Several key legal developments have taken place since the publication of the 2017 FRA report. For example, the CJEU and ECtHR issued seminal judgments on the transatlantic flow of data and surveillance by intelligence services; the General Data Protection Regulation (GDPR)[12] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, OJ 2016 L 119. and the Law Enforcement Directive[13] Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ 2016 L 119. entered into force at EU level, (hereafter referred to as the 2016 European data protection reform); and the Council of Europe adopted the modernised convention for the protection of individuals with regard to the processing of personal data (Convention 108+).[14] Council of Europe, Committee of Ministers, Protocol amending the Convention for the protection of individuals with regard to automatic processing of personal data (ETS No. 108), ETS No. 223, 18 May 2018. Such legal developments have necessitated changes to national intelligence laws, thus requiring FRA to update its data to reflect such legal reforms.

Figure 1 presents an overview of reforms of legal frameworks on surveillance that have taken place in the EU-27 since the 2017 FRA report was published. The majority of EU Member States (17) have reformed, or are in the process of reforming, their legal frameworks on intelligence services. Legal changes have been quite diverse, ranging from changes in organisational issues to changes in the accountability regimes of intelligence services and remedies against their actions.

Figure 1 – EU Member States’ legal frameworks for surveillance – reforms since mid-2017

Source: FRA, 2023

Reforms were triggered for various reasons beyond legal developments at EU level, requiring incorporation at EU Member State level. In Austria, for example, findings of a parliamentary enquiry on serious misconduct and corruption of intelligence officials and the response to the terrorist attack in Vienna on 2 November 2020 led to the creation of a new agency.[15] Austria, Federal Act amending the Act concerning Police State Protection Act, the Security Police Act, the Criminal Code, the Code of Criminal Procedure 1975 and the Expungement Redemption Act 1972 (Bundesgesetz, mit dem das Polizeiliche Staatsschutzgesetz, das Sicherheitspolizeigesetz, das Strafgesetzbuch, die Strafprozeßordnung 1975 und das Tilgungsgesetz 1972 geändert werden, Federal Law Gazette I No. 148/2021, 26 July 2021; Parliament of Austria (n.d.), BAT Committee of Inquiry (3/A-USA) (BVT-Untersuchungsausschuss (3/A-USA); Parliament of Austria (2019), BAT Committee of Inquiry: Valuable findings, but still some questions unanswered (BVT-Untersuchungsausschuss: Wertvolle Erkenntnisse, aber noch einige Fragen offen, Parliamentary Correspondence No. 937, 25 September 2019; and Commission of Inquiry into the Terrorist Attack of November 2nd, 2020 (Untersuchungskommission (2021), Final report (Abschlussbericht, 10 February 2021. A new specialised and independent oversight body was also established as a result of the reforms.[16] Austria, State Protection and Intelligence Service Act (Bundesgesetz über die Organisation, Aufgaben und Befugnisse des Verfassungsschutzes - Staatsschutz- und Nachrichtendienst-Gesetz, Federal Law Gazette I No. 5/2016, Art. 17a f..

Greece has also amended its legal framework several times since 2017. The changes involved various issues, such as the organisation of intelligence services,[17] Greece, Emergency regulations for the protection of public health from the ongoing consequences of the COVID-19 pandemic, development, social protection, re-opening of the courts and other matters (Κατεπείγουσες ρυθμίσεις για την προστασία της δημόσιας υγείας από τις συνεχιζόμενες συνέπειες της πανδημίας του κορωνοϊού COVID-19, την ανάπτυξη, την κοινωνική προστασία και την επαναλειτουργία των δικαστηρίων και άλλα ζητήματα, Law No. 4790, Government Gazette Issue A’ 48/31.03.2021, Art. 87. the authorisation of surveillance, and the abolishment and subsequent reintroduction of notification of surveillance.[18] Greece, Waiving privacy procedure, cyber security and protection of citizens’ personal data (Διαδικασία άρσης του απορρήτου των επικοινωνιών, κυβερνοασφάλεια και προστασία προσωπικών δεδομένων πολιτών, Law No. 5002/2022, Government Gazette Issue A’ 228/09.1.2022, Art. 4 (7). The latest of these amendments were made in response to complaints against the intelligence services regarding the inappropriate monitoring of communications of politicians and journalists. Allegations that unknown actors were using illegal spyware to monitor the communications of politicians, journalists and other public figures, as reported in the media, also necessitated these changes.[19] Greece, Kathimerini, ‘Observations: Against the backdrop of the bill, the conflict’, 17 November 2022. In response to the spyware allegations, investigations were initiated by the Greek data protection authority (DPA) and criminal authorities.

