24
May
2023

Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU - 2023 update

This report provides a partial update on the findings of the 2017 European Union Agency for Fundamental Rights (FRA) report Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU. It was prepared at the request of the European Parliament, which asked FRA to update its 2017 findings to support the work of its committee of inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA).

This report provides a partial update of the 2015 and 2017 European Union Agency for Fundamental Rights (FRA) reports entitled Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU (the 2017 report is henceforth referred to as the 2017 FRA report).[1] FRA (2015), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume I: Member States’ legal frameworks, Luxembourg, Publications Office of the European Union (Publications Office); FRA (2015), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the European Union – Summary, Luxembourg, Publications Office; FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office; and FRA (2018), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the European Union – Volume II: Summary, Luxembourg, Publications Office.
The 2017 FRA report was FRA’s response to the European Parliament’s request for in-depth research on the impact of surveillance on fundamental rights.[2] European Parliament (2014), Resolution of 12 March 2014 on the US NSA surveillance programme, surveillance bodies in various Member States and their impact on EU citizens’ fundamental rights and on transatlantic cooperation in Justice and Home Affairs, P7_TA(2014) 0230, Strasbourg, 12 March 2014.

Following the 2013 Snowden revelations, FRA focused on the large-scale technical collection of intelligence, referred to as the general surveillance of communications and colloquially known as “mass surveillance”. In the context of surveillance by intelligence services, the 2017 FRA report highlighted how the right to respect for private and family life (Article 7), the right to protection of personal data (Article 8) and the right to an effective remedy and a fair trial (Article 47) of the Charter of Fundamental Rights of the European Union (the Charter) should be protected by setting up strong oversight systems and effective remedies open to individuals.

The European Parliament’s request

In the latter part of 2022, the European Parliament asked FRA to prepare this update to support the work of the committee of inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA Committee). In particular, the Parliament asked FRA to present different existing models of oversight mechanisms and to illustrate them with examples from selected Member States.

The European Parliament asked the PEGA Committee to gather information on how much Member States or non-European Union (EU) countries are using intrusive surveillance to the extent that it violates the rights and freedoms enshrined in the Charter.[3] European Parliament (2022), Decision of 10 March 2022 on setting up a committee of inquiry to investigate the use of the Pegasus and equivalent surveillance spyware, and defining the subject of the inquiry, as well as the responsibilities, numerical strength and term of office of the committee, P9_TA(2022) 0071, Strasbourg, 10 March 2022.
In undertaking this task, the PEGA Committee held a significant number of hearings, published various studies and briefings, and undertook fact-finding missions.[4] For more details, see European Parliament (n.d.), Committee of inquiry to investigate the use of Pegasus and equivalent surveillance spyware.

The present update builds on the 2017 FRA report and the 16 FRA opinions therein. This update refers to relevant FRA opinions and key findings from the 2017 FRA report. FRA’s multidisciplinary research network (Franet) provided updated national data that formed the basis of this comparative analysis.

Like the 2017 FRA report, this update focuses on the work of intelligence services. It presents developments since 2017 in intelligence laws in the EU. The report specifically addresses the work of intelligence services, as listed in Table 5 (see Annex 1). Just as the 2017 FRA report did not address in detail the use of intelligence techniques such as spyware in the EU, or secret surveillance in the context of police work and criminal investigations, this update does not deal with these issues.[5] The following report covers these areas: European Parliament (2022), The use of Pegasus and equivalent surveillance spyware: The existing legal framework in EU Member States for the acquisition and use of Pegasus and equivalent surveillance spyware, draft study, December 2022.

