Oversight bodies have diverse roles, including overseeing the legality of the intelligence services’ functioning, efficiency and policies.
The judiciary and/or an expert body normally oversee surveillance. Currently, in 18 of the 27 Member States that this report covers, compared with the 28 that were covered in the 2017 report, expert bodies are part of the oversight system. In 19 Member States – not necessarily including the same ones – judicial authorities authorise targeted surveillance measures.
In 25 Member States, parliaments are involved in oversight. In 22 of these, one or two specialised parliamentary committees are involved in overseeing intelligence services. In the other three of these, a non-specialised committee is responsible for this task.
In five Member States, DPAs have the same powers over intelligence services as over all other data controllers. In 15 Member States, DPAs have no power over intelligence services. In seven Member States, their powers are limited. Following the entry into force of the 2016 European data protection reform, seven Member States have restricted or excluded DPAs from exercising supervision over data processing by intelligence services.
Five Member States have detailed provisions on the general surveillance of communications. Of these Member States, three provide for the binding involvement of an independent body in the authorisation of surveillance measures. In the other two Member States, the opinions of the oversight body are not binding.
There is a great diversity of oversight frameworks in the EU Member States. Five models of oversight frameworks based on the different actors overseeing the intelligence services illustrate this diversity.
Opinion 2: Ensuring broad consultation and openness during the legislative process
EU Member States should undertake broad public consultations with a full range of stakeholders, ensure transparency of the legislative process, and incorporate relevant international and European standards and safeguards when introducing reforms to their legislation on surveillance.
Opinion 3: Providing independent intelligence oversight with sufficient powers and competences
EU Member States should establish a robust oversight framework adequate to the powers and capacities that intelligence services have. The independence of oversight bodies should be enshrined in law and applied in practice. EU Member States should grant oversight bodies adequate financial and human resources, including diverse and technically-qualified professionals. Member States should also grant oversight bodies the power to initiate their own investigations as well as permanent, complete and direct access to necessary information and documents for fulfilling their mandate. Member States should ensure that the oversight bodies’ decisions are binding.
Opinion 4: Bolstering oversight with sufficient technical expertise
EU Member State laws should ensure that oversight bodies have staff with the required technical expertise to assess independently the intelligence services’ often highly technical work.
Opinion 5: Ensuring oversight bodies’ openness to public scrutiny
EU Member States should ensure that oversight bodies’ mandates include public reporting to enhance transparency. The oversight bodies’ reports should be in the public domain and contain detailed overviews of the oversight systems and related activities (e.g. authorisations of surveillance measures, on-going control measures, ex-post investigations and complaints handling).
Opinion 6: Fostering continuity of oversight
EU Member States should ensure that the oversight bodies’ mandates complement each other, so that, overall they provide continuous control and ensure proper safeguards. Such complementarity can be achieved with informal cooperation between oversight bodies or statutory means.
Source: FRA 2017
In preparing this update, FRA confirmed the accuracy of the intelligence services’ accountability scheme, as presented in the 2017 FRA report. This update will focus on entities performing oversight during the different stages of surveillance, while recognising the important role that watchdogs, such as the media, whistle-blowers and civil society organisations, play. The Pegasus revelations provided us with yet another example of the essential role that civil society organisations and the media play. Figure 3, first presented in the 2017 FRA report, illustrates the main actors that contribute to the oversight of intelligence services and their accountability.
Figure 3 – Intelligence services’ accountability scheme
Source: FRA, 2023
The 2017 FRA report emphasised that a crucial precondition for the effective oversight of intelligence services’ activities is the proper internal control of the services themselves.[58] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 59. FRA did not collect up-to-date data on the control exercised by intelligence services or government bodies.
A clear understanding of the legal obligations of intelligence services facilitates effective supervision of them. For example, the French oversight body justifies the low number of negative opinions on requested surveillance techniques based on intelligence services’ good understanding of the law.[59] France, National Commission for Control of Intelligence Techniques (CNCTR) (2022), 6st annual report 2021 (6e rapport d’activité 2021, Paris, CNCTR, p. 67. Awareness can also be enhanced through a memorandum of understanding. For example, in Italy the DPA and the coordinator of the intelligence services (the Security Intelligence Department– DIS).[60] Italy, Italian Data Protection Authority (Garante pre la protezione dei dati personali (2019), ‘Privacy e sicurezza: l’iniziativa di Garante privacy e Intelligence a tutela dei cittadini’, press release, 6 March 2019.
Notes on terminology
General surveillance of communications
Intelligence can be collected by technical means and on a large scale. This surveillance technique is referred to in different ways, including as “signals intelligence”, “strategic surveillance”, “bulk investigatory powers”, “mass digital surveillance” and “storage of data on a generalised basis”. Whenever possible, FRA uses the national laws’ terminology. However, it also uses – as a generic, all-encompassing term – “general surveillance of communications”.
Targeted and untargeted surveillance
Based on whether or not a target exists, surveillance measures can be divided into targeted and untargeted surveillance. Targeted surveillance presupposes the existence of prior suspicion of a targeted individual or organisation. Untargeted surveillance is conducted without prior suspicion or a specific target.