FRA data suggest that spyware revelations since 2021 have had almost no impact on national reforms to date, except in Greece, where reforms in December 2022 addressed the regulation of spyware.[20] Greece, Waiving privacy procedure, cyber security and protection of citizens’ personal data (Διαδικασία άρσης του απορρήτου των επικοινωνιών, κυβερνοασφάλεια και προστασία προσωπικών δεδομένων πολιτών, Law No. 5002/2022, Government Gazette Issue A’ 228/09.1.2022, Arts. 10–14. In August 2022, the Prime Minister of Spain announced plans to reform the law on intelligence services.[21] Spain, La Moncloa (2022), ‘Pedro Sánchez announces a reform of the legal control regulation of the National Intelligence Centre (CNI) to strengthen its guarantees’, press release, 26 May 2022. At the time of writing, no draft law had been published. In addition, the government’s 2023 action plan does not refer to such a reform.[22] Spain, Government of Spain(Gobierno de España, General Administration of the State (Administración General del Estado, Annual Action Plan 2023 (Plan Anual Normativo 2023, 2023.

In some cases, court judgments on successful constitutional or administrative law challenges against intelligence laws necessitated amendments to such laws, such as in France,[23]France, Council of State (Conseil d’État, French Data Network and Others v. France, Decision No. 393099, 21 April 2021. Germany[24]Germany, Federal Constitutional Court (Bundesverfassungsgericht, BVerfG), 1 BvR 2835/17, 19 May 2020; and BVerfG (2022), 1 BvR 2354/13, 28 September 2022. and Portugal.[25]Portugal, Constitutional Court (Tribunal Constitucional, Judgment No. 464/2019, 21 October 2019. In Germany, for example, among other changes, a new oversight body was set up in 2021.[26] Germany, Act to Change the Federal Intelligence Service Act to Implement the Guidelines of the Federal Constitutional Court and the Federal Administrative Court (Gesetz zur Änderung des BND-Gesetzes zur Umsetzung der Vorgaben des Bundesverfassungsgerichts sowie des Bundesverwaltungsgerichts, 19 April 2021, setting up the Independent Supervisory Council (Unabhängiger Kontrollrat.

Data protection reforms following the implementation of the 2016 European data protection reform also led to restrictions on or exclusions in the powers of national DPAs to exercise oversight over intelligence services in some countries, such as Bulgaria,[27] Bulgaria, Amendments and supplements to the Personal Data Protection Act (Закон за изменение и допълнение на Закона за защита на личните данни, 26 February 2019; State Intelligence Agency Act (Закон за Държавна агенция „Разузнаване”, 13 October 2015, last amended 4 August 2020, Arts. 27 and 28; Military Intelligence Act (Закон за военното разузнаване, 13 November 2015, last amended 26 March 2021, Art. 78; and State Agency for National Security Act (Закон за Държавна агенция „Национална сигурност”, 13 October 2015, last amended 5 June 2020, Art. 37. Croatia,[28]Croatia, General Regulation on Data Protection Act (Zakon o provedbi Opće uredbe o zaštiti podataka, 25 May 2018. Greece[29] Greece, Hellenic Data Protection Authority (HDPA), measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and transposition of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, and other provisions, Law No. 4624, Government Gazette Issue A’ 137/29.08.2019, Art. 10 (5). and Lithuania.[30] Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas), No. XIII-1435, 30 June 2018, Art. 39 (3). In others, such as Hungary, changes do not appear to have substantially strengthened the DPAs.[31]Hungary, Act 112 of 2011 on the right to informational self-determination and information freedom (törvény az információs önrendelkezési jogról és az információszabadságról, Art. 51/A; amendment entered into force on 26 July 2018, introduced by Amending Act 38 of 2018, 26 July 2018, Art. 20. In some Member States, such as Cyprus and Luxembourg, reforms appear to have reinforced the role of national DPAs (see the section ‘Expert bodies and data protection authorities’).