The legal frameworks on spyware are discussed in detail in the draft report the PEGA Committee prepared,[6] European Parliament (2022), Draft report of the investigation of alleged contraventions and maladministration in the application of Union law in relation to the use of Pegasus and equivalent surveillance spyware, 8 November 2022.
in a proposed Recommendation of the European Parliament[7] European Parliament (2023), European Parliament draft recommendation to the Council and the Commission pursuant to Rule 208(12) of the rules of procedure following the investigation of alleged contraventions and maladministration in the application of Union law in relation to the use of Pegasus and equivalent surveillance spyware, 4 January 2023.
and in reports prepared as part of the committee’s work.[8] European Parliament (2022), The use of Pegasus and equivalent surveillance spyware: The existing legal framework in EU Member States for the acquisition and use of Pegasus and equivalent surveillance spyware, draft study, December 2022; and European Parliament (2022), The impact of Pegasus on fundamental rights and democratic processes, study, December 2022.
The United Nations High Commissioner for Human Rights also dealt with the widespread abuse of intrusive hacking tools and the need for enhanced safeguards on their use.[9] United Nations, Office of the United Nations High Commissioner for Human Rights (2022), The right to privacy in the digital age, A/HRC/51/17, 4 August 2022.
The Council of Europe’s Parliamentary Assembly is also addressing the issue,[10]Council of Europe, Committee on Legal Affairs and Human Rights (2022), Pegasus and similar spyware and secret state surveillance, 8 April 2022.
and the Commissioner for Human Rights issued a comment.[11] Council of Europe, Commissioner for Human Rights (2023), Highly intrusive spyware threatens the essence of human rights, human rights comment, Strasbourg, Council of Europe, 27 January 2023; see also Council of Europe, Information Society Department (2022), Pegasus spyware and its impacts on human rights, Strasbourg, Council of Europe, 20 June 2022.

This update focuses on two key aspects of the accountability of intelligence services, namely oversight and remedies. These two aspects should be enshrined in every secret surveillance framework to protect against abuse, as both the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR) emphasise.

“In view of the risk that a system of secret surveillance set up to protect national security (and other essential national interests) may undermine or even destroy the proper functioning of democratic processes under the cloak of defending them, the Court must be satisfied that there are adequate and effective guarantees against abuse. The assessment depends on […] the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law.”

ECtHR, Big Brother Watch and Others v. the United Kingdom, Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021

Several key legal developments have taken place since the publication of the 2017 FRA report. For example, the CJEU and ECtHR issued seminal judgments on the transatlantic flow of data and surveillance by intelligence services; the General Data Protection Regulation (GDPR)[12] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, OJ 2016 L 119. and the Law Enforcement Directive[13] Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ 2016 L 119. entered into force at EU level, (hereafter referred to as the 2016 European data protection reform); and the Council of Europe adopted the modernised convention for the protection of individuals with regard to the processing of personal data (Convention 108+).[14] Council of Europe, Committee of Ministers, Protocol amending the Convention for the protection of individuals with regard to automatic processing of personal data (ETS No. 108), ETS No. 223, 18 May 2018. Such legal developments have necessitated changes to national intelligence laws, thus requiring FRA to update its data to reflect such legal reforms.

Figure 1 presents an overview of reforms of legal frameworks on surveillance that have taken place in the EU-27 since the 2017 FRA report was published. The majority of EU Member States (17) have reformed, or are in the process of reforming, their legal frameworks on intelligence services. Legal changes have been quite diverse, ranging from changes in organisational issues to changes in the accountability regimes of intelligence services and remedies against their actions.

Figure 1 – EU Member States’ legal frameworks for surveillance – reforms since mid-2017

Figure 1 – EU Member States’ legal frameworks for surveillance – reforms since mid-2017

 