Source: FRA, 2017
Effective oversight of surveillance operations requires, among other things, that independent oversight be present when the surveillance measures are first ordered, as the 2017 FRA report stressed.[61]FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, pp. 93–97. Both the CJEU and the ECtHR underline that any measure for secret surveillance should be subject to prior authorisation, preferably by a court or another independent authority.[62] CJEU, Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH [GC], 20 September 2022, paras. 72 and 131 and operative part; and ECtHR, Big Brother Watch and Others v. the United Kingdom, Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 350–352, 377, 416 and 425. The authorising authority should ensure that any requested measures are proportionate and necessary in practice to protect national security.[63]CJEU, Joined cases C‑793/19 and C‑794/19, Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland GmbH [GC], 20 September 2022, paras. 72 and 131 and operative part and ECtHR, Centrum för rättvisa v. Sweden [GC], No. 35252/08, 25 May 2021, paras. 266, 268, 270, 275, 298–302.
Table 1 shows the different bodies that have a binding/final decision in the authorisation or approval processes for different types of targeted surveillance measures. The information provided for an individual Member State covers all potential actors with binding decision-making powers in authorising targeted surveillance measures. Pegasus and the other spyware related to the PEGA Committee’s work fall within the category of targeted surveillance.[64] European Parliament (2022), Pegasus and surveillance spyware, in-depth analysis, May 2022, p. 4.
In several Member States, two or more bodies authorise surveillance techniques. The modalities and details of this authorisation process vary considerably among Member States and depend on the different types of surveillance measures involved, as the 2017 FRA report states.
Table 1 – Binding authorisation/approval of targeted surveillance measures in the EU-27
Member State
Judicial bodies
Executive
Expert bodies
Intelligence services
AT
✓
BE
BG
CY
CZ
DE
DK
EE
EL
ES
FI
FR
✓*
HR
HU
IE
IT
LT
LU
LV
MT
NL
PL
PT**
RO
SE
SI
SK
Notes:
* In France, when the expert body issues a negative opinion on the use of a surveillance technique, if the Prime Minister wishes to disregard the opinion the expert body immediately brings the matter before the Council of State. The council then issues a final binding decision.
** In Portugal, the constitution only allows public authorities to interfere with correspondence, telecommunications and other means of communication in criminal proceedings, which the intelligence service is not allowed to conduct. The intelligence service is therefore prohibited from carrying out this type of surveillance.
One notable example of a legal reform regarding the authorisation of surveillance measures is the 2021 reform in France. This reform strengthened the decision-making power of the expert body. If the Prime Minister decides not to consider a negative opinion delivered by the National Commission for Control of Intelligence Techniques (Commission nationale de contrôle des techniques de renseignement, CNCTR), the CNCTR must immediately refer the case to the Council of State. The council takes the final decision.[65]France, Internal Security Code (Code de la sécurité intérieure, Art. L 821-1. While a negative opinion used to be non-binding, it has now become “blocking”.[66] France, CNCTR (2022), 6e annual report 2021 (6e rapport d’activité 2021, Paris, CNCTR, pp. 8–9.
The Netherlands provides another example, with the establishment of a new body – the Investigatory Powers Commission (Toetsingscommissie inzet bevoegdheden) – in 2017. The commission became operational in May 2018.[67] The Netherlands, Intelligence and Security Services Act 2017 (Wet op de inlichtingen- en veiligheidsdiensten 2017, 1 May 2022. Its task is to assess in advance the legality of the government’s authorisation of the surveillance techniques that intelligence agencies employ.[68] The Netherlands, Intelligence and Security Services Act 2017 (Wet op de inlichtingen- en veiligheidsdiensten 2017,1 May 2022, Arts. 32–37. If it deems the authorisation unlawful, surveillance cannot proceed.[69]The Netherlands, Investigatory Powers Commission (Toetsingscommissie inzet bevoegdheden, TIB) (2020), Annual report TIB 2018/2019, The Hague, TIB.
Five EU Member States have detailed laws on the general surveillance of communications. As anticipated in the 2017 FRA report, since 2017, Finland has completed its wide-reaching intelligence law reform. The reform included new legislation that details the general surveillance of communications by intelligence services.[70] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 40. Table 2 presents the bodies that have the power to provide final authorisation for the general surveillance of communication measures in the Member States that implement such surveillance techniques.
Table 2 – Approval/authorisation of general surveillance of communications in EU Member States
Parliamentary committees
Note: * In France, when the expert body issues a negative opinion on the use of a surveillance technique, if the Prime Minister wishes to disregard the opinion, the expert body immediately brings the matter before the Council of State. The council then issues a final binding decision.
