Surveillance by intelligence services: fundamental rights safeguards and remedies in the EU - Volume II: field perspectives and legal update FRA Opinions

Providing for a clear legal framework

Intelligence services help protect national security. To do this successfully, they often need to work in secrecy. However, international and European human rights standards require the mandate and powers of intelligence services to be clearly defined in a legal framework, and for this framework to establish safeguards against arbitrary action to counterbalance secrecy. The European Court of Human Rights (ECtHR) has held that national legal frameworks must be clear, accessible and foreseeable. It obliges Member States to enshrine minimum safeguards in law, such as specifying the nature of offences that may lead to interception orders and defining the categories of people who may be put under surveillance. FRA’s fieldwork shows that surveillance legislation is considered complex and that a clearer legal framework with meaningful definitions is needed.

Ensuring broad consultation and openness during the legislative process

The preparation of intelligence legislation should involve an open debate among key stakeholders. During discussions on draft intelligence laws, governments should take the time to clarify the needs of intelligence services and to explain which fundamental rights guarantees the bill has established. FRA data show that most EU Member States have reformed their intelligence and counter-terrorism legislation in recent years. Some of these legislative processes unfolded during FRA’s fieldwork. The interviewed experts emphasised the need for a broader inclusion of key actors and stakeholders in the development of intelligence legislation. In some Member States, online public consultations and lively parliamentary discussions are taking place instead of new legislation being fast-tracked. FRA’s Fundamental Rights Report 2017 underlined the need for such an approach.

Providing independent intelligence oversight with sufficient powers and competences

Setting up a strong oversight mechanism is an essential part of an intelligence accountability system. The oversight framework should reflect the powers of the intelligence services. European Court of Human Rights case law provides that oversight bodies should be independent and have adequate powers and competences. FRA’s research findings show that all EU Member States have at least one independent body in their oversight framework. However, the findings also identified limits to full independence, with some oversight bodies remaining strongly dependent on the executive: the law does not grant them binding decision-making powers, they have limited staff and budget, or their offices are located in government buildings.

Bolstering oversight with sufficient technical expertise

Particularly in light of rapidly evolving technology in the digital area, technical expertise and capacity among oversight bodies is crucial. FRA’s fieldwork indicates that limits on oversight bodies’ IT expertise and their technical capacity to fully access intelligence data poses, and will continue to pose, a major challenge. Interviewed experts stated they sometimes need to rely on external expertise to complement their own legal expertise. FRA’s legal research shows that some EU Member State laws explicitly require oversight bodies to have technical expertise.

Ensuring oversight bodies’ openness to public scrutiny

The European Court of Human Rights has underlined that intelligence services and oversight bodies should be held accountable for their work. They should be transparent and effectively inform parliaments and the public about their activities. FRA’s research shows that in some Member States, enhanced transparency is achieved while respecting necessary secrecy. Experts interviewed during FRA’s fieldwork consider enhanced transparency to be particularly important. However, oversight bodies’ approaches to transparency vary considerably across Member States, ranging from publishing regular reports to having websites or using social media.

Fostering continuity of oversight

The European Court of Human Rights has held that effective oversight requires ‘continuous control’ at every stage of the process. FRA’s research findings show extremely diverse oversight structures across EU Member States. When different bodies are involved in the various steps of oversight – from approving a surveillance measure to the oversight of its use – possible gaps or overlaps can result. Such shortcomings undermine the adequacy of the safeguards. FRA’s fieldwork highlights that institutional and informal cooperation between the oversight bodies within individual Member States is crucial.

Enhancing safeguards for protected professions

The European Court of Human Rights has held that enhanced safeguards are needed to protect journalistic sources in the context of surveillance. This principle similarly applies to other professions which, due to overarching principles such as parliamentary privileges, independence of the judiciary and confidentiality in lawyer-client relations, also require greater protection. FRA’s research shows that while diverse approaches exist, several EU Member States have laws stipulating enhanced authorisation and approval procedures for, as well as stricter controls on, the processing of data collected through surveillance of individuals belonging to protected professions.

Ensuring efficient whistleblower protection

The European Court of Human Rights has held that whistleblowing by civil servants should be ensured. Whistlebowers can significantly contribute to a wellfunctioning accountability system. FRA’s research revealed different whistleblowing practices across EU Member States. Interviewed experts expressed diverging views about whistleblower protection.

