24
May
2023

Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU - 2023 update

This report provides a partial update on the findings of the 2017 European Union Agency for Fundamental Rights (FRA) report Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU. It was prepared at the request of the European Parliament, which asked FRA to update its 2017 findings to support the work of its committee of inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA).


The 2017 FRA report highlighted the challenge of accessing effective remedies when it comes to surveillance. On the one hand, the need for secrecy that is inherent to the field of intelligence impedes effective access to classified information, and, on the other hand, a lack of expertise among the staff of remedial bodies may create specific issues. In addition to these specific issues, classic challenges hampering access to effective remedies also apply. For example, judicial avenues are often costly and slow, and entail complex procedural rules. In the context of surveillance, non-judicial avenues may provide individuals with important complementary remedial avenues.

In 2017, FRA’s research showed that, overall, in the context of surveillance, only few individuals seek remedy. The average of 10 to 20 individuals per year in 2017 stayed stable in more recent years.

FRA highlighted the need to ensure minimum requirements for remedies to be effective. Non-judicial bodies must be independent. They must tackle the following challenges: raising awareness of surveillance measures among individuals, either through notification or through any other opportunity to obtain information about interceptions; ensuring access to classified information for remedial bodies; ensuring appropriate redress, for example the destruction of the data collected or monetary relief; and ensuring proper expertise within remedial bodies.

In 2023, the situation appears much like that in 2017. However, the 2016 European data protection reform affected six DPAs, which lost their remedial powers in the area of surveillance.

In most EU Member States, non-judicial bodies can offer individuals remedies. Only three Member States do not offer non-judicial remedial avenues to lodge a complaint related to activities of intelligence services. In this regard, the situation has remained unchanged since 2017.

In 12 Member States, individuals may lodge a complaint with only a single non-judicial body with remedial powers. In 2017, this was the case in 10 out of the 28 EU Member States. In the remaining 12 Member States – out of a total of 24 that offer non-judicial remedies – two or more such bodies have remedial powers.

Since 2017, the situation with regard to the scope of remedial powers of expert bodies has remained largely unchanged. Basically, expert bodies still enjoy broader powers than other non-judicial bodies with remedial powers: in nine of the 14 Member States that have expert bodies, these bodies have the strongest powers to offer an effective remedy. However, the following changes should be noted. In the three Member States where new expert bodies were established, two were granted significant remedial powers, to take binding decisions, to fully access collected data and to communicate that controls have been implemented to the complainant. The other only granted the new expert body full access to the data, including classified information.

Remedial bodies’ effectiveness depends foremost on their binding decision-making powers. In 15 Member States, remedial bodies can issue binding decisions. Most of them are expert bodies and DPAs. While in 2017 six Member States had not granted any of their non-judicial bodies the power to take binding decisions, this is now the case in seven Member States.


Opinion 12: Providing for effective remedies before independent bodies with remedial powers

EU Member States should ensure that judicial and non-judicial bodies with remedial powers have the powers and competences to effectively assess and decide on individuals’ complaints related to surveillance.

Opinion 13: Ensuring availability of non-judicial bodies with remedial powers

EU Member States should ensure that both judicial and non-judicial remedial bodies are accessible to individuals. Notably, Member States should identify what potential gaps prevent individuals from having their complaints effectively reviewed, and ensure that non-judicial expert bodies can complement the remedial landscape where needed.

Opinion 14: Allowing for awareness of completed surveillance measures

EU Member States should ensure that the legitimate aim and proportionality tests are conducted by intelligence services before limiting access to information based on national security. A competent authority should assess the confidentiality level. Alternatively, controls should be carried out by oversight bodies in the name of complainants when notification or disclosure are not possible.

Opinion 15: Ensuring a high level of expertise among remedial bodies

EU Member States should ensure that where judicial or non-judicial remedial bodies lack relevant expertise to effectively assess individuals’ complaints, specific systems are established to address these gaps. Cooperation with expert oversight bodies, technical experts or members of the intelligence services can support effective remedial systems.