The 2021 reform in Germany specified the threshold for the general surveillance of foreign communications. In addition, it tasked its new expert body – the Independent Supervisory Council (Unabhängiger Kontrollrat) – with approving the general surveillance of foreign communications ordered by the Federal Intelligence Service (Bundesnachrichtendienst).[71] Germany, Act amending the BND Act to implement the requirements of the Federal Constitutional Court and the Federal Administrative Court (Gesetz zur Änderung des BND-Gesetzes zur Umsetzung der Vorgaben des Bundesverfassungsgerichts sowie des Bundesverwaltungsgerichts, 19 April 2021, Art. 1 (21), amending Arts. 23 and 42 of the BND Act. In the Netherlands, the Investigatory Powers Commission (Toetsingscommissie inzet bevoegdheden) assesses the legality of the ministerial authorisation provided to intelligence services to acquire real-time and fully automated access to databases or for the large-scale monitoring of internet traffic.[72] The Netherlands, Intelligence and Security Services Act 2017 (Wet op de inlichtingen- en veiligheidsdiensten 2017, 1 May 2022, Arts. 32–37. In Finland, 2019 laws granted intelligence services the power to conduct the general surveillance of communications techniques, albeit under strict conditions and court authorisation.
Intelligence services can acquire communications data based on the automated segregation of data traffic and the processing of acquired data concerning transborder data traffic.Network traffic is selected based on objective criteria – search terms or search term categories – subject to court authorisation.For the court to grant authorisation, the intelligence service must justify that it is necessary to screen specific traffic during a specific period.[73] Finland, Ministry of the Interior (sisäministeriö/inrikeministeriet (n.d.), Civilian intelligence protects Finland’s national security. Such data should provide information about activities that pose a serious threat to national security that is otherwise unattainable.[74] Finland, Act on the Use of Network Traffic Intelligence in Civilian Intelligence (laki tietoliikennetiedustelusta siviilitiedustelussa/lag om civil underrättelseinhämtning avseende datatrafik,Act No. 582/2019, 18 January 2019, Section 7; and Act on Military Intelligence (laki sotilastiedustelusta/lag om militär underrättelseverksamhet), Act No. 590/2019, 26 April 2019.
National parliaments are responsible for holding the executive accountable for its actions. The findings of the 2017 FRA report are still relevant, namely that the vast majority of EU Member States provide for parliamentary oversight through specialised or non-specialised parliamentary committees (see Figure 4). The only two exceptions are Ireland and Malta, which do not provide for some sort of parliamentary oversight of intelligence services. In three Member States – Cyprus, Poland and Sweden – this task is assigned to a non-specialised committee. In the other 22 Member States, parliamentary oversight is exercised by specialised parliamentary committees.
Figure 4 – Parliamentary oversight of intelligence services in the EU-27
For example, in Finland, the newly established Intelligence Oversight Committee (Tiedusteluvalvontavaliokunta) oversees the proper implementation and appropriateness of intelligence operations; monitors and evaluates the focus areas of intelligence operations; monitors and promotes the effective exercise of fundamental and human rights in intelligence operations; provisionally considers reports of the Intelligence Ombudsman, before a discussion in plenary; and processes the supervisory findings of the Intelligence Ombudsman.[75]Finland,Parliament’s Rules of Procedure(eduskunnan työjärjestys/riksdagens arbetsordning, Act No. 40/2000, Chapter 3, Section 31 (b). For the English translation of the tasks provided in this section of the act, see Parliament of Finland (n.d.), Intelligence Oversight Committee.
In addition, in France, the powers of the parliamentary committee responsible for intelligence services (Délégation parlementaire au renseignement, DPR) have been enhanced.[76] France, Order No. 58-1100 on the functioning of parliamentary assemblies (Ordonnance n° 58-1100 relative au fonctionnement des assemblées parlementaires, 17 November 1958, Art. 6 (9). Among other things, it can now request any document or information, implement any assessment consideration needed to carry out its duties and hold hearings of people exercising management duties within intelligence services. The scope of the DPR has been extended to include the monitoring of current issues and the determination of future challenges to public intelligence policy. It is in this context that the DPR addressed Pegasus in its latest report.[77]France, Buffet, F.-N., Parliamentary Delegation on Intelligence (Délegation parlementaire au renseignement (2022), Activity of the Parliamentary Delegation on Intelligence 2021-2022 (Activité de la délégation parlementaire au renseignement pour l’année 2021–2022, 24 February 2022.
The role of parliamentary oversight of intelligence services can be crucial for the overall functioning of intelligence services. In Austria, for example, the abolishment and replacement of the intelligence service in 2021 is mainly attributed to the findings of a parliamentary enquiry committee that established serious shortcomings in the service.[78] Parliament of Austria (n.d.), BAT Committee of Enquiry (BVT-Untersuchungsausschuss (3/A-USA); Commission of Inquiry into the Terrorist Attack of November 2nd, 2020 (Untersuchungskommission, Final report (Abschlussbericht, 10 February 2021 The effectiveness of parliamentary oversight must be assessed in practice, as required by case law. In the case of Zoltan Varga v. Slovakia, the ECtHR highlighted some shortcomings in relation to parliamentary oversight.[79] ECtHR, Zoltán Varga v. Slovakia, Nos. 58361/12, 25592/16 and 27176/16, 20 July 2021, paras. 135 and 159. Shortcomings were also detailed in the case of Ekimdzhiev and Others v. Bulgaria. The court noted, first, that the committee members do not need to have legal qualifications or experience and, second, that the committee “has no power to order remedial measures in concrete cases”.[80] ECtHR, Ekimdzhiev and Others v. Bulgaria, No. 70078/12, 11 January 2022, para. 414.
