This report provides a partial update on the findings of the 2017 European Union Agency for Fundamental Rights (FRA) report Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU. It was prepared at the request of the European Parliament, which asked FRA to update its 2017 findings to support the work of its committee of inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA).
The 2017 FRA report highlighted the challenge of accessing effective remedies when it comes to surveillance. On the one hand, the need for secrecy that is inherent to the field of intelligence impedes effective access to classified information, and, on the other hand, a lack of expertise among the staff of remedial bodies may create specific issues. In addition to these specific issues, classic challenges hampering access to effective remedies also apply. For example, judicial avenues are often costly and slow, and entail complex procedural rules. In the context of surveillance, non-judicial avenues may provide individuals with important complementary remedial avenues.
In 2017, FRA’s research showed that, overall, in the context of surveillance, only few individuals seek remedy. The average of 10 to 20 individuals per year in 2017 stayed stable in more recent years.
FRA highlighted the need to ensure minimum requirements for remedies to be effective. Non-judicial bodies must be independent. They must tackle the following challenges: raising awareness of surveillance measures among individuals, either through notification or through any other opportunity to obtain information about interceptions; ensuring access to classified information for remedial bodies; ensuring appropriate redress, for example the destruction of the data collected or monetary relief; and ensuring proper expertise within remedial bodies.
In 2023, the situation appears much like that in 2017. However, the 2016 European data protection reform affected six DPAs, which lost their remedial powers in the area of surveillance.
In most EU Member States, non-judicial bodies can offer individuals remedies. Only three Member States do not offer non-judicial remedial avenues to lodge a complaint related to activities of intelligence services. In this regard, the situation has remained unchanged since 2017.
In 12 Member States, individuals may lodge a complaint with only a single non-judicial body with remedial powers. In 2017, this was the case in 10 out of the 28 EU Member States. In the remaining 12 Member States – out of a total of 24 that offer non-judicial remedies – two or more such bodies have remedial powers.
Since 2017, the situation with regard to the scope of remedial powers of expert bodies has remained largely unchanged. Basically, expert bodies still enjoy broader powers than other non-judicial bodies with remedial powers: in nine of the 14 Member States that have expert bodies, these bodies have the strongest powers to offer an effective remedy. However, the following changes should be noted. In the three Member States where new expert bodies were established, two were granted significant remedial powers, to take binding decisions, to fully access collected data and to communicate that controls have been implemented to the complainant. The other only granted the new expert body full access to the data, including classified information.
Remedial bodies’ effectiveness depends foremost on their binding decision-making powers. In 15 Member States, remedial bodies can issue binding decisions. Most of them are expert bodies and DPAs. While in 2017 six Member States had not granted any of their non-judicial bodies the power to take binding decisions, this is now the case in seven Member States.
Opinion12: Providing for effective remedies before independent bodies with remedial powers
EU Member States should ensure that judicial and non-judicial bodies with remedial powers have the powers and competences to effectively assess and decide on individuals’ complaints related to surveillance.
Opinion13: Ensuring availability of non-judicial bodies with remedial powers
EU Member States should ensure that both judicial and non-judicial remedial bodies are accessible to individuals. Notably, Member States should identify what potential gaps prevent individuals from having their complaints effectively reviewed, and ensure that non-judicial expert bodies can complement the remedial landscape where needed.
Opinion14: Allowing for awareness of completed surveillance measures
EU Member States should ensure that the legitimate aim and proportionality tests are conducted by intelligence services before limiting access to information based on national security. A competent authority should assess the confidentiality level. Alternatively, controls should be carried out by oversight bodies in the name of complainants when notification or disclosure are not possible.
Opinion15: Ensuring a high level of expertise among remedial bodies
EU Member States should ensure that where judicial or non-judicial remedial bodies lack relevant expertise to effectively assess individuals’ complaints, specific systems are established to address these gaps. Cooperation with expert oversight bodies, technical experts or members of the intelligence services can support effective remedial systems.