Source: FRA, 2017

In line with the well-established European case law, any individual may claim to be a victim of an interference with their privacy rights based on the existence of intelligence laws prescribing secret surveillance.[110] ECtHR, Ekimdzhiev and Others v. Bulgaria, No. 70078/12, 11 January 2022, para. 262; and Centrum för rättvisa v. Sweden, No. 35252/08, 25 May 2021, para. 167.
Individuals should have recourse to remedies that are effective in law and practice for reviewing the lawfulness and proportionality of any surveillance of them and redressing any violations of their rights. While such remedies do not need to be of a judicial nature, they need to be effective.

The courts have an important role to play in reviewing surveillance ex post at the remedial stage, either when directly handling complaints against intelligence services or when examining appeals against the decisions of non-judicial oversight bodies.[111] CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier ministre and Others and Ordre des barreaux francophones et germanophone and Others v. Conseil des ministres, 6 October 2020, para. 190; and ECtHR, Centrum för rättvisa v. Sweden, No. 35252/08, 25 May 2021, paras. 166–167, 249, 251, 271, 273, 275 and 362; and Big Brother Watch and Others v. the United Kingdom, Nos. 58170/13, 62322/14 and 24960/15, 25 May 2021, paras. 413, 415 and 425.
While in principle all Member States provide the opportunity for individuals to complain about privacy and other rights violations before a judge, judicial avenues are not necessarily effective, as the 2017 FRA report highlighted.

Strict procedural rules on evidence and legal standing may hinder recourse to courts. The ECtHR has acknowledged the common ineffectiveness of judicial recourse in surveillance cases. It affords a much broader meaning to the term ‘victim’ based on the European Convention on Human Rights. It therefore has not required the prior exhaustion of domestic judicial remedies in a number of cases regarding surveillance by intelligence services.[112] ECtHR, Ekimdzhiev and Others v. Bulgaria, No. 70078/12, 11 January 2022, paras. 264–277.
At the same time, recourse to non-judicial bodies raises issues relating to power, independence and expertise.[113] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 60.

In this regard, the ECtHR has repeatedly found the notification of surveillance measures, or, at least, an adequate opportunity to request and obtain information about interceptions from the authorities, to be a relevant factor in assessing the effectiveness of remedies and hence the existence of effective safeguards against the abuse of surveillance powers.[114]ECtHR,Centrum för rättvisa v. Sweden, No. 35252/08, 25 May 2021, para. 271.

“As regards the third stage, after the surveillance has been terminated, the question of subsequent notification of surveillance measures is a relevant factor in assessing the effectiveness of remedies before the courts and hence to the existence of effective safeguards against the abuse of surveillance powers. There is in principle little scope for recourse to the courts by the individual concerned unless the latter is advised of the measures taken without his or her knowledge and thus able to challenge their legality retrospectively or, in the alternative, unless any person who suspects that he or she has been subject to surveillance can apply to courts, whose jurisdiction does not depend on notification to the surveillance subject of the measures taken.”

ECtHR, Centrum för rättvisa v. Sweden[GC], No. 35252/08, 25 May 2021, paragraph 251

Providing individuals with the necessary information, although crucial, is not sufficient and is only a precondition for effective access to remedies. Excessive formal requirements, for example short time frames within which a complaint can be brought, would severely undermine the effectiveness of any available remedies.[115] ECtHR, Ekimdzhiev and Others v. Bulgaria, No. 70078/12, 11 January 2022, paras. 264–275, 354–355, 356 (h) and 380–382; and Marie Ringler v. Austria, No. 2309/10, 12 May 2020, para. 73.

In the case of Centrum för rättvisa v. Sweden, the ECtHR stressed the need for guarantees that exclude any conflicts of interest of remedial bodies with the body authorising the surveillance or exercising regular oversight of intelligence services.[116] ECtHR, Centrum för rättvisa v. Sweden, No. 35252/08, 25 May 2021, paras. 359 and 372.
In addition, in the case of Ekimdzhiev and Others v. Bulgaria, the court highlighted other challenges to the effectiveness of remedies and notably the ability of any remedial body to take binding decisions, including on the destruction of collected information.