The 2017 FRA report presented the various expert oversight bodies established in the Member States and analysed the oversight frameworks, alongside the features and powers of these bodies. The report stated that these bodies should have “two essential qualities: be independent and have sufficient powers to carry out continuous control that is subject to public scrutiny”.[81] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 73. These powers relate, on the one hand, to the appropriate review of the measures and, on the other hand, to the oversight bodies’ ability to ensure that effective action is taken if they find irregularities.[82] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 75.
Since 2017, six Member States – Czechia, Finland, Germany, Lithuania, Luxembourg, and the Netherlands – have set up new, or replaced old, expert bodies dedicated to the oversight of intelligence services.
In Czechia, the establishment of a new oversight body is regulated by a 2018 law. This body has not become operational yet because of the high number of requirements imposed on its members. They should, among other things, hold top secret clearance, have no connection to the intelligence services and be over the age of 40. Additional requirements were removed in 2022 to facilitate the procedure for nominating members.[83] Czechia, Act No. 325/2017 Coll., effective from 1 January 2018, which amended Act No. 153/1994 Coll., on the intelligence services of the Czech Republic; and Act No. 150/2021 Coll., amending Act No. 289/2005 Coll. on military intelligence, as amended, and some other acts.
The section below provides an updated list of bodies specialised in intelligence oversight, excluding DPAs. For the purpose of this report, DPAs are considered expert bodies. However, as they are not specialised in intelligence oversight, except in Belgium, they are dealt with separately.
Expert bodies, excluding DPAs, overseeing intelligence services in the EU-27
Austria
Belgium
Bulgaria
Croatia
Cyprus
Czechia
Denmark
Estonia
Finland
France
Germany
Greece
Hungary
Ireland
Italy
Latvia
Lithiuania
Luxembourg
Malta
Netherlands
Poland
Portugal
Romania
Slovakia
Slovenia
Spain
Sweden
* The 2018 data protection reform in Belgium established Standing Committee I as the supervisory authority in the area of data protection.
In 2021, Austria reformed its oversight framework and established a new expert body: the Independent Control Commission on the Protection for the Constitution (Unabhängige Kontrollkommission Verfassungsschutz).[84] Austria, Federal Act amending the Act concerning Police State Protection Act, the Security Police Act, the Criminal Code, the Code of Criminal Procedure 1975 and the Expungement Redemption Act 1972 (Bundesgesetz, mit dem das Polizeiliche Staatsschutzgesetz, das Sicherheitspolizeigesetz, das Strafgesetzbuch, die Strafprozeßordnung 1975 und das Tilgungsgesetz 1972 geändert werden), Federal Law Gazette I No. 148/2021, 26 July 2021, Art. 4a. This body identifies systemic deficiencies in and ways to improve the intelligence services. It acts either on its own initiative or at the request of the Minister for the Interior or the parliamentary committee on intelligence oversight. In addition, it serves as a contact point for whistle-blowers.[85]Austria, Explanatory notes to the Federal Act amending the Act concerning Police State Protection Act, the Security Police Act, the Criminal Code, the Code of Criminal Procedure 1975 and the Expungement Redemption Act 1972 (Eräuterungen zum Bundesgesetz, mit dem das Polizeiliche Staatsschutzgesetz, das Sicherheitspolizeigesetz, das Strafgesetzbuch, die Strafprozeßordnung 1975 und das Tilgungsgesetz 1972 geändert werden).
This new expert body consists of five independent people appointed by the National Council with a two-thirds majority. These people must possess legal qualifications and experience and undergo a trustworthiness test before appointment.[86]Austria, State Protection and Intelligence Service Act (Bundesgesetz über die Organisation, Aufgaben und Befugnisse des Verfassungsschutzes - Staatsschutz- und Nachrichtendienst-Gesetz, Federal Law Gazette I No. 5/2016, Art. 17b, Section 2a. To safeguard the body’s independence, it has separate office premises from the intelligence agency. This body does not deal with matters in the area of expertise of the Legal Protection Commissioner at the federal Ministry of the Interior or any other legal protection authority.
Another example of a new oversight body is the Finnish Intelligence Ombudsman (tiedusteluvalvontavaltuutettu / underrättelsetillsynsombudsmannen), set up in 2019. It oversees both the civilian intelligence authorities and the military intelligence authorities. It is an independent body with investigative powers and an extensive right to access information. The body can order the suspension or cessation of surveillance if it considers that the intelligence authority has acted unlawfully.