Member States’ activities protecting national security do not fall under EU competence, according to Article 4 (2) of the Treaty on European Union. The “national security exemption” is also reflected in the GDPR and the Directive on Privacy and Electronic Communications.[32]GDPR, Arts. 2 (2) and 23 (1) (a); Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ 2002 L 201, Arts. 1 (3) and 15 (1).

Nonetheless, the 2017 FRA report discussed this exemption and highlighted examples of intelligence services’ activities that are within the scope of EU law and therefore subject to EU law protecting fundamental rights, in addition to guarantees applying to the same rights under national constitutional provisions and international human rights treaties. The report suggested that the protection the GDPR offers could well apply to the transfer of communications data by service providers to intelligence services for national security purposes.[33] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 22.
The 2017 FRA report concluded that “the ‘national security’ exemption thus cannot be seen as entirely excluding the applicability of EU law”.[34]FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 22. See also European Parliament (2022), The impact of Pegasus on fundamental rights and democratic processes, study, December 2022.
A report requested by the PEGA Committee concurred with this finding.[35]European Parliament (2022), The impact of Pegasus on fundamental rights and democratic processes, study, December 2022.

The CJEU has since confirmed this conclusion, stating that invoking national security cannot justify the avoidance of EU law, including scrutiny under the Charter.[36]CJEU, Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, para. 66;Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres [GC], 6 October 2020, para. 99; and C‑623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, para. 44.
The court clarified this in relation to general data retention and access, and real-time access to communications data when protecting national security.[37]CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres [GC], 6 October 2020, paras. 56–79; and C‑623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, paras. 19–29, 30 and 50.
The court also defined protecting national security as the “protection of the essential functions of the State and the fundamental interests of society” against actions “destabilising the fundamental structures of a country” and threatening the population.[38]CJEU, Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, para. 92; Joined cases C-511/18, C-512/18 and C-520/18,La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 135; and C‑623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others[GC], 6 October 2020, para. 74.

Moreover, the court specified that protecting public security and combating serious crime cannot be treated in the same way.[39]CJEU, Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, paras. 72 and 93–94; C‑140/20,G.D. v. Commissioner of An Garda Síochána and Others[GC], 5 April 2022, para. 58; Joined cases C-511/18, C-512/18 and C-520/18,La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 136; and C‑623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, para. 75.
By defining the protection of national security, the court tried to rule out the possibility of invoking it as a pretext for other purposes.

“[T]he mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable and exempt the Member States from their obligation to comply with that law”.

“[N]ational security […] corresponds to the primary interest [of Member States] in protecting the essential functions of the State and the fundamental interests of society and encompasses the prevention and punishment of activities capable of seriously destabilising the fundamental constitutional, political, economic or social structures of a country and, in particular, of directly threatening society, the population or the State itself, such as terrorist activities”.

CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres [GC], 6 October 2020, paragraphs 99 and 135

In the field of surveillance for national security purposes, the CJEU found that it is always private parties (i.e. service providers) that retain and provide access to communications data – in real time or not – on the request of state authorities, based on law. These activities are not performed directly by state organs. Retaining and providing access to data or transmitting data to state authorities for national security purposes are permitted by provisions that derogate from the principle of the confidentiality of communications established in the Directive on Privacy and Electronic Communications. Hence, data retention and access for national security purposes fall within the scope of EU law.[40] Directive on privacy and electronic communications, Art. 15 (1); CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 58, referring to Joined cases C-203/15 and C-698/15, Tele2 Sverige v. Post- och telestyrelsen and Secretary of State for the Home Department v. Watson and Others [GC], 21 December 2016 and operative part; and C‑623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, paras. 38 and 49 and operative part.