“[S]everal shortcomings undermine its [the special parliamentary committee’s] effectiveness. First, its members need not be persons with legal qualifications or experience. Secondly, it has no power to order remedial measures in concrete cases, such as the destruction of retained or accessed communications data; it can only give instructions designed to improve the relevant procedures. If it detects irregularities, it can only bring the matter to the attention of the prosecuting authorities, or inform the heads of the relevant access-requesting authorities and communications service providers. In view of the shortcomings outlined above, the system of overseeing the retention of communications data and [their] subsequent accessing by the authorities in Bulgaria, as currently organised, does not appear capable of providing effective guarantees against abusive practices in this respect.”

ECtHR, Ekimdzhiev and Others v. Bulgaria, No. 70078/12, 11 January 2022, pp. 414–415.

As Table 3 shows, in most EU Member States, different models exist in terms of non-judicial bodies such as DPAs, expert bodies, executive bodies, parliamentary committees and ombuds institutions that can offer remedies. Only three Member States (Czechia, Latvia and Poland) do not offer non-judicial remedial avenues but only provide individuals with judicial avenues to lodge a complaint. In these Member States, neither DPAs nor any other oversight bodies have remedial powers over intelligence services. In this regard, the situation remains unchanged compared with 2017.

Table 3 – Non-judicial bodies with remedial powers in the context of surveillance: different models in the EU-27

Member State

Executive (ministry)

Expert body (or bodies)

DPA

Parliamentary committee(s)

Ombuds

institution

AT

 

 

BE

 

 

 

BG

 

 

 

CY

 

 

 

 

CZ

 

 

 

 

 

DE

 

 

DK

 

 

 

 

EE

 

 

 

 

EL

 

 

 

 

ES

 

 

 

 

FI

 

 

FR

 

 

HR

 

 

HU

 

IE

 

 

 

IT

 

 

 

 

LT

 

 

 

LU

 

 

 

 

LV

 

 

 

 

 

MT

 

 

 

 

NL

 

 

 

 

PL

 

 

 

 

 

PT

 

 

 

RO

 

 

 

 

SE

 

 

 

SI

 

 

SK

 

 

 

 

Source: FRA, 2023

In relation to DPAs’ remedial powers over intelligence services, the situation has evolved in seven Member States since 2017. In Belgium, Bulgaria, Croatia, Greece and Lithuania, as a result of the national data protection reforms, DPAs no longer have control over matters linked to national security. They have consequently lost their power to investigate complaints lodged by individuals in the context of intelligence services’ activities. These modifications were introduced by the Member States while implementing the 2016 EU data protection reform.

In Bulgaria, for example, the 2019 legislative reform excluded surveillance activities from the overall scope of application of the Personal Data Protection Act.[117]Bulgaria, Amendments and supplements to the Personal Data Protection Act (Закон за изменение и допълнение на Закона за защита на личните данни, 26 February 2019.
The explanatory report accompanying the amendments referred to the EU data protection reform to justify the amendments.[118]Bulgaria, National Assembly (Народно събрание (2019), Explanatory report to the draft amendments and supplements to the Personal Data Protection Act (Мотиви към Законопроект за изменение и допълнение на Закона за защита на личните данни, 18 July 2015.
Similarly, in Croatia, the act adopted in 2018 to implement the GDPR prescribes that the law does not apply to the processing of personal data carried out by competent authorities to, among other things, protect against threats to public security, including in the areas of national security and defence.[119]Croatia, Act on the Protection of Natural Persons in Connection with the Processing and Exchange of Personal Data for the Purposes of Prevention, Research, Detection or Prosecution of Criminal Offenses or Execution of Criminal Sanctions (Zakon o zaštiti fizičkih osoba u vezi s obradom i razmjenom osobnih podataka u svrhe sprječavanja, istraživanja, otkrivanja ili progona kaznenih djela ili izvršavanja kaznenih sankcija, 4 August 2018.

