Surveillance by intelligence services – Volume II: field perspectives and legal update
Table 7:
(continued)
Bodies with remedial competence
Decisions
May fully
Control is
Decision
are
access
communicated may be
binding collected data to complainant reviewed
MT Commissioner of the Security Service
NL
PT
Review Committee for the Intelligence and Security
Services
Council for the Oversight of the Intelligence
Portugese Ombudsman
RO Parliamentary Committees
Swedish Foreign Intelligence Inspectorate (SIUN)
SE Commission on Security and Integrity Protection (SIN)
Swedish Data Protection Authority (Datainspektionen)
Human Rights Ombudsman
SI
Information Commissioner
Parlm. Supervision of the Intelligence and Security
Services Act
SK Commission to Supervise the Use of IT Tools
Note:
= Expert body
= Ombuds institution
= Data protection authority
= Parliamentary Committee
= Executive
Source: FRA, 2017
and/or the removal and destruction of data processed
by the services. 475 Austria is the only country where
both the expert body and the DPA have binding decision
powers. Two Member States, Finland and Romania,
have empowered another non-judicial body with such
power: the ombuds institution and the parliamentary
committees, respectively. Nonetheless, the examples
introduced throughout this third part show that the
power to issue binding decisions, although essential,
may be greatly limited if the body’s mandate does not
include other crucial features, such as independence
and full access to classified information and premises.
Of the 16 Member States that have established expert
bodies, 12 entrust them with specific remedial powers,
but only seven may issue binding decisions (in Belgium,
Denmark, Ireland, Luxembourg, the Netherlands,
Sweden and the United Kingdom).
475 The Netherlands, Act on the Intelligence and Security
Services 2017 (Wetsvoorstel Wet op de inlichtingen- en
veiligheidsdiensten 2017), Art. 124.
116
DPAs in 14 EU Member States can examine individual
complaints. Of these, ten may issue binding decisions;
these are the seven Member States where DPAs enjoy
the same powers over intelligence services as the
expert oversight bodies, and Cyprus, Greece and Italy.
In four other Member States (Belgium, France, Germany
and Ireland), DPAs may process individual complaints or
enable an individual’s indirect right to access, but are
not entitled to issue binding decisions. In four Member
States (Cyprus, Germany, Greece and France), access
is accompanied by enhanced requirements, e.g. the
presence of the DPA head (Cyprus, Greece); a staff
member of the DPA who has been a member of the
Council of State, the Court of Cassation or the Court
of Auditors (France); or an officer duly authorised in
writing (Germany). FRA’s fieldwork findings show
that in France, Germany and Italy, such requirement
proved, in practice, to be helpful for DPAs conducting
on-site inspections. Figure 10 illustrates the diversity of
DPAs’ remedial competences over intelligence services
across the EU.