Corporate Governance in EU Agencies: The Europol Case

: There is a trend in government to establish semi-autonomous public organizations, “Agencies”, to carry out public tasks, implement policies, regulate markets and policy sectorsor deliver public services. Once an Agency is established, it is necessary to ensure proper governance. Object of this paper is to answer three Research Questions. RQ1: “Is EU Agencies governance subject to change over time”? If the answeris “Yes”, a second question (RQ2) pops up: ‘Why EU Agencies’ governance is subject to change?” Last but not least, change has to be implemented. The topic is developed in relation to the choice made by the European Union,the one-size-fits-all modelthat makes the work of controllers simple. Are we sure that such a model“is the best choice for EU Agencies’ governance?” (RQ3). If RQ1 is self-evident, more interesting are RQ2 and RQ3 because explain the nature of change (Why) and How change was introduced. In this quest, the tasks assigned to the Board of Directors and the Executive Directorare mapped against Agencies’ mission. In the case of the European Police Office, in eight years three founding acts-an international Convention, a Council decision and a Regulation - have changed the tasks of the Board of Directors and of the Executive Directorin line with the evolution of the political scenari: from intergovernmental cooperation to a policy assigned by the Lisbon Treatyto the European Union.


Introduction
In the international scenario, the European Union (EU) is a peculiar political actor, an organization partially intergovernmental and partially supranational (Nugent, 2010). In order to implement its policies and policy processes (Buonanno and Nugent, 2013), the EU relies on a limited number of officials -24,000 less than the number of civil servants of the city of Birmingham -to serve a Union of 446 million citizens and implement an annual budget of165.8 billion euro in 2019 which is 1% of the EU's total GNP, about the size of 2017 government expenditures of a populous and relatively wealthy country such as Turkey.
Having embraced the ideas associated with the New Public Management model (Grünenfelder, 2011), separating policy-making and setting, and the advisory and supervision function from policy implementation (Bale, 2008), over the time several ad-hoc decentralized Agencies have been established. Some of them as a project, with begin and sunset clause. Some as permanent organizations, hosted in the Member States, with a staff of 5,400 specialists. A proliferation in line with a global process of agencification that in the same yearsinterested European Continental and Nordic countries, as well as Anglo-American, Far East and African Countries .
Agencies are the arms' length of the EU, carry out public tasks and are semi-autonomous. Since the Seventies,in a time span of 7-8 lustra, the process of creating new Agencies passed through three waves that resulted in a very little alignment among their founding acts. Moreover, older acts do not consider important up-to-date governance topics, such as privacy, conflict of interest and frauds against the EU in: procurement, award granting and recruited staff. For the sake of higher coherence, effectiveness and accountability, the European Commission launched a process of reform (European Commission, 2008), stigmatizing the need for standardization of founding acts (European Commission, 2005). In 2012 the European Parliament, the Commission and the Council endorsed in a Joint Statementa Common Approach on decentralized agencies (European Council, 2012), translated into a dedicated Roadmap with 89 action points. Among them, Action 2, a new model for Agencies' founding acts, was the most controversial topic (EU Agencies Network, 2015).

Eugenio Orlandi
Corporate Governance in EU Agencies: The Europol Case 34 Once introduced the concept of corporate governance, this paper answers three Research Questions: • (RQ1): Is EU Agencies' governance subject to change over time?
• (RQ2): (If the answer to RQ1 is "yes") Why EU Agencies' governance is subject to change?
• (RQ3): Is the one-size-fits-all model the most efficient and effective for EU Agencies' governance?
As far as Agencies' typology is concerned, Executive Agencies are responsible for the management of Community programs. A larger group of Regulatory Agencies operate in a wide variety of fields. In relation to the tasks, four main clusters can be identified (Andoura and Timmermann, 2008): • Regulatory agencies that act as administrative regulators and provide certificates and licenses.
• Observatory agencies that collect, analyse, process and distribute reliable information to theMember States, Community institutions and the general public.

•
Cooperative agencies operating in the area of social policy aimed at promoting social dialogue at the EU level.