Source: FRA, 2023

Reforms were triggered for various reasons beyond legal developments at EU level, requiring incorporation at EU Member State level. In Austria, for example, findings of a parliamentary enquiry on serious misconduct and corruption of intelligence officials and the response to the terrorist attack in Vienna on 2 November 2020 led to the creation of a new agency.[15] Austria, Federal Act amending the Act concerning Police State Protection Act, the Security Police Act, the Criminal Code, the Code of Criminal Procedure 1975 and the Expungement Redemption Act 1972 (Bundesgesetz, mit dem das Polizeiliche Staatsschutzgesetz, das Sicherheitspolizeigesetz, das Strafgesetzbuch, die Strafprozeßordnung 1975 und das Tilgungsgesetz 1972 geändert werden, Federal Law Gazette I No. 148/2021, 26 July 2021; Parliament of Austria (n.d.), BAT Committee of Inquiry (3/A-USA) (BVT-Untersuchungsausschuss (3/A-USA); Parliament of Austria (2019), BAT Committee of Inquiry: Valuable findings, but still some questions unanswered (BVT-Untersuchungsausschuss: Wertvolle Erkenntnisse, aber noch einige Fragen offen, Parliamentary Correspondence No. 937, 25 September 2019; and Commission of Inquiry into the Terrorist Attack of November 2nd, 2020 (Untersuchungskommission (2021), Final report (Abschlussbericht, 10 February 2021. A new specialised and independent oversight body was also established as a result of the reforms.[16] Austria, State Protection and Intelligence Service Act (Bundesgesetz über die Organisation, Aufgaben und Befugnisse des Verfassungsschutzes - Staatsschutz- und Nachrichtendienst-Gesetz, Federal Law Gazette I No. 5/2016, Art. 17a f..

Greece has also amended its legal framework several times since 2017. The changes involved various issues, such as the organisation of intelligence services,[17] Greece, Emergency regulations for the protection of public health from the ongoing consequences of the COVID-19 pandemic, development, social protection, re-opening of the courts and other matters (Κατεπείγουσες ρυθμίσεις για την προστασία της δημόσιας υγείας από τις συνεχιζόμενες συνέπειες της πανδημίας του κορωνοϊού COVID-19, την ανάπτυξη, την κοινωνική προστασία και την επαναλειτουργία των δικαστηρίων και άλλα ζητήματα, Law No. 4790, Government Gazette Issue A’ 48/31.03.2021, Art. 87. the authorisation of surveillance, and the abolishment and subsequent reintroduction of notification of surveillance.[18] Greece, Waiving privacy procedure, cyber security and protection of citizens’ personal data (Διαδικασία άρσης του απορρήτου των επικοινωνιών, κυβερνοασφάλεια και προστασία προσωπικών δεδομένων πολιτών, Law No. 5002/2022, Government Gazette Issue A’ 228/09.1.2022, Art. 4 (7). The latest of these amendments were made in response to complaints against the intelligence services regarding the inappropriate monitoring of communications of politicians and journalists. Allegations that unknown actors were using illegal spyware to monitor the communications of politicians, journalists and other public figures, as reported in the media, also necessitated these changes.[19] Greece, Kathimerini, ‘Observations: Against the backdrop of the bill, the conflict’, 17 November 2022. In response to the spyware allegations, investigations were initiated by the Greek data protection authority (DPA) and criminal authorities.

FRA data suggest that spyware revelations since 2021 have had almost no impact on national reforms to date, except in Greece, where reforms in December 2022 addressed the regulation of spyware.[20] Greece, Waiving privacy procedure, cyber security and protection of citizens’ personal data (Διαδικασία άρσης του απορρήτου των επικοινωνιών, κυβερνοασφάλεια και προστασία προσωπικών δεδομένων πολιτών, Law No. 5002/2022, Government Gazette Issue A’ 228/09.1.2022, Arts. 10–14. In August 2022, the Prime Minister of Spain announced plans to reform the law on intelligence services.[21] Spain, La Moncloa (2022), ‘Pedro Sánchez announces a reform of the legal control regulation of the National Intelligence Centre (CNI) to strengthen its guarantees’, press release, 26 May 2022. At the time of writing, no draft law had been published. In addition, the government’s 2023 action plan does not refer to such a reform.[22] Spain, Government of Spain(Gobierno de España, General Administration of the State (Administración General del Estado, Annual Action Plan 2023 (Plan Anual Normativo 2023, 2023.