CJEU case law also had a significant impact at national level. In France, for example, a CJEU ruling led to a decision of the Council of State (Conseil d’État)[41]French Council of State (Conseil d’État, French Data Network and Others v. France, Decision No. 393099, 21 April 2021.
that triggered an amendment of the intelligence law in relation to the binding character of the opinions of the French oversight body. In 2020, noting the pending case before the CJEU at the time, the German Federal Constitutional Court (Bundesverfassungsgericht) ruled that surveillance by intelligence services on foreign communications violated fundamental rights set out in the German Basic Law.[42] BVerfG, 1 BvR 2835/17, 19 May 2020.
One of the reasons was that the powers and the organisational and institutional design of the competent bodies did not ensure extensive independent and continuous oversight.[43]BVerfG, 1 BvR 2835/17, 19 May 2020, paras. 265–300 and 324.

In a nutshell, some aspects of the intelligence services’ work, namely surveillance of communications data, cannot be completely excluded from the scope of EU law, including the Charter. The CJEU also highlighted that secret surveillance techniques that are outside the scope of EU law should comply with the corresponding requirements of the European Convention on Human Rights.[44] CJEU,Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 103.
Figure 2 summarises the applicability of EU law in the context of the national security exemption, as defined in the CJEU case law to date.

Figure 2 – Applicability of EU law in the context of intelligence services’ activities

Source: FRA, 2023

In 2018, the Committee of Ministers of the Council of Europe decided to open Convention 108+ for signature. Once the convention enters into force, it will play an important role in surveillance by intelligence services. Article 3 of Convention 108+ does not exclude from its scope of application actions that States Parties take to protect national security.[45] Council of Europe, Convention 108+: Convention for the protection of individuals with regard to the processing of personal data, ETS No. 223, June 2018. See also Council of Europe, The modernised Convention 108: Novelties in a nutshell; and FRA, Council of Europe and European Data Protection Supervisor (2018), Handbook on European data protection law, Luxembourg, Publications Office, Chapter 8, p. 273.
Furthermore, States Parties are no longer provided with the opportunity to make declarations granting complete exemption from the application of the convention data processing in the context of national security.

Under Article 11 of Convention 108+, States Parties may introduce exceptions in the areas outlined, provided that such exceptions respect “the essence of the fundamental rights” and comply with the principles of necessity and proportionality. Furthermore, Article 11 (3) of the convention states that data processing for national security and defence purposes should be subject to independent and effective review and supervision by a supervisory authority. This supervisory authority should have the powers and characteristics set out in Article 15 of Convention 108+.

Convention 108+ allows intelligence services to engage in surveillance activities to protect national security, provided that such activities “are laid down by law and constitute a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the data subjects”.[46] Council of Europe, Convention 108+: Convention for the protection of individuals with regard to the processing of personal data, ETS No. 223, June 2018, para. 92, p. 26.
Moreover, intelligence services should be subject to independent and effective review and supervision by one or more authorities. The authorities should also ensure their compliance with the convention’s applicable provisions.The explanatory report on the convention makes clear reference to the applicability of requirements developed in the case law of the ECtHR in this regard.[47] Council of Europe, Convention 108+: Convention for the protection of individuals with regard to the processing of personal data, ETS No. 223, June 2018, paras. 98 and 118, pp. 26 and 29.

The 2017 FRA report was structured based on the ECtHR case law requirements. The report focused on three key aspects:

• the legal framework on surveillance and the requirement for clear, foreseeable and accessible laws regulating secret surveillance;
• the accountability of intelligence services, focusing on existing oversight bodies with appropriate powers;
• the availability of effective remedies for individuals before remedial bodies with appropriate powers.