•
Executive agencies that perform technical tasks, entrusted by the Commission with limited nondiscretionary powers for the management of Community programs.

Literature Review
There is a rich literature on organs and institutions of the European Union, but relatively few works are dedicated to its Agencies. Aim of this paper is to fill this gap not only giving an insight on EU Agencies but also explaining the impact of shifting their control from the Council to the Commission.

Research Methodology -Materials and Methods
Control is an important issue when using public resources collected by taxation. Corporate governance is defined as "the collection of control mechanisms that an organization adopts to prevent or dissuade potentially self-interested managers from engaging in activities detrimental to the welfare of shareholders and stakeholders" (Larker and Tayan, 2016). The relationship between the Commission and it Agencies can be described by the Principal-Agent (P/A) Model of Figure 1: a relationship between an asset owner (principal, P) and the agent (A), the person contracted to manage that asset on the owner's behalf. (1) Eugenio Orlandi Corporate Governance in EU Agencies: The Europol Case 35 A principal hires an agent to carry out a specific task. Unfortunately, P and A have very different objectives: P is interested in maximizing "the difference between the value it receives as a result of the agent's action and any payment it makes to the agent" (Besanko et al., 2010) while the agent "is concerned with the value he/she receives from participating in the relationship, minus any costs incurred by doing so". A has more information about his/her performance compared to P (information asymmetry). The main risks for the principal are: 1. Adverse selection: P cannot hire the best A because of lack of information; 2. Mad hazard: A can perform sub-optimally (shrinking) without being sanctioned.
Incentives and monitoring are the traditional solution to cope with these risks. In the EU, the Commission and the Council play the role of principals, and Agencies the one of agents. This study is based on non-classified documents of the European Union, the Network of EU Agencies, and one of the 32 decentralized Agencies.

Controls of EU Agencies
The EU budget has always been a controversial topic, with net contributors to the budget wanting their contributions cut, and net beneficiaries wanting their benefits protected. Member States and taxpayers could not easily observe whether the work being paid for with taxes are collected, was actually being done. Corporate governance ensures a first level of control. Further checks are distributed in additional layers: political accountability in front of the European Parliament; judicial accountability ensured by the Court of Justice of the European Communities; financial accountability under scrutiny ofthe Commission's budgetary authority and the Court of Auditors; administrative accountability safeguarded by the European Ombudsman; and transparency by the right of access to the documents of the Commission, the Council and the European Parliament. Considering all these controls, Ongaro (2012) wrote: «EU agencies represent an extreme case, in terms of being (over) controlled and scrutinized».
After the publication on the press of some critical articles on the functioning of its bureaucratic apparatus, the Commission launched in 2005 a process of reform and standardization for its decentralized Agencies with the aim of improving efficiency and effectiveness.In 2008 a working document -European Agencies: the way forward -was published to foster inter-institutional discussions among the Commission, the European Parliament and the Council that, in 2012, endorsed a Common Approach, and a dedicated Roadmap with 89 Action Points, more than half (50) to be implemented by Agencies; 11 by the Commission, with Agencies providing substantial contribution; and the remaining by both actors.
Among the innovations, the most controversial issue was the standardization of the founding act, through a Decision or, after the Lisbon Treaty, a Regulation . The founding act is the most important document for an Agency because defines: mission, tasks, review or sunset clause, human resources provisions (Appointing Authority, Director nomination and dismissal procedure, and role), methods for evaluating the Agencies' performances, conflict of interest, international relations strategy, exchange of EU classified information, (multi)annual work program.