The body can also temporarily stop a surveillance technique authorised by a court and refer the matter to the authorising court. It also receives investigation requests and complaints from individuals and acts on them.[87] Finland, Act on the Oversight of Intelligence Gathering (laki tiedustelutoiminnan valvonnasta/lag om övervakning av underrättelseverksamheten, Act No. 121/2019, 18 January 2019, Sections 11–14.
Similarly, in Lithuania, a new expert body – the Intelligence Ombudsman (Žvalgybos kontrolierius) – was set up through a 2021 law that came into effect on 1 January 2022.[88] Lithuania, Law on Intelligence Ombudsmen (Žvalgybos kontrolierių įstatymas), No. XIV-868, 23 December 2021 This body was established after the national DPA was excluded from exercising any control over data processing by national institutions for national security and defence purposes.[89]Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas), No. XIII-1435, 30 June 2018, Art. 39 (3). It is composed of two ombudspersons who are appointed by the parliament for a five-year term. The body has its own staff and budget, and one of the two ombudspersons is appointed as its head.
The Intelligence Ombudsman is independent and accountable only to parliament, to which it submits an annual report. It supervises intelligence services and their compliance with human rights standards and data protection regulations. It also carries out assessments of the legality of intelligence services’ activities and methods.
The ombudsman can investigate intelligence services’ activities and processing of personal data, and may access the data they collect. It can initiate investigations on its own initiative, or based on complaints received from individuals, parliamentarians or other public institutions.
Germany established the Independent Supervisory Council (Unabhängiger Kontrollrat) in 2021. This council acts as a quasi-judicial oversight body tasked with the authorisation of surveillance measures, and as an administrative oversight body for ex post oversight. Its members are six judges of the Federal Supreme Court and/or the Federal Administrative Court, who are elected by the Parliamentary Oversight Panel (Parlamentarisches Kontrollgremium) for 12 years.Cooperation among the different German intelligence oversight bodies is provided for by an amendment of the Parliamentary Oversight Panel Act. The act authorises the panel to request information from the G 10 Commission, the Federal Commissioner for Data Protection and Freedom of Information, and the Independent Supervisory Council, if deemed necessary for the panel’s investigations.[90] Germany, Act to Change the Federal Intelligence Service Act to Implement the Guidelines of the Federal Constitutional Court and the Federal Administrative Court (Gesetz zur Änderung des BND-Gesetzes zur Umsetzung der Vorgaben des Bundesverfassungsgerichts sowie des Bundesverwaltungsgerichts,19 April 2021.
In the Netherlands, the Investigatory Powers Commission assesses the legality of the authorisation the responsible ministers grant to intelligence services to perform surveillance activities.This body supplements the main oversight body, the Review Committee on the Intelligence and Security Services (Commissie Van Toezicht op de Inlichtingen- en Veiligheidsdiensten). This committee is tasked with the ongoing supervision of surveillance activities that intelligence services conduct after authorisation.[91] The Netherlands, Intelligence and Security Services Act 2017 (Wet op de inlichtingen- en veiligheidsdiensten 2017, 1 May 2022, Arts. 32–37.
The 2016 European data protection reform also led to important changes in intelligence oversight. FRA research indicates that national data protection laws passed after 2016 led mostly to broader restrictions on or even the prevention of DPAs exercising oversight and reviewing the data processing activities of intelligence services (see Figure 5), such as in Bulgaria, Croatia and Greece. These changes concerned not only the oversight functions of DPAs over intelligence activities, but also authorities’ remedial powers, as described in the section ‘Remedies’.
However, in some states, such as France, Italy and Slovenia, no important changes affected the general oversight framework. In Slovenia, under the 2022 data protection reform, the Director of the intelligence service can delay the DPA’s inspections in very limited circumstances.[92] Slovenia, Personal Data Protection Act (Zakon o varstvu osebnih podatkov, ZVOP-2), Official Journal of the Republic of Slovenia, No. 136/22, 15 December 2022, Art. 29 (6). In some countries, such as Belgium and Lithuania, the exclusion of DPAs from overseeing the activities of intelligence services was accompanied by the provision of supervisory powers in the area of data protection to oversight bodies.
Figure 5 – DPAs’ oversight powers over national intelligence services in the EU-27
In Bulgaria, processing for “national defence and national security” was excluded from the scope of personal data legislation and the GDPR, restricting the oversight of intelligence services by its national DPA: the Commission for Personal Data Protection (Комисия за защита на личните данни).[93] Bulgaria, Amendments and supplements to the Personal Data Protection Act (Закон за изменение и допълнение на Закона за защита на личните данни, 26 February 2019. This change was accompanied by corresponding amendments to the laws governing the different intelligence services. These amendments excluded the State Intelligence Agency from the Commission for Personal Data Protection’s oversight but retained the agency’s limited oversight of the activities of the Military Intelligence Service and the State Agency for National Security.[94]Bulgaria, State Intelligence Agency Act (Закон за Държавна агенция „Разузнаване”, 13 October 2015, last amended 4 August 2020, Arts. 27 and 28; Military Intelligence Act (Закон за военното разузнаване, 13 November 2015, last amended 26 March 2021, Art. 78; State Agency for National Security Act (Закон за Държавна агенция „Национална сигурност”, 13 October 2015, last amended 5 June 2020, Art. 37.
