24
May
2023

Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU - 2023 update

This report provides a partial update on the findings of the 2017 European Union Agency for Fundamental Rights (FRA) report Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU. It was prepared at the request of the European Parliament, which asked FRA to update its 2017 findings to support the work of its committee of inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA).

Big Brother Watch and Others v. the United Kingdom, Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021.

Centrum för rättvisa v. Sweden, No. 35252/08, 25 May 2021.

Hüttl v. Hungary, No. 58032/16, 29 September 2022.

Haščák v. Slovakia, Nos. 58359/12, 27787/16 and 67667/16, 23 June 2022.

Ekimdzhiev and Others v. Bulgaria, No. 70078/12, 11 January 2022.

Zoltán Varga v. Slovakia, Nos. 58361/12, 25592/16 and 27176/16, 20 July 2021.

Tretter and Others v. Austria, No. 3599/10 (dec.), 29 September 2020.

Marie Ringler v. Austria (dec.), No. 2309/10, 12 May 2020.

Breyer v. Germany, No. 50001/12, 30 January 2020.

France, Council of State (Conseil d’État), French Data Network and Others v. France, Decision No. 393099, 21 April 2021.

Germany, Federal Constitutional Court (Bundesverfassungsgericht), 1 BvR 2835/17, 19 May 2020.

Germany, Federal Constitutional Court (Bundesverfassungsgericht), 1 BvR 2354/13, 28 September 2022.

Portugal, Constitutional Court (Tribunal Constitucional), Judgment No. 464/2019, 21 October 2019.

Overview

The current report updates relevant parts of the 2017 report. Like the 2017 report, this update focuses on the work of intelligence services. It describes the developments that have taken place since 2017 in intelligence laws in the European Union (EU).

Significant developments that have taken place include the welcomed establishment of new oversight bodies following constitutional courts’ decisions and the impact of the 2016 European data protection reform on data protection authorities’ powers in the field of intelligence services’ activities. In 2023, 18 expert bodies are overseeing the work of intelligence services in the EU-27, compared with 16 in the EU-28 in 2017. These developments are viewed in the light of minimum requirements shaped by the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR).

In this context, the current report refers to a selection of relevant FRA opinions drawn from the 16 opinions published in the 2017 FRA report, alongside key findings from this earlier report. It also highlights relevant developments over time. In particular, it provides, as per the European Parliament’s request, up-to-date information on existing models of oversight mechanisms and remedies, illustrating them with examples from selected Member States. The report describes five distinct models of oversight frameworks. These encapsulate the diverse spectrum of frameworks across the EU Member States.

In 2017, FRA concluded that protecting the public from security threats while respecting fundamental rights can be achieved through strong oversight systems and effective remedies open to individuals. This conclusion remains valid in 2023.