The European Police Office
The Maastricht Treaty, signed in 1992, came into effect on 1 November 1993 and reformed the EC introducing threepillar architecture: i) the European Communities; ii) a Common Foreign and Security Policy (CFSP); iii) cooperation in the spheres of Justice and Home Affairs (JHA).
Before World War I, European travel was passport-free. About seventy years after five EU Member States, after the positive experience of passport-free areas (Benelux and Nordic Countries), signed in 1985 in the town of Schengen, Luxembourg, an extra-EU agreement on the abolition of border controls. In 1997 the Schengen acquis was integrated in the EU framework through a protocol which came into effect in 1999 (Buonanno and Nugent, 2013). Eventually, the

Eugenio Orlandi
Corporate Governance in EU Agencies: The Europol Case 36 Schengen Agreement was supplemented by a Convention (European Union, 2000). In some countries organized crime, considered as a single entity, is the biggest national "employer". Only in Europe 3,600 criminal organizations are active (Europol, 2013). Some are multinational corporations employing people of sixty different nationalities.The abolition of internal customs and police control required stricter judicial and police cooperation in criminal matters (König, 2019).A European Police Office, Europol, was established in 1992 as a centre of expertise in law enforcement and for strategic intelligence on organized crime.The idea was to move from the traditional bilateral police cooperation to multilateral (network) cooperation, to save time and money, and better cope with the business models of organized crime.
In the vision of Europol's political sponsors such as the German Chancellor Helmut Kohl, well aware of the transnational nature of organized crime, Europol was the first stone for a future European FBI (Federal Bureau of Investigation) but up to now doesn't have any coercive power. Being a "federal" agency,is allowed to intervene in the limit of its mandate, if and only if two or more Member States are involvedin serous crime (Europol, 2004). The initialstep was to improve police cooperation by establishing a police information broker, similar to Interpol but with a higher level of trust and data protection, supported by an ad-hoc large information system, offering unique connectivity services to the Member States and providing in its headquarter in The Hague, The Netherlands, a single point of contact for 200 liaison officers posted by the Member States, third Countries or National Agencies that have signed a strategic or operational agreement with Europol,such as the US FBI.
The Europol's founding act, a Convention, established the Agency under Article K.3 of the Treaty on European Union (Maastricht Treaty). Signed in 1995, the Convention came into force on 1 October 1998 after having been ratified by all the fifteen EU Member States. It contained 47 Articles, an Annex, four Declarations (Europol, 2004) thatdefined the Europol's mission, what should do, and how should act. The major concern was data protection because of the potential risk from centralizing criminal data processing: hacking and authoritarian use of data. Therefore, 27 out of 47 Articles dealt with information technology, access and processing rules, data protection and confidentiality, duty to inform the European Parliament. The Police Office, an executive agency, commenced its activities on 1st July 1999.  A Council Decision (European Union, 2009) necessary to make the status of Europol compliant with the Reform Treaty replaced the Europol Convention. Unfortunately, the Council Decision was adopted while a reform of the Commission's decentralized agencies was at its initial stage. After the approval of a Common Approach, the need of a new founding act common to all the Agencies appeared evident. The Europol's Council Decision became obsolete in three year time. To reach an agreement, quite a long discussion was necessary. A draft circulated after the approval of the Roadmap in 2012. In 2015 new threats redefined the perimeter of the EU Internal Security: massive irregular immigration (1.5 million refugees and economic migrants) and Islamic terrorism. Charlie Hebdo's attack in Paris, France (17 victims), was followed by the Bataclan massacre that claimed 130 lives injuring 352 people. The Europol Regulation, still in the draft status, was amended in order to cope with the new challenges, and was agreed only in 2016  (European Union, 2016). Figure 2 summarized the evolution of European Union's framework (Treaties and Common Approach) and, with a certain time delay, the consequential changes in Europol's Founding Acts. Moreover, differently from most of the European Agencies, the existence of Europol is enshrined in a Treaty, the TFEU . More specifically, TEFU Article 87 defines the EU mandate in terms of police cooperation under the responsibility of the European Parliament and the Council, and Article 88 the Europol's mission.