Source: FRA, 2017
In line with the well-established European case law, any individual may claim to be a victim of an interference with their privacy rights based on the existence of intelligence laws prescribing secret surveillance.[110] ECtHR, Ekimdzhiev and Others v. Bulgaria, No.70078/12, 11January 2022, para.262; and Centrum för rättvisa v. Sweden, No.35252/08, 25May 2021, para.167. Individuals should have recourse to remedies that are effective in law and practice for reviewing the lawfulness and proportionality of any surveillance of them and redressing any violations of their rights. While such remedies do not need to be of a judicial nature, they need to be effective.
The courts have an important role to play in reviewing surveillance ex post at the remedial stage, either when directly handling complaints against intelligence services or when examining appeals against the decisions of non-judicial oversight bodies.[111] CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres, 6October 2020, para.190; and ECtHR, Centrum för rättvisa v. Sweden, No.35252/08, 25May 2021, paras.166–167, 249, 251, 271, 273, 275 and 362; and Big Brother Watch and Others v. the United Kingdom, Nos.58170/13, 62322/14 and 24960/15, 25May 2021, paras.413, 415 and 425. While in principle all Member States provide the opportunity for individuals to complain about privacy and other rights violations before a judge, judicial avenues are not necessarily effective, as the 2017 FRA report highlighted.
Strict procedural rules on evidence and legal standing may hinder recourse to courts. The ECtHR has acknowledged the common ineffectiveness of judicial recourse in surveillance cases. It affords a much broader meaning to the term ‘victim’ based on the European Convention on Human Rights. It therefore has not required the prior exhaustion of domestic judicial remedies in a number of cases regarding surveillance by intelligence services.[112] ECtHR, Ekimdzhiev and Others v. Bulgaria, No.70078/12, 11January 2022, paras.264–277. At the same time, recourse to non-judicial bodies raises issues relating to power, independence and expertise.[113] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – VolumeII: Field perspectives and legal update, Luxembourg, Publications Office, p.60.
In this regard, the ECtHR has repeatedly found the notification of surveillance measures, or, at least, an adequate opportunity to request and obtain information about interceptions from the authorities, to be a relevant factor in assessing the effectiveness of remedies and hence the existence of effective safeguards against the abuse of surveillance powers.[114]ECtHR,Centrum för rättvisa v. Sweden, No.35252/08, 25May 2021, para.271.
“As regards the third stage, after the surveillance has been terminated, the question of subsequent notification of surveillance measures is a relevant factor in assessing the effectiveness of remedies before the courts and hence to the existence of effective safeguards against the abuse of surveillance powers. There is in principle little scope for recourse to the courts by the individual concerned unless the latter is advised of the measures taken without his or her knowledge and thus able to challenge their legality retrospectively or, in the alternative, unless any person who suspects that he or she has been subject to surveillance can apply to courts, whose jurisdiction does not depend on notification to the surveillance subject of the measures taken.”
Providing individuals with the necessary information, although crucial, is not sufficient and is only a precondition for effective access to remedies. Excessive formal requirements, for example short time frames within which a complaint can be brought, would severely undermine the effectiveness of any available remedies.[115] ECtHR, Ekimdzhiev and Others v. Bulgaria, No.70078/12, 11January 2022, paras.264–275, 354–355, 356(h) and 380–382; and Marie Ringler v. Austria, No.2309/10, 12May 2020, para.73.
In the case of Centrum för rättvisa v. Sweden, the ECtHR stressed the need for guarantees that exclude any conflicts of interest of remedial bodies with the body authorising the surveillance or exercising regular oversight of intelligence services.[116] ECtHR, Centrum för rättvisa v. Sweden, No.35252/08, 25May 2021, paras. 359 and 372. In addition, in the case of Ekimdzhiev and Others v. Bulgaria, the court highlighted other challenges to the effectiveness of remedies and notably the ability of any remedial body to take binding decisions, including on the destruction of collected information.
“[S]everal shortcomings undermine its [the special parliamentary committee’s] effectiveness. First, its members need not be persons with legal qualifications or experience. Secondly, it has no power to order remedial measures in concrete cases, such as the destruction of retained or accessed communications data; it can only give instructions designed to improve the relevant procedures. If it detects irregularities, it can only bring the matter to the attention of the prosecuting authorities, or inform the heads of the relevant access-requesting authorities and communications service providers. In view of the shortcomings outlined above, the system of overseeing the retention of communications data and [their] subsequent accessing by the authorities in Bulgaria, as currently organised, does not appear capable of providing effective guarantees against abusive practices in this respect.”