A similar change was passed in Greece in 2019. The new data protection law excluded the Greek DPA from supervising operations involving the processing of classified personal data carried out for activities concerning national security.[95]Greece, Hellenic Data Protection Authority (HDPA), measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and transposition of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, and other provisions, Law No. 4624, Government Gazette Issue A’ 137/29.08.2019, Art. 10, para. 5. A similar change occurred in Croatia. The new data protection laws prevented bodies of the security intelligence system from conducting data processing for the purpose of protecting national security and, hence, exempted them from any oversight by the national DPA.[96]Croatia, Implementation of the General Regulation on Data Protection Act (Zakon o provedbi Opće uredbe o zaštiti podataka, Official Gazette No. 42/18, Art. 1 (2); Act on the Protection of Natural Persons in Connection with the Processing and Exchange of Personal Data for the Purposes of Prevention, Research, Detection or Prosecution of Criminal Offenses or Execution of Criminal Sanctions (Zakon o zaštiti fizičkih osoba u vezi s obradom i razmjenom osobnih podataka u svrhe sprječavanja, istraživanja, otkrivanja ili progona kaznenih djela ili izvršavanja kaznenih sankcija,Official Gazette (Narodne novine No. 68/18, Art. 3 (2); Croatian Personal Data Protection Agency (n.d.), Croation Personal Data Protection Agency;Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka (n.d.), Insight into the files of school employees by employees of the Security and Intelligence Agency (Uvid u dosje zaposlenika škole od strane zaposlenika Sigurnosno-obavještajne agencije.
While Lithuania established a new oversight body in 2021, by enacting the European data protection reform in 2018 the country had specifically removed the DPA’s powers over intelligence services’ data processing for the purposes of national security and defence.[97] Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas, No. XIII-1435, 30 June 2018, Art. 39 (3). In Belgium, the 2018 data protection reform designatedthe Standing Intelligence Agencies Review Committee (Standing Committee I) (Le Comité permanent de contrôle des services de renseignement, Comité permanent R) as the supervisory authority for all data processing activities of intelligence services linked to national security.[98] Belgium, Act on the protection of natural persons with regard to the processing of personal data (Loi relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnel, 5 September 2018. See Belgium, Standing Intelligence Agencies Review Committee (Standing Committee I) (2019), Activity Report 2018 (Rapport d’activités 2018, p. 71. The Belgian DPA (L’Autorité de protection des données) is excluded from performing any oversight on data processing by intelligence services.
However, data protection law calls for cooperation between the various sectoral supervisory authorities. Accordingly, in 2020, a protocol for cooperation was adopted.[99]Belgium, Autorité de protection des données, Organe de contrôle de l’information policière, Comité permanent de contrôle des services de renseignement and Comité permanent de contrôle des services de police, Protocol for cooperation between the Belgian federal supervisory authorities in the field of data protection agreement between the data protection authority, the police information supervisory body, the permanent committee for the control of the intelligence services and the permanent committee control of police services (Protocole de coopération entre les autorités de contrôle fédérales belges en matière de protection des données convention entre l’autorité de protection des données, l’organe de contrôle de l’information policière, le comité permanent de contrôle des services de renseignement et le comité permanent de contrôle des services de police, 20 November 2020. It clarifies the division of tasks and the scope of powers of the data protection supervisory authorities in Belgium. Since 2018, the Standing Committee I has reported annually on its activities as a supervisory authority in the area of data protection.[100] See the latest report: Belgium, Standing Committee I (2022), Rapport d’activités 2021, p. 123.
Other data protection reforms were enacted in other Member States. In Germany, for example, the data protection reform revised the framework for data processing in the field of national security.[101]Germany, Act for the Adjustment of Data Protection Law to Regulation (EU) 2016/679 and for the Implementation of Directive (EU) 2016/680 (Gesetz zur Anpassung des Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680, 30 June 2017, The laws of the three federal intelligence services included new provisions on the specific role and oversight of the Federal Commissioner for Data Protection and Freedom of Information (Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, BfDI), thus transferring the supervisory powers from the old Federal Data Protection Act to intelligence legislation.[102]Germany, Federal Act on the Protection of the Constitution (Bundesverfassungsschutzgesetz, after further legal changes, 20 December 1990, Sections 27 and 28; Federal Intelligence Agency Act (Bundesnachrichtendienstgesetz, 20 December 1990, Sections 63 and 64; Military Counter Intelligence Act (Gesetz über den Militärischen Abschirmdienst, Sections 13 and 13a. In particular, with regard to the Federal Intelligence Service (Bundesnachrichtendienst), the BfDI’s power to issue ad hoc opinions on critical issues to the parliament and the general public is limited in that the BfDI may inform other oversight bodies only confidentially.[103] Germany, Act to Change the Federal Intelligence Service Act to Implement the Guidelines of the Federal Constitutional Court and the Federal Administrative Court (Gesetz zur Änderung des BND-Gesetzes zur Umsetzung der Vorgaben des Bundesverfassungsgerichts sowie des Bundesverwaltungsgerichts, 19 April 2021.
