Intelligence services help protect national security. To do this successfully, they often need to work in secrecy. However, international and European human rights standards require the mandate and powers of intelligence services to be clearly defined in a legal framework, and for this framework to establish safeguards against arbitrary action to counterbalance secrecy. The European Court of Human Rights (ECtHR) has held that national legal frameworks must be clear, accessible and foreseeable. It obliges Member States to enshrine minimum safeguards in law, such as specifying the nature of offences that may lead to interception orders and defining the categories of people who may be put under surveillance. FRA’s fieldwork shows that surveillance legislation is considered complex and that a clearer legal framework with meaningful definitions is needed.
EU Member States should have clear, specific and comprehensive intelligence laws. National legal frameworks should be as detailed as possible on intelligence services’ mandates and powers, and on the surveillance measures they can use. Fundamental rights safeguards should feature prominently in intelligence laws, with privacy and data protection guarantees for collecting, retaining, disseminating and accessing data.
The preparation of intelligence legislation should involve an open debate among key stakeholders. During discussions on draft intelligence laws, governments should take the time to clarify the needs of intelligence services and to explain which fundamental rights guarantees the bill has established. FRA data show that most EU Member States have reformed their intelligence and counter-terrorism legislation in recent years. Some of these legislative processes unfolded during FRA’s fieldwork. The interviewed experts emphasised the need for a broader inclusion of key actors and stakeholders in the development of intelligence legislation. In some Member States, online public consultations and lively parliamentary discussions are taking place instead of new legislation being fast-tracked. FRA’s Fundamental Rights Report 2017 underlined the need for such an approach.
EU Member States should undertake broad public consultations with a full range of stakeholders, ensure transparency of the legislative process, and incorporate relevant international and European standards and safeguards when introducing reforms to their legislation on surveillance.
Setting up a strong oversight mechanism is an essential part of an intelligence accountability system. The oversight framework should reflect the powers of the intelligence services. European Court of Human Rights case law provides that oversight bodies should be independent and have adequate powers and competences. FRA’s research findings show that all EU Member States have at least one independent body in their oversight framework. However, the findings also identified limits to full independence, with some oversight bodies remaining strongly dependent on the executive: the law does not grant them binding decision-making powers, they have limited staff and budget, or their offices are located in government buildings.
EU Member States should establish a robust oversight framework adequate to the powers and capacities that intelligence services have. The independence of oversight bodies should be enshrined in law and applied in practice. EU Member States should grant oversight bodies adequate financial and human resources, including diverse and technically-qualified professionals. Member States should also grant oversight bodies the power to initiate their own investigations as well as permanent, complete and direct access to necessary information and documents for fulfilling their mandate. Member States should ensure that the oversight bodies’ decisions are binding.
Particularly in light of rapidly evolving technology in the digital area, technical expertise and capacity among oversight bodies is crucial. FRA’s fieldwork indicates that limits on oversight bodies’ IT expertise and their technical capacity to fully access intelligence data poses, and will continue to pose, a major challenge. Interviewed experts stated they sometimes need to rely on external expertise to complement their own legal expertise. FRA’s legal research shows that some EU Member State laws explicitly require oversight bodies to have technical expertise.
EU Member State laws should ensure that oversight bodies have staff with the required technical expertise to assess independently the intelligence services’ often highly technical work.
The European Court of Human Rights has underlined that intelligence services and oversight bodies should be held accountable for their work. They should be transparent and effectively inform parliaments and the public about their activities. FRA’s research shows that in some Member States, enhanced transparency is achieved while respecting necessary secrecy. Experts interviewed during FRA’s fieldwork consider enhanced transparency to be particularly important. However, oversight bodies’ approaches to transparency vary considerably across Member States, ranging from publishing regular reports to having websites or using social media.
EU Member States should ensure that oversight bodies’ mandates include public reporting to enhance transparency. The oversight bodies’ reports should be in the public domain and contain detailed overviews of the oversight systems and related activities (e.g. authorisations of surveillance measures, on-going control measures, ex-post investigations and complaints handling).
The European Court of Human Rights has held that effective oversight requires ‘continuous control’ at every stage of the process. FRA’s research findings show extremely diverse oversight structures across EU Member States. When different bodies are involved in the various steps of oversight – from approving a surveillance measure to the oversight of its use – possible gaps or overlaps can result. Such shortcomings undermine the adequacy of the safeguards. FRA’s fieldwork highlights that institutional and informal cooperation between the oversight bodies within individual Member States is crucial.
EU Member States should ensure that the oversight bodies’ mandates complement each other, so that overall they provide continuous control and ensure proper safeguards. Such complementarity can be achieved with informal cooperation between oversight bodies or statutory means.
The European Court of Human Rights has held that enhanced safeguards are needed to protect journalistic sources in the context of surveillance. This principle similarly applies to other professions which, due to overarching principles such as parliamentary privileges, independence of the judiciary and confidentiality in lawyer-client relations, also require greater protection. FRA’s research shows that while diverse approaches exist, several EU Member States have laws stipulating enhanced authorisation and approval procedures for, as well as stricter controls on, the processing of data collected through surveillance of individuals belonging to protected professions.
EU Member States should establish specific legal procedures to safeguard the professional privilege of groups such as members of parliament, members of the judiciary, lawyers and media professionals. Implementation of these procedures should be overseen by an independent body.