As Table 3 shows, in most EU Member States, different models exist in terms of non-judicial bodies such as DPAs, expert bodies, executive bodies, parliamentary committees and ombuds institutions that can offer remedies. Only three Member States (Czechia, Latvia and Poland) do not offer non-judicial remedial avenues but only provide individuals with judicial avenues to lodge a complaint. In these Member States, neither DPAs nor any other oversight bodies have remedial powers over intelligence services. In this regard, the situation remains unchanged compared with 2017.
In relation to DPAs’ remedial powers over intelligence services, the situation has evolved in seven Member States since 2017. In Belgium, Bulgaria, Croatia, Greece and Lithuania, as a result of the national data protection reforms, DPAs no longer have control over matters linked to national security. They have consequently lost their power to investigate complaints lodged by individuals in the context of intelligence services’ activities. These modifications were introduced by the Member States while implementing the 2016 EU data protection reform.
In Bulgaria, for example, the 2019 legislative reform excluded surveillance activities from the overall scope of application of the Personal Data Protection Act.[117]Bulgaria, Amendments and supplements to the Personal Data Protection Act (Закон за изменение и допълнение на Закона за защита на личните данни, 26February 2019. The explanatory report accompanying the amendments referred to the EU data protection reform to justify the amendments.[118]Bulgaria, National Assembly (Народно събрание (2019), Explanatory report to the draft amendments and supplements to the Personal Data Protection Act (Мотиви към Законопроект за изменение и допълнение на Закона за защита на личните данни, 18July 2015. Similarly, in Croatia, the act adopted in 2018 to implement the GDPR prescribes that the law does not apply to the processing of personal data carried out by competent authorities to, among other things, protect against threats to public security, including in the areas of national security and defence.[119]Croatia, Act on the Protection of Natural Persons in Connection with the Processing and Exchange of Personal Data for the Purposes of Prevention, Research, Detection or Prosecution of Criminal Offenses or Execution of Criminal Sanctions (Zakon o zaštiti fizičkih osoba u vezi s obradom i razmjenom osobnih podataka u svrhe sprječavanja, istraživanja, otkrivanja ili progona kaznenih djela ili izvršavanja kaznenih sankcija, 4August 2018.
In Lithuania, both the DPA and the ombudsperson lost their remedial powers through the adoption of two legislative reforms. The law of 2018 incorporating the EU Law Enforcement Directive in national legislation precludes the Lithuanian DPA from exercising any control over data processing by national institutions for national security and defence purposes.[120] Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas,No.XIII-1435, 30June 2018, Art.39(3). In addition, amendments made in 2022 to the Law on Seimas Ombudsmen preclude the ombudsperson from investigating activities of intelligence institutions.[121] Lithuania, Law on Seimas Ombudsmen (Seimo kontrolierių įstatymas, No.VIII-950, 3December 1998, as amended by Law No. XIV-872 of 23December 2021, and other amendments, Art.12(2). During the 2022 reform, a new expert body, the Intelligence Ombudsman, was set up and was given remedial powers concerning intelligence services’ processing of personal data and other activities.[122]Lithuania, Law on Intelligence Ombudsmen (Žvalgybos kontrolierių įstatymas, No.XIV-868, 23December 2021, Art.3.
In Belgium, the 2018 law implementing the 2016 European data protection reform specifically shifted the remedial powers from the DPA to the expert oversight body.
However, in Cyprus and Sweden, the implementation of the GDPR at national level provided the DPA with new powers that strengthen its ability to provide effective remedies.
In Cyprus, the adoption of the 2018 law implementing the GDPR provided the DPA with the legal basis to access data held by the intelligence services and take binding decisions.[123]Cyprus, Law on the protection of individuals with regard to the processing of personal data and the free circulation of personal data of 2018 (O περί της Προστασίας των Φυσικών Προσώπων Έναντι της Επεξεργασίας των Δεδομένων Προσωπικού Χαρακτήρα και της Ελεύθερης Κυκλοφορίας των Δεδομένων αυτών Νόμος του 2018, No.125(I)/2018, Similarly, in Sweden, the DPA was granted access to all personal data processed by intelligence services, including to implement safety and protective measures. The DPA may order the Swedish Security Service to stop processing or destroy personal data but cannot order the Swedish Armed Forces or the National Defence Radio Establishment to do so. Finally, decisions the DPA takes may be reviewed by a court.
