29 January 2018, seeks to stop other countries from making ‘significant defense transactions’ with Iran, Russia, and North Korea.

On 8 May 2019, President Trump announced US withdrawal from the Joint Comprehensive Plan of Action (JCPOA) with Iran, involving the return of US economic sanctions against Iran and against any business, based in any country, which trades with an Iranian entity.^[7]

The US export regulations restrict imports and exports to certain countries without a US government authorisation. Embargoes sanctions prohibit all transactions with Cuba, Iran, North Korea, Sudan, Syria and Ukraine. Targeted sanctions prohibit certain exports of items, data and/or software without licenced authorisation. The Balkans, Belarus, the Central African Republic, Congo, Iraq, Lebanon, Liberia, Libya, Somalia, Venezuela, Yemen and Zimbabwe, are among the countries on the list for targeted sanctions.^[8]

US extraterritorial law relating to the collection of personal data

The 2018 Clarifying Lawful Overseas Use of Data Act (CLOUD Act) allows government authorities to require all data of any US company, even if it is stored outside of the US. The authorities can therefore access electronic communication (email, messages, etc), as well as metadata associated with those electronic communications (dates, time, transmitter, addresses, etc).

The European Union’s tools to protect its sovereignty

Like the US, the EU aims at fighting crimes, but also at protecting its citizens, companies and market. Nevertheless, the tools adopted by the EU to reach these goals are far more moderate compared to their US counterparts. In addition, the EU has also attempted to create legal instruments to counter the effect of US extraterritorial laws, with relative success.

EU legal instruments of worldwide impact

EU sanctions aimed at promoting human rights and fighting terrorism

The EU imposes sanctions to uphold its fundamental objectives such as promoting peace, human rights, democracy and reinforcing international safety.

These measures can apply to governments of non-member states because of policies contrary to the fundamental objectives of the EU; companies who are complicit of such policies; groups or organisations, such as terrorist groups; individuals who support previously mentioned policies, or participate in terrorist activities.

The sanctions are defined by country or by theme.

The countries subjected to such sanctions are Belarus, Burundi, the Central African Republic, the Democratic Republic of the Congo, Egypt, Guinea-Bissau, Iran, Iraq, Lebanon, Libya, North Korea, Russia, Sudan, Syria, Ukraine and Zimbabwe.^[9]

The thematic sanctions relate to the fight against terrorism (EU regulation 2001/2580 and EU regulation 2016/1686), the use and proliferation of chemical weapons (EU regulation 2018/1548), or cyber-attacks against EU Member States (EU regulation 2019/796).

These regulations apply to governments, entities or individuals which violate them, regardless of their nationality and the country where the activities take place.

EU regulations protecting the data and intellectual property rights of EU residents and entities

The General Data Protection Regulation (GDPR), No 2016/679, adopted on 27 April 2016, is an EU regulation that protects EU residents with regards to the processing of their personal data. The GDPR has extra-territorial scope: websites outside of the EU that process data of people within the EU are subject to GDPR regulation.

The Directive on the Protection of Undisclosed Know-How and Business Information, No 2016/943, adopted on 8 June 2016, protects companies’ trade secrets against their unlawful acquisition, use and disclosure.

EU competition regulation

EU competition law applies to all the Member States as well as to other countries that form the European Economic Area: Iceland, Lichtenstein, Norway and currently the United Kingdom. In addition, EU competition rules apply to conduct or agreements concluded outside of the EU if they have effects within the internal market.

More precisely, in the 1972 case ICI v Commission, ECR 619, the Court of Justice of the European Community (CJEC) ruled that ‘European competition law could be applied to foreign conduct consistently with the territoriality principle by treating the foreign companies and their European affiliates as a single economic entity’.

In the 1988 Woodpulp case, ECR 5193, the CJEC introduced the ‘implementation test’, based on the territoriality principle: the European Commission and courts may apply European competition rules to anti-competitive conduct formed outside the EU if they are also ‘implemented’ in the EU: ‘the decisive factor is where the agreement, decision or concerted practice is implemented rather than where it is formed. It is immaterial whether or not the producers had recourse to subsidiaries, agents, sub-agents, or branches within the Community in order to make their contacts with purchasers within the Community.’^[10]

The ‘GAFA tax’

For several years the EU has been negotiating the adoption of a tax which would be imposed on the world’s largest digital companies, Google, Apple, Facebook and Amazon (‘GAFA’), which manage to pay half as much tax as conventional companies in the EU, and which is a source of competition distortion.

On 21 March 2018, the European Commission unveiled a proposal for digital services tax. The idea is to tax up to three per cent in all EU Member States, of the turnover (and not only the profits as in the conventional system) generated by certain digital activities: the sale of personal data, of online advertising space targeting users based on the data they have provided, and services that allow interactions between users and facilitate the sale of goods and services between them. However, the unanimity required to adopt this proposal was not reached.