Research Question RQ1
As far as public organizations are concerned, corporate governance is defined by their founding acts. Themethodology followed to answer Research Question (RQ1) -"Is EU Agencies' governance subject to change over time? -has been the comparison of the founding acts in relation to tasks and responsibilities of the two most important organs of an Agency: itsBoard of Directors, hereafter the Management Board, described inTable1, Table 2 and Table 3, and its Executive Director, described in Table 4, Table 5 and Table 7. With three different releases of its founding act, Europol shows that in EU Agencies indeed governance is subject to change over time. The most significant structural change was reducing its organs from the four of the Europol Convention into two (Council Decision, Article 37) -the Management Board, hereafter MB, and the Directorassigning the control tasks to the Commission (DG Budget) and the EU Court of Auditors. Under the Convention, control on budget implementation was ensured by two ad hoc organs: the Financial Controller and the Financial Committee (Art. 27).Accountability for Europol's Strategies, activities, results was shared between the MB, whose tasks are defined in Article 28 of the Europol Convention, and the Director whose tasks and responsibilities are defined in Article 29. In particular, the Director is "Accountable to the MB in respect of the performance of his duties". S/he shall attend MB meetings with non-voting status".
Over the time, align the founding acts of EU Agencies to the evolution of the legal and control systems and their present-day points of weaknesses -conflict of interest and frauds -appeared necessary (Larker &Tayan, 2016). In the case of Europol, the trigger was the change of the institutional framework. The Actors involved (Member States, the Commission, the Council, Europol) took the opportunity to review some initial assumptions. Thanks to a good record of data processing security at Europol, and the evolution of information security, the prohibition of inter-connecting computerized systemswas removed. The new ICT police architecture privileged the exchange of existing information distributed in different national systems, instead of building new centralized stand-alone systems and data bases.

Eugenio Orlandi
Corporate Governance in EU Agencies: The Europol Case Lately, align the founding acts to the evolution of the legal and control system and their present-day points of weaknesses -conflict of interest and frauds -appeared necessary (Larker &Tayan, 2016). But it was not the technological evolution to push for change: the driving force was the redistribution of power introduced by the Lisbon Treaty: a reduction of the influence of the Member States and an increasing role of the Commission in the AFSJ as can be appreciated by comparing Table 1 and Table 2. Under the Convention, Europol was controlled by the Council, more inter-governmental than supranational, strongly influenced by the Member States. With the Lisbon Treaty more and more competences on internal and external security moved from the Member States to the AFJS under the direct supervision of the Commission.
In the Europol Convention, Article 28 (2) states that the MB is composed of one representative of each Member State, and assigns one vote to each member. Article 28(4) defines the role of the Commission, invited to attend the meetings with non-voting status. Article 28(7) prescribes that the MB shall convene at least two times per year. Sub-point (10) prescribes that each year a general report on Europol's activities, and a report on Europol's future activities shall be adopted unanimously "taking into account Member States' operational requirements and budgetary and staffing implications for Europol". Table 1, Table 2 and Table 3 summarize the tasks of the MB clustered in categories: strategic role, staff management,core business (data management & data protection, operations) and supervision.
By comparing the different versions of the Europol's founding act, two were the most interesting features under the Convention: 1) a strong strategic role of the MB, and 2) the pay-per-use financing system through the MB's approval of the multiannual programming and the annual work programme for the following year. After the MB's approval, the Member States were invited to contribute pro quota to the budget as stated by Article 35: "The budget shall be financed from Member States' contribution and by other incidental income. Each Member States' financial contribution shall be determined according to the proportion of its GNP".
A wide span of control on operational activities was justified by the novelty of police cooperation, and the traditional police reluctance to share data. With the Council Decision, the tasks of the MB were redefined, reduced in number and influence, as is clear by comparing Table 1 and Table 2. The most significant change was a dramatic reduction of its strategic role and, consequently, of the role of the Member States, in favour of the Commission. With the Council Decision, the representative of the Commission sits in the MB with the vote right. The MB is no more involved in the definition of the Europol's priorities and the adoption of rules governing Europol's relations with third States and third bodies. Under the Convention, communication of data to third States and third bodies was disciplined by Article 18. Europol was allowed to "establish and maintain relations with third States and third bodies". The role of the Council was that of a regulator, "drawing up rules governing the relations" after having obtained the opinion of the MB. With the Council Decision, Europol's budget became part of the Commission's budget, subject to the political dynamics of the Commission's budget -competing with other Directorate Generals and subject to budget cuts depending on the available resources -with no links to the users' willingness to pay for the services received.
Compared to the Council Decision, the new Regulation sounds more modern, addressing hot governance topics such as conflict of interests, corporate fraud and irregularities. Attention and control have shifted from Data Protectiona field in which Europol can be regarded as a world best practice -to operations (sub-point "s" in Table 3) where cybercrime, terrorism, trafficking of human beings and illegal immigration are hot topics.