Figure 12 illustrates the diversity of DPAs’ remedial powers over intelligence services across the EU.
In 2023, the situation regarding the remedial powers of non-judicial oversight bodies other than DPAs remains largely unchanged. A few developments are, however, worth noting.
In a few Member States, including Croatia, Denmark and Finland, oversight bodies have gained certain aspects of remedial powers over intelligence authorities. In Finland, the Intelligence Ombudsman may fully access data collected by intelligence services and may take binding decisions. Since the Intelligence Ombudsman was established in 2019, it has not received any individual complaints but has received more than 50 requests for investigations.[124] Finland, Intelligence Ombudsman (Tiedusteluvalvontavaltuutettu (2020), Report of the Intelligence Ombudsman for 2019 (Tiedusteluvalvontavaltuutetun kertomus vuodelta 2019, K 14/2020 vp, 20May 2020, p. 20; Finland, Intelligence Ombudsman (2021), Report of the Intelligence Ombudsman for 2020 (Tiedusteluvalvontavaltuutetun kertomus vuodelta 2020), K 10/2021 vp, 27April 2021, p.8; and Finland, Intelligence Ombudsman (2022), Report of the Intelligence Ombudsman for 2021 (Tiedusteluvalvontavaltuutetun kertomus vuodelta 2021), K 13/2022 vp, 4May 2022, p.8. When an investigation has been carried out, the ombudsman may inform individuals, but only stating that an investigation has been carried out.[125] Finland, Act on the Oversight of Intelligence Gathering (laki tiedustelutoiminnan valvonnasta/lagom övervakning av underrättelseverksamheten, Act No.121/2019, 18January 2019, Chapter2, Section3.
A natural or legal person living in Denmark may file a complaint and request the oversight body (the Danish Intelligence Oversight Board (TET)) to investigate whether the intelligence service has illegally processed information about them, in accordance with the act on the Danish Security and Intelligence Service and the act on the Danish Defence Intelligence Service. These acts were consolidated in 2017.[126] Denmark, Consolidated Act No.231 of 7March 2017 on the Danish Security and Intelligence Service (Bekendtgørelse af lov om Politiets Efterretningstjeneste (PET). The TET can only inform the individual that the service does not illegally process information regarding them, without providing any further information. Where it is established during an examination that intelligence services processed information illegally, TET has the power to issue binding decisions requesting the services to delete the data.
If special circumstances so warrant, TET has the power to instruct intelligence services to wholly or partially specify what information was processed concerning the complainant. However, the TET highlighted in 2021 that in practice these provisions have limited application, as few individuals have so far requested TET to investigate whether an intelligence service has illegally processed information about them.[127] Denmark, Danish Intelligence Oversight Board (TET), Annual report 2021: Politiets Efterretningstjeneste, Copenhagen, TET, p.28; and TET, Annual report 2021: Danish Defence Intelligence Service, Copenhagen, TET, p.22.
In Croatia, the Council for Civilian Oversight of Security and Intelligence Agencies, re-established in 2018 after several years of inactivity, may now access data that intelligence services have collected, and may inform complainants once it performs an investigation based on their complaints.
In 2021, the Belgian Standing Committee I received 72 complaints, compared with 62 in 2020. In 2020, most of them were dismissed (55 out of 62).[129] Belgium, Standing CommitteeI (2021), Activity report 2020, Brussels, Standing CommitteeI, p.1. By contrast, in 2021, 23 were rejected as manifestly ill-founded and 28 because Standing Committee I was not competent. A total of 14 of the remaining were handled in 2021.[130] Belgium, Standing CommitteeI (2022), Activity report 2021 (Rapport d’activités 2021, p.1.
In France, the CNCTR received 48 complaints in 2021, compared with 33 in 2020. Complaints are handled within two months. Once the individual has received the response from the CNCTR, they can bring the case before the Specialised Formation of the Council of State (la formation spécialisée du Conseil d’État). In 2021, like in 2020, it received 8 applications.[131] France, CNCTR (2022), 6e annual report 2021 (6e rapport d’activité 2021, Paris, CNCTR, p.108.