In Lithuania, both the DPA and the ombudsperson lost their remedial powers through the adoption of two legislative reforms. The law of 2018 incorporating the EU Law Enforcement Directive in national legislation precludes the Lithuanian DPA from exercising any control over data processing by national institutions for national security and defence purposes.[120] Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas,No. XIII-1435, 30 June 2018, Art. 39 (3).
In addition, amendments made in 2022 to the Law on Seimas Ombudsmen preclude the ombudsperson from investigating activities of intelligence institutions.[121] Lithuania, Law on Seimas Ombudsmen (Seimo kontrolierių įstatymas, No. VIII-950, 3 December 1998, as amended by Law No. XIV-872 of 23 December 2021, and other amendments, Art. 12 (2).
During the 2022 reform, a new expert body, the Intelligence Ombudsman, was set up and was given remedial powers concerning intelligence services’ processing of personal data and other activities.[122]Lithuania, Law on Intelligence Ombudsmen (Žvalgybos kontrolierių įstatymas, No. XIV-868, 23 December 2021, Art. 3.

In Belgium, the 2018 law implementing the 2016 European data protection reform specifically shifted the remedial powers from the DPA to the expert oversight body.

However, in Cyprus and Sweden, the implementation of the GDPR at national level provided the DPA with new powers that strengthen its ability to provide effective remedies.

In Cyprus, the adoption of the 2018 law implementing the GDPR provided the DPA with the legal basis to access data held by the intelligence services and take binding decisions.[123]Cyprus, Law on the protection of individuals with regard to the processing of personal data and the free circulation of personal data of 2018 (O περί της Προστασίας των Φυσικών Προσώπων Έναντι της Επεξεργασίας των Δεδομένων Προσωπικού Χαρακτήρα και της Ελεύθερης Κυκλοφορίας των Δεδομένων αυτών Νόμος του 2018, No. 125(I)/2018,
Similarly, in Sweden, the DPA was granted access to all personal data processed by intelligence services, including to implement safety and protective measures. The DPA may order the Swedish Security Service to stop processing or destroy personal data but cannot order the Swedish Armed Forces or the National Defence Radio Establishment to do so. Finally, decisions the DPA takes may be reviewed by a court.

Figure 12 illustrates the diversity of DPAs’ remedial powers over intelligence services across the EU.

Figure 12 – DPAs’ remedial powers over intelligence services compared with powers over other data controllers

A diagram of a power source</p>
<p>Description automatically generated with medium confidence

Source: FRA, 2023

In 2023, the situation regarding the remedial powers of non-judicial oversight bodies other than DPAs remains largely unchanged. A few developments are, however, worth noting.

In a few Member States, including Croatia, Denmark and Finland, oversight bodies have gained certain aspects of remedial powers over intelligence authorities. In Finland, the Intelligence Ombudsman may fully access data collected by intelligence services and may take binding decisions. Since the Intelligence Ombudsman was established in 2019, it has not received any individual complaints but has received more than 50 requests for investigations.[124] Finland, Intelligence Ombudsman (Tiedusteluvalvontavaltuutettu (2020), Report of the Intelligence Ombudsman for 2019 (Tiedusteluvalvontavaltuutetun kertomus vuodelta 2019, K 14/2020 vp, 20 May 2020, p. 20; Finland, Intelligence Ombudsman (2021), Report of the Intelligence Ombudsman for 2020 (Tiedusteluvalvontavaltuutetun kertomus vuodelta 2020), K 10/2021 vp, 27 April 2021, p. 8; and Finland, Intelligence Ombudsman (2022), Report of the Intelligence Ombudsman for 2021 (Tiedusteluvalvontavaltuutetun kertomus vuodelta 2021), K 13/2022 vp, 4 May 2022, p. 8.
When an investigation has been carried out, the ombudsman may inform individuals, but only stating that an investigation has been carried out.[125] Finland, Act on the Oversight of Intelligence Gathering (laki tiedustelutoiminnan valvonnasta/lagom övervakning av underrättelseverksamheten, Act No. 121/2019, 18 January 2019, Chapter 2, Section 3.

A natural or legal person living in Denmark may file a complaint and request the oversight body (the Danish Intelligence Oversight Board (TET)) to investigate whether the intelligence service has illegally processed information about them, in accordance with the act on the Danish Security and Intelligence Service and the act on the Danish Defence Intelligence Service. These acts were consolidated in 2017.[126] Denmark, Consolidated Act No. 231 of 7 March 2017 on the Danish Security and Intelligence Service (Bekendtgørelse af lov om Politiets Efterretningstjeneste (PET).
The TET can only inform the individual that the service does not illegally process information regarding them, without providing any further information. Where it is established during an examination that intelligence services processed information illegally, TET has the power to issue binding decisions requesting the services to delete the data.