The oversight powers of DPAs appear to have been reinforced since 2017 in only a few countries. For example, in Luxembourg, based on the 2018 data protection reform, the National Commission for Data Protection (Commission Nationale pour la Protection des Données) is responsible for monitoring and verifying the legal compliance of the processing of personal data by the State Intelligence Service. In this regard, the National Commission for Data Protection enjoys significant investigative, corrective, authorisation and advisory powers. It also hears complaints and provides for remedies, subject to judicial appeal.[104] Luxembourg, Act of 1 August 2018 on the organisation of the National Data Protection Commission, implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), amending the Labour Code and the amended Act of 25 March 2015 stipulating the rules of remuneration and the terms and conditions for the promotion of State civil servants (Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en oeuvre du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE (règlement général sur la protection des données), portant modification du Code du travail et de la loi modifiée du 25 mars 2015 fixant le régime des traitements et les conditions et modalités d’avancement des fonctionnaires de l’État, Arts. 8, 44 and 45.
In Cyprus, following the 2018 reforms, the DPA has access to all personal data and information necessary to perform its mandate. The confidentiality of the data is not maintained, unless they are covered by legal professional privilege. Past restrictions on accessing records, which were kept for national security purposes, were abolished.[105] Cyprus, Law on the protection of individuals with regard to the processing of personal data and the free circulation of personal data of 2018 (O περί της Προστασίας των Φυσικών Προσώπων Έναντι της Επεξεργασίας των Δεδομένων Προσωπικού Χαρακτήρα και της Ελεύθερης Κυκλοφορίας των Δεδομένων αυτών Νόμος του 2018, No. 125(I)/2018, Art. 25 (a). In Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) can, on its own initiative, now issue warning orders but also injunctions requiring the intelligence services to take measures to secure the lawfulness of data processing.[106] Sweden, Act (2021:1171) on the processing of personal data by the Swedish Armed Forces (Lag [2021:1171] om behandling av personuppgifter vid Försvarsmakten, 2 December 2021, Chapter 6, Sections 3 and 4; Act (2021:1172) on the processing of personal data by the National Defence Radio Establishment (Lag [2021:1172] om behandling av personuppgifter vid Försvarets radioanstalt, 2 December 2021, Chapter 6, Sections 4 and 5. See also Ministry of Defence (Försvarsdepartementet (2021), Processing of personal data by the Swedish Armed Forces and the National Defence Radio Establishment (Behandling av personuppgifter vid Försvarsmakten och Försvarets radioanstalt, government bill, 13 September 2021, p. 148.
In Hungary, the implementation of the GDPR allowed the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), which oversees the activities of intelligence services, to start investigations on its own initiative. This power was relied on in its review of Pegasus-related allegations.[107] Hungary, Act 112 of 2011 on the right to informational self-determination and information freedom (törvény az információs önrendelkezési jogról és az információszabadságról, Art. 51/A; amendment entered into force on 26 July 2018, introduced by Amending Act 38 of 2018, 26 July 2018, Art. 20. However, the ECtHR recently found a violation of the ECHR in respect of the limited powers of the authority. The authority can perform its tasks by sending its fact-finding requests to the overseeing minister and rely on their findings.[108] ECtHR, Hüttl v. Hungary, No. 58032/16, 29 September 2022, para. 18.
Figure 6 summarises the current situation with regard to expert bodies’ and DPAs’ oversight of intelligence services across EU Member States.
Figure 6 – Oversight of surveillance by intelligence services by expert bodies and DPAs
Note: * As over other data controllers.
The oversight of intelligence services is organised differently across EU Member States, as highlighted in the 2017 FRA report and considering the recent developments in the frameworks of oversight bodies described in previous sections. The jurisprudence of the CJEU and the ECtHR has set minimum standards but leaves states with significant leeway to organise the oversight of the activities of their own intelligence services. This section specifically responds to the European Parliament’s request for FRA to determine which oversight models were prevalent in the EU. FRA’s research identified 18 different oversight frameworks in the EU.
The following section describes five models covering most EU Member States, identified from the 18 oversight frameworks. When assessing the efficiency of an oversight framework, two key elements should be considered. First, the oversight framework should have oversight powers that correlate with the surveillance powers of the intelligence services, along with adequate resources and expertise to ensure effective oversight (see FRA opinion 3 above). Second, the oversight structure, including through the collaboration of different entities, should cover the full surveillance cycle, which the ECtHR refers to as “continuous control” (see FRA opinion 6 above). The models in this section focus on expert bodies exercising oversight over intelligence services during and after secret surveillance measures. In FRA’s understanding, ex post oversight starts once the surveillance measure has been authorised by the bodies mentioned in the section ‘Ex ante authorisation’.
The models neither describe nor extend to the judicial control of surveillance measures at the stage of remedies. This choice does not disregard the important role that courts play in the overall framework for the oversight of intelligence services, especially at the remedial stage.