In some cases, court judgments on successful constitutional or administrative law challenges against intelligence laws necessitated amendments to such laws, such as in France,[23]France, Council of State (Conseil d’État, French Data Network and Others v. France, Decision No. 393099, 21 April 2021. Germany[24]Germany, Federal Constitutional Court (Bundesverfassungsgericht, BVerfG), 1 BvR 2835/17, 19 May 2020; and BVerfG (2022), 1 BvR 2354/13, 28 September 2022. and Portugal.[25]Portugal, Constitutional Court (Tribunal Constitucional, Judgment No. 464/2019, 21 October 2019. In Germany, for example, among other changes, a new oversight body was set up in 2021.[26] Germany, Act to Change the Federal Intelligence Service Act to Implement the Guidelines of the Federal Constitutional Court and the Federal Administrative Court (Gesetz zur Änderung des BND-Gesetzes zur Umsetzung der Vorgaben des Bundesverfassungsgerichts sowie des Bundesverwaltungsgerichts, 19 April 2021, setting up the Independent Supervisory Council (Unabhängiger Kontrollrat.

Data protection reforms following the implementation of the 2016 European data protection reform also led to restrictions on or exclusions in the powers of national DPAs to exercise oversight over intelligence services in some countries, such as Bulgaria,[27] Bulgaria, Amendments and supplements to the Personal Data Protection Act (Закон за изменение и допълнение на Закона за защита на личните данни, 26 February 2019; State Intelligence Agency Act (Закон за Държавна агенция „Разузнаване”, 13 October 2015, last amended 4 August 2020, Arts. 27 and 28; Military Intelligence Act (Закон за военното разузнаване, 13 November 2015, last amended 26 March 2021, Art. 78; and State Agency for National Security Act (Закон за Държавна агенция „Национална сигурност”, 13 October 2015, last amended 5 June 2020, Art. 37. Croatia,[28]Croatia, General Regulation on Data Protection Act (Zakon o provedbi Opće uredbe o zaštiti podataka, 25 May 2018. Greece[29] Greece, Hellenic Data Protection Authority (HDPA), measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and transposition of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, and other provisions, Law No. 4624, Government Gazette Issue A’ 137/29.08.2019, Art. 10 (5). and Lithuania.[30] Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas), No. XIII-1435, 30 June 2018, Art. 39 (3). In others, such as Hungary, changes do not appear to have substantially strengthened the DPAs.[31]Hungary, Act 112 of 2011 on the right to informational self-determination and information freedom (törvény az információs önrendelkezési jogról és az információszabadságról, Art. 51/A; amendment entered into force on 26 July 2018, introduced by Amending Act 38 of 2018, 26 July 2018, Art. 20. In some Member States, such as Cyprus and Luxembourg, reforms appear to have reinforced the role of national DPAs (see the section ‘Expert bodies and data protection authorities’).

Member States’ activities protecting national security do not fall under EU competence, according to Article 4 (2) of the Treaty on European Union. The “national security exemption” is also reflected in the GDPR and the Directive on Privacy and Electronic Communications.[32]GDPR, Arts. 2 (2) and 23 (1) (a); Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ 2002 L 201, Arts. 1 (3) and 15 (1).

Nonetheless, the 2017 FRA report discussed this exemption and highlighted examples of intelligence services’ activities that are within the scope of EU law and therefore subject to EU law protecting fundamental rights, in addition to guarantees applying to the same rights under national constitutional provisions and international human rights treaties. The report suggested that the protection the GDPR offers could well apply to the transfer of communications data by service providers to intelligence services for national security purposes.[33] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 22.
The 2017 FRA report concluded that “the ‘national security’ exemption thus cannot be seen as entirely excluding the applicability of EU law”.[34]FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 22. See also European Parliament (2022), The impact of Pegasus on fundamental rights and democratic processes, study, December 2022.
A report requested by the PEGA Committee concurred with this finding.[35]European Parliament (2022), The impact of Pegasus on fundamental rights and democratic processes, study, December 2022.

The CJEU has since confirmed this conclusion, stating that invoking national security cannot justify the avoidance of EU law, including scrutiny under the Charter.[36]CJEU, Joined cases C793/19 and C794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, para. 66;Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres [GC], 6 October 2020, para. 99; and C623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, para. 44.
The court clarified this in relation to general data retention and access, and real-time access to communications data when protecting national security.[37]CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres [GC], 6 October 2020, paras. 56–79; and C623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, paras. 19–29, 30 and 50.
The court also defined protecting national security as the “protection of the essential functions of the State and the fundamental interests of society” against actions “destabilising the fundamental structures of a country” and threatening the population.[38]CJEU, Joined cases C793/19 and C794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, para. 92; Joined cases C-511/18, C-512/18 and C-520/18,La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 135; and C623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others[GC], 6 October 2020, para. 74.