Research Question RQ3
The EU desired high level of standardization -implementing the one-size-fits-all model -removed some peculiarities due to the very different missions of Agencies. Moreover, the one-fits-all model was launched when the peoples of Europe were asking for an EU less influenced by lobbies and closer to the needs and the identities of the European citizens (Coriat et Al. 2010 and. In 2005 the concerns of many Europeans resulted in the negative popular response to the referendum promoted by two founding Member States, France and The Netherlands, on the adoption of a European Constitution. A negative outcome and the first stop to the process of European integration that paved the road for the referendum held in the UK on 22 June 2016, known as Brexit. With the Common Approach the Commission took the opportunity to redesign tasks and composition of the MBs of the Agencies whose dimension has increased over the time due to the EU enlargement from the initial nine members (one for each Member State) of 1975, plus one or more representatives of the Commission and/or other organizations, to the 28 members of 2013. With the paradox that, in the case of a small Agency such as CEPOL, the EU Agency for Law Enforcement Training, the number of the Management Board members exceed the number of the Agency's employees.

Eugenio Orlandi
Corporate Governance in EU Agencies: The Europol Case 40 As far as Europol is concerned, one of its success stories was the agreement signed with Colombia, supported by a strong business case: fight drugs traffic between South America and the EU. The willingness to sign an agreement pushed Colombia to emend its Constitution and align data protection rules to EU standards increasing the level of protection of personal data.Article 26(1) of the Council Decision states that the list of the third States and bodies with which Europol can conclude agreements, is determined by the Council after having consulted the Parliament. When the Council wants to improve relationships with a third State, may suggest to the EU Agencies, including Europol, to work at an agreement even if there is little business need. Vice versa, an agreement with third States important from the business perspective is hardly signed if the State is not in the political agenda of the Council such as in the case of countries relevant from the criminal perspective but far from the EU political landscape. If the Colombia business case had been discussed after the Council Decision, quite certainly Europol wouldn't had been authorized to sign an Agreement with a Country not in the top list of the CFSP interested in the neighborhood (Mediterranean) countries, in former French and British colonies, and very poor countries.
If it is true that a Commission Agency is established to implement Commission policies, it is also true that, once defined the Agency's mission, policies dictated by a contingent political momentum could not be in line with such a mission. Through the Lisbon Treaty, in order to benefit of more effectiveness in combatting crime and not to subordinate police cooperation to political games,the mandate of the Commission in the AFJS was widened. In the case of Europol its mission -as it is defined by the Lisbon Treaty -is closer to the interests of the European citizens and the Member States -combat today's crime -than to the interests of the Council and the Commission: extend cooperation, including police cooperation, with a list of Countries in the political agenda.
Manage a Board with 29 Members, and 25 languages, is not simple. To increase efficiency, the Commission has proposed for the Board of Directors the two-tier German model, with a Supervisory Board (Aufischtsrat) that oversees and appoints members of a Management Board (Vorstand) and approves major management decisions. The Member States, jealous of losing control delegating the real power to a limited number of Countries represented in the "traditional" MB rejected the proposal.

The role of the Director
If the evolution of the founding acts produced a different balance of power between the MB and the Commission, the power (tasks and responsibilities) of the Director registered little change in the substance (Table 4). Change interested mainly the increased number of the institutions involved in controls and the standardization of the information provided. In the Council Decision is possible to notice the Director's increasing duty of reporting to different levels of control, as it can be appreciated in Table 5 in order to reduce the traditional information asymmetry between shareholders and management. The reduced strategic role of the MB -no more responsible for the establishment of the priorities for Europol -is reflected by the duty of the Director to inform the MB on the priorities identified by the Council. Such an evolution continued in the Regulation (Table 5) taking into account the standardization work of the Common Approach. In Table 5 is also possible to appreciate the progressive extension of control on Europol assigned to other European Union bodies: the European anti-fraud office (Olaf) and the European Data Protection Supervisor (EDPS). The latter replaced the Joint Supervisory Body, a collegial body with representatives of the Member States expert on police data protection that ensured a successful data protection regime under the Convention and the Council Decision.