The European Court of Human Rights has held that whistleblowing by civil servants should be ensured. Whistlebowers can significantly contribute to a wellfunctioning accountability system. FRA’s research revealed different whistleblowing practices across EU Member States. Interviewed experts expressed diverging views about whistleblower protection.
EU Member States should ensure efficient protection of whistleblowers in the intelligence services. Such whistleblowers require a regime specifically tailored to their field of work.
FRA’s comparative legal analysis shows that almost all Member States have laws on international intelligence cooperation. However, only a third require intelligence services to draft internal rules on processes and modalities for international cooperation, including safeguards on data sharing. When they exist, these rules are generally secret. Only a few Member States allow for external assessments of international intelligence cooperation agreements.
EU Member States should define rules on how international intelligence sharing takes place. These rules should be subject to review by oversight bodies, which should assess whether the processes for transferring and receiving intelligence respect fundamental rights and include adequate safeguards.
FRA’s comparative legal analysis shows that most Member States’ laws do not have clear provisions on whether oversight bodies can oversee international cooperation exchanges. Eight EU Member States establish oversight bodies’ competences over international intelligence sharing – either with or without limitations; laws in three EU Member States exclude any form of independent oversight. In the remaining 17 Member States, legal frameworks are subject to interpretation to determine oversight bodies’ competences over international intelligence sharing.
EU Member States should ensure that legal frameworks regulating intelligence cooperation clearly define the extent of oversight bodies’ competences in the area of intelligence services cooperation.
In international intelligence service cooperation, the third-party rule prevents a service from disclosing to a third party any data received from a partner without the source’s consent. FRA’s research underlines that the third-party rule protects sources and guarantees trust among intelligence services that cooperate. However, FRA’s data show that oversight bodies are often considered as ‘third parties’ and therefore cannot assess data coming from international cooperation. In some Member States, oversight bodies are no longer considered as ‘third parties’ and so have full access to such data.
Notwithstanding the third-party rule, EU Member States should consider granting oversight bodies full access to data transferred through international cooperation. This would extend oversight powers over all data available to and processed by intelligence services.
The European Court of Human Rights has held that an effective remedy is characterised by investigative and decisional powers granted to judicial and non-judicial bodies. In particular, the remedial body should have access to the premises of intelligence services and the data collected; be given the power to issue binding decisions; and inform complainants on the outcome of its investigations. The individual should be able to appeal the body’s decision. FRA’s data show that 22 EU Member States have at least one non-judicial body with remedial powers. In six Member States, though, these bodies lack the powers to issue binding decisions and access classified data.
EU Member States should ensure that judicial and non-judicial bodies with remedial powers have the powers and competences to effectively assess and decide on individuals’ complaints related to surveillance.
FRA’s data show that non-judicial oversight mechanisms are more accessible to individuals than judicial remedies as they are simpler, cheaper and faster. FRA’s comparative legal analysis shows that in the area of surveillance, individuals can lodge a complaint with a non-judicial body in 25 EU Member States. In ten Member States, one single non-judicial body has remedial powers, while in most Member States, individuals can lodge a complaint with two or more bodies with remedial powers.
EU Member States should ensure that both judicial and non-judicial remedial bodies are accessible to individuals. Notably, Member States should identify what potential gaps prevent individuals from having their complaints effectively reviewed, and ensure that non-judicial expert bodies can complement the remedial landscape where needed.
FRA’s comparative legal analysis shows that all EU Member States have a national security exception in their freedom of information laws. FRA’s findings also show that all Member States limit either individuals’ right to be notified or their right to access their own data based on the confidentiality of intelligence data and protection of national security or of on-going surveillance operations. Some Member States’ laws provide for alternative ways to make individuals aware of surveillance measures and so enable them to seek an effective remedy.
EU Member States should ensure that the legitimate aim and proportionality tests are conducted by intelligence services before limiting access to information based on national security. A competent authority should assess the confidentiality level. Alternatively, controls should be carried out by oversight bodies in the name of complainants when notification or disclosure are not possible.
Remedial bodies need to have a good understanding of surveillance techniques. FRA’s fieldwork has identified ways to informally address shortcomings in technical expertise. Exchanges between remedial bodies, expert bodies, and intelligence services, while respecting each other’s role and independence, have proven to deepen the technical understanding of reviewers and foster mutual trust. National practices of appointing specialised judges or establishing specialised courts or chambers to hear complaints about surveillance by intelligence services contribute to the development of judicial expertise in the area. Such systems can also facilitate different arrangements on judicial access to classified information.
EU Member States should ensure that where judicial or non-judicial remedial bodies lack relevant expertise to effectively assess individuals’ complaints, specific systems are established to address these gaps. Cooperation with expert oversight bodies, technical experts or members of the intelligence services can support effective remedial systems.
FRA’s fieldwork underlines that national human rights institutions, civil society organisations and, in some cases, ombudsperson institutions can play a crucial role in an enhanced intelligence services accountability system. However, FRA’s fieldwork also shows that civil society organisations often lack adequate resources, with few able to offer comprehensive services to victims of alleged unlawful surveillance.
EU Member States should broaden the operational space for national human rights bodies and institutions and civil society organisations, which can play a strong role as ‘watchdogs’ in the oversight framework.