Moreover, the court specified that protecting public security and combating serious crime cannot be treated in the same way.[39]CJEU, Joined cases C793/19 and C794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, paras. 72 and 93–94; C140/20,G.D. v. Commissioner of An Garda Síochána and Others[GC], 5 April 2022, para. 58; Joined cases C-511/18, C-512/18 and C-520/18,La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 136; and C623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, para. 75.
By defining the protection of national security, the court tried to rule out the possibility of invoking it as a pretext for other purposes.

“[T]he mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable and exempt the Member States from their obligation to comply with that law”.

“[N]ational security […] corresponds to the primary interest [of Member States] in protecting the essential functions of the State and the fundamental interests of society and encompasses the prevention and punishment of activities capable of seriously destabilising the fundamental constitutional, political, economic or social structures of a country and, in particular, of directly threatening society, the population or the State itself, such as terrorist activities”.

CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres [GC], 6 October 2020, paragraphs 99 and 135

In the field of surveillance for national security purposes, the CJEU found that it is always private parties (i.e. service providers) that retain and provide access to communications data – in real time or not – on the request of state authorities, based on law. These activities are not performed directly by state organs. Retaining and providing access to data or transmitting data to state authorities for national security purposes are permitted by provisions that derogate from the principle of the confidentiality of communications established in the Directive on Privacy and Electronic Communications. Hence, data retention and access for national security purposes fall within the scope of EU law.[40] Directive on privacy and electronic communications, Art. 15 (1); CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 58, referring to Joined cases C-203/15 and C-698/15, Tele2 Sverige v. Post- och telestyrelsen and Secretary of State for the Home Department v. Watson and Others [GC], 21 December 2016 and operative part; and C623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, paras. 38 and 49 and operative part.

CJEU case law also had a significant impact at national level. In France, for example, a CJEU ruling led to a decision of the Council of State (Conseil d’État)[41]French Council of State (Conseil d’État, French Data Network and Others v. France, Decision No. 393099, 21 April 2021.
that triggered an amendment of the intelligence law in relation to the binding character of the opinions of the French oversight body. In 2020, noting the pending case before the CJEU at the time, the German Federal Constitutional Court (Bundesverfassungsgericht) ruled that surveillance by intelligence services on foreign communications violated fundamental rights set out in the German Basic Law.[42] BVerfG, 1 BvR 2835/17, 19 May 2020.
One of the reasons was that the powers and the organisational and institutional design of the competent bodies did not ensure extensive independent and continuous oversight.[43]BVerfG, 1 BvR 2835/17, 19 May 2020, paras. 265–300 and 324.

In a nutshell, some aspects of the intelligence services’ work, namely surveillance of communications data, cannot be completely excluded from the scope of EU law, including the Charter. The CJEU also highlighted that secret surveillance techniques that are outside the scope of EU law should comply with the corresponding requirements of the European Convention on Human Rights.[44] CJEU,Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 103.
Figure 2 summarises the applicability of EU law in the context of the national security exemption, as defined in the CJEU case law to date.

Figure 2 – Applicability of EU law in the context of intelligence services’ activities

 

Source: FRA, 2023

In 2018, the Committee of Ministers of the Council of Europe decided to open Convention 108+ for signature. Once the convention enters into force, it will play an important role in surveillance by intelligence services. Article 3 of Convention 108+ does not exclude from its scope of application actions that States Parties take to protect national security.[45] Council of Europe, Convention 108+: Convention for the protection of individuals with regard to the processing of personal data, ETS No. 223, June 2018. See also Council of Europe, The modernised Convention 108: Novelties in a nutshell; and FRA, Council of Europe and European Data Protection Supervisor (2018), Handbook on European data protection law, Luxembourg, Publications Office, Chapter 8, p. 273.
Furthermore, States Parties are no longer provided with the opportunity to make declarations granting complete exemption from the application of the convention data processing in the context of national security.

