24
May
2023

Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU - 2023 update

This report provides a partial update on the findings of the 2017 European Union Agency for Fundamental Rights (FRA) report Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU. It was prepared at the request of the European Parliament, which asked FRA to update its 2017 findings to support the work of its committee of inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA).

This update presented developments in a field of law that is continuously evolving: intelligence laws need to continuously improve the capacity of intelligence services to deal with threats and technical developments.

At the same time, the CJEU case law has made clear that secret surveillance has an impact on, among other things, the right to respect for private and family life (Article 7), the right to the protection of personal data (Article 8), and the right to an effective remedy and a fair trial (Article 47) of the Charter. It also makes clear that bodies exercising oversight over intelligence services should evolve in a similar fashion to intelligence laws and capacities of intelligence services. Their power and technical abilities should match those of the services they oversee to fulfil the requirements the case law of the CJEU and the ECtHR set. The crucial concept of continuous control developed by the ECtHR should be a reality in practice.

In all EU Member States, several entities contribute to the oversight framework. Enhanced collaboration between relevant oversight authorities should ensure the oversight of the full surveillance cycle. The efficiency of the five oversight models presented in this report should be assessed based on two principles: matching powers and continuous control over the intelligence cycle.

The report also addresses the issue of remedies. A number of challenges in the field of surveillance by intelligence services need to be overcome to ensure access to effective remedies, as FRA highlighted in 2017. In this area, individuals wishing to complain about alleged fundamental rights violations face several issues. These include a challenge that undermines the right to a fair hearing, namely secrecy.

The 2017 FRA report discussed how Member States addressed this key aspect of surveillance. In this update, FRA found that in 2023 the situation had not evolved much since 2017. Pursuing a claim against an alleged illegal surveillance measure places the individual in a situation where they need to trust the remedial body. The effectiveness of a remedial body is the crucial element from which such trust stems. Furthermore, the 2016 EU data protection reform led to some Member States significantly reducing DPAs’ remedial competencies in the field of national security. In other Member States, the reform reinforced the DPAs’ powers.

In 2023, as was the case in 2017, a strong independent oversight structure offering effective remedies to individuals would “pave the way […] to renewed trust among European citizens towards their intelligence services and, as a result, a more effective defence of national security”.[134] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 135.
Enhanced security measures should be enshrined in a strong fundamental rights framework, where the necessity and proportionality of surveillance measures are regularly assessed.

Overview

The current report updates relevant parts of the 2017 report. Like the 2017 report, this update focuses on the work of intelligence services. It describes the developments that have taken place since 2017 in intelligence laws in the European Union (EU).

Significant developments that have taken place include the welcomed establishment of new oversight bodies following constitutional courts’ decisions and the impact of the 2016 European data protection reform on data protection authorities’ powers in the field of intelligence services’ activities. In 2023, 18 expert bodies are overseeing the work of intelligence services in the EU-27, compared with 16 in the EU-28 in 2017. These developments are viewed in the light of minimum requirements shaped by the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR).

In this context, the current report refers to a selection of relevant FRA opinions drawn from the 16 opinions published in the 2017 FRA report, alongside key findings from this earlier report. It also highlights relevant developments over time. In particular, it provides, as per the European Parliament’s request, up-to-date information on existing models of oversight mechanisms and remedies, illustrating them with examples from selected Member States. The report describes five distinct models of oversight frameworks. These encapsulate the diverse spectrum of frameworks across the EU Member States.

In 2017, FRA concluded that protecting the public from security threats while respecting fundamental rights can be achieved through strong oversight systems and effective remedies open to individuals. This conclusion remains valid in 2023.