Eugenio Orlandi
Corporate Governance in EU Agencies: The Europol Case 41 Unfortunately, data protection of police information requires different skills and competences when compared to ordinary data protection that is the field of expertise of the civil EDPS (European Data Protection Service). A poorly designed data protection can reduce the added value of having consolidated European police information. As many other changes, also this one has increased the Commission's power that, through the EDPS, can paralyze the work of Europol.
The charism of an EU Agency Director -Executive Director in the Regulation -is defined by the way s/he is appointed. In all EU Agencies, appointing a new Executive Director is a MB task. According to Table 6, the MB has the power to choose among the candidates proposed by the Commission, considering experience, performance in the selection process, and the impressions received when the selected candidates introduce themselves and propose their vision and strategy for the Agency. But if the "suitable" candidates are only two, and one is quite modest and/or a Commission's employee, is the Commission that selects and appoints its candidate. Should the MB refused appointing such a candidate, a new expensive and time consuming recruitment process was necessary, and no Member State wants to accept the responsibility of leaving for a long time an organization without its leader. The procedure works well for Agencies that can to be managed by a bureaucrat, and do not require a charismatic Director. This is not the case of Europol that maintains a different process of appointing its Director and the Deputy Directors (Table 7). The latter cannot be dismissed by the Director, and act also as an additional level of control on the Director.By comparing Table  6 describing the procedure for appointing the Executive Director of a European Agency, and Table 7 describing the procedure for appointing the Director of Europol, is possible to appreciate the higher power of the Europol's MB compared to the MBs of other EU Agencies. Notwithstanding the provision of the Common Approach (Table 6), under the Europol Regulation the MB maintains the power of adopting "internal rules regarding the procedure for the selection of the Executive Director, including rules on the composition of the selected committee which ensures independence and impartiality" (Article 11, subpoint (i) ).In this process the Commission has just one vote as well as all an ordinary Member State. The final choice is made by the Council on the shortlist proposed by the MB. Compared to the Convention, the Council Decision gave more margins for maneuvers to the Council by requiring "at least three candidates". This limitation was removed by the Regulation and the removal can be read as an empowerment of the MB. Also the Commission plays a major role in the extension of the term of the Directors of Agencies (Table 7) being in charge of evaluating their performance, and being a positive evaluation necessary to motivate the Commission's request to the MB to of extending the Director's tenure. In the case of Europol, this power remained in the hands of the MB in the Council Decision while in the Regulation the assessment is a joint task of the Commission and the MB. In both cases, Council Decision and Regulation, is the MB who proposes the Director's renewal to the Council. It is also thanks to these differences, that the Europol's Director charism is higher when compared to the one of the Commission selected Directors of the other EU Agencies.

Discussion
The proposed Case Stories -Europol's three founding acts and the Joint Statement -answer three Research Questions: (RQ1) Is EU Agencies' governance subject to change over time? (RQ2) Why EU Agencies' governance is subject to change?and (RQ3) Is the one-size-fits-all model the best one for EU Agencies' governance? Changes reflected in corporate governance of the EU Agencies map the evolution of the EU institutional framework (RQ1). With the Lisbon Treaty, the Third Pillar of the Maastricht Treaty architecture -judicial and police cooperation in criminal matters (JHA) -evolved in an Area of Freedom, Security and Justice (AFSJ). Power shifted from the Member States to the European Commission (RQ2).
The EU institutional framework and the European Agencies corporate governance are evolving in line with the field best practices. The evolution of the MB has been analysed through three different founding acts. The reshaping of the strategic role of the MB passing from the Convention to the Council Decision has reduced the resources available for the business needs of the Member States. Even if Europol is the main provider of information for the EU multi-annual policy cycle on organized and serious international crime, the law enforcement priorities of the Commission are different from priorities of the Member States.