None of the five models cover Ireland or Malta[109] See United Nations, Special Rapporteur on Privacy (2019), Comments on legislation and policy – Malta, 2/2019, 12 December 2019. because these Member States do not rely on any arrangement of parliamentary oversight.
The multitude of models across the EU is due to the diversity of actors contributing to the oversight frameworks. Several Member States emphasise the role of parliament in the oversight structure. This forms the basis for the first model that FRA identified. The model mainly relies on two actors: an authority authorising the surveillance measure and a parliamentary committee exercising subsequent oversight.
Figure 7 illustrates the model. It is present in Estonia, Latvia, Romania, Slovakia and Spain. Poland has features of this model, but instead of a judge authorising the surveillance measure it is the executive or the intelligence services, depending on the surveillance measure, that approves the surveillance technique.
Figure 7 – Model 1 – reliance on parliamentary oversight
As noted above, the majority of EU Member States have set up specialised expert bodies to oversee the work of intelligence services. In this second model, the specialised expert body focuses its work on ex post oversight alongside a parliamentary committee. A judicial authority authorises the surveillance measure.
Figure 8 illustrates the role played by the expert body, which has no power at the authorisation stage. This model has been adopted in Croatia, Czechia, Denmark, Greece and Lithuania. The Dutch system also resembles this model. However, in the Netherlands, a judicial authority, the executive or an expert body can authorise the surveillance measure, depending on the measure at stake.
Figure 8 – Model 2 – ex post oversight by an expert body and parliament
A significant number of Member States not only rely on specialised expert bodies to oversee the activities of intelligence services but also include DPAs in their oversight frameworks. In most cases, the DPA has limited power compared with that of the specialised expert body, which leads the ex post oversight of activities of intelligence services. In this third model, a parliamentary committee also contributes to the oversight function.
Luxembourg provides an example of this model, as illustrated in Figure 9. Germany also largely adheres to this model, the only difference being that the parliamentary committee approves certain surveillance measures. France also follows the same model, but the executive has the binding approval power when authorising a surveillance technique.
This model also largely fits the Belgian and Bulgarian oversight frameworks. In Belgium, the executive, an expert body (e.g. the Administrative Commission) or the intelligence services authorise the surveillance measure, depending on the measure at stake. In Bulgaria, only a judge can authorise surveillance measures. In exceptional cases, the DPA holds the same powers over intelligence services as over any other data controller. This is the case in Austria and Finland.
In Belgium, the specialised expert body (Standing Committee I) is the supervisory authority in the area of data protection (DPA).
Figure 9 – Model 3 – ex post oversight by an expert body, a DPA and parliament
The fourth model relies on the DPA and the parliamentary committee to conduct the oversight of intelligence services, with no separate oversight body with a mandate wider than data protection. In Hungary, Italy and Slovenia, where this model is applied, there is no specialised expert body. The DPA has either limited power (Hungary and Italy) or the same power as over any other data controller (Slovenia). Figure 10 illustrates the Hungarian model. In Italy, a judge always authorises the use of surveillance measures.
Figure 10 – Model 4 – ex post oversight by a DPA and parliament
The fifth and final model is characterised by a non-specialised parliamentary committee at the ex post oversight stage. This model is present in Sweden, where the expert body works with a DPA with the same powers over intelligence services as over any other data controller, while a judge authorises the use of surveillance measures. Figure 11 illustrates this model.
Non-specialised parliamentary committees are also present in Cyprus and Portugal. In Cyprus, the executive authorises the use of surveillance measures, with an expert body and a DPA performing the expert oversight. In Portugal, a judge authorises the use of these measures, while an expert body oversees them.
Figure 11 – Model 5 – ex post oversight by an expert body and a non-specialised parliamentary committee
The current report updates relevant parts of the 2017 report. Like the 2017 report, this update focuses on the work of intelligence services. It describes the developments that have taken place since 2017 in intelligence laws in the European Union (EU).
Significant developments that have taken place include the welcomed establishment of new oversight bodies following constitutional courts’ decisions and the impact of the 2016 European data protection reform on data protection authorities’ powers in the field of intelligence services’ activities. In 2023, 18 expert bodies are overseeing the work of intelligence services in the EU-27, compared with 16 in the EU-28 in 2017. These developments are viewed in the light of minimum requirements shaped by the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR).
In this context, the current report refers to a selection of relevant FRA opinions drawn from the 16 opinions published in the 2017 FRA report, alongside key findings from this earlier report. It also highlights relevant developments over time. In particular, it provides, as per the European Parliament’s request, up-to-date information on existing models of oversight mechanisms and remedies, illustrating them with examples from selected Member States. The report describes five distinct models of oversight frameworks. These encapsulate the diverse spectrum of frameworks across the EU Member States.
In 2017, FRA concluded that protecting the public from security threats while respecting fundamental rights can be achieved through strong oversight systems and effective remedies open to individuals. This conclusion remains valid in 2023.