These reports from EU Member States constitute the background material for a comparative analysis for the report ‘National intelligence authorities and surveillance in the EU: Fundamental rights safeguards and remedies’. The country studies were prepared by FRA’s research network, FRANET. The information and views contained in the document do not necessarily reflect the views or the official position of the FRA. The documents are made available for transparency and information purposes only and do not constitute legal advice or legal opinion.
Data protection rules protect privacy and prevent personal information from misuse. When the general data protection regulation (GDPR) came into force in 2018, it strengthened the role of data protection authorities. These supervisory bodies are the key enforcers of the fundamental right of protection of personal data. This report analyses the challenges they face in the GDPR implementation. The findings complement the European Commission's forthcoming evaluation of the GDPR.
Civil society organisations struggle to maintain an environment safe from threats and attacks. FRA’s sixth annual update on civic space explores the challenges for organisations across the EU. While there has been significant development since FRA began monitoring the situation in 2018, civil society organisations remain under immense pressure. Abusive lawsuits and attacks against those involved in migrant search and rescue at sea are just some of the challenges identified. This report presents ways forward to protect civil society and human rights.
Across the world, human rights defenders protect and uphold human rights in some of the most challenging situations. In some countries they face worrying levels of threats and attacks, intimidation and harassment. This report outlines how human rights defenders can enter and stay in the EU when they need protection. It suggests how EU institutions and Member States could use the flexibility in existing legal provisions and provide shelter for defenders who seek protection.
FRA’s Fundamental Rights Report 2023 reviews major developments in the field in 2022, identifying both achievements and areas of concern. It also presents FRA’s opinions on these developments, including a synopsis of the evidence supporting these opinions.
With terrorism, cyber-attacks and sophisticated cross-border criminal networks posing growing threats, the work of intelligence services has become more urgent, complex and international. Such work can strongly interfere with fundamental rights, especially privacy and data protection. While continuous technological advances potentially exacerbate the threat of such interference, effective oversight and remedies can curb the potential for abuse.
This report is FRA’s second publication addressing a European Parliament request for in-depth research on the impact of surveillance on fundamental rights. It updates FRA’s 2015 legal analysis on the topic, and supplements that analysis with field-based insights gained from extensive interviews with diverse experts in intelligence and related fields, including its oversight.
This report, drafted in response to the European Parliament’s call for thorough research on fundamental rights protection in the context of surveillance, maps and analyses the legal frameworks on surveillance in place in EU Member States.
In April 2014, the European Parliament requested the European Union Agency for Fundamental Rights (FRA) “to undertake in–depth research on the protection of fundamental rights in the context
of surveillance”. This summary presents FRA’s main research findings, which are published in full in the report entitled Surveillance by intelligence services: fundamental rights safeguards and remedies in the EU – Mapping Member States’ legal frameworks.
Overview
The current report updates relevant parts of the 2017 report. Like the 2017 report, this update focuses on the work of intelligence services. It describes the developments that have taken place since 2017 in intelligence laws in the European Union (EU).
Significant developments that have taken place include the welcomed establishment of new oversight bodies following constitutional courts’ decisions and the impact of the 2016 European data protection reform on data protection authorities’ powers in the field of intelligence services’ activities. In 2023, 18 expert bodies are overseeing the work of intelligence services in the EU-27, compared with 16 in the EU-28 in 2017. These developments are viewed in the light of minimum requirements shaped by the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR).
In this context, the current report refers to a selection of relevant FRA opinions drawn from the 16 opinions published in the 2017 FRA report, alongside key findings from this earlier report. It also highlights relevant developments over time. In particular, it provides, as per the European Parliament’s request, up-to-date information on existing models of oversight mechanisms and remedies, illustrating them with examples from selected Member States. The report describes five distinct models of oversight frameworks. These encapsulate the diverse spectrum of frameworks across the EU Member States.
In 2017, FRA concluded that protecting the public from security threats while respecting fundamental rights can be achieved through strong oversight systems and effective remedies open to individuals. This conclusion remains valid in 2023.