Surveillance by intelligence services – Volume II: field perspectives and legal update
Foreign Intelligence Inspectorate (Statens inspektion för
försvarsunderrättelseverksamheten) of the principles
applied in their international cooperation and the
countries and/or organisations they cooperate with.452
In Germany, the scope of oversight bodies’ competences
over international cooperation differs depending on
the type of surveillance conducted. The Independent
Committee may conduct controls at all time over
foreign to foreign data transfers.453 However, in cases
of strategic surveillance, the oversight is limited, as
data transfers only need to be reported to the G 10
Commission on a monthly basis and to the PKGr every
six months. 454 The German government informs the
PKGr about the international data exchanges.455 In 2015,
the German intelligence service (BND) transferred data
to two foreign services.456
The effectiveness of oversight exercised by national
bodies over international intelligence cooperation was
questioned by several institutions, both at national and
international level. In Poland, where no limitations are
expressly mentioned by law, a judgment of the ECtHR
highlighted the absence of effective oversight over
activities conducted under international cooperation,
and in particular, of the effectiveness of the investigation
powers of the parliamentary commission in this field. In
Al Nashiri v. Poland, the court noted that the “instant
case (…) also points out in this context to a more
general problem of democratic oversight of intelligence
services. The protection of human rights guaranteed by
the Convention, especially in Articles 2 and 3, requires
not only an effective investigation of alleged human
rights abuses but also appropriate safeguards – both
in law and in practice – against intelligence services
violating Convention rights, notably in the pursuit
of their covert operations. The circumstances of the
instant case may raise concerns as to whether the Polish
legal order fulfils this requirement.”457
The absence of any specific mention of oversight
over international cooperation in a law may be
differently interpreted from one Member State to
another. In some, this absence might be understood
as implicit permission for oversight bodies to conduct
similar control regarding international cooperation
as over domestic intelligence efforts. Others may
couple this absence with the third party rule (see
Section 11.3), and interpret it as a tacit prohibition on
controlling international intelligence-sharing.
452
453
454
455
Sweden, Regulation on Defence Intelligence Service, Art. 6.
Germany, BNDG, S. 15 (3).
Germany, G10 Act, S. 7a.
Germany, Federal Parliament (Deutscher Bundestag) (2016a),
pp. 10-11.
456 Germany, Federal Parliament (Deutscher Bundestag) (2017a),
p. 9.
457 ECtHR, Al Nashiri v. Poland, No. 28761/11, 16 February 2015,
para. 498.
106
11.3. Limits to oversight:
the third party rule
“As the world becomes more and more wired and
interconnected, these [personal digital] data are increasingly
stored and transmitted freely across borders and through
transit countries, leading to an unclear situation regarding
jurisdiction and diminishing the relevance of national
legislation and of national oversight.” European Parliament,
Committee on Civil Liberties, Justice and Home Affairs (2013b)
The dominant principle of international cooperation
is the ‘third party rule’, also known as the ‘originator
control principle’. This rule specifies that a foreign
agency to which intelligence has been transmitted
can neither share this information with a third party,
nor use the data for an objective different from the
one for which the exchange was established in the
first place. While the rule is a core element of trust
in which the global intelligence cooperation is rooted,
it is also used by intelligence services to prevent
oversight bodies from accessing any information related
to international cooperation.
Third party rule should not act as
a foreign veto
“[Member States should] [e]nsure that access to information by oversight bodies is not restricted by or subject to
the third party rule or the principle of originator control.
This is essential for ensuring that democratic oversight
is not subject to an effective veto by foreign bodies that
have shared information with security services. Access
to information by oversight bodies should extend to all
relevant information held by security services including
information provided by foreign bodies.”
Council of Europe, Democratic and effective oversight of national security
services, 2015, Recommendation 16, p. 13
Some Member States explicitly refer to the third party
rule either in their laws or in the bilateral agreements
signed with foreign partners.
The majority of parliamentary committees do not have
access to classified information received from foreign
secret services. This is explicitly stated in the cases of
Spain, 458 France459 and the United Kingdom, 460 among
others. In its activity report, the German Parliamentary
Control Panel acknowledged this fact and called for
458 Spain, Law 11/2002 of 6 May, National Intelligence Centre
Act, Art. 11(2).
459 France, Ordinance No. 58-1100 on the functioning of the
parliamentary assemblies, Art. 6.
460 United Kingdom, Justice and Security Act 2013, s. 5(c) of
Schedule 1.