Under Article 11 of Convention 108+, States Parties may introduce exceptions in the areas outlined, provided that such exceptions respect “the essence of the fundamental rights” and comply with the principles of necessity and proportionality. Furthermore, Article 11 (3) of the convention states that data processing for national security and defence purposes should be subject to independent and effective review and supervision by a supervisory authority. This supervisory authority should have the powers and characteristics set out in Article 15 of Convention 108+.

Convention 108+ allows intelligence services to engage in surveillance activities to protect national security, provided that such activities “are laid down by law and constitute a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the data subjects”.[46] Council of Europe, Convention 108+: Convention for the protection of individuals with regard to the processing of personal data, ETS No. 223, June 2018, para. 92, p. 26.
Moreover, intelligence services should be subject to independent and effective review and supervision by one or more authorities. The authorities should also ensure their compliance with the convention’s applicable provisions.The explanatory report on the convention makes clear reference to the applicability of requirements developed in the case law of the ECtHR in this regard.[47] Council of Europe, Convention 108+: Convention for the protection of individuals with regard to the processing of personal data, ETS No. 223, June 2018, paras. 98 and 118, pp. 26 and 29.

The 2017 FRA report was structured based on the ECtHR case law requirements. The report focused on three key aspects:

  • the legal framework on surveillance and the requirement for clear, foreseeable and accessible laws regulating secret surveillance;
  • the accountability of intelligence services, focusing on existing oversight bodies with appropriate powers;
  • the availability of effective remedies for individuals before remedial bodies with appropriate powers.

Since 2017, both the CJEU and the ECtHR have further elaborated their case law requirements regarding surveillance by intelligence services. With regard to oversight and remedies in particular, their requirements are essentially aligned. Some notable developments include the following.

The CJEU held that:

Both European courts stressed the following key aspects of accountability in the surveillance of communications by intelligence services.

Both courts confirmed that the above main requirements apply to the targeted surveillance of data, the bulk interception of communications data, and service providers’ retention of communications data and authorities’ subsequent access, real time or not, to the data.[56]CJEU, Joined cases C793/19 and C794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, paras. 61 and 87–89; C140/20, G.D. v. Commissioner of An Garda Síochána and Others[GC], 5 April 2022, para. 45; and ECtHR, Big Brother Watch and Others v. the United Kingdom[GC], Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 363–364, 416 and 425.
The treatment of different types of data once obtained may differ.[57] See, for example, ECtHR, Big Brother Watch and Others v. the United Kingdom[GC], Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 364, 416, 421 and 423.

Recent European case law has elaborated on the requirements applicable to the life cycle of surveillance activities that intelligence services conduct. Figure 13 (in Annex 2) summarises the requirements the ECtHR and the CJEU have developed.

This update is structured as follows: the first part focuses on accountability through the oversight of intelligence services, while the second part discusses remedies available at EU Member State level.

 

Overview

The current report updates relevant parts of the 2017 report. Like the 2017 report, this update focuses on the work of intelligence services. It describes the developments that have taken place since 2017 in intelligence laws in the European Union (EU).

Significant developments that have taken place include the welcomed establishment of new oversight bodies following constitutional courts’ decisions and the impact of the 2016 European data protection reform on data protection authorities’ powers in the field of intelligence services’ activities. In 2023, 18 expert bodies are overseeing the work of intelligence services in the EU-27, compared with 16 in the EU-28 in 2017. These developments are viewed in the light of minimum requirements shaped by the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR).

In this context, the current report refers to a selection of relevant FRA opinions drawn from the 16 opinions published in the 2017 FRA report, alongside key findings from this earlier report. It also highlights relevant developments over time. In particular, it provides, as per the European Parliament’s request, up-to-date information on existing models of oversight mechanisms and remedies, illustrating them with examples from selected Member States. The report describes five distinct models of oversight frameworks. These encapsulate the diverse spectrum of frameworks across the EU Member States.

In 2017, FRA concluded that protecting the public from security threats while respecting fundamental rights can be achieved through strong oversight systems and effective remedies open to individuals. This conclusion remains valid in 2023.