Consequently, some EU Member States started to lobby the Organisation for Economic Cooperation and Development (OECD) for a similar tax. In January 2019, the OECD obtained the agreement ‘of principle’ of 127 states to reform the current tax rules, in favour of fairer taxation for the digital economy. In January 2020, the OECD/G20 issued a statement affirming their commitment to reach an agreement on a consensus-based solution by the end of 2020, for a tax to be applied to automated digital services (including online search engines and social media platforms) and consumer-facing business (including personal computing products).^[11]

Given the current lack of consensus, some EU Member States started the legislative process to tax the digital giants. On 24 July 2019, the French parliament adopted a law creating a tax on digital services, targeting companies with a revenue from digital activities of over €750m worldwide and €25m in France. After this tax was announced, the US ordered an investigation, threatening heavy retaliatory financial sanctions. France and the US entered into ongoing talks, along with discussions over an OECD agreement.

EU legal instruments aimed at blocking US extraterritorial laws

The EU has adopted several measures to prevent the US from having far-reaching jurisdiction on EU entities.

The Blocking Statute

In 1996, the US adopted the Amado-Kennedy law targeting ‘rogue states’. It prohibited all oil investment in Iran and Libya and sanctioned any company of any country violating this ban, in particular through the prohibition of exporting their products in the US. A similar law, Helms-Burton Act, was passed during the same year concerning Cuba.

In reaction, on 22 November 1996, the EU adopted Council Regulation 2271/96 protecting against the effects of the extra-territorial application of legislation adopted by a third country, also called ‘Blocking Statute’, on the grounds that ‘by their extra-territorial application such laws, regulations and other legislative instruments violate international law and impede the attainment of the aforementioned objectives.’

Pursuant to its Article 1, the Blocking Statute protects EU operators engaged in lawful international trade and/or movement of capital, as well as related commercial activities, against the effects of the extra-territorial legislation specified in an Annex. In practice, it targets only the US laws, concerning Iran, Cuba and Libya, the US being the only state to have adopted legislation of such extraterritorial scope.

The Blocking Statute protects EU operators, regardless of their size and field of activity, by nullifying the effect in the EU of any foreign court ruling based on the foreign laws listed in its Annex (Article 4), and allowing EU operators to recover in court damages caused by the extra-territorial application of the specified foreign laws (Article 6).

It bans compliance by EU operators with any requirement or prohibition based on the specified foreign laws. If EU operators consider that non-compliance with a foreign extraterritorial law would seriously damage their interests or EU interests, they can apply to the Commission for an authorisation to comply with such law. 

The Blocking Statute was updated in August 2018, after the US unilaterally decided to re-imposesanctions on Iran. Nevertheless, its effects are mitigated. In June 2018, the French car manufacturer Peugeot ceased its activities in Iran, wanting to avoid the risk of US sanctions.^[12] In August 2018, the French company Total abandoned its project to develop activities in Iran over fears of US sanctions.^[13]

INSTEX

The Instrument in Support of Trade Exchanges (INSTEX) is a European special-purpose vehicle established in January 2019 by France, Germany and the United Kingdom. Its aim was to facilitate non-US$ and non-SWIFT transactions in order to avoid breaking US sanctions for trading with an Iranian entity. INSTEX is now available to all EU Member States.

However, as the US has threatened to impose economic sanctions on any entity using the mechanism it has not been utilised since its creation, even though it was in theory only designed to exchange humanitarian goods.

EU Member States regulations adopted in reaction to US DoJ negotiated sanctions of European companies

The US Department of Justice regularly negotiates and imposes heavy fines on European companies, in particular banks, in exchange of the abandon of prosecution, a mechanism unavailable in the 27 EU Member States. In reaction, some EU Members States have started to adopt legislation which enables them to adopt similar negotiated sanctions.

For instance, the 2016 French Law on transparency, fight against corruption and modernisation of the economic life, known as ‘Sapin II’, introduced the possibility, for companies or individuals suspected of having broken anti-corruption laws, to negotiate a deferred prosecution agreement, to avoid criminal charges in exchange for payment of a fine (convention judiciaire d’intérêt public). In doing this, France has attempted to affirm its authority in the field of financial and white collar crime.

Despite its efforts to counter the extraterritorial effects of US legislation, the EU is still struggling to do this efficiently. Enacting laws in the EU require approval from the 27 Member States, which can be difficult. With the United Kingdom, a somewhat notorious ally of the US, having left the EU, the situation might now change. The multiplication of EU ‘blocking’ or extraterritorial legislation in recent years could support a stronger EU sovereignty and limit future US hegemony.