Since 2017, both the CJEU and the ECtHR have further elaborated their case law requirements regarding surveillance by intelligence services. With regard to oversight and remedies in particular, their requirements are essentially aligned. Some notable developments include the following.

The CJEU held that:

• intelligence services can apply secret surveillance when it genuinely pursues the protection of national security based on the court’s definition;[48]CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, paras. 135–137; C‑623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, paras. 74–75 and 77; Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, paras. 72 and 131 and operative part; and C‑140/20,G.D. v. Commissioner of An Garda Síochána and Others[GC], 5 April 2022, para. 58.
  
• only a “genuine and present or foreseeable” serious threat to national security justifies measures that apply indiscriminately to all users of communications systems.[49] CJEU, Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, paras. 72 and 131 and operative part; C‑140/20,G.D. v. Commissioner of An Garda Síochána and Others[GC], 5 April 2022, para. 58; and Joined cases C-511/18, C-512/18 and C-520/18,La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, paras. 137 and 177.
  

Both European courts stressed the following key aspects of accountability in the surveillance of communications by intelligence services.

• Secret surveillance should be subject to clear and publicly accessible legal rules, which include the necessary safeguards against abuses of surveillance techniques carried out for national security purposes.[50] CJEU, Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, para. 91; Joined cases C-511/18, C-512/18 and C-520/18,La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres[GC], 6 October 2020, para. 132; and C‑623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others [GC], 6 October 2020, para. 68; and ECtHR, Big Brother Watch and Others v. the United Kingdom[GC], Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 332–334, 339 and 425; Haščák v. Slovakia, Nos. 58359/12, 27787/16 and 67667/16, 23 June 2022, paras. 89 and 94–95.
  
• Independent authorities and the courts should review and supervise the implementation of the relevant rules and conditions during the authorisation and implementation of surveillance measures by intelligence services.[51] ECtHR, Big Brother Watch and Others v. the United Kingdom[GC], Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 336, 350–352, 356, 377 and 425.
  
• Individuals under surveillance should have recourse to remedies that are effective in practice for reviewing the lawfulness and proportionality of any surveillance against them and redressing any violations of their rights.[52] ECtHR, Big Brother Watch and Others v. the United Kingdom[GC], Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 337 and 357.
  
• The ECtHR emphasised that remedial bodies should possess guarantees of “objectivity and thoroughness” to ensure that there are no conflicts of interest with the body that authorised and supervised the surveillance.[53] ECtHR, Centrum för rättvisa v. Sweden [GC], No. 35252/08, 25 May 2021, paras. 359 and 372.
  
• The ECtHR also clarified that notification of surveillance, which is required as soon as the purpose of the surveillance would not be jeopardised, cannot depend on a national security exemption.[54] ECtHR, Centrum för rättvisa v. Sweden [GC], No. 35252/08, 25 May 2021, para. 272.
  Unless remedies depend on it, notification may be omitted when affected individuals can request and receive relevant information through a competent independent authority.[55] ECtHR, Marie Ringler v. Austria (dec.), No. 2309/10, 12 May 2020, paras. 73 and 79.
  

Both courts confirmed that the above main requirements apply to the targeted surveillance of data, the bulk interception of communications data, and service providers’ retention of communications data and authorities’ subsequent access, real time or not, to the data.[56]CJEU, Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH[GC], 20 September 2022, paras. 61 and 87–89; C‑140/20, G.D. v. Commissioner of An Garda Síochána and Others[GC], 5 April 2022, para. 45; and ECtHR, Big Brother Watch and Others v. the United Kingdom[GC], Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 363–364, 416 and 425.
The treatment of different types of data once obtained may differ.[57] See, for example, ECtHR, Big Brother Watch and Others v. the United Kingdom[GC], Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 364, 416, 421 and 423.

Recent European case law has elaborated on the requirements applicable to the life cycle of surveillance activities that intelligence services conduct. Figure 13 (in Annex 2) summarises the requirements the ECtHR and the CJEU have developed.

This update is structured as follows: the first part focuses on accountability through the oversight of intelligence services, while the second part discusses remedies available at EU Member State level.