If special circumstances so warrant, TET has the power to instruct intelligence services to wholly or partially specify what information was processed concerning the complainant. However, the TET highlighted in 2021 that in practice these provisions have limited application, as few individuals have so far requested TET to investigate whether an intelligence service has illegally processed information about them.[127] Denmark, Danish Intelligence Oversight Board (TET), Annual report 2021: Politiets Efterretningstjeneste, Copenhagen, TET, p. 28; and TET, Annual report 2021: Danish Defence Intelligence Service, Copenhagen, TET, p. 22.

In Croatia, the Council for Civilian Oversight of Security and Intelligence Agencies, re-established in 2018 after several years of inactivity, may now access data that intelligence services have collected, and may inform complainants once it performs an investigation based on their complaints.

As was shown in the 2017 FRA report, only very few individuals accused intelligence services of performing unlawful activities before oversight bodies.[128] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 118.
The following examples confirm the 2017 findings.

In 2021, the Belgian Standing Committee I received 72 complaints, compared with 62 in 2020. In 2020, most of them were dismissed (55 out of 62).[129] Belgium, Standing Committee I (2021), Activity report 2020, Brussels, Standing Committee I, p. 1.
By contrast, in 2021, 23 were rejected as manifestly ill-founded and 28 because Standing Committee I was not competent. A total of 14 of the remaining were handled in 2021.[130] Belgium, Standing Committee I (2022), Activity report 2021 (Rapport d’activités 2021, p. 1.

In France, the CNCTR received 48 complaints in 2021, compared with 33 in 2020. Complaints are handled within two months. Once the individual has received the response from the CNCTR, they can bring the case before the Specialised Formation of the Council of State (la formation spécialisée du Conseil d’État). In 2021, like in 2020, it received 8 applications.[131] France, CNCTR (2022), 6e annual report 2021 (6e rapport d’activité 2021, Paris, CNCTR, p. 108.

The German G 10 Commission received four complaints in 2020, three of which were ill-founded.[132] Germany, Federal Parliament (2022), Bericht gemäß § 14 Absatz 1 Satz 2 des Gesetzes zur Beschränkung des Brief-, Post- und Fernmeldegeheimnisses (Artikel 10-Gesetz – G 10) über die Durchführung sowie Art und Umfang der Maßnahmen nach den §§ 3, 5, 7a und 8 G 10 (Berichtszeitraum 1. Januar bis 31. Dezember 2020), Document 20/4976, 14 December 2022, p. 7.
The Dutch Review Committee on the Intelligence and Security Services handled 23 complaints in 2021.[133] Netherlands, Review Committee on the Intelligence and Security Services (Commissie van Toezicht op de Inlichtingen- en Veiligheidsdiensten, CTIVD) (2022), Annual report 2021, The Hague, CTIVD, p. 19.


Overview

The current report updates relevant parts of the 2017 report. Like the 2017 report, this update focuses on the work of intelligence services. It describes the developments that have taken place since 2017 in intelligence laws in the European Union (EU).

Significant developments that have taken place include the welcomed establishment of new oversight bodies following constitutional courts’ decisions and the impact of the 2016 European data protection reform on data protection authorities’ powers in the field of intelligence services’ activities. In 2023, 18 expert bodies are overseeing the work of intelligence services in the EU-27, compared with 16 in the EU-28 in 2017. These developments are viewed in the light of minimum requirements shaped by the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR).

In this context, the current report refers to a selection of relevant FRA opinions drawn from the 16 opinions published in the 2017 FRA report, alongside key findings from this earlier report. It also highlights relevant developments over time. In particular, it provides, as per the European Parliament’s request, up-to-date information on existing models of oversight mechanisms and remedies, illustrating them with examples from selected Member States. The report describes five distinct models of oversight frameworks. These encapsulate the diverse spectrum of frameworks across the EU Member States.

In 2017, FRA concluded that protecting the public from security threats while respecting fundamental rights can be achieved through strong oversight systems and effective remedies open to individuals. This conclusion remains valid in 2023.