EU Member States should ensure efficient protection of whistleblowers in the intelligence services. Such whistleblowers require a regime specifically tailored to their field of work.

Subjecting international intelligence cooperation to rules assessed by oversight bodies

FRA’s comparative legal analysis shows that almost all Member States have laws on international intelligence cooperation. However, only a third require intelligence services to draft internal rules on processes and modalities for international cooperation, including safeguards on data sharing. When they exist, these rules are generally secret. Only a few Member States allow for external assessments of international intelligence cooperation agreements.

Defining in law oversight bodies’ competences over international intelligence cooperation

FRA’s comparative legal analysis shows that most Member States’ laws do not have clear provisions on whether oversight bodies can oversee international cooperation exchanges. Eight EU Member States establish oversight bodies’ competences over international intelligence sharing – either with or without limitations; laws in three EU Member States exclude any form of independent oversight. In the remaining 17 Member States, legal frameworks are subject to interpretation to determine oversight bodies’ competences over international intelligence sharing.

Exempting oversight bodies from the third-party rule

In international intelligence service cooperation, the third-party rule prevents a service from disclosing to a third party any data received from a partner without the source’s consent. FRA’s research underlines that the third-party rule protects sources and guarantees trust among intelligence services that cooperate. However, FRA’s data show that oversight bodies are often considered as ‘third parties’ and therefore cannot assess data coming from international cooperation. In some Member States, oversight bodies are no longer considered as ‘third parties’ and so have full access to such data.

Providing for effective remedies before independent bodies with remedial powers

The European Court of Human Rights has held that an effective remedy is characterised by investigative and decisional powers granted to judicial and non-judicial bodies. In particular, the remedial body should have access to the premises of intelligence services and the data collected; be given the power to issue binding decisions; and inform complainants on the outcome of its investigations. The individual should be able to appeal the body’s decision. FRA’s data show that 22 EU Member States have at least one non-judicial body with remedial powers. In six Member States, though, these bodies lack the powers to issue binding decisions and access classified data.

Ensuring availability of nonjudicial bodies with remedial powers

FRA’s data show that non-judicial oversight mechanisms are more accessible to individuals than judicial remedies as they are simpler, cheaper and faster. FRA’s comparative legal analysis shows that in the area of surveillance, individuals can lodge a complaint with a non-judicial body in 25 EU Member States. In ten Member States, one single non-judicial body has remedial powers, while in most Member States, individuals can lodge a complaint with two or more bodies with remedial powers.

Allowing for awareness of completed surveillance measures

FRA’s comparative legal analysis shows that all EU Member States have a national security exception in their freedom of information laws. FRA’s findings also show that all Member States limit either individuals’ right to be notified or their right to access their own data based on the confidentiality of intelligence data and protection of national security or of on-going surveillance operations. Some Member States’ laws provide for alternative ways to make individuals aware of surveillance measures and so enable them to seek an effective remedy.

Ensuring a high level of expertise among remedial bodies

Remedial bodies need to have a good understanding of surveillance techniques. FRA’s fieldwork has identified ways to informally address shortcomings in technical expertise. Exchanges between remedial bodies, expert bodies, and intelligence services, while respecting each other’s role and independence, have proven to deepen the technical understanding of reviewers and foster mutual trust. National practices of appointing specialised judges or establishing specialised courts or chambers to hear complaints about surveillance by intelligence services contribute to the development of judicial expertise in the area. Such systems can also facilitate different arrangements on judicial access to classified information.

EU Member States should ensure that where judicial or non-judicial remedial bodies lack relevant expertise to effectively assess individuals’ complaints, specific systems are established to address these gaps. Cooperation with expert oversight bodies, technical experts or members of the intelligence services can support effective remedial systems.

Supporting other human rights actors

FRA’s fieldwork underlines that national human rights institutions, civil society organisations and, in some cases, ombudsperson institutions can play a crucial role in an enhanced intelligence services accountability system. However, FRA’s fieldwork also shows that civil society organisations often lack adequate resources, with few able to offer comprehensive services to victims of alleged unlawful surveillance.